Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows System Exploit

megafrock.com

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Windows System Exploit

#41

Post by kyberias »

maxdeliso wrote: post #38
kyberias wrote: post #36

Ok, tried it. This DOES NOT trigger blue screen on Windows 8 (64bit) / Visual Studio 2012. I'm pretty sure the author has some other problems in his environment.

This is not the case. Did you use the makefile to build it? I'm thinking that those specific compile and link flags are key to the triggering condition. I've gotten it to crash at least three or four times on several windows 7 boxes of wildly differing configurations. No confirmed trials on a windows eight box, the bug may have been fixed there.

Yes, I used the makefile. Certainly it is possible that it has been fixed.

Re: Windows System Exploit

#42

Post by kyberias »

mjpa wrote: post #12
JoachimSchipper wrote: post #7

Earlier quoted context omitted.

That's not entirely true - non-privileged local users are not supposed to be able to bluescreen the system. Note that, e.g. Terminal Server exists.

You can cause a blue screen by trying to copy the device context of the screen to itself with BitBlt - a stupid thing to do but still causes a blue screen

Most probably not universally true. Care to provide more information?

Re: Windows System Exploit

#43

Post by kyberias »

wcchandler wrote: post #39
kyberias wrote: post #34

Earlier quoted context omitted.

I don't get it. It takes the exact same time to write a report to Microsoft about it. The author clearly didn't even consider it.

We don't know the author. He may very well enjoy writing these types of articles. Filling out a form online? Maybe not so much. He also has complete freedom in writing anything he wants with no obligation of providing further proof or information. To some, that's enough motivation.

Look, I get it. I just don't approve it. I think it's irresponsible.

Re: Windows System Exploit

#44

Post by kyberias »

maxdeliso wrote: post #38
kyberias wrote: post #36

Ok, tried it. This DOES NOT trigger blue screen on Windows 8 (64bit) / Visual Studio 2012. I'm pretty sure the author has some other problems in his environment.

This is not the case. Did you use the makefile to build it? I'm thinking that those specific compile and link flags are key to the triggering condition. I've gotten it to crash at least three or four times on several windows 7 boxes of wildly differing configurations. No confirmed trials on a windows eight box, the bug may have been fixed there.

I also ran it on Windows 7 (64-bit). Nothing happens, although the prompt was displayed. It wasn't on Windows 8. The program doesn't do anything special. Either you're running some other version of the program, or your report is incorrect.

Re: Windows System Exploit

#45

Post by maxdeliso »

easy_rider wrote: post #14

Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.

: host microsoft-com.mail.protection.outlook.com[207.46.100.11] said: 550 5.7.1 Service unavailable; Client host [66.175.217.21] blocked using Blocklist 1; To request removal from this list please forward this message to delist@messaging.microsoft.com (in reply to RCPT TO command)

Re: Windows System Exploit

#46

Post by yuhong »

kyberias wrote: post #44
maxdeliso wrote: post #38

Earlier quoted context omitted.

This is not the case. Did you use the makefile to build it? I'm thinking that those specific compile and link flags are key to the triggering condition. I've gotten it to crash at least three or four times on several windows 7 boxes of wildly differing configurations. No confirmed trials on a windows eight box, the bug may have been fixed there.

I also ran it on Windows 7 (64-bit). Nothing happens, although the prompt was displayed. It wasn't on Windows 8. The program doesn't do anything special. Either you're running some other version of the program, or your report is incorrect.

Was able to reproduce and get a dump on Win7 32-bit, but had to run the program more than once.

