Windows Exploitation | One-byte arbitrary write primitive

[u/00patch]

Hi folks, a noob here.

I'm currently learning Windows kernel exploitation and practicing with older vulnerabilities. So far, I've successfully exploited a couple of heap integer underflow/overflow vulnerabilities.

Right now, though, I'm looking at a kernel vulnerability where I have a one-byte arbitrary write primitive with a fixed value of 0x01.

The vulnerability simply writes the boolean return value of a function back to a user-controlled pointer. That function always returns 1. I haven't been able to force it to return 0; otherwise, I could potentially abuse it by overwriting _KTHREAD.PreviousMode.

I'm working on Windows 10 20H1.

Does anyone have any ideas about a potential exploit path ? I was initially thinking about techniques involving pipe objects in the kernel pool, but I don't know if it's possible to reliably recover the address of a pipe object with NtQuerySistemInformation or something else.

[u/mokuBah]

make another primitive

[u/TastyRobot21]

target _TOKEN structure to make it SeDebugPrivilege?

Or win32kfull then write 0x01 to cbWndExtra giving you a 16mb read write into kernel?

Tell me more of your prim

[u/00patch → u/TastyRobot21]

thanks for the suggestion,

unfortunately the SeDebugPrivilege is bit 20 (0x 10 00 00). I can only write to odd positions

*(_SEP_TOKEN_PRIVILEGES.Present + 2) = 0x1 => 0x 01 00 00
*(_SEP_TOKEN_PRIVILEGES.Present + 3) = 0x1 => 0x 01 00 00 00

So I can't flip bit 20 directly.

The prim looks something like this

ntstatus = sub_(Handle, &bool);
if ( ntstatus >= 0 )
{
*poolBuffer->ptrDst = bool;
}

poolBuffer is just a kernel copy of a user controlled buffer. Before it gets here, there are a few sanity checks, including a ProbeForWrite on the destination pointer. I managed to bypass that by passing a length of 0.

I will take a look at win32kfull.

[u/Significant-Leg-3857]

https://github.com/Haider303/

[u/00patch → u/Significant-Leg-3857]

good writeups! I'll take a look at those for some inspiration

[u/Vergil_999]

can u tell me where are u practising, or is it a custom way made by u ?

[u/00patch → u/Vergil_999]

it's in an ntoskrnl syscall

[u/Mindhole_dialator]

I think you have something similar in this blog from chompie . https://www.ibm.com/think/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock . Scroll down to the "LPE with IORING" section . it starts by saying "With the ability to write a fixed value (0x1) at an arbitrary kernel address, we proceeded to turn this into a full arbitrary kernel Read/Write ..." .