WooYun.org

PCWSTR szKey_DisallowRun = L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun";
void __stdcall CMCALLBACK_BSOD_ROUTINE(PCWSTR KeyNameBuf)
{
	SIZE_T         KeyNameLength; 
	UNICODE_STRING KeyName; 
	ULONG          ResultLength = 0; 
	ULONG          i = 0; // [sp+10h] [bp-844h]@1
	PKEY_FULL_INFORMATION FullKeyInfo = NULL; 
	NTSTATUS Status = STATUS_UNSUCCESSFUL; 
	WCHAR    ValueNameBuf[256] = {0}; // [esp+1Ch] [ebp-838h] 
	WCHAR    ValueDataBuf[256] = {0}; // [esp+21Ch] [ebp-638h] 
	OBJECT_ATTRIBUTES obja = {0}; // [esp+420h] [ebp-434h]
	PKEY_VALUE_FULL_INFORMATION FullValueInfo = NULL; // [esp+438h]
	char           Unused[512] = {0}; 
	UNICODE_STRING ValueName; 
	ULONG          ValueNumbers = 0; 
	HANDLE         KeyHandle; 
	ULONG          Index = 0; 
	WCHAR          NameBuf[256] = {0}; 
	KeyNameLength = wcslen(KeyNameBuf);
	if ( KeyNameLength + wcslen(szKey_DisallowRun) + 1 <= 0x100 )
	{
		wcscpy(NameBuf, KeyNameBuf);
		wcscat(NameBuf, szKey_DisallowRun);
		RtlInitUnicodeString(&KeyName, NameBuf);
		InitializeObjectAttributes(&obja, &KeyName, OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE, NULL, NULL);
		
		Status = ZwOpenKey(&KeyHandle, 0xF003Fu, &obja);
		if ( NT_SUCCESS(Status) )
		{
			Status = ZwQueryKey(KeyHandle, KeyFullInformation, 0, 0, &ResultLength);
			if ( Status == STATUS_BUFFER_OVERFLOW || Status == STATUS_BUFFER_TOO_SMALL )
			{
				FullKeyInfo = (PKEY_FULL_INFORMATION)ExAllocatePool(NonPagedPool, ResultLength);
				if ( FullKeyInfo )
				{
					Status = ZwQueryKey(KeyHandle, KeyFullInformation, FullKeyInfo, ResultLength, &ResultLength);
					if ( NT_SUCCESS(Status) )
					{
						ValueNumbers = FullKeyInfo->Values;
						FullValueInfo = ExAllocatePool(NonPagedPool, 0x418);
						if ( FullValueInfo )
						{
							for ( Index = 0; Index < ValueNumbers; ++Index )
							{
								Status = ZwEnumerateValueKey(
								KeyHandle,
								Index,
								KeyValueFullInformation,
								FullValueInfo,
								0x418u,
								&ResultLength);
								if ( NT_SUCCESS(Status) )
								{
									memset(ValueNameBuf, 0, 0x200);
									memset(ValueDataBuf, 0, 0x200);
									memcpy(ValueNameBuf, FullValueInfo->Name, FullValueInfo->NameLength);
									memcpy(ValueDataBuf, (PCH)FullValueInfo + FullValueInfo->DataOffset, FullValueInfo->DataLength);//Buffer over flow
									for ( i = 0; ProcessNameList2[i]; ++i )
									{
										if ( !wcsicmp(ProcessNameList2[i], ValueDataBuf) )
										{
											RtlInitUnicodeString(&ValueName, ValueNameBuf);
											Status = ZwDeleteValueKey(KeyHandle, &ValueName);
											if ( Status >= 0 )
											{
												--Index;
												--ValueNumbers;
											}
										}
									}
								}
							}
							ZwClose(KeyHandle);
							ExFreePoolWithTag(FullKeyInfo, 0);
							ExFreePoolWithTag(FullValueInfo, 0);//BSOD
						}
						else
						{
							Status = STATUS_INSUFFICIENT_RESOURCES;
							ZwClose(KeyHandle);
							ExFreePoolWithTag(FullKeyInfo, 0);
						}
					}
					else
					{
						ZwClose(KeyHandle);
						ExFreePoolWithTag(FullKeyInfo, 0);
					}
				}
				else
				{
					Status = STATUS_INSUFFICIENT_RESOURCES;
					ZwClose(KeyHandle);
				}
			}
		}
	}
}