trustedsec / cs-situational-awareness-bof Goto Github PK

	pwszNameSpace = (LPWSTR)KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, MAX_PATH*sizeof(wchar_t));
-	if (NULL == pwszServer)
+	if (NULL == pwszNameSpace)

		clear:
		if (certificate_context)
+		{
			CRYPT32$CertFreeCertificateContext(certificate_context);
+			certificate_context = NULL;
+		}
		if(certificate_header)
+		{
			intFree(certificate_header);
+			certificate_header = NULL;
+		}
		if(certificate)
+		{
			intFree(certificate);
+			certificate = NULL;
+		}

    IP_ADAPTER_INFO * info = intAlloc(sizeof(IP_ADAPTER_INFO) * 32); // have to keep stack < 4K
...
    if(IPHLPAPI$GetNetworkParams(pFixedInfo, &netOutBufLen) == ERROR_BUFFER_OVERFLOW){
        pFixedInfo = (FIXED_INFO *)intAlloc(netOutBufLen);
        if (pFixedInfo == NULL)
        {

			BeaconPrintf(CALLBACK_ERROR, "could not get network adapter info");
            return;   
! Leaks memory belonging to info 
        }
        if (IPHLPAPI$GetNetworkParams(pFixedInfo, &netOutBufLen) != NO_ERROR)
        {
            if (pFixedInfo){
                intFree(pFixedInfo);
            }
			BeaconPrintf(CALLBACK_ERROR, "could not get network adapter info");
            return;  
! Leaks memory belonging to info 
        }

    }

    hProcess = KERNEL32$OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID);
...
    // Get size needed before requesting hMods
    if(!PSAPI$EnumProcessModulesEx(hProcess, 0, 0, &cbNeeded, LIST_MODULES_ALL)){
        internal_printf("Failed to enumerate modules\n");
        return 1;   
! Fails to call CloseHandle on hProcess
    }

		dwRet = ADVAPI32$RegConnectRegistryA(hostname, hivekey, &RemoteKey);
...
		dwRet = ADVAPI32$RegOpenKeyExA(RemoteKey, keystring, 0, KEY_READ, &key);
...
    ValueData = intAlloc(size);
    if (ValueData == NULL){
        BeaconPrintf(CALLBACK_ERROR, "Failed to allocate memory\n");
        return E_OUTOFMEMORY;   
! fails to free registry key handles done at the END: label
    }

    END:
...
! early function exits fail to release allocated resources as done here
    if(key)
     	ADVAPI32$RegCloseKey(key);
	if(RemoteKey)
		ADVAPI32$RegCloseKey(RemoteKey);

		if ((scService = ADVAPI32$OpenServiceA(scManager, cpServiceName, SC_MANAGER_CONNECT | GENERIC_READ)) == NULL)   
! SC_MANAGER_CONNECT is not a service permission

    if (ADVAPI32$OpenProcessToken(KERNEL32$GetCurrentProcess(), TOKEN_READ, &hToken))
    {
        ADVAPI32$GetTokenInformation(hToken,
                            TokenType,
                            NULL,
                            dwLength,
                            &dwLength);

        if (KERNEL32$GetLastError() == ERROR_INSUFFICIENT_BUFFER)
        {
            pTokenInfo = intAlloc(dwLength);
            if (pTokenInfo == NULL)
            {
                //printf("ERROR: not enough memory to allocate the token structure.\r\n");
                return NULL;         
! doesn't call CloseHandle on hToken
            }
        }

        if (!ADVAPI32$GetTokenInformation(hToken, TokenType,
                                 (LPVOID)pTokenInfo,
                                 dwLength,
                                 &dwLength))
        {
            //printf("ERROR 0x%x: could not get token information.\r\n", GetLastError());
            intFree(pTokenInfo);
            return NULL;		 
! doesn't call CloseHandle on hToken
        }

HRESULT wmi_query(
	LPWSTR pwszServer,
	LPWSTR pwszNameSpace,	
	LPWSTR pwszQuery
)
{
	HRESULT	hr = S_OK;

