|
2008-09-04
Pointers and Handles - A Story of Unchecked Assumptions in the Windows Kernel Last month on Black Hat conference Alex Ionescu presented several vulnerabilities discovered in Win32k.sys. In first part of the presentation Alex discussed a couple of unchecked pointer dereferences. In the second part (most focused) he discussed about user-mode accessible handles, and incorrect usage of Nt/Zw APIs when dealing with user-mode data. Alex wrote that calling NtUserGetThreadState or NtUserGetDCEx from Client Server Runtime Process (csrss.exe) can cause immediately BSoD. But there is another one function that dereferences Win32ThreadInfo->Desktop - NtUserGetWindowDC. I wrote three demonstration DoS exploits. One for NtUserGetDCEx, NtUserGetWindowDC and NtUserCloseWindowStation. In the last one I used different scenario then Alex Ionescu showed on his blog. Firstly we look for handle of WindowStation then set ProtectFromClose attribute and finally call NtUserCloseWindowStation. References: Black Hat 2008 Wrap-up Exploits: NtUserGetDCEx_DoS.zip - Local Denial of Service Exploit NtUserGetWindowDC_DoS.zip - Local Denial of Service Exploit NtUserCloseWindowStation_DoS.zip - Local Denial of Service Exploit Looking for vulnerabilities in different drivers I found a driver which allows any user to call ZwClose directly by supplying a specially crafted Irp to the IOCTL handler function.
...
.text:00012572 @@ioctl_close_handle:
.text:00012572 cmp dword ptr [eax+4], 210h ; OutputBufferLength
.text:00012579 jb @@invalid_buffer_size
.text:0001257F mov eax, [ebx+0Ch] ; SystemBuffer
.text:00012582 push dword ptr [eax+208h]
.text:00012588 call ds:ZwClose
...
2008-09-21 DESlock+ - 3.2.7 (vdlptokn.sys) - Local Denial of Service Exploit At the beginning of the year mu-b of digit-labs published information about few serious vulnerabilities he found in drivers distributed with DESlock+ - DESLock+ IOCTL Request Local Code Execution and Denial of Service Vulnerabilities. Yesterday he placed on digit-labs another exploits to prove that vulnerabilities in latest version of DESlock+ still exists. I decided to publish sample DoS exploit related with vdlptokn.sys device driver. I hope that this time Data Encryption Systems will correct all vulnerabilities. Exploit: Vdlptoken_DoS.zip - Local Denial of Service Exploit 2008-10-01 ESET SysInspector - 1.1.1.0 (esiadrv.sys) Proof of Concept Exploit ESET SysInspector is prone to a local privilege escalation vulnerability, which could be exploited by local users in order o execute arbitrary code with kernel privileges. The problem specifically exists within the IOCTL handling code in the esiadrv.sys (3.0.65535.0) device driver. The device driver fails to validate user supplied addresses passed to IOCTLs. All IOCTLs are generated as METHOD_NEITHER. Although this is not serious vulnerability because the device driver is loaded and unloaded dynamically with the GUI application.
...
.text:00012C3A @@ioctl_0x223C1F:
.text:00012C3A mov eax, [ebp+10h] ; InputBuffer
.text:00012C3D cmp eax, ebx
.text:00012C3F jz short @@jump
.text:00012C41 cmp [ebp+14h], edi ; InputBufferLength
.text:00012C44 jnz short @@jump
.text:00012C46 cmp dword ptr [eax], 12345678h ; InputBuffer[0] == 0x12345678 ?
.text:00012C4C jnz short @@jump
.text:00012C4E push offset aBsodCalled ; "BSOD called\n"
.text:00012C53 call DbgPrint
.text:00012C58 pop ecx
.text:00012C59 push 0DEADDEADh
.text:00012C5E call ds:KeBugCheck
.text:00012C64
.text:00012C64 @@jump:
.text:00012C64 mov esi, [ebp+18h] ; OutputBuffer
.text:00012C67 cmp esi, ebx
.text:00012C69 jz short @@invalid_parameter
.text:00012C6B cmp [ebp+1Ch], edi ; OutputBufferLength
.text:00012C6E jb short @@invalid_parameter
.text:00012C70 mov [ebp+10h], ebx
.text:00012C73 lea eax, [ebp+10h]
.text:00012C76 push eax
.text:00012C77 push dword ptr [ebp+28h] ; DeviceObject
.text:00012C7A call sub_148EC
.text:00012C7F mov [ebp-1Ch], eax
.text:00012C82 mov eax, [ebp+10h]
.text:00012C85 mov [esi], eax ; OutputBuffer[0] - ?x????????
.text:00012C87 mov [ebp-20h], edi
.text:00012C8A jmp short @@return
...
Exploit:Esiasdrv_DoS.zip - Local Denial of Service Exploit |