Windows UAF漏洞在x64系统下的测试

之前在看雪看了一篇关于UAF的漏洞详解，里面博主写了关于Win7 x86下的UAF提权。但是后来提出很多关于在Win x64下的UAF问题。

问题是关于Token 里 nt!_EX_FAST_REF 结构中在X86的结构下偏移是F8。

kd> ed 87040ca0+f8 8a201275
kd> dt nt!_EX_FAST_REF 87040ca0+f8
+0x000 Object : 0x8a201275 Void
+0x000 RefCnt : 0y101
+0x000 Value : 0x8a201275

但在x64中并没有写到偏移是多少，自己花了点时间解答一下。

首先用windbg本地内核调试。

lkd> !dml_proc
Address           PID  Image file name
fffffa80`0184fb30 4    System         
fffffa80`023af5d0 10c  smss.exe       
fffffa80`02bd08f0 168  csrss.exe      
fffffa80`02d40b30 190  wininit.exe    
fffffa80`02d87830 19c  csrss.exe      
fffffa80`02da8310 1c0  winlogon.exe   
fffffa80`02ded620 208  services.exe   
fffffa80`02e07b30 214  lsass.exe      
fffffa80`02e09b30 21c  lsm.exe        
fffffa80`02e4db30 288  svchost.exe    
fffffa80`0332e7d0 2c8  vmacthlp.exe   
fffffa80`033454a0 2e8  svchost.exe    
fffffa80`03373b30 320  svchost.exe    
fffffa80`033fa5f0 3b8  svchost.exe    
fffffa80`03401060 3d4  svchost.exe    
fffffa80`034645d0 2e4  svchost.exe    
fffffa80`034c0060 488  ZhuDongFangYu. 
fffffa80`034d1b30 4bc  svchost.exe    
fffffa80`035245f0 534  spoolsv.exe    
fffffa80`03556270 558  svchost.exe    
fffffa80`035eab30 5f4  pg_ctl.exe     
fffffa80`0362a200 638  nssm.exe       
fffffa80`0363d240 650  postgres.exe   
fffffa80`0360db30 658  conhost.exe    
fffffa80`036400c0 684  svchost.exe    
fffffa80`03675060 6b4  expressvpnd.ex 
fffffa80`03678b30 6bc  FNPLicensingSe 
fffffa80`036827d0 6c4  conhost.exe    
fffffa80`036cc620 754  sqlservr.exe   
fffffa80`03729b30 7b8  Service_KMS.ex 
fffffa80`03780b30 470  sqlwriter.exe  
fffffa80`03792b30 570  VGAuthService. 
fffffa80`0369f260 130  postgres.exe   
fffffa80`037beb30 628  postgres.exe   
fffffa80`037e2b30 618  postgres.exe   
fffffa80`037be570 648  postgres.exe   
fffffa80`037e6b30 630  postgres.exe   
fffffa80`0368cb30 65c  vmtoolsd.exe   
fffffa80`038e5b30 954  WmiPrvSE.exe   
fffffa80`039dbb30 af8  svchost.exe    
fffffa80`03a505a0 b4c  svchost.exe    
fffffa80`03a98b30 be8  dllhost.exe    
fffffa80`038ae0e0 88c  msdtc.exe      
fffffa80`03310060 740  taskhost.exe   
fffffa80`03c88b30 260  dwm.exe        
fffffa80`03cbab30 360  explorer.exe   
fffffa80`02e71b30 c14  vmtoolsd.exe   
fffffa80`032f7b30 c74  jusched.exe    
fffffa80`03982060 cdc  GoogleCrashHan 
fffffa80`03ab1060 cec  GoogleCrashHan 
fffffa80`03545750 d9c  SearchIndexer. 
fffffa80`03766620 e20  wmpnetwk.exe   
fffffa80`0390d160 f58  svchost.exe    
fffffa80`030f9060 3c8  ExpressVPNNoti 
fffffa80`03a5bb30 dd0  mscorsvw.exe   
fffffa80`03a5eb30 c88  svchost.exe    
fffffa80`03ba4b30 c6c  >14沐w.exe  
fffffa80`03c8db30 4b0  windbg.exe     
fffffa80`03d16060 fc4  cmd.exe        
fffffa80`03d11060 fcc  conhost.exe    
fffffa80`03998060 f10  360rp.exe      
fffffa80`03c08060 b90  360sd.exe      
fffffa80`03d99b30 96c  jucheck.exe    
fffffa80`0346b060 6fc  taskeng.exe    
fffffa80`03d77b30 a7c  sppsvc.exe     
fffffa80`03de1590 5e8  audiodg.exe 

