WinPcap NPF.SYS Privilege Elevation Vulnerability Jul 09 2007 11:32PM
mballano gmail com (1 replies)
WinPcap NPF.SYS Privilege Elevation Vulnerability PoC exploit

Affected software:

(*) WinPcap versions affected (Confirmed)

- WinPcap 3.1
- WinPcap 4.1

(*) Operating systems affected (Confirmed)

- Windows 2000 SP4 (Both server and workstation)
- Windows XP SP2
- Windows 2003 Server
- Windows Vista !!


It's a well known issue that WinPcap security model allows non-administrator
users to use its device driver. If they don't manually unload it after using
tools such as Wireshark (ethereal), which unfortunatelly oftenly happens, this
can lead to unwanted network traffic sniffing and now with the help of this
exploit to kernel mode code execution ;-)


The exploit code is a PoC and was tested only against Windows XP SP2, with minor
modifications (delta offsets and changing VirtualAlloc for NtAllocVirtualMemory due
to base address restrictions in Windows Vista ) should work on all OSes commented

To test the PoC, just pick any software which uses WinPcap like WireShark, then
start to sniff in any iface and close it (so WinPcap device gets up ). Run the
exploit code (as guest user if you want) you should hit an int 3 in kernel mode :-)

Vulnerability discovered by:

Mario Ballano Bárcena, mballano[_at_]gmail.com

You can download exploit and analysis at : http://www.48bits.com/exploits/npfxpl.c

Best regards,


[ reply ]
Re: WinPcap NPF.SYS Privilege Elevation Vulnerability Jul 10 2007 06:37PM
Gerald Combs (gerald wireshark org)


Privacy Statement
Copyright 2010, SecurityFocus