Windows XP 核心驱动 AFD.sys 本地权限提升漏洞分析.doc

此文档收集于网络，如有侵权，请联系网站删除Windows XP 核心驱动 AFD.sys 本地权限提升漏洞分析(ms08066)创建时间：2008-10-15文章属性：原创文章提交：whitecell (sinister_at_)Author:PolymorphoursEmail: PHomepage: Date:2008-10-15漏洞模块: AFD.sys漏洞类型: 任意内核地址可写这个漏洞又是一个可以写任意内核地址的漏洞，产生这个漏洞的原因是 ProbeForWrite 函数因为检查长度为 0 的Buffer被绕过。下面看下具体漏洞的情况，这个漏洞出现在函数 AfdGetRemoteAddress 中，当传入的第7个参数为 0 的时候，ProbeForWrite的检查形同虚设了。注意第六个参数 PVOID Address, 它是由 Irp-UserBuffer 传入的，而 SIZE_T Length 为 OutputBufferLength，那么如果在 DeviceIoControl 中的 OutputBuffer 设置成内核需要写的地址，OutputBufferLength 设置为 0，并设置正确的 IoDeviceCode 即可触发这个漏洞.PAGE:00017D17 ; int _stdcall AfdGetRemoteAddress(int,int,char,int,int,PVOID Address,SIZE_T Length,int)PAGE:00017D17 _stdcall AfdGetRemoteAddress(x, x, x, x, x, x, x, x) proc nearPAGE:00017D17 ; DATA XREF: .data:0001230CoPAGE:00017D17PAGE:00017D17 var_24= dword ptr -24hPAGE:00017D17 var_20= dword ptr -20hPAGE:00017D17 var_1C= dword ptr -1ChPAGE:00017D17 ms_exc= CPPEH_RECORD ptr -18hPAGE:00017D17 arg_0 = dword ptr8PAGE:00017D17 arg_8 = byte ptr10hPAGE:00017D17 Address = dword ptr1ChPAGE:00017D17 Length= dword ptr20hPAGE:00017D17 arg_1C= dword ptr24hPAGE:00017D17PAGE:00017D17 push14hPAGE:00017D19 pushoffset unk_11B00PAGE:00017D1E call_SEH_prologPAGE:00017D1EPAGE:00017D23 mov eax, ebp+arg_0PAGE:00017D26 mov ebx, eax+0ChPAGE:00017D29 mov ebp+var_24, ebxPAGE:00017D2C xor esi, esiPAGE:00017D2E mov eax, ebp+arg_1CPAGE:00017D31 mov eax, esiPAGE:00017D33 pushebxPAGE:00017D34 callAfdLockEndpointContext(x)PAGE:00017D34PAGE:00017D39 mov ebp+var_20, eaxPAGE:00017D3C cmp eax, esiPAGE:00017D3E jzloc_17DE0PAGE:00017D3EPAGE:00017D44 cmp word ptr ebx, 0AFD2hPAGE:00017D49 jnz loc_17DE0PAGE:00017D49PAGE:00017D4F cmp byte ptr ebx+2, 3PAGE:00017D53 jnz loc_17DE0PAGE:00017D53PAGE:00017D59 movzx eax, word ptr ebx+5AhPAGE:00017D5D movzx ecx, word ptr ebx+58hPAGE:00017D61 add ecx, eaxPAGE:00017D63 cmp ecx, ebx+74hPAGE:00017D66 jashort loc_17DE0PAGE:00017D66PAGE:00017D68 cmp ebp+Length, eax-这里检查Buffer大小，如果Buffer大于规定的大小就有默认的大小来代替PAGE:00017D6B jnb short loc_17D76PAGE:00017D6BPAGE:00017D6D mov ebp+var_1C, 80000005hPAGE:00017D74 jmp short loc_17D7C-最终导致问题点: 如果BufferLength小于的话，居然还能继续运行它向下运行PAGE:00017D74PAGE:00017D76 ; -PAGE:00017D76PAGE:00017D76 loc_17D76:; CODE XREF: AfdGetRemoteAddress(x,x,x,x,x,x,x,x)+54jPAGE:00017D76 