 锁定到进程cmd（注意，这个cmd是标准用户，非管理员）

fffffa80`03d16060

找到PID为4的SYSTEM（SYSTEM在所有系统PID都为4）

fffffa80`0184fb30

查看一下EPROCESS

nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x160 ProcessLock      : _EX_PUSH_LOCK
   +0x168 CreateTime       : _LARGE_INTEGER 0x01d59164`33008f2d
   +0x170 ExitTime         : _LARGE_INTEGER 0x0
   +0x178 RundownProtect   : _EX_RUNDOWN_REF
   +0x180 UniqueProcessId  : 0x00000000`00000fc4 Void
   +0x188 ActiveProcessLinks : _LIST_ENTRY [ 0xfffffa80`03d111e8 - 0xfffffa80`03c8dcb8 ]
   +0x198 ProcessQuotaUsage : [2] 0x10e0
   +0x1a8 ProcessQuotaPeak : [2] 0x1160
   +0x1b8 CommitCharge     : 0x1cd
   +0x1c0 QuotaBlock       : 0xfffffa80`033451c0 _EPROCESS_QUOTA_BLOCK
   +0x1c8 CpuQuotaBlock    : (null) 
   +0x1d0 PeakVirtualSize  : 0x25b4000
   +0x1d8 VirtualSize      : 0x25b4000
   +0x1e0 SessionProcessLinks : _LIST_ENTRY [ 0xfffffa80`03d11240 - 0xfffffa80`03c8dd10 ]
   +0x1f0 DebugPort        : (null) 
   +0x1f8 ExceptionPortData : 0xfffffa80`02d94090 Void
   +0x1f8 ExceptionPortValue : 0xfffffa80`02d94090
   +0x1f8 ExceptionPortState : 0y000
   +0x200 ObjectTable      : 0xfffff8a0`03fecf90 _HANDLE_TABLE
   +0x208 Token            : _EX_FAST_REF
   +0x210 WorkingSetPage   : 0x5a636
   +0x218 AddressCreationLock : _EX_PUSH_LOCK
   +0x220 RotateInProgress : (null) 
   +0x228 ForkInProgress   : (null) 
   +0x230 HardwareTrigger  : 0
   +0x238 PhysicalVadRoot  : (null) 
   +0x240 CloneRoot        : (null) 
   +0x248 NumberOfPrivatePages : 0x96
   +0x250 NumberOfLockedPages : 0
   +0x258 Win32Process     : 0xfffff900`c2d99ce0 Void
   +0x260 Job              : (null) 
   +0x268 SectionObject    : 0xfffff8a0`0430a230 Void
   +0x270 SectionBaseAddress : 0x00000000`49d20000 Void
   +0x278 Cookie           : 0xef793cbe
   +0x27c UmsScheduledThreads : 0
   +0x280 WorkingSetWatch  : (null) 
   +0x288 Win32WindowStation : 0x00000000`00000034 Void
   +0x290 InheritedFromUniqueProcessId : 0x00000000`00000360 Void
   +0x298 LdtInformation   : (null) 
   +0x2a0 Spare            : (null) 
   +0x2a8 ConsoleHostProcess : 0xfcc
   +0x2b0 DeviceMap        : 0xfffff8a0`0261fc00 Void
   +0x2b8 EtwDataSource    : (null) 
   +0x2c0 FreeTebHint      : 0x000007ff`fffde000 Void
   +0x2c8 FreeUmsTebHint   : 0x00000001`00000000 Void
   +0x2d0 PageDirectoryPte : _HARDWARE_PTE
   +0x2d0 Filler           : 0
   +0x2d8 Session          : 0xfffff880`0445c000 Void
   +0x2e0 ImageFileName    : [15]  "cmd.exe"
   +0x2ef PriorityClass    : 0x2 ''
   +0x2f0 JobLinks         : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x300 LockedPagesList  : (null) 
   +0x308 ThreadListHead   : _LIST_ENTRY [ 0xfffffa80`023ceea8 - 0xfffffa80`023ceea8 ]
   +0x318 SecurityPort     : (null) 
   +0x320 Wow64Process     : (null) 
   +0x328 ActiveThreads    : 1
   +0x32c ImagePathHash    : 0x4a81b364
   +0x330 DefaultHardErrorProcessing : 1
   +0x334 LastThreadExitStatus : 0n0
   +0x338 Peb              : 0x000007ff`fffdd000 _PEB
   +0x340 PrefetchTrace    : _EX_FAST_REF
   +0x348 ReadOperationCount : _LARGE_INTEGER 0x0
   +0x350 WriteOperationCount : _LARGE_INTEGER 0x0
   +0x358 OtherOperationCount : _LARGE_INTEGER 0x0
