{"id":19523279,"url":"https://github.com/niklasb/elgoog","last_synced_at":"2025-04-26T09:32:36.237Z","repository":{"id":141703688,"uuid":"140274216","full_name":"niklasb/elgoog","owner":"niklasb","description":"elgoog/searchme challenge from 34C3 CTF / WCTF 2018: sources \u0026 exploit","archived":false,"fork":false,"pushed_at":"2018-07-09T12:45:32.000Z","size":140,"stargazers_count":67,"open_issues_count":0,"forks_count":11,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-04T10:47:11.158Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/niklasb.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2018-07-09T11:11:47.000Z","updated_at":"2025-01-05T19:17:37.000Z","dependencies_parsed_at":null,"dependency_job_id":"1bc90d4d-048d-4233-b9de-943c7009372a","html_url":"https://github.com/niklasb/elgoog","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/niklasb%2Felgoog","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/niklasb%2Felgoog/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/niklasb%2Felgoog/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/niklasb%2Felgoog/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/niklasb","download_url":"https://codeload.github.com/niklasb/elgoog/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250967528,"owners_count":21515615,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T00:42:56.405Z","updated_at":"2025-04-26T09:32:32.815Z","avatar_url":"https://github.com/niklasb.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# elgoog / searchme\n\nThis is a kernel pwnable for Windows 10. Exploit works on RS4 with medium integrity. In RS3 low integrity was enough, because HMValidateHandle could be used to leak palette object addresses.\n\nIt was called \"elgoog2\" at 34C3 CTF, but had an unintended bug. Brought back for WCTF 2018, as \"searchme\".\n\nWe have a vulnerable kernel driver that deals with document indexing. It lets\nyou build an inverted index by adding documents incrementally to an index, and\nthen compressing the posting lists using an [binary interpolative code][1],\nof course all in kernel land, via driver IOCTLs. Data structures are stored on\nthe paged kernel pool.\n\n\n## Bug\n\nWhile adding documents to an inverted list, the code [tries to keep the list\nunique][2] but clearly this is broken because we can just add the same document\ntwice with one other document in between.\n\nThen we can trigger an awkward mismatch between the [size computation][3] and\n[actual implementation][4] of the interpolative encoding, which allows us to\nwrite more than the size that was computed. So we can make almost all of the\n`write_XXX` functions receive an out-of-bounds `*buf` pointer. For `write_bit`,\nthis is a problem, because the bounds check is incorrect, and hence we can\noverflow by one byte.\n\nThe primitive we can obtain from this bug is an arbitrary off-by-one overflow\nin the paged kernel pool, where some NT data structures but also all of the\nelgoog-specific data structures reside.\n\n\n## Intended solution\n\nThe intended solution was to corrupt the `PrevSize` field of a `_POOL_HEADER` and\ntrigger a backward consolidation, leading to overlapping pool chunks. With that\nwe can corrupt elgoog's own data structures that contain pointers, and achieve\nan arbitrary write. Refer to the [exploit code][5] for details.\n\nWe then use that to overwrite our own `SEP_TOKEN_RPIVLEGES` and give us debug\nprivileges, which allows us to inject code into `winlogon.exe`.\n\n\n[1]: https://link.springer.com/article/10.1023/A:1013002601898\n[2]: https://github.com/niklasb/elgoog/blob/master/searchme/index.c#L124\n[3]: https://github.com/niklasb/elgoog/blob/master/searchme/index.c#L172\n[4]: https://github.com/niklasb/elgoog/blob/master/searchme/index.c#L213\n[5]: https://github.com/niklasb/elgoog/blob/master/searchme_pwn/pwn.cpp#L193\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fniklasb%2Felgoog","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fniklasb%2Felgoog","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fniklasb%2Felgoog/lists"}