mov ebp+Length, eax-用规定的长度代替PAGE:00017D79 mov ebp+var_1C, esiPAGE:00017D79PAGE:00017D7CPAGE:00017D7C loc_17D7C:; CODE XREF: AfdGetRemoteAddress(x,x,x,x,x,x,x,x)+5DjPAGE:00017D7C mov ebp+ms_exc.disabled, esiPAGE:00017D7F cmp ebp+arg_8, 0PAGE:00017D83 jzshort loc_17D93PAGE:00017D83PAGE:00017D85 push1 ; AlignmentPAGE:00017D87 pushebp+Length; LengthPAGE:00017D8A pushebp+Address ; AddressPAGE:00017D8D callds:ProbeForWrite(x,x,x)-如果 ebp+Length为0，那么检查被绕过PAGE:00017D8DPAGE:00017D93PAGE:00017D93 loc_17D93:; CODE XREF: AfdGetRemoteAddress(x,x,x,x,x,x,x,x)+6CjPAGE:00017D93 movzx ecx, word ptr ebx+5AhPAGE:00017D97 movzx esi, word ptr ebx+58hPAGE:00017D9B add esi, ebp+var_20PAGE:00017D9E mov edi, ebp+Address- memcpy的代码，拷贝数据到UserBuffer中PAGE:00017DA1 mov eax, ecxPAGE:00017DA3 shr ecx, 2PAGE:00017DA6 rep movsdPAGE:00017DA8 mov ecx, eaxPAGE:00017DAA and ecx, 3PAGE:00017DAD rep movsbPAGE:00017DAF mov eax, ebx+74hPAGE:00017DB2 mov ecx, ebp+arg_1CPAGE:00017DB5 mov ecx, eaxPAGE:00017DB7 orebp+ms_exc.disabled, 0FFFFFFFFhPAGE:00017DBB jmp short loc_17DE7PAGE:00017DBBPAGE:00017DBB ; -PAGE:00017DBD align 10hPAGE:00017DC0 db 2 dup(90h)PAGE:00017DC2 ; -PAGE:00017DC2PAGE:00017DC2 loc_17DC2:; DATA XREF: .rdata:00011B04oPAGE:00017DC2 lea eax, ebp-1ChPAGE:00017DC5 pusheaxPAGE:00017DC6 pushdword ptr ebp-14hPAGE:00017DC9 callAfdExceptionFilter(x,x)PAGE:00017DC9PAGE:00017DCE retn在看看补丁的情况PAGE:00017D17 ; int _stdcall AfdGetRemoteAddress(int,int,char,int,int,PVOID Address,int,int)PAGE:00017D17 _stdcall AfdGetRemoteAddress(x, x, x, x, x, x, x, x) proc nearPAGE:00017D17 ; DATA XREF: .data:0001230CoPAGE:00017D17PAGE:00017D17 var_24= dword ptr -24hPAGE:00017D17 var_20= dword ptr -20hPAGE:00017D17 var_1C= dword ptr -1ChPAGE:00017D17 ms_exc= CPPEH_RECORD ptr -18hPAGE:00017D17 arg_0 = dword ptr8PAGE:00017D17 arg_8 = byte ptr10hPAGE:00017D17 Address = dword ptr1ChPAGE:00017D17 arg_18= dword ptr20hPAGE:00017D17 arg_1C= dword ptr24hPAGE:00017D17PAGE:00017D17 push14hPAGE:00017D19 pushoffset unk_11B00PAGE:00017D1E call_SEH_prologPAGE:00017D1EPAGE:00017D23 mov eax, ebp+arg_0PAGE:00017D26 mov ebx, eax+0ChPAGE:00017D29 mov ebp+var_24, ebxPAGE:00017D2C xor esi, esiPAGE:00017D2E mov eax, ebp+arg_1CPAGE:00017D31 mov eax, esiPAGE:00017D33 pushebxPAGE:00017D34 callAfdLockEndpointContext(x)PAGE:00017D34PAGE:00017D39 