   +0x360 ReadTransferCount : _LARGE_INTEGER 0x0
   +0x368 WriteTransferCount : _LARGE_INTEGER 0x0
   +0x370 OtherTransferCount : _LARGE_INTEGER 0x0
   +0x378 CommitChargeLimit : 0
   +0x380 CommitChargePeak : 0x28e
   +0x388 AweInfo          : (null) 
   +0x390 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x398 Vm               : _MMSUPPORT
   +0x420 MmProcessLinks   : _LIST_ENTRY [ 0xfffffa80`03d11480 - 0xfffffa80`03c8df50 ]
   +0x430 HighestUserAddress : 0x000007ff`ffff0000 Void
   +0x438 ModifiedPageCount : 0
   +0x43c Flags2           : 0xd000
   +0x43c JobNotReallyActive : 0y0
   +0x43c AccountingFolded : 0y0
   +0x43c NewProcessReported : 0y0
   +0x43c ExitProcessReported : 0y0
   +0x43c ReportCommitChanges : 0y0
   +0x43c LastReportMemory : 0y0
   +0x43c ReportPhysicalPageChanges : 0y0
   +0x43c HandleTableRundown : 0y0
   +0x43c NeedsHandleRundown : 0y0
   +0x43c RefTraceEnabled  : 0y0
   +0x43c NumaAware        : 0y0
   +0x43c ProtectedProcess : 0y0
   +0x43c DefaultPagePriority : 0y101
   +0x43c PrimaryTokenFrozen : 0y1
   +0x43c ProcessVerifierTarget : 0y0
   +0x43c StackRandomizationDisabled : 0y0
   +0x43c AffinityPermanent : 0y0
   +0x43c AffinityUpdateEnable : 0y0
   +0x43c PropagateNode    : 0y0
   +0x43c ExplicitAffinity : 0y0
   +0x43c Spare1           : 0y0
   +0x43c ForceRelocateImages : 0y0
   +0x43c DisallowStrippedImages : 0y0
   +0x43c LowVaAccessible  : 0y0
   +0x440 Flags            : 0x144d0841
   +0x440 CreateReported   : 0y1
   +0x440 NoDebugInherit   : 0y0
   +0x440 ProcessExiting   : 0y0
   +0x440 ProcessDelete    : 0y0
   +0x440 Wow64SplitPages  : 0y0
   +0x440 VmDeleted        : 0y0
   +0x440 OutswapEnabled   : 0y1
   +0x440 Outswapped       : 0y0
   +0x440 ForkFailed       : 0y0
   +0x440 Wow64VaSpace4Gb  : 0y0
   +0x440 AddressSpaceInitialized : 0y10
   +0x440 SetTimerResolution : 0y0
   +0x440 BreakOnTermination : 0y0
   +0x440 DeprioritizeViews : 0y0
   +0x440 WriteWatch       : 0y0
   +0x440 ProcessInSession : 0y1
   +0x440 OverrideAddressSpace : 0y0
   +0x440 HasAddressSpace  : 0y1
   +0x440 LaunchPrefetched : 0y1
   +0x440 InjectInpageErrors : 0y0
   +0x440 VmTopDown        : 0y0
   +0x440 ImageNotifyDone  : 0y1
   +0x440 PdeUpdateNeeded  : 0y0
   +0x440 VdmAllowed       : 0y0
   +0x440 CrossSessionCreate : 0y0
   +0x440 ProcessInserted  : 0y1
   +0x440 DefaultIoPriority : 0y010
   +0x440 ProcessSelfDelete : 0y0
   +0x440 SetTimerResolutionLink : 0y0
   +0x444 ExitStatus       : 0n259
   +0x448 VadRoot          : _MM_AVL_TABLE
   +0x488 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x4a8 TimerResolutionLink : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x4b8 RequestedTimerResolution : 0
   +0x4bc ActiveThreadsHighWatermark : 1
   +0x4c0 SmallestTimerResolution : 0
   +0x4c8 TimerResolutionStackRecord : (null) 

　　从Token中能看到偏移是0x208

　　在x86中是0XF8

　　跟到进程地址偏移位0x208 的_EX_FAST_REF结构

lkd> dt _EX_FAST_REF 0xfffffa8003d16060+0x208
nt!_EX_FAST_REF
   +0x000 Object           : 0xfffff8a0`00004aaf Void
   +0x000 RefCnt           : 0y1111
   +0x000 Value            : 0xfffff8a0`00004aaf

　　然后再用同样偏移的地址找system的_EX_FAST_REF

　　最后修改值指向到Object就OK了。

　　这里注意用到的是EP，并不是8位的ED。