...

	hr = S_OK;

	// Initialize COM
	hr = Wmi_Initialize(&m_WMI);
	if (FAILED(hr))
	{
		BeaconPrintf(CALLBACK_ERROR, "Wmi_Initialize failed: 0x%08lx", hr);
		goto fail;
	}

	// Connect to WMI on host
	hr = Wmi_Connect(&m_WMI, pwszServer, pwszNameSpace);
	if (FAILED(hr))
	{
		BeaconPrintf(CALLBACK_ERROR, "Wmi_Connect failed: 0x%08lx", hr);
		goto fail;
	}


...

fail:

	hr = Wmi_Finalize(&m_WMI);
! this overrides any previous value of hr from a `goto fail` and will result in it being set to S_OK
	if (FAILED(hr))
! this code path will never be called
	{
-		BeaconPrintf(CALLBACK_ERROR, "Wmi_Destroy failed: 0x%08lx", hr);
+		BeaconPrintf(CALLBACK_ERROR, "Wmi_Finalize failed: 0x%08lx", hr);
	}

	return hr;
}

HRESULT Wmi_Finalize(
	WMI* pWmi
)
{
	HRESULT hr = S_OK;

	SAFE_RELEASE(pWmi->pWbemServices);
	SAFE_RELEASE(pWmi->pWbemLocator);

	SAFE_FREE(pWmi->bstrLanguage);
	SAFE_FREE(pWmi->bstrServer);
	SAFE_FREE(pWmi->bstrNameSpace);
	SAFE_FREE(pWmi->bstrNetworkResource);
	SAFE_FREE(pWmi->bstrQuery);

	// un-initialize the COM library
	OLE32$CoUninitialize();

! always returns S_OK
	return hr;

}

VOID go( 
	IN PCHAR Buffer, 
	IN ULONG Length 
) 
{
	const char * hostname = NULL;
	const char * servicename = NULL;
-	DWORD result = 0;
+	DWORD result = ERROR_SUCCESS;
...	
if ((gscManager = ADVAPI32$OpenSCManagerA(hostname, SERVICES_ACTIVE_DATABASEA, SC_MANAGER_CONNECT | GENERIC_READ)) == NULL)
	{
		result = KERNEL32$GetLastError();
	}
-	if(result == S_OK)
+	if(result == ERROR_SUCCESS)
	{
		result = enumerate_services();
-		if(result != S_OK)
+		if(result != ERROR_SUCCESS)
		{
			BeaconPrintf(CALLBACK_ERROR, "Failed to query service: %u", result);
		}

DWORD enumerate_services()
{
	DWORD dwResult = ERROR_SUCCESS;
...
	return dwResult;
! returns ERROR_SUCCESS or GetLastError, not S_OK
}

int enumerate_loaded_drivers()
{
	// Create a handle to the service manager for calls to EnumServicesStatusExW.
	SC_HANDLE scm_handle = ADVAPI32$OpenSCManagerA(NULL, NULL, SC_MANAGER_ENUMERATE_SERVICE);
	if (!scm_handle)
	{
		internal_printf("[ERROR] Cannot open handle to service manager.\n");
		return 1;
	}
	
	// Determine the bytes needed for allocation.
	unsigned long bytes_needed = 0;
	unsigned long services_returned = 0;
	ADVAPI32$EnumServicesStatusExW(scm_handle, SC_ENUM_PROCESS_INFO, SERVICE_DRIVER, SERVICE_ACTIVE, NULL, 0, &bytes_needed, &services_returned, NULL, NULL);

