{"id":128698,"date":"2023-07-03T00:35:23","date_gmt":"2023-07-03T07:35:23","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=128698"},"modified":"2024-07-30T18:08:21","modified_gmt":"2024-07-31T01:08:21","slug":"win32k-analysis-part-2","status":"publish","type":"post","link":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/","title":{"rendered":"\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790"},"content":{"rendered":"<h2><a id=\"post-128698-_4lt92rr5muov\"><\/a>\u6982\u8981<\/h2>\n<p>Microsoft Windows\u306b\u304a\u3051\u308b2\u3064\u306e\u985e\u4f3c\u3057\u305f\u7279\u6a29\u6607\u683c\u306e\u8106\u5f31\u6027(CVE-2021-1732\u3068CVE-2022-21882)\u306e\u5831\u544a\u3092\u898b\u305f\u79c1\u305f\u3061\u306f\u3001\u305d\u308c\u305e\u308c\u306b\u95a2\u308f\u308b\u30b3\u30fc\u30c9\u3092\u6df1\u304f\u7406\u89e3\u3059\u308b\u305f\u3081\u3001\u3053\u308c\u3089\u306eCVE\u3092\u5206\u6790\u3059\u308b\u3053\u3068\u306b\u3057\u307e\u3057\u305f\u3002\u672c\u7a3f\u306f<a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-1\/\">\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8<\/a>\u306e\u7d9a\u7de8\u3067\u3059\u3002\u524d\u7de8\u3067\u306f\u3001<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-1732\">CVE-2021-1732<\/a>\u3068<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-21882\">CVE-2022-21882<\/a>\u306b\u307e\u3064\u308f\u308b\u554f\u984c\u3092\u63a2\u308b\u305f\u3081\u306e\u80cc\u666f\u60c5\u5831\u3068\u3057\u3066\u3001Win32k\u306e\u5185\u90e8\u3068\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u5168\u822c\u306b\u3064\u3044\u3066\u89e3\u8aac\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u672c\u7a3f\u3067\u306f\u3001CVE-2021-1732\u3068CVE-2022-21882\u3001\u304a\u3088\u3073\u3053\u308c\u3089\u306eCVE\u306b\u95a2\u9023\u3059\u308b\u6982\u5ff5\u5b9f\u8a3c(PoC)\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u6df1\u6398\u308a\u3057\u3066\u3044\u304d\u307e\u3059\u3002\u3053\u306e2\u3064\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u5206\u6790\u3092\u901a\u3058\u3001\u300cCVE-2021-1732\u306b\u5bfe\u3059\u308b\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u304cCVE-2022-21882\u306e\u9632\u6b62\u306b\u306f\u4e0d\u5341\u5206\u3067\u3042\u3063\u305f\u7406\u7531\u300d\u3092\u660e\u3089\u304b\u306b\u3057\u307e\u3059\u3002<\/p>\n<p>\u672c\u9023\u8f09\u3067\u53d6\u308a\u4e0a\u3052\u308b\u8106\u5f31\u6027\u306f\u3001\u3044\u305a\u308c\u3082Cortex XDR\u306eAnti-LPE\u4fdd\u8b77\u30e2\u30b8\u30e5\u30fc\u30eb\u306b\u3088\u308a\u691c\u51fa\u30fb\u30d6\u30ed\u30c3\u30af\u3055\u308c\u307e\u3059\u3002\u3044\u305a\u308c\u306e\u8106\u5f31\u6027\u3082\u3001NT AUTHORITY\\SYSTEM\u306e\u7279\u6a29\u30c8\u30fc\u30af\u30f3\u3092\u73fe\u5728\u306e(\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e)\u30d7\u30ed\u30bb\u30b9\u306e\u305d\u308c\u306b\u30b3\u30d4\u30fc\u3059\u308b\u3053\u3068\u3067\u7279\u6a29\u6607\u683c\u3092\u56f3\u308b\u3001\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u578b\u306e(\u30b7\u30b9\u30c6\u30e0\u4e0a\u306e\u30c7\u30fc\u30bf\u5909\u66f4\u306b\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u5fc5\u8981\u3068\u3057\u306a\u3044\u7a2e\u985e\u306e)\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3067\u3059\u3002Cortex XDR\u306eAnti-LPE\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001\u3053\u306e\u7279\u5b9a\u306e\u7a2e\u985e\u306e\u7279\u6a29\u6607\u683c\u6280\u8853\u3092\u76e3\u8996\u3057\u307e\u3059\u3002<\/p>\n<table style=\"width: 100%;\">\n<thead>\n<tr>\n<td style=\"width: 35%;\"><b>\u95a2\u9023\u3059\u308bUnit 42\u306e\u30c8\u30d4\u30c3\u30af<\/b><\/td>\n<td style=\"width: 100%;\"><a href=\"https:\/\/unit42.paloaltonetworks.jp\/tag\/microsoft-windows-ja\/\" target=\"_blank\" rel=\"noopener\"><b>Microsoft Windows<\/b><\/a>, <strong><a href=\"https:\/\/unit42.paloaltonetworks.jp\/tag\/CVE-2021-1732-ja\/\" target=\"_blank\" rel=\"noopener\">CVE-2021-1732<\/a>, <a href=\"https:\/\/unit42.paloaltonetworks.jp\/tag\/CVE-2022-21882-ja\/\" target=\"_blank\" rel=\"noopener\">CVE-2022-21882<\/a><\/strong><\/td>\n<\/tr>\n<\/thead>\n<\/table>\n<h2><a id=\"post-128698-_v6qzll4ejae7\"><\/a>CVE-2021-1732\u3068CVE-2022-21882\u306e\u5206\u6790<\/h2>\n<p>\u3053\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u306fWin32k\u306e2\u3064\u306ePoC\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3001CVE-2021-1732\u3068CVE-2022-21882\u306b\u3064\u3044\u3066\u8ad6\u3058\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u8106\u5f31\u6027\u306f\u3044\u305a\u308c\u3082\u3001<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3092\u60aa\u7528\u3057\u3001\u96a3\u63a5\u3059\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbWndExtra<\/span>\u306e\u30c7\u30fc\u30bf \u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u5927\u304d\u306a\u5024\u306b\u4e0a\u66f8\u304d\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u4efb\u610f\u306ewrite\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u53d6\u5f97\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u3082\u306e\u3067\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u8106\u5f31\u6027\u306f\u3044\u305a\u308c\u3082\u3001\u3053\u306e\u4efb\u610f\u306ewrite\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u4f7f\u3063\u3066\u3001\u96a3\u63a5\u3059\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u5185\u3067\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u3092\u4f5c\u6210\u3057\u3066\u304b\u3089\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u3092\u4f7f\u3063\u3066\u4efb\u610f\u306eread\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u305d\u3057\u3066\u3001\u3053\u306e\u4efb\u610f\u306eread\/write\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u4f7f\u3044\u3001NT AUTHORITY \\SYSTEM\u30c8\u30fc\u30af\u30f3\u3092\u73fe\u5728\u306e(\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3055\u308c\u305f)\u30d7\u30ed\u30bb\u30b9\u3078\u30b3\u30d4\u30fc\u3057\u307e\u3059\u3002<\/p>\n<p>\u3053\u3053\u3067\u306fCVE-2022-21882\u306ePoC\u3092\u8a73\u7d30\u306b\u5206\u6790\u3057\u307e\u3059\u3002CVE-2021-1732\u306b\u3064\u3044\u3066\u306f\u3001CVE-2022-21882\u306e\u5206\u6790\u3092\u9032\u3081\u308b\u306a\u304b\u3067\u9069\u5b9c\u3001\u76f8\u9055\u70b9\u3092\u8aac\u660e\u3059\u308b\u304b\u305f\u3061\u3067\u53d6\u308a\u4e0a\u3052\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001Microsoft\u304cCVE-2021-1732\u306b\u5bfe\u3057\u3066\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u304cCVE-2022-21882\u306e\u9632\u6b62\u306b\u4e0d\u5341\u5206\u3067\u3042\u3063\u305f\u7406\u7531\u3092\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<p>CVE-2022-21882\u3092\u8ad6\u3058\u308b\u306e\u306b\u6642\u9593\u3092\u5272\u304f\u3053\u3068\u306b\u3057\u305f\u7406\u7531\u306f\u3001CVE-2021-1732\u306b\u3064\u3044\u3066\u306f<a href=\"https:\/\/googleprojectzero.github.io\/0days-in-the-wild\/0day-RCAs\/2021\/CVE-2021-1732.html\" target=\"_blank\" rel=\"noopener\">Google<\/a>\u3084<a href=\"https:\/\/ti.dbappsecurity.com.cn\/blog\/articles\/2021\/02\/10\/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack\/\" target=\"_blank\" rel=\"noopener\">DBAPPSecurity Threat Intelligence