Skip to content

Commit 4bddd07

Browse files
wchen-r7wchen-r7
committed
Land rapid7#2762 - Use new ntdll railgun functions
2 parents 8af81c9 + e8396dc commit 4bddd07

File tree

4 files changed

+0
-152
lines changed

4 files changed

+0
-152
lines changed

‎modules/exploits/windows/local/ms11_080_afdjoinleaf.rb

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -172,19 +172,6 @@ def exploit
172172
irpstuff << rand_text_alpha(231)
173173

174174
if not this_proc.memory.writable?(0x1000)
175-
session.railgun.add_function(
176-
'ntdll',
177-
'NtAllocateVirtualMemory',
178-
'DWORD',
179-
[
180-
["DWORD", "ProcessHandle", "in"],
181-
["PBLOB", "BaseAddress", "inout"],
182-
["PDWORD", "ZeroBits", "in"],
183-
["PBLOB", "RegionSize", "inout"],
184-
["DWORD", "AllocationType", "in"],
185-
["DWORD", "Protect", "in"]
186-
])
187-
188175
result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ base_addr ].pack("L"), nil, [ 0x1000 ].pack("L"), "MEM_COMMIT | MEM_RESERVE", "PAGE_EXECUTE_READWRITE")
189176
end
190177
if not this_proc.memory.writable?(0x1000)
@@ -261,31 +248,6 @@ def exploit
261248
return
262249
end
263250

264-
session.railgun.add_function(
265-
'ntdll',
266-
'NtDeviceIoControlFile',
267-
'DWORD',
268-
[
269-
[ "DWORD", "FileHandle", "in" ],
270-
[ "DWORD", "Event", "in" ],
271-
[ "DWORD", "ApcRoutine", "in" ],
272-
[ "DWORD", "ApcContext", "in" ],
273-
[ "PDWORD", "IoStatusBlock", "out" ],
274-
[ "DWORD", "IoControlCode", "in" ],
275-
[ "LPVOID", "InputBuffer", "in" ],
276-
[ "DWORD", "InputBufferLength", "in" ],
277-
[ "LPVOID", "OutputBuffer", "in" ],
278-
[ "DWORD", "OutPutBufferLength", "in" ]
279-
])
280-
281-
session.railgun.add_function(
282-
'ntdll',
283-
'NtQueryIntervalProfile',
284-
'DWORD',
285-
[
286-
[ "DWORD", "ProfileSource", "in" ], [ "PDWORD", "Interval", "out" ]
287-
])
288-
289251
print_status("Triggering AFDJoinLeaf pointer overwrite...")
290252
result = session.railgun.ntdll.NtDeviceIoControlFile(socket, 0, 0, 0, 4, 0x000120bb, 0x1004, 0x108, halDispatchTable0x4 + 0x1, 0)
291253
result = session.railgun.ntdll.NtQueryIntervalProfile(1337, 4)

‎modules/exploits/windows/local/ms_ndproxy.rb

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -87,44 +87,6 @@ module has been tested successfully on Windows XP SP3 and Windows 2003 SP2. In o
8787
end
8888

8989
def add_railgun_functions
90-
session.railgun.add_function(
91-
'ntdll',
92-
'NtAllocateVirtualMemory',
93-
'DWORD',
94-
[
95-
["DWORD", "ProcessHandle", "in"],
96-
["PBLOB", "BaseAddress", "inout"],
97-
["PDWORD", "ZeroBits", "in"],
98-
["PBLOB", "RegionSize", "inout"],
99-
["DWORD", "AllocationType", "in"],
100-
["DWORD", "Protect", "in"]
101-
])
102-
103-
session.railgun.add_function(
104-
'ntdll',
105-
'NtDeviceIoControlFile',
106-
'DWORD',
107-
[
108-
[ "DWORD", "FileHandle", "in" ],
109-
[ "DWORD", "Event", "in" ],
110-
[ "DWORD", "ApcRoutine", "in" ],
111-
[ "DWORD", "ApcContext", "in" ],
112-
[ "PDWORD", "IoStatusBlock", "out" ],
113-
[ "DWORD", "IoControlCode", "in" ],
114-
[ "LPVOID", "InputBuffer", "in" ],
115-
[ "DWORD", "InputBufferLength", "in" ],
116-
[ "LPVOID", "OutputBuffer", "in" ],
117-
[ "DWORD", "OutPutBufferLength", "in" ]
118-
])
119-
120-
session.railgun.add_function(
121-
'ntdll',
122-
'NtQueryIntervalProfile',
123-
'DWORD',
124-
[
125-
[ "DWORD", "ProfileSource", "in" ],
126-
[ "PDWORD", "Interval", "out" ]
127-
])
12890
session.railgun.add_dll('psapi') unless session.railgun.dlls.keys.include?('psapi')
12991
session.railgun.add_function(
13092
'psapi',

