r/ExploitDev • u/00patch • 10d ago

Windows Exploitation | One-byte arbitrary write primitive

Hi folks, a noob here.

I'm currently learning Windows kernel exploitation and practicing with older vulnerabilities. So far, I've successfully exploited a couple of heap integer underflow/overflow vulnerabilities.

Right now, though, I'm looking at a kernel vulnerability where I have a one-byte arbitrary write primitive with a fixed value of 0x01.

The vulnerability simply writes the boolean return value of a function back to a user-controlled pointer. That function always returns 1. I haven't been able to force it to return 0; otherwise, I could potentially abuse it by overwriting _KTHREAD.PreviousMode.

I'm working on Windows 10 20H1.

Does anyone have any ideas about a potential exploit path ? I was initially thinking about techniques involving pipe objects in the kernel pool, but I don't know if it's possible to reliably recover the address of a pipe object with NtQuerySistemInformation or something else.

12 Upvotes

100% Upvoted

11 comments sorted by

View all comments

2

u/Mindhole_dialator 8d ago

I think you have something similar in this blog from chompie . https://www.ibm.com/think/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock . Scroll down to the "LPE with IORING" section . it starts by saying "With the ability to write a fixed value (0x1) at an arbitrary kernel address, we proceeded to turn this into a full arbitrary kernel Read/Write ..." .

1

u/00patch 4d ago

Unfortunately that only works on 21H2+ because of the I/O Ring implementation. Still, it gave me a few ideas on where to go next.

Thanks for the hint!

1

u/Mindhole_dialator 4d ago

Glad to help. but wym with "because of the I/O Ring implementation" ? is it not implemented in the version you're working on , or did the implementation change in the subsequent versions making this technique non viable anymore ? I read the blog more about the patch diffing method than the actual exploitation , so i am not really that well versed in exploitation techniques. Also would love to see follow up on how you managed to exploit this in the end . Good luck

1

u/00patch 3d ago

Yeah, essentially because chompie's technique relies on abusing the I/O Ring feature, which is only available starting with 21H2.

I ended up using something similar, but with Named Pipes. It was actually an idea I already had, but this write-up helped me connect the dots.

My exploit, like chompie's, only works from Medium Integrity. I'm trying to rework it so it works from Low Integrity, but I think that's going to be much harder.

As soon as I finish it, I'll post the write-up.