Center<\/a>\u304c\u8a73\u7d30\u306b\u5206\u6790\u3057\u305f\u30d6\u30ed\u30b0\u304c\u8907\u6570\u3042\u308b\u304b\u3089\u3067\u3059\u3002<\/p>\n<p>\u3053\u308c\u3089\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306f\u3044\u305a\u308c\u3082\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u578b\u306e\u653b\u6483\u3067\u3059\u3002\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u653b\u6483\u306e\u5834\u5408\u3001read\/write\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3060\u3051\u3042\u308c\u3070\u653b\u6483\u304c\u3067\u304d\u3001\u653b\u6483\u8005\u304c\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u3059\u308b\u30b3\u30fc\u30c9\u306e\u5b9f\u884c\u306f\u5fc5\u8981\u3042\u308a\u307e\u305b\u3093\u3002\u6700\u65b0\u306e\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b7\u30b9\u30c6\u30e0\u306b\u5c0e\u5165\u3055\u308c\u3066\u3044\u308b\u73fe\u4ee3\u7684\u306a\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u9632\u6b62\u7b56\u306f\u56de\u907f\u304c\u96e3\u3057\u3044\u306e\u3067\u3001\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u578b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u6feb\u7528\u306f\u62e1\u5927\u3057\u3066\u304d\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3><a id=\"post-128698-_89soq5kuz5sb\"><\/a><strong>CVE-2022-21882\u306e\u6982\u8981<\/strong><\/h3>\n<p>\u3053\u306e\u8106\u5f31\u6027\u306f\u30012021\u5e7410\u6708\u306b\u958b\u50ac\u3055\u308c\u305f<a href=\"https:\/\/www.securityweek.com\/19-million-paid-out-exploits-chinas-tianfu-cup-hacking-contest\/\" target=\"_blank\" rel=\"noopener\">\u5929\u5e9c\u676f\u30cf\u30c3\u30ad\u30f3\u30b0 \u30b3\u30f3\u30c6\u30b9\u30c8<\/a>\u3067\u3001RyeLv\u6c0f(<a href=\"https:\/\/twitter.com\/b2ahex\" target=\"_blank\" rel=\"noopener\">@b2ahex<\/a>)\u304c\u767a\u898b\u3057\u305f\u3082\u306e\u3067\u3059\u3002Microsoft\u306f\u3001<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2022-21882\" target=\"_blank\" rel=\"noopener\">2022\u5e741\u6708\u306b\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u30ea\u30ea\u30fc\u30b9<\/a>\u3057\u307e\u3057\u305f\u3002CVE-2021-1732\u3068\u306e\u985e\u4f3c\u6027\u304b\u3089\u3059\u308b\u3068\u3001\u82e5\u5e72\u4fee\u6b63\u3059\u308b\u3060\u3051\u3067Windows 10\u306e\u30d0\u30fc\u30b8\u30e7\u30f31709\u304b\u308921H2\u307e\u3067\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3066\u3044\u305f\u53ef\u80fd\u6027\u304c\u9ad8\u3044\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n<p>Microsoft\u306fWindows 11\u7528\u306b\u3082\u540c\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u89e3\u6790\u3059\u308bPoC\u306f\u3001Windows 10\u306e\u30d0\u30fc\u30b8\u30e7\u30f321H2\u3067\u30c6\u30b9\u30c8\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h4><a id=\"post-128698-_9kkxco7rxc66\"><\/a>\u8106\u5f31\u6027\u306e\u30c8\u30ea\u30ac\u30fc<\/h4>\n<p>\u6b74\u53f2\u7684\u306b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u4f5c\u8005\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u3084<span style=\"font-family: 'courier new', courier, monospace;\">bitmap<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u60aa\u7528\u306b\u983c\u3063\u3066read\/write\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u5b9f\u73fe\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u524d\u7a3f\u3067\u8ff0\u3079\u305f\u3088\u3046\u306b\u3001Microsoft\u306f\u3053\u3046\u3057\u305f\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u60aa\u7528\u3057\u3065\u3089\u304f\u3059\u308b\u305f\u3081\u591a\u5927\u306a\u52b4\u529b\u3092\u8cbb\u3084\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u5177\u4f53\u7684\u306b\u306f\u3001Windows 10\u306e\u30d0\u30fc\u30b8\u30e7\u30f3 1703\u304b\u3089\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLong<\/span>\u3092\u4f7f\u3063\u305f\u5834\u5408\u3001\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30d4\u30fc\u5185\u306e<span style=\"font-family: 'courier new', courier, monospace;\">ExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3060\u3051\u304c\u5909\u66f4\u3055\u308c\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306f\u5909\u66f4\u3055\u308c\u306a\u3044\u3068\u3044\u3046\u5236\u7d04\u304c\u52a0\u308f\u308a\u307e\u3057\u305f\u3002\u305f\u3060\u3057\u3001\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u64cd\u4f5c\u3057\u3066\u3044\u308b\u5834\u5408\u306b\u306f\u3053\u306e\u5236\u7d04\u304c\u9069\u7528\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\n<p>\u305d\u3053\u3067\u3001\u3053\u308c\u3089\u306e\u8106\u5f31\u6027\u306f2\u3064\u3068\u3082\u3001Windows\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b7\u30b9\u30c6\u30e0\u304c\u60f3\u5b9a\u3057\u306a\u3044\u30bf\u30a4\u30df\u30f3\u30b0\u3067<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u306b\u3088\u308a\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u4e2d\u306b\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5909\u63db\u3059\u308b\u3068\u3044\u3046\u65b9\u6cd5\u3067\u3053\u306e\u5236\u7d04\u3092\u304b\u3044\u304f\u3050\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u3046\u3057\u3066\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5909\u63db\u3057\u305f\u7d50\u679c\u3001\u3053\u306e\u95a2\u6570\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u30de\u30b9\u30af\u306b<span style=\"font-family: 'courier new', courier, monospace;\">0x800<\/span>\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u3082\u306f\u3084\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u8868\u3059\u306e\u3067\u306f\u306a\u304f\u30ab\u30fc\u30cd\u30eb\u306b\u5bfe\u3059\u308b\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u8868\u3059\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>Windows\u306f\u30a6\u30a3\u30f3\u30c9\u30a6\u7a2e\u5225\u306e\u78ba\u8a8d\u51e6\u7406\u3092\u4f55\u3082\u5165\u308c\u3066\u3044\u306a\u304b\u3063\u305f\u306e\u3067\u3001\u3053\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5bfe\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLong<\/span>\u304c\u547c\u3073\u51fa\u3055\u308c\u308c\u3070\u3001\u30d0\u30fc\u30b8\u30e7\u30f31703\u3088\u308a\u524d\u306eWindows 10\u540c\u69d8\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306b\u5909\u66f4\u304c\u52a0\u3048\u3089\u308c\u3066\u3057\u307e\u3044\u307e\u3059\u3002CVE-2022-21882\u306ePoC\u3092\u901a\u3057\u3067\u773a\u3081\u3066\u3001\u3053\u308c\u304c\u3069\u306e\u3088\u3046\u306b\u5b9f\u73fe\u3055\u308c\u3066\u3044\u308b\u306e\u304b\u3092\u898b\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<h4><a id=\"post-128698-_ejyu3xt7u77t\"><\/a>PoC (Proof of Concept: \u6982\u5ff5\u5b9f\u8a3c)\u306e\u30a6\u30a9\u30fc\u30af\u30b9\u30eb\u30fc<\/h4>\n<p>\u3067\u306f<a href=\"https:\/\/github.com\/KaLendsi\/CVE-2022-21882\/blob\/main\/ExploitTest.cpp\">PoC (\u6982\u5ff5\u5b9f\u8a3c)<\/a>\u3092\u898b\u3066\u3044\u304d\u307e\u3059\u3002\u4ee5\u4e0b\u306b\u7c21\u5358\u306b\u307e\u3068\u3081\u3066\u307f\u307e\u3057\u305f\u3002<\/p>\n<ol>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3092\u898b\u3064\u3051\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u3092\u30ed\u30fc\u30c9\u3059\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u3092\u898b\u3064\u3051\u308b\n<ol>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u683c\u7d0d\u3059\u308b<\/li>\n<\/ol>\n<\/li>\n<li>\u30a6\u30a3\u30f3\u30c9\u30a6 \u30af\u30e9\u30b9\u3092\u3044\u304f\u3064\u304b\u5b9a\u7fa9\u3059\u308b<\/li>\n<li>\u30d2\u30fc\u30d7 \u30b0\u30eb\u30fc\u30df\u30f3\u30b0\u3092\u884c\u3046\n<ol>\n<li>\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u3044\u304f\u3064\u304b\u4f5c\u6210\u3059\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3092\u4f7f\u3063\u3066\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u306e\u4f4d\u7f6e\u3092\u6f0f\u3048\u3044\u3055\u305b\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3092\u4f7f\u3063\u3066\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u306e\u4f4d\u7f6e\u3092\u6f0f\u3048\u3044\u3055\u305b\u308b<\/li>\n<\/ol>\n<\/li>\n<li>\u30a6\u30a3\u30f3\u30c9\u30a6\u9593\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u8a08\u7b97\u3059\u308b<\/li>\n<li>\u6700\u3082\u4e0b\u4f4d\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30a2\u30c9\u30ec\u30b9\u3067<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3092\u547c\u3073\u51fa\u3059<\/li>\n<li>3\u3064\u3081\u306e(magic)\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u3059\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u3092\u547c\u3073\u51fa\u3059\u60aa\u610f\u306e\u3042\u308b\u30d0\u30fc\u30b8\u30e7\u30f3\u3067<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u30d5\u30c3\u30af\u3057\u3066\u304b\u3089\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u306b\u623b\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u3092\u4f7f\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u4e0a\u306e\u30d5\u30c3\u30af\u3055\u308c\u305f\u95a2\u6570\u3092\u30c8\u30ea\u30ac\u30fc\u3059\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongA<\/span>\u3092\u4f7f\u3063\u3066\u4efb\u610f\u306ewrite\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u4f5c\u6210\u3059\u308b<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3092\u4f7f\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u6f0f\u3048\u3044\u3055\u305b\u3001\u305d\u308c\u3092\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3067\u7f6e\u304d\u63db\u3048\u308b<\/li>\n<li>\u4efb\u610f\u306eread\/write\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u306b\u3088\u308aSystem\u306e\u30c8\u30fc\u30af\u30f3\u3092\u8907\u88fd\u3059\u308b<\/li>\n<li>System\u6a29\u9650\u3067\u65b0\u3057\u3044\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u3066\u5909\u66f4\u3055\u308c\u305f\u30ab\u30fc\u30cd\u30eb\u306e\u5024\u3092\u4fee\u6b63\u3059\u308b<\/li>\n<\/ol>\n<p>\u6b21\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u306f\u3001\u3053\u306e\u307e\u3068\u3081\u3092\u30b9\u30c6\u30c3\u30d71\uff5e5\u307e\u3067\u3092\u9806\u306b\u901a\u3057\u3067\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em>\u7d9a\u304d\u3092\u8aad\u3080 \u27a0 <a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/2\">\u30bb\u30af\u30b7\u30e7\u30f3 2 \u2013 \u8a73\u7d30\u5206\u6790\u30b9\u30c6\u30c3\u30d71-5<\/a><\/em><\/strong><\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n<p><!--nextpage--><\/p>\n<h2><a id=\"TOC\"><\/a>\u76ee\u6b21<\/h2>\n<p><a href=\"#post-128698-_y0xnnzwfgrlm\">CVE-2022-21882\u306e\u8a73\u7d30\u89e3\u6790<\/a><br \/>\n<a href=\"#post-128698-_4u37vab0vanb\">1. HMValidateHandle\u3092\u898b\u3064\u3051\u308b<\/a><br \/>\n<a href=\"#post-128698-_yfe5i0sfp83t\">2. NtUserConsoleControl\u3001NtCallbackReturn\u3092\u30ed\u30fc\u30c9\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_25jq2gtkga8v\">3. KernelCallbackTable\u3092\u898b\u3064\u3051\u3066\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30afxxxClientAllocWindowClassExtraBytes\u3068xxxClientAllocWindowClassExtraBytes\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u4fdd\u5b58\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_1ykdt72ot841\">4. \u30a6\u30a3\u30f3\u30c9\u30a6 \u30af\u30e9\u30b9\u3092\u3044\u304f\u3064\u304b\u5b9a\u7fa9\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_4k8elqoect3v\">5. \u30d2\u30fc\u30d7 \u30b0\u30eb\u30fc\u30df\u30f3\u30b0\u3092\u884c\u3046<\/a><\/p>\n<h2><a id=\"FigToC\"><\/a>\u56f3\u8868\u306e\u76ee\u6b21<\/h2>\n<p><a href=\"#Figure1\">\u56f31. FindHMValidateHandle\u95a2\u6570\u547c\u3073\u51fa\u3057<\/a><br \/>\n<a href=\"#Figure2\">\u56f32. IsMenu\u95a2\u6570\u306eIDA\u306b\u3088\u308b\u9006\u30a2\u30bb\u30f3\u30d6\u30eb<\/a><br \/>\n<a href=\"#Figure3\">\u56f33. FindHMValidateHandle\u306e\u30b3\u30fc\u30c9\u30b9\u30cb\u30da\u30c3\u30c8<\/a><br \/>\n<a href=\"#Figure4\">\u56f34. PoC 285\uff5e288\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure5\">\u56f35. PoC 297\uff5e304\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure6\">\u56f36. WinDbg\u306b\u3088\u308bPEB\u306e\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure7\">\u56f37. KernelCallbackTable\u306e\u6700\u521d\u306e16\u500b\u306e\u30a8\u30f3\u30c8\u30ea\u30fc<\/a><br \/>\n<a href=\"#Figure8\">\u56f38. KernelCallbackTable + 0x3d0\u306eWinDbg\u306b\u3088\u308b\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u3002\u3053\u3053\u306b\u8208\u5473\u306e\u5bfe\u8c61\u3068\u306a\u308b2\u3064\u306e\u95a2\u6570\u304c\u914d\u7f6e\u3055\u308c\u3066\u3044\u308b<\/a><br \/>\n<a href=\"#Figure9\">\u56f39. PoC 312\uff5e325\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure10\">\u56f310. \u6700\u521d\u306b\u4f5c\u6210\u3055\u308c\u305f\u30a6\u30a3\u30f3\u30c9\u30a6\u3067HMValidateHandle\u3092\u547c\u3073\u51fa\u3057\u305f\u3068\u304d\u306e\u623b\u308a\u5024<\/a><br \/>\n<a href=\"#Figure11\">\u56f311. \u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u3068\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u3067\u5171\u6709\u3055\u308c\u308btagWND\u69cb\u9020\u4f53\u306e\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u306e\u30b3\u30d4\u30fc<\/a><\/p>\n<h4><a id=\"post-128698-_y0xnnzwfgrlm\"><\/a>CVE-2022-21882\u306e\u8a73\u7d30\u89e3\u6790<\/h4>\n<h5><a id=\"post-128698-_4u37vab0vanb\"><\/a>1. HMValidateHandle\u3092\u898b\u3064\u3051\u308b(\u56f31)<a id=\"Figure1\"><\/a><\/h5>\n<figure id=\"attachment_128509\" aria-describedby=\"caption-attachment-128509\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128509 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-1.png\" alt=\"\u753b\u50cf1\u306f\u6570\u884c\u306e\u30b3\u30fc\u30c9\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002FindHMValidateHandle\u95a2\u6570\u306b\u5bfe\u3059\u308b\u547c\u3073\u51fa\u3057\u3092\u3057\u3066\u3044\u307e\u3059\u3002 \" width=\"900\" height=\"154\" \/><figcaption id=\"caption-attachment-128509\" class=\"wp-caption-text\">\u56f31. <span style=\"font-family: 'courier new', courier, monospace;\">FindHMValidateHandle<\/span>\u95a2\u6570\u547c\u3073\u51fa\u3057<\/figcaption><\/figure>\n<p>\u524d\u8ff0\u306e\u3088\u3046\u306b\u3001\u6b74\u53f2\u7684\u306b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u4f5c\u8005\u306f<span style=\"font-family: 'courier new', courier, monospace;\">FindHMValidateHandle<\/span>\u95a2\u6570\u3092\u4f7f\u3063\u3066\u3053\u306e\u95a2\u6570\u306b\u30cf\u30f3\u30c9\u30eb\u3092\u6e21\u3057\u305f\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u6f0f\u3048\u3044\u3055\u305b\u3066\u304d\u307e\u3057\u305f\u3002\u3053\u306e\u95a2\u6570\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7\u306f<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle(HANDLE h, BYTE type)<\/span>\u3067\u3059\u3002\u3053\u3053\u3067\u3053\u306e\u30cf\u30f3\u30c9\u30eb<span style=\"font-family: 'courier new', courier, monospace;\">h<\/span>\u306f\u3001\u691c\u8a3c\u5bfe\u8c61\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30cf\u30f3\u30c9\u30eb\u3001<span style=\"font-family: 'courier new', courier, monospace;\">type<\/span>\u306f\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u578b(type)\u3092\u8868\u3059\u6570\u5024\u5b9a\u6570\u3067\u3059\u3002<\/p>\n<p>\u672c\u7a3f\u3067\u306f\u3053\u306e\u578b\u304c<span style=\"font-family: 'courier new', courier, monospace;\">0x001<\/span>\u3068\u3044\u3046\u30a6\u30a3\u30f3\u30c9\u30a6\u578b\u3092\u8868\u3059\u3082\u306e\u3068\u3057\u307e\u3059\u3002Windows 