0vercl0k / cve-2021-28476

PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.

Hello, world 👋

If you made it all the way here, you might as well check out some of my projects and where I blog 😊. Oh, and if you want to say hi, come hangout on the Diary of a reverse-engineer's discord: invite!

Windows related

• wtf: A distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows,
• windbg-scripts: A collection of JavaScript debugger extensions for WinDbg,
• kdmp-parser / udmp-parser: C++ libraries to parse Windows kernel and usermode dumps (udmp-parser-rs / kdmp-parser-rs for Rust crates),
• 🔮 clairvoyance: Visualize the virtual address space of a Windows process on a Hilbert curve,
• symbolizer-rs: A fast execution trace symbolizer for Windows that runs on all major platforms and doesn't depend on any Microsoft libraries,
• SiC: Enumerate user mode shared memory mappings on Windows,
• KEPaboo: Neutralize KEPServerEX anti-debugging techniques,
• rp-bf.rs: A library to bruteforce ROP gadgets by emulating a Windows user-mode crash-dump,
• Various CVE PoCs for tcpip.sys (CVE-2021-24086), http.sys (CVE-2021-31166), Hyper-V (CVE-2021-28476), Realtek's RTKVHD64.sys driver (CVE-2021-32537) and the Mozilla browser (CVE-2022-28281),
• Modern Debugging with WinDbg Preview: Workshop that @hugsy and I ran during Defcon 27.

Exploitation

• Paracosme: Zero-click remote memory corruption exploit that compromises ICONICS Genesis64 (Pwn2Own Miami 2022),
• Longue vue: Over-the-web remote compromise exploit chain for NETGEAR DGND3700v2 devices,
• Zenith: Remote kernel exploit for the TP-Link AC1750 Smart Wi-Fi Router (Pwn2Own Austin 2021),
• Pwn2Own Miami 2023: Writeups/PoCs for bugs I found while preparing for Pwn2Own Miami 2023 targeting UaGateway in the OPC UA Server category,
• CVE-2019-11708: Full chain for CVE-2019-11708 & CVE-2019-9810,
• CVE-2019-9810: RCE exploit for Firefox on Windows.

Misc

• rp: A fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM binaries,
• z3-playground: A bunch of Z3-python scripts that can be used as examples, reminders, etc.
• Theorem prover, symbolic execution and practical reverse-engineering: Presentation I gave in Lille, France in 2015,
• teesee-calc: A simple web application that allows you to visualize and compare total compensation packages.

cve-2021-28476's Issues

vmswitch source code missing

vmswitch's source code is missing. (There is no source code in both compressed file)
Can you re-upload the source code?

Diffing your vmswitch files with wrong results

Hi,

i've downloaded your vmswitch files and i diffed both, but i don't have the same results as you:

And if i search for the target function VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST this has not difference

the idbs were created with ida pro 7.5 and they were diffed with bindiff 7

can you tell me if your files are correctly posted or something?

thanks in advance and sorry, i'm a noob yet

Error in loading the driver

I followed the steps but I still get errors, please let me know what you think:
https://freeimage.host/i/HCmYfXj

Thanks.

poc no work for windows server 2012 r2

I inserted fragment code printk(KERN_ALERT "poc: trig vuln VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST") into the rndis_filter.c (in func rndis_trigger_rndisquery before call rndis_filter_send_request()) for loggining. After execute poc,system no state dos,but dmesg output have string "poc: trig vuln VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST"
I tried poc execute for different package updates:
1)
"windows server 2012 r2 installed updates":[ "KB5001382", "KB2999226", "KB2949621", "KB2939471", "KB2938772", "KB2937220", "KB2919355", "KB2919442" ]
2)
"windows server 2012 r2 installed updates":[ "KB5000848", "KB2999226", "KB2949621", "KB2939471", "KB2938772", "KB2937220", "KB2919355", "KB2919442" ]
3)
"windows server 2012 r2 installed updates":[ "KB2999226", "KB2949621", "KB2939471", "KB2938772", "KB2937220", "KB2919355", "KB2919442" ]
4)
"windows server 2012 r2 installed updates":[ "nil" ]
config guest vm hv:
"config":{ "guest hyper-v system":{ "os": ["ubuntu 20.01"] "type vm": ["2(*supported vmbus and hvcalls*)"] "network":[ "external virtual network":{ "SR-IOV":True, "Allow management operation system to share this network adapter":True } ] } }
I took the driver with vmswitch.sys from Windows 2012 r2 server, path: "/ SystemRoot / system32 / drivers / vmswitch.sys" and tried to find symbols
VmsIfrInfoParams_ * using ida. ida did not find symbols

what dependencies and nuances I did not take into account for successful execution poc?

What should I do to get RCE?

Hello, I was very interested in PoC. Can you tell me how to do RCE? (Sorry for my bad english.)