	// Retrieve a buffer of active driver services.
	PBYTE services = (PBYTE)intAlloc(bytes_needed);
	if (!ADVAPI32$EnumServicesStatusExW(scm_handle, SC_ENUM_PROCESS_INFO, SERVICE_DRIVER , SERVICE_ACTIVE, services, bytes_needed, &bytes_needed, &services_returned, NULL, NULL))
	{
		internal_printf("[ERROR] Cannot enumerate services -> %ld.\n", KERNEL32$GetLastError());
! leaks memory allocated for `services`
		return 1;
	}
	LPENUM_SERVICE_STATUS_PROCESSW service = (LPENUM_SERVICE_STATUS_PROCESSW)services;
	// Get the ImagePath for each service from registry, and pass that to the validate_driver() function.
	for (unsigned long i = 0; i < services_returned; i++)
	{
		PWCHAR registry_path = (PWCHAR)intAlloc(MAX_PATH * 2);
		if (registry_path)
		{
			MSVCRT$wcsncat(registry_path,  L"SYSTEM\\CurrentControlSet\\Services\\", MAX_PATH);
			MSVCRT$wcsncat(registry_path, service->lpServiceName, MAX_PATH);
		}
		{
			BeaconPrintf(CALLBACK_ERROR, "Out of memory");
! leaks memory allocated for `services`
			return 1;
		}
		
		HKEY key_handle;
		ADVAPI32$RegOpenKeyExW(HKEY_LOCAL_MACHINE, registry_path, 0, KEY_QUERY_VALUE, &key_handle);
		
		unsigned long length = 0;
		ADVAPI32$RegQueryValueExW(key_handle, L"ImagePath", NULL, NULL, NULL, &length);
		intFree(registry_path);
		if (length)
		{
			PWCHAR driver_path = (PWCHAR)intAlloc(length);
! should check for failed allocation for `driver_path`
			ADVAPI32$RegQueryValueExW(key_handle, L"ImagePath", NULL, NULL, (LPBYTE)driver_path, &length);
			validate_driver(driver_path);
			intFree(driver_path);
		}
		
		KERNEL32$CloseHandle(key_handle);
		service++;
	}

	intFree(services);
	KERNEL32$CloseHandle(scm_handle);
	return 0;
}

int enumerate_loaded_drivers()
{
	// Create a handle to the service manager for calls to EnumServicesStatusExW.
	SC_HANDLE scm_handle = ADVAPI32$OpenSCManagerA(NULL, NULL, SC_MANAGER_ENUMERATE_SERVICE);
@@ scm_handle is not a kernel handle @@ 

...
-	KERNEL32$CloseHandle(scm_handle);
+	ADVAPI32$CloseServiceHandle(scm_handle );

	return 0;

int enumerate_loaded_drivers()
{

...
		HKEY key_handle;
		ADVAPI32$RegOpenKeyExW(HKEY_LOCAL_MACHINE, registry_path, 0, KEY_QUERY_VALUE, &key_handle);
		
		unsigned long length = 0;
		ADVAPI32$RegQueryValueExW(key_handle, L"ImagePath", NULL, NULL, NULL, &length);
		intFree(registry_path);
		if (length)
		{
			PWCHAR driver_path = (PWCHAR)intAlloc(length);
			ADVAPI32$RegQueryValueExW(key_handle, L"ImagePath", NULL, NULL, (LPBYTE)driver_path, &length);
			validate_driver(driver_path);
			intFree(driver_path);
		}
		
-		KERNEL32$CloseHandle(key_handle);
+		ADVAPI32$RegCloseKey(key_handle);
		service++;
	}

	EServiceStatus = antiStringResolve(8, "SPACER", "STOPPED", "START_PENDING", "STOP_PENDING", "RUNNING", "CONTINUE_PENDING", "PAUSE_PENDING");
! 8 items declared but only 7 in va_args
...
	EServiceStartup = antiStringResolve(6, "BOOT_DRIVER", "SYSTEM_START_DRIVER", "AUTO_START", "DEMAND_START", "DISABLED");
! 6 items declared but only 5 in va_args

	EServiceStatus = antiStringResolve(8, "SPACER", "STOPPED", "START_PENDING", "STOP_PENDING", "RUNNING", "CONTINUE_PENDING", "PAUSE_PENDING");
! 8 items declared but only 7 in va_args
	EServiceStartup = antiStringResolve(6, "BOOT_DRIVER", "SYSTEM_START_DRIVER", "AUTO_START", "DEMAND_START", "DISABLED");
! 6 items declared but only 5 in va_args