10 \u30d0\u30fc\u30b8\u30e7\u30f3 1803\u4ee5\u964d\u306e\u5834\u5408\u3001\u3053\u308c\u306f\u3001\u6e21\u3055\u308c\u305f\u30a6\u30a3\u30f3\u30c9\u30a6 \u30cf\u30f3\u30c9\u30eb\u3068\u5bfe\u5fdc\u3059\u308b<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3078\u306e\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3055\u308c\u305f\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u8fd4\u3057\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u306f\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3055\u308c\u305f\u95a2\u6570\u3067\u306f\u306a\u3044\u306e\u3067\u3001\u5358\u7d14\u306b<span style=\"font-family: 'courier new', courier, monospace;\">GetProcAddress<\/span>\u3092\u4f7f\u3063\u3066\u3053\u306e\u95a2\u6570\u3092\u89e3\u6c7a\u3055\u305b\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u3002\u305d\u3053\u3067\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u4f5c\u8005\u306f\u901a\u5e38<span style=\"font-family: 'courier new', courier, monospace;\">User32.dll<\/span>\u5185\u306e<span style=\"font-family: 'courier new', courier, monospace;\">IsMenu<\/span>\u95a2\u6570\u3092\u89e3\u6c7a\u3055\u305b\u3001\u3053\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8 \u30b3\u30fc\u30c9\u304c\u6700\u521d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">E8<\/span>\u30aa\u30da\u30b3\u30fc\u30c9\u3092\u691c\u7d22\u3059\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002\u305d\u306e\u7406\u7531\u306f<span style=\"font-family: 'courier new', courier, monospace;\">IsMenu<\/span>\u304c\u547c\u3073\u51fa\u3059\u552f\u4e00\u306e\u95a2\u6570\u304c<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3067\u3042\u308b\u305f\u3081\u3067\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">E8<\/span>\u30aa\u30da\u30b3\u30fc\u30c9\u306f<span style=\"font-family: 'courier new', courier, monospace;\">CALL<\/span>\u547d\u4ee4 (<span style=\"font-family: 'courier new', courier, monospace;\">IsMenu<\/span>\u306e\u552f\u4e00\u306eCALL\u547d\u4ee4)\u306b\u5bfe\u5fdc\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u56f32\u306f<span style=\"font-family: 'courier new', courier, monospace;\">IsMenu<\/span>\u95a2\u6570\u3092\u9006\u30a2\u30bb\u30f3\u30d6\u30eb\u3057\u305f\u3082\u306e\u3067\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">E8<\/span>\u30aa\u30da\u30b3\u30fc\u30c9\u304c<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u306b\u5bfe\u3059\u308b\u547c\u3073\u51fa\u3057\u3092\u884c\u3046\u6700\u521d\u3067\u552f\u4e00\u306e\u30aa\u30da\u30b3\u30fc\u30c9\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure2\"><\/a><\/p>\n<figure id=\"attachment_128511\" aria-describedby=\"caption-attachment-128511\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128511 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-2.png\" alt=\"\u753b\u50cf2\u306f\u3001IsMenu\u95a2\u6570\u3092\u9006\u30a2\u30bb\u30f3\u30d6\u30eb\u3057\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002HMValidateHandle\u306b\u5bfe\u3059\u308b\u547c\u3073\u51fa\u3057\u3092\u884c\u3046\u6700\u521d\u3067\u6700\u5f8c\u306e\u30aa\u30da\u30b3\u30fc\u30c9\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"371\" \/><figcaption id=\"caption-attachment-128511\" class=\"wp-caption-text\">\u56f32. <span style=\"font-family: 'courier new', courier, monospace;\">IsMenu<\/span>\u95a2\u6570\u306eIDA\u306b\u3088\u308b\u9006\u30a2\u30bb\u30f3\u30d6\u30eb<\/figcaption><\/figure>\n<p>\u3053\u306e\u4f5c\u8005\u306f\u3053\u306ePoC 58\u884c\u76ee\u306b<span style=\"font-family: 'courier new', courier, monospace;\">FindHMValidateHandle<\/span>\u3068\u3044\u3046\u540d\u524d\u306e\u95a2\u6570\u3092\u5b9a\u7fa9\u3059\u308b\u3053\u3068\u3067\u3001\u4e0a\u8a18\u306e\u5185\u5bb9\u3092\u5b9f\u73fe\u3057\u3066\u3044\u307e\u3059\u3002\u56f33\u306f\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">FindHMValidateHandle<\/span>\u3068\u3044\u3046\u95a2\u6570\u304b\u3089\u306e\u30b3\u30fc\u30c9\u30b9\u30cb\u30da\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u95a2\u6570\u306f<span style=\"font-family: 'courier new', courier, monospace;\">E8<\/span>\u30aa\u30da\u30b3\u30fc\u30c9\u3092\u63a2\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">IsMenu<\/span>\u3092\u691c\u7d22\u3057\u3001\u305d\u306e\u4f4d\u7f6e\u3092\u30dd\u30a4\u30f3\u30bf\u30fc\u3068\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">g_pfnHmValidateHandle<\/span>\u3068\u3044\u3046\u30b0\u30ed\u30fc\u30d0\u30eb\u5909\u6570\u306b\u4fdd\u5b58\u3057\u307e\u3059\u3002\u3053\u306e\u4f4d\u7f6e\u306f\u3001\u5f8c\u3067\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306b\u30de\u30c3\u30d7\u3055\u308c\u305f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u6f0f\u3048\u3044\u3055\u305b\u308b\u306e\u306b\u4f7f\u308f\u308c\u307e\u3059\u3002<a id=\"Figure3\"><\/a><\/p>\n<figure id=\"attachment_128513\" aria-describedby=\"caption-attachment-128513\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128513 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-3.png\" alt=\"\u753b\u50cf3\u306f\u3001FindHMValidateHandle\u306e\u30b3\u30fc\u30c9 \u30b9\u30cb\u30da\u30c3\u30c8\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"900\" height=\"522\" \/><figcaption id=\"caption-attachment-128513\" class=\"wp-caption-text\">\u56f33. <span style=\"font-family: 'courier new', courier, monospace;\">FindHMValidateHandle<\/span>\u306e\u30b3\u30fc\u30c9 \u30b9\u30cb\u30da\u30c3\u30c8<\/figcaption><\/figure>\n<h5><a id=\"post-128698-_yfe5i0sfp83t\"><\/a>2. NtUserConsoleControl\u3001NtCallbackReturn\u3092\u30ed\u30fc\u30c9\u3059\u308b<\/h5>\n<p>CVE-2022-21882\u3068CVE-2021-1732\u306e\u30c8\u30ea\u30ac\u30fc\u306b\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u306e\u4e21\u95a2\u6570\u304c\u60aa\u7528\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u3044\u305a\u308c\u3082\u6587\u66f8\u5316\u3055\u308c\u3066\u3044\u306a\u3044\u95a2\u6570\u3067\u3001\u305d\u308c\u305e\u308c<span style=\"font-family: 'courier new', courier, monospace;\">win32u.dll<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">ntdll.dll<\/span>\u306b\u5b58\u5728\u3057\u3066\u3044\u307e\u3059\u3002PoC 285\uff5e288\u884c\u76ee(\u56f34)\u306f\u3001\u3053\u308c\u3089\u306e\u95a2\u6570\u3092\u89e3\u6c7a\u3057\u3066\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u4fdd\u5b58\u3057\u3001\u5f8c\u3067\u4f7f\u3048\u308b\u3088\u3046\u306b\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure4\"><\/a><\/p>\n<figure id=\"attachment_128515\" aria-describedby=\"caption-attachment-128515\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128515 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-4.png\" alt=\"\u753b\u50cf4\u306fPoC 285\u301c288\u884c\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u308c\u3089\u306e\u884c\u306f\u3001\u524d\u8ff0\u306e\u95a2\u6570\u3092\u89e3\u6c7a\u3057\u3001\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u4fdd\u5b58\u3057\u3066\u5f8c\u3067\u4f7f\u7528\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002\" width=\"900\" height=\"89\" \/><figcaption id=\"caption-attachment-128515\" class=\"wp-caption-text\">\u56f34. PoC 285\uff5e288\u884c\u76ee<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u306e\u4e21\u95a2\u6570\u306b\u3064\u3044\u3066\u306f\u305d\u308c\u305e\u308c\u30b9\u30c6\u30c3\u30d77\u30689\u3067\u8a73\u3057\u304f\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<h5><a