{"id":241,"date":"2022-08-13T17:44:06","date_gmt":"2022-08-13T15:44:06","guid":{"rendered":"https:\/\/areyou1or0.it\/?p=241"},"modified":"2022-08-13T18:52:07","modified_gmt":"2022-08-13T16:52:07","slug":"hevd-windows-kernel-exploitation-2-write-what-where","status":"publish","type":"post","link":"https:\/\/areyou1or0.it\/index.php\/2022\/08\/13\/hevd-windows-kernel-exploitation-2-write-what-where\/","title":{"rendered":"HEVD Windows Kernel Exploitation 3 -Write What Where"},"content":{"rendered":"\n<p>Let&#8217;s continue with the third blogpost of the Kernel exploitation series. Few notes: <\/p>\n\n\n\n<ul><li>With Stack Overfow:&nbsp;&nbsp;we put our shellcode in user-land in an allocated memory and execute in kernel-land<\/li><\/ul>\n\n\n\n<ul><li>With Arbitraty Overwrite: we&#8217;ll be writing the value pointed by &#8220;what&#8221; to the memory location referenced by &#8220;where&#8221;<\/li><\/ul>\n\n\n\n<p>The strategy for this blogpost:<\/p>\n\n\n\n<h4>Initial Phase:<\/h4>\n\n\n\n<ul><li>Source Code Review<\/li><li>Finding IOCTL<\/li><li>Verifying the vulnerability with the initial script<\/li><\/ul>\n\n\n\n<h4>Exploitation Phase:<\/h4>\n\n\n\n<ul><li>Enumerate all drivers<\/li><li>Find the address for ntoskrnl.exe<\/li><li>Load ntoskrnl.exe into LoadLibraryExA<\/li><li>Enumerate HalDispatchTable address<\/li><li>Overwrite HalDispatchTable + 0x4 with a pointer to our shellcode<\/li><\/ul>\n\n\n\n<h2>Source Code Review:<\/h2>\n\n\n\n<p>We have 2 source-code files for this vulnerability:<\/p>\n\n\n\n<ul><li><a href=\"https:\/\/github.com\/hacksysteam\/HackSysExtremeVulnerableDriver\/blob\/master\/Driver\/HEVD\/Windows\/ArbitraryWrite.h\">https:\/\/github.com\/hacksysteam\/HackSysExtremeVulnerableDriver\/blob\/master\/Driver\/HEVD\/Windows\/ArbitraryWrite.h<\/a><\/li><\/ul>\n\n\n\n<ul><li><a href=\"https:\/\/github.com\/hacksysteam\/HackSysExtremeVulnerableDriver\/blob\/master\/Driver\/HEVD\/Windows\/ArbitraryWrite.c\">https:\/\/github.com\/hacksysteam\/HackSysExtremeVulnerableDriver\/blob\/master\/Driver\/HEVD\/Windows\/ArbitraryWrite.c<\/a><\/li><\/ul>\n\n\n\n<p>Let&#8217;s start with the header file: <strong><em>ArbitraryWrite.h<\/em><\/strong>:<\/p>\n\n\n\n<ul><li>in the first snippet, typedef is used to create new datatype for what and where<\/li><li><strong><em>WRITE_WHAT_WHERE<\/em><\/strong> is an alias used to reference the struct <strong><em>_WRITE_WHAT_WHERE<\/em><\/strong><\/li><li><strong><em>PWRITE_WHAT_WHERE<\/em><\/strong> is an &#8216;aliased pointer&#8217; to the struct <strong><em>_WRITE_WHAT_WHERE<\/em><\/strong><\/li><\/ul>\n\n\n\n<ul><li>in the second snippet, we see a variable <strong><em>UserWriteWhatWhere<\/em><\/strong> with the datatype <strong><em>PWRITE_WHAT_WHERE<\/em><\/strong> which was a pointer to the struct <strong><em>_WRITE_WHAT_WHERE<\/em><\/strong> which contains What &amp; Where pointers<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"716\" height=\"794\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-5.png\" alt=\"\" class=\"wp-image-247\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-5.png 716w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-5-271x300.png 271w\" sizes=\"(max-width: 716px) 100vw, 716px\" \/><\/figure>\n\n\n\n<p>After getting some insights from the header file, we&#8217;ll have a look at the C code:<\/p>\n\n\n\n<ul><li>here we see what and where which was declared in the header file already<\/li><li>they are initialized here as NULL<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"716\" height=\"296\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image.png\" alt=\"\" class=\"wp-image-242\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image.png 716w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-300x124.png 300w\" sizes=\"(max-width: 716px) 100vw, 716px\" \/><\/figure>\n\n\n\n<p>Then we see the secure version of the code which verifies if values pointed by what and where resides in User mode. The vulnerable version doesn&#8217;t verify while writing the value pointed by WHAT to the memory location referenced by WHERE, if the values reside in user mode or not.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"331\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-6-1024x331.png\" alt=\"\" class=\"wp-image-248\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-6-1024x331.png 1024w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-6-300x97.png 300w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-6-768x249.png 768w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-6.png 1384w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>So after doing some source code review, we&#8217;ll find the IOCTL code as the first thing:&nbsp;<\/p>\n\n\n\n<ul><li>if we subtract&nbsp;0x222003&nbsp;from our IOCTL and we don\u2019t get&nbsp;0x0,<\/li><li>subtract another&nbsp;0x4. If we don\u2019t get&nbsp;0x0,<\/li><li>subtract another&nbsp;0x4. If we get&nbsp;0x0, jump to the Arbitrary Write function.