hacking-team-windows-kernel-lpe - GitLite

KO | EN

gitlite — search

#javascript #react #go #android #rust #nodejs #macos #java #awesome #kubernetes #vue #awesome-list #security #ios

hacking-team-windows-kernel-lpe

(★ 203)

Previously-0day exploit from the Hacking Team leak, written by Eugene Ching/Qavar.

File Explorer

Download Latest Version (.zip)

- - 64BitHelper.h
  - AdjustStack.asm
  - FontData.h
  - function_link_order.txt
  - function_link_order64.txt
  - FunctionSignatures.h
  - Get-FunctionHash.ps1
  - Get-PEHeader.ps1
  - GetProcAddressWithHash.h
  - NtGdiGetTextMetricsW.asm
  - NtGdiRemoveFontMemResourceEx.asm
  - Out-Shellcode.ps1
  - PIC.c
  - PIC.vcxproj
  - ZwGdiAddFontMemResourceEx.asm
- LICENSE.txt
- PIC.sdf
- PIC.sln
- PIC.suo
- PIC.v12.suo
font-data.bin
make-injector-cpp.py
make-raw-bytes.py
make.bat
README.md

# Installation Guide

1. Get the code

git clone https://github.com/vlad902/hacking-team-windows-kernel-lpe

Downloads the entire project code from GitHub to your computer.

cd hacking-team-windows-kernel-lpe

Moves into the project folder you just downloaded.

2. .NET

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
.NET SDK The SDK required for the dotnet command.

cd exploit

This project's files live in a subfolder, so move into it first.

dotnet restore

Downloads the packages the project depends on.

dotnet run

Builds the project and runs it immediately.

✅ After dotnet run, check the message or address shown in the terminal.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

This an exploit for CVE-2015-2426 (MS-078), a Windows kernel local privilege escalation 0day from the Hacking Team archive (email [here](https://wikileaks.org/hackingteam/emails/emailid/974752)). It was developed by Eugene Ching / Qavar security. Original contents below:

Summary.
========

Windows kernel memory corruption exploit leading to privilege escalation.

Tested on Windows 8.1 fully-patched (as of 28 Jan 2015).

Also tested to work against:

* Google Chrome, up to v40.0.2214.93 (64-bit); and  
  * Google Chrome Canary, up to v42.0.2290.6 canary (64-bit)

assuming a suitable RCE in Chrome (simulated via injecting a thread into 
Chrome)

Main exploit code.
==================

The main exploit is implemented in `PIC.c`, which is provided as part of a
Visual Studio 2013 Express solution.

Building the solution would produce `PIC.exe`.

Exploit "raw bytes".
====================

We ultimately want to inject the exploit into the target's memory, and directly
run it. In order to do that, we need to inject only the relevant instructions
(opcodes) and the necessary data.

Hence, we extract the code segment (the opcodes) from `PIC.exe`, and append the
necessary data (the malformed font, `font-data.bin`) into a sequence of  bytes.

This produces the "raw bytes" that we can directly inject into the target and
call `CreateRemoteThread()` on.

This process is automated through the Python script named `make-raw-bytes.py`.
The output is `raw-bytes.bin`.

Injection into target.
======================

To convert the "raw bytes" into an .exe that actually injects the "raw bytes"
into a target, we need to call `WriteProcessMemory()` & `CreateRemoteThread()`.

This process is handled by `make-injector-cpp.py`. The output is
`injector.cpp`, a piece of code which, when compiled, takes a target PID and
executes the exploit.

Convenience wrapper.
====================

As a convenience, `make.bat` will produce `injector.exe` directly by performing
the steps described above.

In other words, `make.bat` will:
  - make-raw-bytes.py
  - make-injector-cpp.py
  - build injector.exe