id=\"post-128698-_25jq2gtkga8v\"><\/a>3. KernelCallbackTable\u3092\u898b\u3064\u3051\u3066\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30afxxxClientAllocWindowClassExtraBytes\u3068xxxClientAllocWindowClassExtraBytes\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u4fdd\u5b58\u3059\u308b<\/h5>\n<p>297\u301c304\u884c\u76ee\u307e\u3067\u306e\u30b3\u30fc\u30c9(\u56f35)\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u306e\u5834\u6240\u3092\u7279\u5b9a\u3057\u3001\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u3068<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u95a2\u6570\u306e\u30a2\u30c9\u30ec\u30b9\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u30ed\u30fc\u30ab\u30eb\u5909\u6570\u306b\u4fdd\u5b58\u3057\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u3068 <span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u95a2\u6570(\u30b9\u30c6\u30c3\u30d79\u3067\u8aac\u660e)\u3092\u30d5\u30c3\u30af\u3059\u308b\u306b\u306f\u3001\u5404\u95a2\u6570\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u898b\u3064\u3051\u308b\u5fc5\u8981\u304c\u3042\u308b\u306e\u3067\u3059\u3002\u3053\u308c\u3089\u306e\u95a2\u6570\u306f\u3044\u305a\u308c\u3082\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u3067\u3001Windows API\u5185\u3067\u306e\u5229\u7528\u306e\u305f\u3081\u306b\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u306a\u3044\u306e\u304c\u305d\u306e\u7406\u7531\u3067\u3059\u3002<a id=\"Figure5\"><\/a><\/p>\n<figure id=\"attachment_128517\" aria-describedby=\"caption-attachment-128517\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128517 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-5.png\" alt=\"\u753b\u50cf5\u306f\u3001PoC 297\u301c304\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002KernelCallbackTable\u306e\u4f4d\u7f6e\u3092\u7279\u5b9a\u3057\u3066\u30a2\u30c9\u30ec\u30b9\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u4fdd\u5b58\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"247\" \/><figcaption id=\"caption-attachment-128517\" class=\"wp-caption-text\">\u56f35. PoC 297\uff5e304\u884c\u76ee<\/figcaption><\/figure>\n<p>\u30d7\u30ed\u30bb\u30b9\u74b0\u5883\u30d6\u30ed\u30c3\u30af(PEB)\u3092\u30d1\u30fc\u30b9\u3059\u308b\u3053\u3068\u306b\u3088\u308a<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u306e\u5834\u6240\u304c\u7279\u5b9a\u3055\u308c\u307e\u3059\u3002\u3053\u306ePEB\u306e\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x58<\/span>\u306e\u4f4d\u7f6e\u306b<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><strong>\u6ce8<\/strong>: <span style=\"font-family: 'courier new', courier, monospace;\">GS[0x60]<\/span>\u30ec\u30b8\u30b9\u30bf\u30fc\u306f\u3001Windows x64\u30b7\u30b9\u30c6\u30e0\u3067\u306fPEB\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u542b\u3093\u3067\u3044\u307e\u3059\u3002\u3053\u306e\u30b3\u30fc\u30c9\u304c<span style=\"font-family: 'courier new', courier, monospace;\">__readgsqword(0x60u)<\/span>\u3092\u53c2\u7167\u3057\u3066\u3044\u308b\u306e\u306f\u305d\u306e\u305f\u3081\u3067\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u306f\u3001Windows\u30ab\u30fc\u30cd\u30eb\u304c\u4f7f\u7528\u3059\u308b\u3059\u3079\u3066\u306e\u30ab\u30fc\u30cd\u30eb \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u95a2\u6570\u3078\u30de\u30c3\u30d4\u30f3\u30b0\u3059\u308b\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u542b\u3080\u30c6\u30fc\u30d6\u30eb\u3067\u3059\u3002\u3053\u306ePEB\u306e<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u306e\u8868\u793a\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059(<span style=\"font-family: 'courier new', courier, monospace;\">dt nt!_peb @$peb<\/span>\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3063\u3066\u73fe\u5728\u306ePEB\u3092\u30c0\u30f3\u30d7\u3057\u305f)\u3002<\/p>\n<p>\u56f36\u306b\u793a\u3057\u305f<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306e\u51fa\u529b\u306b\u3082\u3068\u3065\u304f\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">PEB+0x58<\/span>\u306b <span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u30a2\u30c9\u30ec\u30b9\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure6\"><\/a><\/p>\n<figure id=\"attachment_128519\" aria-describedby=\"caption-attachment-128519\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128519 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-6.png\" alt=\"\u753b\u50cf6\u306fWinDbg\u306e\u51fa\u529b\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002KernelCallbackTable\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"229\" \/><figcaption id=\"caption-attachment-128519\" class=\"wp-caption-text\">\u56f36. <span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308bPEB\u306e\u51fa\u529b<\/figcaption><\/figure>\n<p>\u30ab\u30fc\u30cd\u30eb \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u306e\u6700\u521d\u306e\u3044\u304f\u3064\u304b\u306e\u30a8\u30f3\u30c8\u30ea\u30fc\u3092\u56f37\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure7\"><\/a><\/p>\n<figure id=\"attachment_128521\" aria-describedby=\"caption-attachment-128521\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128521 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-7.png\" alt=\"\u753b\u50cf7\u306f\u3001KernelCallbackTable\u306e\u6700\u521d\u306e16\u500b\u306e\u30a8\u30f3\u30c8\u30ea\u30fc\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"900\" height=\"469\" \/><figcaption id=\"caption-attachment-128521\" class=\"wp-caption-text\">\u56f37 <span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u306e\u6700\u521d\u306e16\u500b\u306e\u30a8\u30f3\u30c8\u30ea\u30fc<\/figcaption><\/figure>\n<p>\u3053\u306ePoC\u306f<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">g_oldxxxClientAllocWindowClassExtraBytes<\/span>\u3068 <span style=\"font-family: 'courier new', courier, monospace;\">g_oldxxxClientFreeWindowClassExtraBytes<\/span>\u306b\u30012\u3064\u306e\u30dd\u30a4\u30f3\u30bf\u30fc(\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x3d8<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">0x3e0<\/span>)\u3092\u305d\u308c\u305e\u308c\u4fdd\u5b58\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable+0x3d8<\/span>\u306b\u306f <span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u3001\u6b21\u306e\u30a8\u30f3\u30c8\u30ea\u30fc(<span style=\"font-family: 'courier new', courier, monospace;\">0x3e0<\/span>)\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u4fdd\u5b58\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u305d\u306e\u3088\u3046\u3059\u3092\u56f38\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure8\"><\/a><\/p>\n<figure id=\"attachment_128523\" aria-describedby=\"caption-attachment-128523\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128523 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-8.png\" alt=\"\u753b\u50cf8\u306f\u3001WinDbg\u3067KernelCallbackTable + 0x3d0\u3092\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u3057\u305f\u3055\u3044\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"900\" height=\"171\" \/><figcaption id=\"caption-attachment-128523\" class=\"wp-caption-text\">\u56f38. KernelCallbackTable + 0x3d0\u306eWinDbg\u306b\u3088\u308b\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u3002\u3053\u3053\u306b\u8208\u5473\u306e\u5bfe\u8c61\u3068\u306a\u308b2\u3064\u306e\u95a2\u6570\u304c\u914d\u7f6e\u3055\u308c\u3066\u3044\u308b<\/figcaption><\/figure>\n<h5><a id=\"post-128698-_1ykdt72ot841\"><\/a>4. \u30a6\u30a3\u30f3\u30c9\u30a6 \u30af\u30e9\u30b9\u3092\u3044\u304f\u3064\u304b\u5b9a\u7fa9\u3059\u308b<\/h5>\n<p>\u56f39\u306e\u30b3\u30fc\u30c9(312\u301c325\u884c\u76ee)\u306b\u306f\u898b\u899a\u3048\u304c\u3042\u308b\u3067\u3057\u3087\u3046\u3002<a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-1\/\">\u672c\u9023\u8f09\u306e\u7b2c1\u90e8<\/a>\u3067\u53d6\u308a\u4e0a\u3052\u305f\u3088\u3046\u306b\u30012\u3064\u306e\u30a6\u30a3\u30f3\u30c9\u30a6 \u30af\u30e9\u30b9\u3092\u5b9a\u7fa9\u3057\u3001\u305d\u306e\u3046\u30611\u3064(<span style=\"font-family: 'courier new', courier, monospace;\">wndClass<\/span>)\u3092\u767b\u9332\u3057\u3066\u3044\u307e\u3059\u3002\u4e00\u65b9\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">normalClass<\/span>\u3068\u3044\u3046\u30af\u30e9\u30b9\u540d\u304c\u4e0e\u3048\u3089\u308c\u3001\u3082\u3046\u4e00\u65b9\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">magicClass<\/span>\u3068\u3044\u3046\u30af\u30e9\u30b9\u540d\u304c\u4e0e\u3048\u3089\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u307e\u305f\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">magic<\/span>\u30a6\u30a3\u30f3\u30c9\u30a6 \u30af\u30e9\u30b9\u306b\u306f\u3001\u30e9\u30f3\u30c0\u30e0\u306a<span style=\"font-family: 'courier new', courier, monospace;\">cbWndExtra<\/span>\u5024\u304c\u4e0e\u3048\u3089\u308c\u3066\u3044\u308b\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u3002\u3053\u306e\u5024\u306f\u3001\u5f8c\u3067\u30d5\u30c3\u30af\u3055\u308c\u305f\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u3055\u3044\u306b\u30012\u3064\u306e\u30a6\u30a3\u30f3\u30c9\u30a6 \u30af\u30e9\u30b9\u3092\u533a\u5225\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059(\u8a73\u7d30\u5206\u6790\u306f\u5f8c\u8ff0)\u3002<a id=\"Figure9\"><\/a><\/p>\n<figure id=\"attachment_128525\" aria-describedby=\"caption-attachment-128525\" style=\"width: 748px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128525 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-9.png\" alt=\"\u753b\u50cf9\u306fPoC 312\u301c325\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002g_nRandom\u3092\u9ec4\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"748\" height=\"596\" \/><figcaption id=\"caption-attachment-128525\" class=\"wp-caption-text\">\u56f39. PoC 312\uff5e325\u884c\u76ee<\/figcaption><\/figure>\n<h5><a id=\"post-128698-_4k8elqoect3v\"><\/a>5. \u30d2\u30fc\u30d7 \u30b0\u30eb\u30fc\u30df\u30f3\u30b0\u3092\u884c\u3046<\/h5>\n<p>PoC 413\u301c467\u884c\u76ee\u307e\u3067\u306f<span style=\"font-family: 'courier new', courier, monospace;\">normalClass<\/span>\u3068\u3044\u3046\u30af\u30e9\u30b9 \u30bf\u30a4\u30d7\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u309210\u500b\u4f5c\u6210\u3059\u308bdo while\u30eb\u30fc\u30d7\u3092\u5b9a\u7fa9\u3057\u3066\u3044\u307e\u3059\u3002\u5404\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">somewnd<\/span>\u3068\u3044\u3046\u30a6\u30a3\u30f3\u30c9\u30a6\u540d\u304c\u4e0e\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u4f5c\u8005\u306f\u30010\u304b\u30899\u307e\u306710\u500b\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u3057\u305f\u5f8c\u30012\u304b\u30899\u307e\u3067\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u524a\u9664\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u304a\u305d\u3089\u304f\u3001\u3053\u3053\u3067\u6b8b\u3057\u305f2\u3064\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u3059\u3050\u5f8c\u308d\u306b\u5f8c\u304b\u3089PoC\u306e\u3053\u306e\u90e8\u5206\u3067\u4f5c\u6210\u3059\u308b\u3053\u3068\u306b\u306a\u308bmagic\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u5272\u308a\u5f53\u3066\u308b\u305f\u3081\u306b\u30d2\u30fc\u30d7 \u30b0\u30eb\u30fc\u30df\u30f3\u30b0\u3092\u884c\u304a\u3046\u3068\u3057\u305f\u306e\u3060\u308d\u3046\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u305f\u3060\u3057\u5f8c\u8ff0\u3059\u308b\u3088\u3046\u306b\u3001\u3053\u306e\u5b9f\u884c\u30b5\u30f3\u30d7\u30eb\u3067\u306f\u3001magic\u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u6700\u521d\u306e2\u3064\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u771f\u3093\u4e2d\u306b\u5272\u308a\u5f53\u3066\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>\u5404\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u4f5c\u6210\u6642\u3001\u3053\u306e\u4f5c\u8005\u306f\u5404\u30a6\u30a3\u30f3\u30c9\u30a6\u3078\u306e\u30cf\u30f3\u30c9\u30eb\u3092<span style=\"font-family: 'courier new', courier, monospace;\">arrhwndNoraml[]<\/span>\u3068\u3044\u3046\u540d\u524d\u306e\u914d\u5217\u306b\u683c\u7d0d\u3057\u307e\u3059\u3002\u6b21\u306b\u3001\u5404\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u3001<span style=\"font-family: 'courier new', courier, monospace;\">arrEntryDesktop[]<\/span>\u3068\u3044\u3046\u540d\u524d\u306e\u5225\u306e\u914d\u5217\u306b\u683c\u7d0d\u3057\u307e\u3059\u3002\u3053\u306e\u51e6\u7406\u306f<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u884c\u308f\u308c\u307e\u3059\u3002\u3059\u3067\u306b\u8aac\u660e\u3057\u305f\u3088\u3046\u306b\u3053\u306e\u547c\u3073\u51fa\u3057\u3067\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u5404<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30d4\u30fc\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u8fd4\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u56f310\u306f<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3092\u6700\u521d\u306b\u547c\u3073\u51fa\u3057\u305f\u5f8c(\u3064\u307e\u308a1\u3064\u3081\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u3057\u305f\u5f8c)\u306e\u623b\u308a\u5024(<span style=\"font-family: 'courier new', courier, monospace;\">rax<\/span>)\u3067\u3059\u3002<a id=\"Figure10\"><\/a><\/p>\n<figure id=\"attachment_128527\" aria-describedby=\"caption-attachment-128527\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128527 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-10.png\" alt=\"\u753b\u50cf10\u306f\u3001\u6700\u521d\u306b\u4f5c\u6210\u3057\u305f\u30a6\u30a3\u30f3\u30c9\u30a6\u3067HMValidateHandle\u3092\u547c\u3073\u51fa\u3057\u305f\u3055\u3044\u306e\u623b\u308a\u5024\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u623b\u308a\u5024\u306frax\u3067\u3059\u3002\" width=\"900\" height=\"525\" \/><figcaption id=\"caption-attachment-128527\" class=\"wp-caption-text\">\u56f310. \u6700\u521d\u306b\u4f5c\u6210\u3055\u308c\u305f\u30a6\u30a3\u30f3\u30c9\u30a6\u3067<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u3092\u547c\u3073\u51fa\u3057\u305f\u3068\u304d\u306e\u623b\u308a\u5024<\/figcaption><\/figure>\n<p>PoC\u5206\u6790\u3067\u91cd\u8981\u3068\u306a\u308b\u30e9\u30d9\u30eb\u3092<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306b\u8ffd\u52a0\u3057\u3066\u3042\u308a\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbWNDExtra<\/span>\u306e\u5024\u304c32 (<span style=\"font-family: 'courier new', courier, monospace;\">0x20<\/span>)\u3067\u3042\u308b\u3053\u3068\u306b\u7559\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u306e\u5024\u306f\u4e0a\u8a18\u56f39\u306e<span style=\"font-family: 'courier new', courier, monospace;\">normalClass<\/span>\u306e\u767b\u9332\u6642\u306b\u5ba3\u8a00\u3055\u308c\u305f\u5024\u3068\u540c\u3058\u3067\u3059\u3002<\/p>\n<p>\u307e\u305f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlags<\/span>\u306b\u3082\u6ce8\u76ee\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u306e\u5024\u304c<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u306e\u547c\u3073\u51fa\u3057\u4e2d\u306b\u5909\u5316\u3059\u308b\u5024\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u5024\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30a2\u30c9\u30ec\u30b9\u3067\u306f\u306a\u304f\u3001\u30ab\u30fc\u30cd\u30eb\u306b\u5bfe\u3059\u308b\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u793a\u3059\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u4f5c\u6210\u76f4\u5f8c\u306f\u3001\u3053\u306e\u5024\u304c\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30a2\u30c9\u30ec\u30b9(<span