	EServiceStatus = antiStringResolve(8, "SPACER", "STOPPED", "START_PENDING", "STOP_PENDING", "RUNNING", "CONTINUE_PENDING", "PAUSE_PENDING");
! 8 items declared but only 7 in va_args

pregkeyval init_regkey(const char * curpath, DWORD dwcurpathsz, const char * childkey, DWORD dwchildkeysz, HKEY hreg)
{
    pregkeyval item = (pregkeyval)intAlloc(sizeof(regkeyval));
@@ allocates memory for item @@
    item->dwkeypathsz = dwcurpathsz + ((dwchildkeysz) ? dwchildkeysz + 1 : 0); //str\str does not include null or just str, if we don't have a child key
    item->keypath = intAlloc(item->dwkeypathsz + 1);
    memcpy(item->keypath, curpath, dwcurpathsz);
    if(dwchildkeysz > 0)
    {
        item->keypath[dwcurpathsz] = '\\';
        memcpy(item->keypath + dwcurpathsz + 1, childkey, dwchildkeysz);
    }
    item->hreg = hreg;
    //item->keypath[item->dwkeypathsz] = 0;
    return item;
}


void free_regkey(pregkeyval val)
{
    if(val->keypath)
    {
        intFree(val->keypath);
    }
    if(val->hreg)
    {
        ADVAPI32$RegCloseKey(val->hreg);
    }
}

DWORD Reg_EnumKey(const char * hostname, HKEY hivekey, DWORD Arch, const char* keystring, BOOL recursive){
...
    keyStack->push(keyStack, init_regkey(keystring, strlen(keystring), NULL, 0, rootkey));
    while((curitem = keyStack->pop(keyStack)) != NULL)
...
        nextloop:
        if(currentkeyname)
        {intFree(currentkeyname); currentkeyname = NULL;}
        if(currentvaluename)
        {intFree(currentvaluename); currentvaluename = NULL;}
        if(currentdata)
        {intFree(currentdata); currentdata = NULL;}
        retCode = ERROR_SUCCESS;
        i = 0;
        cSubKeys = 0;
        cbMaxSubKey = 0;
        cValues = 0;
        cchMaxValue = 0;
        cchMaxData = 0;
        free_regkey(curitem);
! curitem itself not freed?
        curitem = NULL;
    } // end While

    char szGroupName[255] = {0};
    char szDomainName[255] = {0};

    DWORD cchGroupName  = _countof(szGroupName);
-    DWORD cchDomainName = _countof(szGroupName);
+    DWORD cchDomainName = _countof(szDomainName);

HRESULT _adcs_get_CertificateTemplateExtendedKeyUsages(VARIANT* lpvarExtendedKeyUsages)
{
...
	BSTR bstFriendlyName = NULL;
...
	while(SUCCEEDED(hr) && lFetch > 0)
	{
		if (lFetch == 1)
		{
			pDisp = V_DISPATCH(&var);
			pDisp->lpVtbl->QueryInterface(pDisp, &IID_IObjectId, (void**)&pObjectId); 
			SAFE_RELEASE(pDisp);

			hr = pObjectId->lpVtbl->get_FriendlyName(
				pObjectId, 
				&bstFriendlyName
			);
			if (FAILED(hr))	{ internal_printf("      N/A\n"); }
			else { 
			    internal_printf("      %S\n", bstFriendlyName); 
+			    SAFE_FREE(bstFriendlyName);
			}

			SAFE_RELEASE(pObjectId);
		}
		OLEAUT32$VariantClear(&var);

		hr = pEnum->lpVtbl->Next(pEnum, 1, &var, &lFetch);
	} // end loop through IObjectIds via enumerator
	SAFE_RELEASE(pObjectId);

	hr = S_OK;

	//internal_printf("\n _adcs_get_CertificateTemplateExtendedKeyUsages SUCCESS.\n");

fail:

	OLEAUT32$VariantClear(&var);

	return hr;
} // end _adcs_get_CertificateTemplateExtendedKeyUsages