<\/li><li>this makes our IOCTL 0x222003 + 8 bytes = 0x22200B<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"680\" height=\"424\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-3.png\" alt=\"\" class=\"wp-image-246\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-3.png 680w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-3-300x187.png 300w\" sizes=\"(max-width: 680px) 100vw, 680px\" \/><\/figure>\n\n\n\n<p>Now we have the IOCTL code, we&#8217;ll verify the vulnerability with our initial script:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"406\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/Screenshot-2022-08-13-at-17.39.54-1024x406.png\" alt=\"\" class=\"wp-image-250\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/Screenshot-2022-08-13-at-17.39.54-1024x406.png 1024w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/Screenshot-2022-08-13-at-17.39.54-300x119.png 300w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/Screenshot-2022-08-13-at-17.39.54-768x304.png 768w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/Screenshot-2022-08-13-at-17.39.54.png 1520w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>After verifing the vulnerability, we will proceed with the exploitation phase:<\/p>\n\n\n\n<h2>Exploitation Phase:<\/h2>\n\n\n\n<ul><li>Enumerate all drivers<\/li><li>Find the address for ntoskrnl.exe<\/li><li>Load ntoskrnl.exe into LoadLibraryExA<\/li><li>Enumerate HalDispatchTable address<\/li><li>Overwrite HalDispatchTable + 0x4 with a pointer to our shellcode<\/li><\/ul>\n\n\n\n<p>So I&#8217;ll give a bit of theory here to understand what are we doing and why are we doing it, then will continue purely with code snippets and explaning the lines of code:<\/p>\n\n\n\n<p>Since the Arbitrary Overwrite vulnerability exists, we need to find a way to execute user mode shellcode from kernel mode. This can be done via HalDispatchTable which is a part of the kernel for hardware\/machine instructions. It helps making various hardware architectures to be compatible with Windows.&nbsp;We&#8217;ll use various Windows API calls for our goal. Let&#8217;s start by creating code snippets for each goal:<\/p>\n\n\n\n<h3>Enumerate all drivers:<\/h3>\n\n\n\n<p>We&#8217;ll use EnumDeviceDrivers() to enumerate all driver addresses:&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/psapi\/nf-psapi-enumdevicedrivers\">https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/psapi\/nf-psapi-enumdevicedrivers<\/a><\/p>\n\n\n\n<ul><li>It gets 3 parameters:&nbsp;*lpImageBase,&nbsp;&nbsp;cb, and lpcbNeeded:<\/li><\/ul>\n\n\n\n<ul><li>An array that receives the list of load addresses for the device drivers.<\/li><li>The size of the&nbsp;<em>lpImageBase<\/em>&nbsp;array, in bytes<\/li><li>The number of bytes returned in the&nbsp;<em>lpImageBase<\/em>&nbsp;array<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"174\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-7-1024x174.png\" alt=\"\" class=\"wp-image-249\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-7-1024x174.png 1024w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-7-300x51.png 300w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-7-768x131.png 768w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-7.png 1152w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3>Find the address for ntoskrnl.exe:<\/h3>\n\n\n\n<p>For finding the address of ntoskrnk.exe, we will use GetDeviceDriverBaseNameA function:&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/psapi\/nf-psapi-getdevicedriverbasenamea\">https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/psapi\/nf-psapi-getdevicedriverbasenamea<\/a><\/p>\n\n\n\n<ul><li>it gets 3 parameters:&nbsp;ImageBase, lpFilename, nSize<\/li><li>ImageBase: the load address of the device driver<\/li><li>nSize: the size of the&nbsp;lpBaseName&nbsp;buffer, in characters<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"378\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-4-1024x378.png\" alt=\"\" class=\"wp-image-245\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-4-1024x378.png 1024w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-4-300x111.png 300w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-4-768x284.png 768w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-4.png 1218w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3>Load ntoskrnl.exe into LoadLibraryExA:<\/h3>\n\n\n\n<p>This time we&#8217;ll use the API function: LoadLibraryExA:&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/libloaderapi\/nf-libloaderapi-loadlibraryexa\">https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/libloaderapi\/nf-libloaderapi-loadlibraryexa<\/a><\/p>\n\n\n\n<ul><li>it gets 3 parameters: lpLibFileName, hFile, dwFlags<\/li><\/ul>\n\n\n\n<ul><li>lpLibFileName: A string that specifies the file name of the module to load<\/li><li>hFile: This parameter is reserved for future use. It must be&nbsp;NULL<\/li><li>dwFlags: The action to be taken when loading the module<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"194\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-1.png\" alt=\"\" class=\"wp-image-243\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-1.png 1024w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-1-300x57.png 300w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-1-768x146.