style=\"font-family: 'courier new', courier, monospace;\">0x0000015ba4b73fb0<\/span>)\u3067\u3042\u308b\u3053\u3068\u304c\u660e\u78ba\u306b\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<p>\u540c\u3058\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u56f311\u306b\u793a\u3057\u307e\u3059\u3002\u3053\u306e\u69cb\u9020\u4f53\u3092\u898b\u3064\u3051\u308b\u305f\u3081\u3001<span style=\"font-family: 'courier new', courier, monospace;\">CreateWindowExW<\/span>\u95a2\u6570\u3092\u9759\u7684\u306b\u89e3\u6790\u3057\u3066\u30e1\u30e2\u30ea\u30fc\u304c\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u5834\u6240\u3092\u7279\u5b9a\u3057\u3001\u5b9f\u884c\u4e2d\u305d\u306e\u5834\u6240\u306b\u30d6\u30ec\u30fc\u30af \u30dd\u30a4\u30f3\u30c8\u3092\u8a2d\u5b9a\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u30ab\u30fc\u30cd\u30eb\u5185\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u304c\u5b9f\u969b\u306b<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u306e\u547c\u3073\u51fa\u3057\u5f8c\u306b\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u3067\u8fd4\u3055\u308c\u308b\u3082\u306e\u3068\u540c\u3058\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u524d\u8ff0\u306e\u3088\u3046\u306b\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306f\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u5358\u306a\u308b\u30b3\u30d4\u30fc\u3067\u3001Win32k\u306f\u5b9f\u969b\u306b\u306f\u3053\u306e\u30b3\u30d4\u30fc\u3092\u4f7f\u3063\u3066\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u7ba1\u7406\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u5f8c\u8ff0\u3057\u307e\u3059\u304c\u3001\u5b9f\u306f\u30ab\u30fc\u30cd\u30eb\u5185\u306b\u306f\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u304c\u914d\u7f6e\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u89aa\u306e\u69cb\u9020\u4f53\u306b\u306f\u95a2\u9023\u3059\u308b\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u304c\u3059\u3079\u3066\u683c\u7d0d\u3055\u308c\u3066\u3044\u3066\u3001Microsoft\u306f\u30a6\u30a3\u30f3\u30c9\u30a6\u69cb\u9020\u4f53\u3078\u306e\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306e\u30a2\u30af\u30bb\u30b9\u306f\u3059\u3079\u3066\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30bb\u30fc\u30d5\u306a<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u4ecb\u3057\u3066\u884c\u308f\u308c\u308b\u3088\u3046\u306b\u3057\u3066\u304d\u307e\u3057\u305f\u3002Microsoft\u306f\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304b\u3089\u306e\u30ab\u30fc\u30cd\u30eb \u30dd\u30a4\u30f3\u30bf\u30fc\u6f0f\u3048\u3044\u9632\u6b62\u306b\u3072\u3068\u304b\u305f\u306a\u3089\u306c\u52aa\u529b\u3092\u3057\u3066\u304a\u308a\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u304b\u3089\u306f\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30a2\u30c9\u30ec\u30b9\u306b\u3057\u304b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u307e\u305b\u3093\u3002\u3053\u306e\u305f\u3081\u3001\u3053\u306e\u5236\u7d04\u3092\u56de\u907f\u3059\u308b\u65b9\u6cd5\u304c\u5c11\u3057\u5f8c\u3067\u5fc5\u8981\u306b\u306a\u308a\u307e\u3059\u3002<a id=\"Figure11\"><\/a><\/p>\n<figure id=\"attachment_128529\" aria-describedby=\"caption-attachment-128529\" style=\"width: 822px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128529 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-11.png\" alt=\"\u753b\u50cf11\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u3068\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u3067\u5171\u6709\u3055\u308c\u308btagWND\u69cb\u9020\u4f53\u306e\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9 \u30b3\u30d4\u30fc\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"822\" height=\"770\" \/><figcaption id=\"caption-attachment-128529\" class=\"wp-caption-text\">\u56f311 \u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u3068\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u3067\u5171\u6709\u3055\u308c\u308btagWND\u69cb\u9020\u4f53\u306e\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u306e\u30b3\u30d4\u30fc<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u304c\u5b58\u5728\u3059\u308b\u5b9f\u969b\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u78ba\u8a8d\u3059\u308c\u3070\u3001\u3055\u3089\u306b<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u304c\u660e\u78ba\u306b\u306a\u308b\u70b9\u306b\u3082\u7559\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002\u4e0a\u8a18\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u306e\u5024\u306f<span style=\"font-family: 'courier new', courier, monospace;\">0x38390<\/span>\u3067\u3001\u30ab\u30fc\u30cd\u30eb\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u306e\u30a2\u30c9\u30ec\u30b9\u306f<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e8201038390<\/span>\u3067\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u306e\u30a2\u30c9\u30ec\u30b9\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u306e\u5024\u3092\u5f15\u304f\u3068\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30a2\u30c9\u30ec\u30b9\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e8201000000<\/span>\u3092\u7279\u5b9a\u3067\u304d\u307e\u3059\u3002\u540c\u3058\u3053\u3068\u304c\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 <span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306b\u3064\u3044\u3066\u3082\u5f53\u3066\u306f\u307e\u308a\u307e\u3059\u3002<\/p>\n<p>\u5f8c\u3067\u4efb\u610f\u306ewrite\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u53d6\u5f97\u3059\u308c\u3070\u3001\u3053\u308c\u3089\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u304c\u30ab\u30fc\u30cd\u30eb \u30e1\u30e2\u30ea\u30fc\u7a7a\u9593\u5185\u306e\u30ca\u30d3\u30b2\u30fc\u30b7\u30e7\u30f3\u306b\u4f7f\u308f\u308c\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002\u7d9a\u304f\u7b2c3\u90e8\u3067\u306f\u30b9\u30c6\u30c3\u30d76\uff5e9\u3092\u898b\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em>\u7d9a\u304d\u3092\u8aad\u3080 \u27a0 <a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/3\">\u30bb\u30af\u30b7\u30e7\u30f3 3 \u2013 \u8a73\u7d30\u5206\u6790\u30b9\u30c6\u30c3\u30d76-9<\/a><\/em><\/strong><\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n<p><!--nextpage--><\/p>\n<h2><a id=\"TOC\"><\/a>\u76ee\u6b21<\/h2>\n<p><a href=\"#post-128698-_j62n51pm0si6\">6. \u30a6\u30a3\u30f3\u30c9\u30a6\u9593\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u8a08\u7b97\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_1vc6ug2if0ck\">7. \u6700\u3082\u4e0b\u4f4d\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30a2\u30c9\u30ec\u30b9\u3067NtUserConsoleControl\u3092\u547c\u3073\u51fa\u3059<\/a><br \/>\n<a href=\"#post-128698-_xddsw82ff6en\">8. 