第一次尝试分析漏洞，水平有限有不对的地方请大家指正，轻拍啊。呵呵。MS17-010漏洞出现在的原因是SrvOs2FeaListSizeToNt在计算需要分配的内存长度时存在问题，以至于可以溢出到邻近的内存块。
int __stdcall SrvOs2FeaListSizeToNt(_DWORD *a1)
{
_WORD *v1; // eax@1
unsigned int v2; // edi@1
unsigned int v3; // esi@1
int v4; // ebx@3
int v6; // [sp+Ch] [bp-4h]@1
v1 = a1;
v6 = 0;
v2 = (unsigned int)a1 + *a1;
v3 = (unsigned int)(a1 + 1);
if ( (unsigned int)(a1 + 1) < v2 )
{
while ( v3 + 4 < v2 )
{
v4 = *(_WORD *)(v3 + 2) + *(_BYTE *)(v3 + 1);
if ( v4 + v3 + 4 + 1 > v2 )
break;
if ( RtlSizeTAdd(v6, (v4 + 12) & 0xFFFFFFFC, &v6) < 0 )
return 0;
v3 += v4 + 5;
if ( v3 >= v2 )
return v6;
v1 = a1;
}
*v1 = v3 - (_WORD)v1;
}
return v6;
}
按上面的逻辑如果v3这个缓存区中全是0，那么每次循环v3向前移动5个字节，v6就会加0xC（也就是12字节）。问题就出现在*v1 = v3 - (_WORD)v1;上a1的长度是一个四字节，但这里却是个双字节。那么如果长度为三字节以上，且执行到这里时就有可能把的长度改大。Eternalblue就设长度是0x10000，最后最后一个分片长度是0xA8,这时v3已经是偏移了FF5D了。加上0xa8就超0x10000了，所以就会走到了这一句，执行后长度变成了0x1FF5D比原来大了不少。
signed int __stdcall SrvOs2FeaListToNt(char *a1, _DWORD *a2, int *a3, _WORD *a4)
{
char *v4; // edi@1
int v5; // eax@1
_DWORD *v7; // eax@3
char *v8; // ebx@9
char *v9; // esi@9
signed int v10; // esi@14
__int16 v11; // [sp+8h] [bp-4h]@1
_DWORD *v12; // [sp+14h] [bp+8h]@11
v11 = 0;
v4 = a1;
v5 = SrvOs2FeaListSizeToNt(a1);
*a3 = v5;
if ( !v5 )
{
*a4 = 0;
return -1063718657;
}
v7 = (_DWORD *)SrvAllocateNonPagedPool(v5, 21);
*a2 = v7;
if ( v7 )
{
v8 = &a1[*(_DWORD *)a1 - 5];
v9 = a1 + 4;
if ( a1 + 4 > v8 )
{
LABEL_13:
if ( v9 == &v4[*(_DWORD *)v4] )
{
*v7 = 0;
return 0;
}
*a4 = v11 - (_WORD)v4;
v10 = -1073741823;
}
else
{
while ( !(*v9 & 0x7F) )
{
v12 = v7;
v11 = (signed __int16)v9;
v7 = (_DWORD *)SrvOs2FeaToNt((int)v7, (int)v9);
v9 += (unsigned __int8)v9[1] + *((_WORD *)v9 + 1) + 5;
if ( v9 > v8 )
{
v7 = v12;
goto LABEL_13;
}
}
*a4 = (_WORD)v9 - (_WORD)v4;
v10 = -1073741811;
}
SrvFreeNonPagedPool(*a2);
return v10;
}
if ( *((_BYTE *)WPP_GLOBAL_Control + 29) >= 2u && *((_BYTE *)WPP_GLOBAL_Control + 32) & 1 && KeGetCurrentIrql() < 2u )
{
DbgPrint("SrvOs2FeaListToNt: Unable to allocate %d bytes from nonpaged pool.", *a3, 0);
DbgPrint("\n");
}
return -1073741307;
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
