Kernel Pool Overflow Exploitation In Real World – Windows 7

[Nytro]

Kernel Pool Overflow Exploitation In Real World – Windows 7

1) Introduction

This article will focus on a vulnerability (CVE-2017-6008) we identified in the HitmanPro standalone scan version 3.7.15 – Build 281. This tool is a part of the HitmanPro.Alert solution and has been integrated in the Sophos solutions as SophosClean.exe.

The vulnerability has been reported to Sophos in February 2017.

The version 3.7.20 – Build 286 patched the vulnerability in May 2017.

We discovered the first crash while playing with Ioctlfuzzer [1].

Ioctlfuzzer is a great and simple tool made to fuzz the I/O Request Packets (IRP). The fuzzer hooks the DeviceIoControlFile API function and place itself as a man in the middle.

For each IRP the fuzzer receives, it lands severals malformed IRP before sending the original one.

The first crash occured at the very beginning of the scan, in the Initialization phase, with a BAD_POOL_HEADER code.

Before going deeper, I strongly recommand readers learn a bit more on IOCTL and IRP on Windows. The MSDN documentation provides a lot of informations you must know to fully understand this article.

This blogpost will be focused on x64 architectures, since it’s harder to exploit than x32 architectures.

 

Article: http://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/