Code Monkey home page Code Monkey logo

kur's Introduction

kur

A code simply offers the ability to kernel-mode read / write memory from user-mode using vulnerable signed driver. It's simply utilizing MmCopyVirtualMemory, which is undocumented yet one of the most common API, in kernel mode so you can read / write any user-mode memory without having to worry about the protection the memory page has. Besides that, it has a function to obtain process handle of given pid as a side arm. Since handle creation is conducted in kernel-mode, standard access checks and callbacks won't kick in i believe.

This project was created for study purposes, and it is not recommended to use it outside of a virtual machine.

background

I've seen that this specific driver has privilege escalation vulnerability in uc forum. So I started reversing the driver myself and indeed the driver doesnt have access control over its strong ioctls.

the vulnerability

This project utilizes the vulnerability that was reported as CVE-2023-38817. https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/

How to use

Since I was too lazy to implement properly u have to just include everything and compile. all functionalities are encapsulated in kur_t class.

kur/kur/kur.h

Lines 5 to 14 in cd3da42

class kur_t
{
vul_driver vul_driver;
public:
auto query_device_handle() const -> HANDLE;
auto get_process_handle(DWORD pid, ACCESS_MASK access_mask) -> std::optional<HANDLE>;
auto read(void* address, void* buffer, size_t buffer_size, HANDLE h_target_process) -> BOOL;
auto write(void* to_address, void* from_address, size_t size, HANDLE h_target_process) -> BOOL;

kur's People

Contributors

pseuxide avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar

kur's Issues

Proper error handling with subclass inherits std::runtime_error

by inheriting std::runtime_error, you can use message when you throw one.
Additionally you also gain polymorphic advantage which you can pass your custom error class to the function which takes param as std::runtime_error or std::exception.
Moreover, it has what function at the first state and it's guaranteed to not throw additional error from it.

class kur_error : public std::runtime_error {
public:
    kur_error(const std::string& message)
        : std::runtime_error(message) {
    }
};

fix constructor

delete driver name and device name from params of kur_t class.
cuz users of the library don't have to know about the driver.

use precompiled header

Currently the compile time is pretty slow, it can be heavily improved by precompiled header i recon.

make pch.h and pch.cpp

set pch.cpp as Create in precompiled header property
set entire project as Use and specify pch.h as precompiled header.

fix memory leak

fix memory leak in vul_driver::ioctl_initialize_driver method.
stop allocating malloc and use struct.

whatever in cleanup() should happen in destructor

whatever in cleanup() should happen in destructor of kur_t or vul_driver class.

the lifetime of both class is very similar, so it's matter of the relevance.

~kur_t()
{
  // Cleanup code here
}

or

~vul_driver()
{
  // Cleanup code here
}

create handle function

in init function,

  • it needs opening device handle by NtOpenFile
// L"\\Device\\echo", GENERIC_READ | GENERIC_WRITE
auto retrieve_device_handle(std::wstring device_name, ACCESS_MASK access_mask) -> PHANDLE
{
    NTSTATUS status;
    HANDLE device_handle;
    OBJECT_ATTRIBUTES obj_attr;
    UNICODE_STRING uni_device_name;
    IO_STATUS_BLOCK io_status_block;

    RtlInitUnicodeString(&uni_device_name, device_name);

    InitializeObjectAttributes(&obj_attr, &uni_device_name,
        OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    ACCESS_MASK access_mask = ;
    ULONG share_access = 0;
    ULONG open_options = 0;

    status = NtOpenFile(&device_handle,
                        access_mask,
                        &obj_attr,
                        &io_status_block,
                        share_access,
                        open_options);

    if (!NT_SUCCESS(status)) {
        std::cerr << "Failed to open handle. Status code: " << std::hex << status << std::endl;
        return nullptr;
    }
    // This handle has to be closed with CloseHandle(device_handle);
    return device_handle;
}

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.