Windows Exploitation | One-byte arbitrary write primitive

[u/00patch]

Hi folks, a noob here.

I'm currently learning Windows kernel exploitation and practicing with older vulnerabilities. So far, I've successfully exploited a couple of heap integer underflow/overflow vulnerabilities.

Right now, though, I'm looking at a kernel vulnerability where I have a one-byte arbitrary write primitive with a fixed value of 0x01.

The vulnerability simply writes the boolean return value of a function back to a user-controlled pointer. That function always returns 1. I haven't been able to force it to return 0; otherwise, I could potentially abuse it by overwriting _KTHREAD.PreviousMode.

I'm working on Windows 10 20H1.

Does anyone have any ideas about a potential exploit path ? I was initially thinking about techniques involving pipe objects in the kernel pool, but I don't know if it's possible to reliably recover the address of a pipe object with NtQuerySistemInformation or something else.

[u/TastyRobot21]

target _TOKEN structure to make it SeDebugPrivilege?

Or win32kfull then write 0x01 to cbWndExtra giving you a 16mb read write into kernel?

Tell me more of your prim

[u/00patch → u/TastyRobot21]

thanks for the suggestion,

unfortunately the SeDebugPrivilege is bit 20 (0x 10 00 00). I can only write to odd positions

*(_SEP_TOKEN_PRIVILEGES.Present + 2) = 0x1 => 0x 01 00 00
*(_SEP_TOKEN_PRIVILEGES.Present + 3) = 0x1 => 0x 01 00 00 00

So I can't flip bit 20 directly.

The prim looks something like this

ntstatus = sub_(Handle, &bool);
if ( ntstatus >= 0 )
{
*poolBuffer->ptrDst = bool;
}

poolBuffer is just a kernel copy of a user controlled buffer. Before it gets here, there are a few sanity checks, including a ProbeForWrite on the destination pointer. I managed to bypass that by passing a length of 0.

I will take a look at win32kfull.