mov ebp+var_20, eaxPAGE:00017D3C cmp eax, esiPAGE:00017D3E jzloc_17DDBPAGE:00017D3EPAGE:00017D44 cmp word ptr ebx, 0AFD2hPAGE:00017D49 jnz loc_17DDBPAGE:00017D49PAGE:00017D4F cmp byte ptr ebx+2, 3PAGE:00017D53 jnz loc_17DDBPAGE:00017D53PAGE:00017D59 movzx eax, word ptr ebx+5AhPAGE:00017D5D movzx ecx, word ptr ebx+58hPAGE:00017D61 add ecx, eaxPAGE:00017D63 cmp ecx, ebx+74hPAGE:00017D66 jashort loc_17DDBPAGE:00017D66PAGE:00017D68 cmp ebp+arg_18, eaxPAGE:00017D6B jnb short loc_17D76PAGE:00017D6BPAGE:00017D6D mov ebp+var_1C, 80000005hPAGE:00017D74 jmp short loc_17DE2-补丁就是在这里，如果访问的BufferLength小于规定的大小，那么直接返回错误PAGE:00017D74PAGE:00017D76 ; -PAGE:00017D76PAGE:00017D76 loc_17D76:; CODE XREF: AfdGetRemoteAddress(x,x,x,x,x,x,x,x)+54jPAGE:00017D76 mov ebp+var_1C, esiPAGE:00017D79 mov ebp+ms_exc.disabled, esiPAGE:00017D7C cmp ebp+arg_8, 0PAGE:00017D80 jzshort loc_17D8EPAGE:00017D80PAGE:00017D82 push1 ; AlignmentPAGE:00017D84 pusheax ; LengthPAGE:00017D85 pushebp+Address ; AddressPAGE:00017D88 callds:ProbeForWrite(x,x,x)PAGE:00017D88PAGE:00017D8EPAGE:00017D8E loc_17D8E:; CODE XREF: AfdGetRemoteAddress(x,x,x,x,x,x,x,x)+69jPAGE:00017D8E movzx ecx, word ptr ebx+5AhPAGE:00017D92 movzx esi, word ptr ebx+58hPAGE:00017D96 add esi, ebp+var_20PAGE:00017D99 mov edi, ebp+AddressPAGE:00017D9C mov eax, ecxPAGE:00017D9E shr ecx, 2PAGE:00017DA1 rep movsdPAGE:00017DA3 mov ecx, eaxPAGE:00017DA5 and ecx, 3PAGE:00017DA8 rep movsbPAGE:00017DAA mov eax, ebx+74hPAGE:00017DAD mov ecx, ebp+arg_1CPAGE:00017DB0 mov ecx, eaxPAGE:00017DB2 orebp+ms_exc.disabled, 0FFFFFFFFhPAGE:00017DB6 jmp short loc_17DE2PAGE:00017DB6PAGE:00017DB6 ; -PAGE:00017DB8 dd 90909090hPAGE:00017DBC db 90hPAGE:00017DBD ; -PAGE:00017DBDPAGE:00017DBD loc_17DBD:; DATA XREF: .rdata:00011B04oPAGE:00017DBD lea eax, ebp-1ChPAGE:00017DC0 pusheaxPAGE:00017DC1 pushdword ptr ebp-14hPAGE:00017DC4 callAfdExceptionFilter(x,x)PAGE:00017DC4PAGE:00017DC9 retnPAGE:00017DC9PAGE:00017DC9 ; -PAGE:00017DCA align 4PAGE:00017DCC db 3 dup(90h)PAGE:00017DCF ; -PAGE:00017DCFPAGE:00017DCF loc_17DCF:; DATA XREF: .rdata:00011B08oPAGE:00017DCF mov esp, ebp-18hPAGE:00017DD2 ordword ptr ebp-4, 0FFFFFFFFhPAGE:00017DD6 mov ebx, ebp-24hPAGE:00017DD9 jmp short loc_17DE2PAGE:00017DD9PAGE:00017DDB ; -PAGE:00017DDBPAGE:0001