关联漏洞
标题:Microsoft Win32k 资源管理错误漏洞 (CVE-2021-40449)Description:Microsoft Win32k是美国微软（Microsoft）公司的一个用于Windows多用户管理的系统文件。 Microsoft Windows Win32K存在资源管理错误漏洞。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows 10 Version 1809 for ARM64-based Systems,Windows Serve
Description
LPE exploit for a UAF in Windows (CVE-2021-40449).
介绍
# CVE-2021-40449
My exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.
# short wu
along with the UAF vulnerabilty other primitives are being used to make this exploit possible:
- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter.
- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s.
- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function.
- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit.
- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter.
- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`.
- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.
- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`.
- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive.
- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\SYSTEM` via injecting shellcode to `winlogon.exe` process.
More information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky.
# PoC
tested on Win10 Redstone (build 14393).
文件快照
[4.0K] /data/pocs/f93d7bfd6a785ae3c0d32a9b85b943c042717dcd
├── [4.0K] CVE-2021-40449
│ ├── [7.1K] CVE-2021-40449.vcxproj
│ ├── [1.1K] CVE-2021-40449.vcxproj.filters
│ ├── [3.2K] defines.h
│ └── [ 12K] exploit.cpp
├── [1.7M] CVE-2021-40449.gif
├── [1.4K] CVE-2021-40449.sln
└── [1.9K] README.md
1 directory, 7 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。