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3>Enumerate HalDispatchTable address:<\/h3>\n\n\n\n<p>We&#8217;ll use&nbsp;GetProcAddress() to find the address of&nbsp;HalDispatchTable:&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/libloaderapi\/nf-libloaderapi-getprocaddress\">https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/libloaderapi\/nf-libloaderapi-getprocaddress<\/a><\/p>\n\n\n\n<ul><li>it gets 2 parameters:&nbsp;hModule, lpProcName<\/li><li>hModule: A handle to the DLL module that contains the function or variable<\/li><li>lpProcName: The function or variable name, or the function&#8217;s ordinal value<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"970\" height=\"206\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-2.png\" alt=\"\" class=\"wp-image-244\" srcset=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-2.png 970w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-2-300x64.png 300w, https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/image-2-768x163.png 768w\" sizes=\"(max-width: 970px) 100vw, 970px\" \/><\/figure>\n\n\n\n<h3>Final Exploit &#8211; few more additions<\/h3>\n\n\n\n<p>So let&#8217;s see what do we have in our final exploit:<\/p>\n\n\n\n<ol type=\"1\"><li>DLLs for windows APIs (kernel32, ntdll, psapi)<\/li><li>We define the what &amp; where stuctures<\/li><li>shellcode (same we used in the Stack overflow exploit)<\/li><li>Defeating DEP with VirtualAlloc (same we used in the Stack overflow exploit)<\/li><li>Enumerate all drivers &#8211; explained above<\/li><li>Find the address for ntoskrnl.exe &#8211; explained above<\/li><li>Load ntoskrnl.exe into LoadLibraryExA &#8211; explained above<\/li><li>Enumerate HalDispatchTable address &#8211; explained above<\/li><li>Trigger the exploit<\/li><li>CreateFileA and DeviceIoControl API functions &#8211; same as the Stack overflow exploit<\/li><li>NtQueryIntervalProfile() call to make sure the exploit is working by executing the shellcode at HAL+0x4<\/li><li>Pop the shell &#8211; same as used in Stack Overflow exploit<\/li><\/ol>\n\n\n\n<p>Most of the code is already given above, there are few adjustments made with the explanations given below. After that run the script and enjoy the SYSTEM shell.<\/p>\n\n\n\n<ul><li>w00t w00t \ud83c\udf89<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>\u00a0import struct, sys, os<br>from ctypes import *<br>from subprocess import *\u00a0<br><br># DLLs for Windows APIs<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/1.png\" alt=\"\"><br>\u00a0<br><br># Here we&#8217;ll define What &amp; Where in our exploit\u00a0<br>\u00a0<img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/2.png\" alt=\"\"><br><br># Shellcode\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/3-1024x598.png\" alt=\"\">\u00a0<br><br># Defeating DEP with VirtualAlloc. Creating RWX memory, and copying our shellcode in that region<br>\u00a0<img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/4-1024x344.png\" alt=\"\"><br><br># Enumerate all drivers:<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/5-1024x174.png\" alt=\"\"><br><br># Find the address for ntoskrnl.exe:\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/6-1024x378.png\" alt=\"\">\u00a0<br><br># Load ntoskrnl.exe into LoadLibraryExA:\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/8.png\" alt=\"\">\u00a0<br><br># Enumerate HalDispatchTable address:\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/9.png\" alt=\"\">\u00a0<br><br># Now we trigger the exploit here:\u00a0\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/10.png\" alt=\"\"><br><br># CreateFileA and DeviceIoControl -same as used in Stack Overflow exploit\u00a0\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/11-1024x68.png\" alt=\"\"><br><br># NtQueryIntervalProfile() will eventually call the Where location (HAL + 0x4) and execute it<br><br>\u00a0\u00a0<img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/12.png\" alt=\"\"><br><br># Pop the shell &#8211; same as used in Stack Overflow exploit\u00a0\u00a0<br><img decoding=\"async\" src=\"https:\/\/areyou1or0.it\/wp-content\/uploads\/2022\/08\/13.png\" alt=\"\">\u00a0\u00a0<\/td><\/tr><\/tbody><\/table><figcaption>Final Exploit<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Let&#8217;s continue with the third blogpost of the Kernel exploitation series. Few notes: With Stack Overfow:&nbsp;&nbsp;we put our shellcode in user-land in an allocated memory and execute in kernel-land With Arbitraty Overwrite: we&#8217;ll be writing the value pointed by &#8220;what&#8221; to the memory location referenced by &#8220;where&#8221; The strategy for this blogpost: Initial Phase: Source&hellip; <a class=\"more-link\" href=\"https:\/\/areyou1or0.it\/index.php\/2022\/08\/13\/hevd-windows-kernel-exploitation-2-write-what-where\/\">Continue reading <span class=\"screen-reader-text\">HEVD Windows Kernel Exploitation 3 -Write What Where<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[21],"tags":[],"_links":{"self":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/241"}],"collection":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/comments?post=241"}],"version-history":[{"count":4,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/241\/revisions"}],"predecessor-version":[{"id":273,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/241\/revisions\/273"}],"wp:attachment":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/media?parent=241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/categories?post=241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/tags?post=241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}