Re: Running Ring3 command from Ring0 in Windows?

["H D Moore" <sflist () digitaloffense net>]

On Wed, 03 Jun 2009 11:39:32 -0500, Jun Koi <junkoi2004 () gmail com> wrote:

> Hi,
>
> I am looking for a way to execute Ring3 command (for ex, "net user
> passwd" to change password of an user) from Ring0 of Windows.
>
> The motivation of this is that I can exploit Windows kernel, and can
> execute my code there. So far so good. But I am not content with
> executing in Ring0 only, and want to run some code in Ring3, too. The
> code can be injected by me, or I just simply run an existent command
> tool (like cmd.exe)
>
> Could anybody recommend any technique to achieve this?

This is what skape's kernel-to-userland injection code does (now part of  
metasploit). It installs a hook, uses this to find a target process, and  
copies the userland shellcode into the target process. We use this to run  
userland payloads through exploited wireless drivers.

Ring0-Ring3 staging:
http://metasploit.com/svn/framework3/trunk/lib/rex/payloads/win32/kernel/stager.rb

Kernel symbol resolution:
http://uninformed.org/index.cgi?v=3&a=4&p=10
http://metasploit.com/svn/framework3/trunk/lib/rex/payloads/win32/common.rb

To run a command, just export a shellcode buffer from msfpayload  
windows/exec CMD="cmd.exe /c something", and append this to the userland  
stub.

-HD

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------