Re: Windows System Exploit

#47

Post by yuhong »

Call stack from WinDbg:

  ChildEBP RetAddr  
  8942ec9c 82b1d2a1 nt!KeBugCheckEx+0x1e
  8942ecc0 82a9ae5a nt!PspCatchCriticalBreak+0x71
  8942ecf0 82a9ad9d nt!PspTerminateAllThreads+0x2d
  8942ed24 8287b8fa nt!NtTerminateProcess+0x1a2
  8942ed24 77b87094 nt!KiFastCallEntry+0x12a
  00f8f260 77b868d4 ntdll!KiFastSystemCallRet
  00f8f264 75d3301f ntdll!ZwTerminateProcess+0xc
  00f8f2a4 75d34d7c CSRSRV!CsrUnhandledExceptionFilter+0xcb
  00f8f2ac 75d36f48 CSRSRV!CsrApiRequestThread+0x3e2
  00f8f2c0 75d36cde CSRSRV!_EH4_CallFilterFunc+0x12
  00f8f2e8 77b87199 CSRSRV!_except_handler4+0x8e
  00f8f30c 77b8716b ntdll!ExecuteHandler2+0x26
  00f8f330 77b5f98f ntdll!ExecuteHandler+0x24
  00f8f3bc 77b86ff7 ntdll!RtlDispatchException+0x127
  00f8f3bc 77b92cc7 ntdll!KiUserExceptionDispatcher+0xf
  00f8f708 77b92c78 ntdll!RtlpLowFragHeapFree+0x31
  00f8f720 75c6b349 ntdll!RtlFreeHeap+0x105
  00f8f734 75c72ce2 sxs!operator delete+0x1c
  00f8f740 75c724f6 sxs!RawStack::~RawStack+0x12
  00f8f74c 75c72484 sxs!XMLParser::~XMLParser+0x68
  00f8f758 75c72e7c sxs!XMLParser::`scalar deleting destructor'+0xd
  00f8f76c 75c686f3 sxs!_unknown::Release+0x27
  00f8f77c 75c73e1f sxs!CSmartRef::~CSmartRef+0x1b
  00f8f7fc 75c74a37 sxs!SxspIncorporateAssembly+0x5db
  00f8f83c 75c78001 sxs!SxspIncorporateAssembly+0xb8
  00f8f874 75c6a944 sxs!SxspCloseManifestGraph+0x7c
  00f8f928 75ce28c7 sxs!SxsGenerateActivationContext+0x48f
  00f8fa90 75ce1ad3 sxssrv!BaseSrvSxsCreateActivationContextFromStruct+0x490
  00f8fac8 75d34d65 sxssrv!BaseSrvSxsCreateActivationContextFromMessage+0xdb
  00f8fc40 77b45e7a CSRSRV!CsrApiRequestThread+0x3cb
  00f8fc80 77ba374e ntdll!__RtlUserThreadStart+0x28
  00f8fc98 00000000 ntdll!_RtlUserThreadStart+0x1b

Re: Windows System Exploit

#48

Post by kyberias »

yuhong wrote: post #46
kyberias wrote: post #44

Earlier quoted context omitted.

I also ran it on Windows 7 (64-bit). Nothing happens, although the prompt was displayed. It wasn't on Windows 8. The program doesn't do anything special. Either you're running some other version of the program, or your report is incorrect.

Was able to reproduce and get a dump on Win7 32-bit, but had to run the program more than once.

I think I was able to reproduce it myself. Yesterday I ran your program on one particular laptop, tried to get it to crash but it didn't. Then today when it woke up from sleep, it suddenly bluescreened. I think you may onto something here...

Re: Windows System Exploit

#49

Post by easy_rider »

bdonlan wrote: post #17
easy_rider wrote: post #14

Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.

I kind of get the feeling that the author doesn't really know what he's doing. The actual exploit code is a fragment of what looks like a 'hello world' sort of console IO test. The 0xC0000000 he goes on and on about is just GENERIC_READ | GENERIC_WRITE, which is a totally legal combination. And he disassembles his own code for no particularly good reason. Given all of this, it's not really a surprise that he's not cl…

> this doesn't really violate 'full disclosure policies'

Well he kinda marked it down like he was.. talking about compiling an exe and all to crash any Vista/7 in 30 secs.

Post reply on HN