‎modules/exploits/windows/local/novell_client_nicm.rb

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -67,44 +67,6 @@ def initialize(info={})
6767
end
6868

6969
def add_railgun_functions
70-
session.railgun.add_function(
71-
'ntdll',
72-
'NtAllocateVirtualMemory',
73-
'DWORD',
74-
[
75-
["DWORD", "ProcessHandle", "in"],
76-
["PBLOB", "BaseAddress", "inout"],
77-
["PDWORD", "ZeroBits", "in"],
78-
["PBLOB", "RegionSize", "inout"],
79-
["DWORD", "AllocationType", "in"],
80-
["DWORD", "Protect", "in"]
81-
])
82-
83-
session.railgun.add_function(
84-
'ntdll',
85-
'NtDeviceIoControlFile',
86-
'DWORD',
87-
[
88-
[ "DWORD", "FileHandle", "in" ],
89-
[ "DWORD", "Event", "in" ],
90-
[ "DWORD", "ApcRoutine", "in" ],
91-
[ "DWORD", "ApcContext", "in" ],
92-
[ "PDWORD", "IoStatusBlock", "out" ],
93-
[ "DWORD", "IoControlCode", "in" ],
94-
[ "LPVOID", "InputBuffer", "in" ],
95-
[ "DWORD", "InputBufferLength", "in" ],
96-
[ "LPVOID", "OutputBuffer", "in" ],
97-
[ "DWORD", "OutPutBufferLength", "in" ]
98-
])
99-
100-
session.railgun.add_function(
101-
'ntdll',
102-
'NtQueryIntervalProfile',
103-
'DWORD',
104-
[
105-
[ "DWORD", "ProfileSource", "in" ],
106-
[ "PDWORD", "Interval", "out" ]
107-
])
10870
session.railgun.add_dll('psapi') if not session.railgun.dlls.keys.include?('psapi')
10971
session.railgun.add_function(
11072
'psapi',

‎modules/exploits/windows/local/novell_client_nwfs.rb

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -63,44 +63,6 @@ def initialize(info={})
6363
end
6464

6565
def add_railgun_functions
66-
session.railgun.add_function(
67-
'ntdll',
68-
'NtAllocateVirtualMemory',
69-
'DWORD',
70-
[
71-
["DWORD", "ProcessHandle", "in"],
72-
["PBLOB", "BaseAddress", "inout"],
73-
["PDWORD", "ZeroBits", "in"],
74-
["PBLOB", "RegionSize", "inout"],
75-
["DWORD", "AllocationType", "in"],
76-
["DWORD", "Protect", "in"]
77-
])
78-
79-
session.railgun.add_function(
80-
'ntdll',
81-
'NtDeviceIoControlFile',
82-
'DWORD',
83-
[
84-
[ "DWORD", "FileHandle", "in" ],
85-
[ "DWORD", "Event", "in" ],
86-
[ "DWORD", "ApcRoutine", "in" ],
87-
[ "DWORD", "ApcContext", "in" ],
88-
[ "PDWORD", "IoStatusBlock", "out" ],
89-
[ "DWORD", "IoControlCode", "in" ],
90-
[ "LPVOID", "InputBuffer", "in" ],
91-
[ "DWORD", "InputBufferLength", "in" ],
92-
[ "LPVOID", "OutputBuffer", "in" ],
93-
[ "DWORD", "OutPutBufferLength", "in" ]
94-
])
95-
96-
session.railgun.add_function(
97-
'ntdll',
98-
'NtQueryIntervalProfile',
99-
'DWORD',
100-
[
101-
[ "DWORD", "ProfileSource", "in" ],
102-
[ "PDWORD", "Interval", "out" ]
103-
])
10466
session.railgun.add_dll('psapi') if not session.railgun.dlls.keys.include?('psapi')
10567
session.railgun.add_function(
10668
'psapi',

0 commit comments

Comments
 (0)