3\u3064\u3081\u306e(magic)\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_532yn1gc6kru\">9. NtUserConsoleControl\u3068NtCallbackReturn\u547c\u3073\u51fa\u3059\u60aa\u610f\u306e\u3042\u308b\u30d0\u30fc\u30b8\u30e7\u30f3\u3067xxxClientAllocWindowClassExtraBytes\u3092\u30d5\u30c3\u30af\u3057\u3066\u304b\u3089\u6b63\u898f\u306exxxClientAllocWindowClassExtraBytes\u306b\u623b\u308b<\/a><\/p>\n<h2><a id=\"FigToC\"><\/a>\u56f3\u8868\u306e\u76ee\u6b21<\/h2>\n<p><a href=\"#Figure12\">\u56f312. PoC 472\uff5e499\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure13\">\u56f313. Wnd1\u306eHMValidateHandle\u306e\u623b\u308a\u5024(rax)\u3092WinDbg\u3067\u30c0\u30f3\u30d7\u3057\u305f\u3068\u3053\u308d<\/a><br \/>\n<a href=\"#Figure14\">\u56f314. Wnd0\u306eHMValidateHandle\u306e\u623b\u308a\u5024(rax)\u3092WinDbg\u3067\u30c0\u30f3\u30d7\u3057\u305f\u3068\u3053\u308d<\/a><br \/>\n<a href=\"#Figure15\">\u56f315. PoC 501\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure16\">\u56f316. NtUserConsoleControl\u547c\u3073\u51fa\u3057\u524d\u5f8c\u306eWnd0\u306epExtraBytes\u306e\u5024<\/a><br \/>\n<a href=\"#Figure17\">\u56f317. WndMagic\u306e\u4f5c\u6210<\/a><br \/>\n<a href=\"#Figure18\">\u56f318. WndMagic\u4f5c\u6210\u76f4\u5f8c\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8<\/a><br \/>\n<a href=\"#Figure19\">\u56f319. PoC 522\uff5e530\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure20\">\u56f320. \u30dd\u30a4\u30f3\u30bf\u30fc\u4e0a\u66f8\u304d\u524d\u306eKernelCallbackTable<\/a><br \/>\n<a href=\"#Figure21\">\u56f321. \u30dd\u30a4\u30f3\u30bf\u30fc\u4e0a\u66f8\u304d\u5f8c\u306eKernelCallbackTable<\/a><br \/>\n<a href=\"#Figure22\">\u56f322. PoC 170\uff5e190\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure23\">\u56f323. PoC 496\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure24\">\u56f324. PoC 151\uff5e164\u884c\u76ee<\/a><\/p>\n<h5><a id=\"post-128698-_j62n51pm0si6\"><\/a>6. \u30a6\u30a3\u30f3\u30c9\u30a6\u9593\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u8a08\u7b97\u3059\u308b<\/h5>\n<p>472\u884c\u76ee\u304b\u3089499\u884c\u76ee(\u56f312)\u3067\u306f\u5358\u7d14\u306b\u3001\u6700\u521d\u306b\u4f5c\u6210\u3055\u308c\u305f2\u3064\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u3046\u3061\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30d9\u30fc\u30b9\u306b\u5bfe\u3059\u308b\u30aa\u30d5\u30bb\u30c3\u30c8\u304c\u5c0f\u3055\u3044\u65b9\u3092\u6c7a\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u30dd\u30a4\u30f3\u30bf\u30fc\u3068<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u3092\u3001\u30e1\u30e2\u30ea\u30fc\u5185\u3067\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u9806\u756a\u306b\u3082\u3068\u3065\u3044\u3066<span style=\"font-family: 'courier new', courier, monospace;\">_min<\/span>\u307e\u305f\u306f<span style=\"font-family: 'courier new', courier, monospace;\">_max<\/span>\u306e\u30bf\u30b0\u3092\u4ed8\u3051\u305f\u5909\u6570\u306b\u4ee3\u5165\u3057\u307e\u3059\u3002<a id=\"Figure12\"><\/a><\/p>\n<figure id=\"attachment_128531\" aria-describedby=\"caption-attachment-128531\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128531 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-12.png\" alt=\"\u753b\u50cf12\u306f\u3001PoC 472\u301c499\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u30dd\u30a4\u30f3\u30bf\u30fc\u3068\u3001\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u5909\u6570\u306b\u3069\u306e\u3088\u3046\u306b\u4ee3\u5165\u3055\u308c\u308b\u304b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"469\" \/><figcaption id=\"caption-attachment-128531\" class=\"wp-caption-text\">\u56f312. PoC 472\uff5e499\u884c\u76ee<\/figcaption><\/figure>\n<p>\u4eca\u56de\u306e\u5834\u5408\u3001\u6700\u521d\u306b\u4f5c\u6210\u3055\u308c\u305f\u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u3001\u5b9f\u306f\u30e1\u30e2\u30ea\u30fc\u4e0a\u3067\u6700\u3082\u4e0b\u4f4d\u306b\u306f\u306a\u304b\u3063\u305f\u306e\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u3068\u547c\u3076\u3053\u3068\u306b\u3057\u307e\u3059\u30022\u3064\u3081\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u3001\u30e1\u30e2\u30ea\u30fc\u4e0a\u3067\u306f\u3088\u308a\u4e0b\u4f4d\u306b\u3042\u308b\u305f\u3081\u3001\u4eca\u5f8c\u306f\u3053\u3061\u3089\u3092<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u3068\u547c\u3093\u3067\u3001\u30e1\u30e2\u30ea\u30fc\u4e0a\u3067\u306e\u4f4d\u7f6e\u3092\u53cd\u6620\u3059\u308b\u3053\u3068\u306b\u3057\u307e\u3059\u3002<\/p>\n<p>\u56f313\u3067\u793a\u3057\u305f\u5185\u5bb9\u304b\u3089\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306f<span style=\"font-family: 'courier new', courier, monospace;\">0x15ba5028390 - 0x38390<\/span>\u3001\u3064\u307e\u308a<span style=\"font-family: 'courier new', courier, monospace;\">0x15ba4ff0000<\/span>\u306b\u306a\u3051\u308c\u3070\u306a\u3089\u306a\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure13\"><\/a><\/p>\n<figure id=\"attachment_128533\" aria-describedby=\"caption-attachment-128533\" style=\"width: 820px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128533 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-13.png\" alt=\"\u753b\u50cf13\u306f\u3001WND1\u306eHMValidateHandle\u306e\u623b\u308a\u5024\u3092WinDbg\u3067\u30c0\u30f3\u30d7\u3057\u305f\u3088\u3046\u3059\u3092\u8868\u3059\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"820\" height=\"140\" \/><figcaption id=\"caption-attachment-128533\" class=\"wp-caption-text\">\u56f313. <span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u306e\u623b\u308a\u5024(<span style=\"font-family: 'courier new', courier, monospace;\">rax<\/span>)\u3092<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u3067\u30c0\u30f3\u30d7\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u3092\u53d6\u308a\u51fa\u3057\u3066\u4e0a\u8a18\u3067\u8a08\u7b97\u3057\u305f\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30a2\u30c9\u30ec\u30b9\u306b\u52a0\u7b97\u3059\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0x15ba4ff0000 + 0x2ad30<\/span>\u3001\u3064\u307e\u308a<span style=\"font-family: 'courier new', courier, monospace;\">0x15ba501ad30<\/span>\u304c\u5f97\u3089\u308c\u307e\u3059\u3002\u56f314\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u3053\u308c\u304c\u307e\u3055\u306b<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306b\u5bfe\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u304c\u8fd4\u3057\u305f\u5185\u5bb9\u3067\u3059\u3002<a id=\"Figure14\"><\/a><\/p>\n<figure id=\"attachment_128535\" aria-describedby=\"caption-attachment-128535\" style=\"width: 822px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128535 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-14.png\" alt=\"\u753b\u50cf14\u306fWND0\u306eHMValidateHandle\u306e\u623b\u308a\u5024\u3092WinDbg\u3067\u30c0\u30f3\u30d7\u3057\u305f\u3088\u3046\u3059\u3092\u8868\u3059\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"822\" height=\"136\" \/><figcaption id=\"caption-attachment-128535\" class=\"wp-caption-text\">\u56f314 <span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">HMValidateHandle<\/span>\u306e\u623b\u308a\u5024(<span style=\"font-family: 'courier new', courier, monospace;\">rax<\/span>)\u3092<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u3067\u30c0\u30f3\u30d7\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n<p>PoC\u306e\u3053\u306e\u90e8\u5206\u3067\u306f\u3001\u5358\u306b\u3053\u306e\u8a08\u7b97\u3092\u884c\u3044\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3068\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u4ee5\u4e0b\u306e\u30c8\u30e9\u30c3\u30ad\u30f3\u30b0\u7528\u306e\u5909\u6570\u306b\u4ee3\u5165\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset1<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset2<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset_Min<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">tagWndMin_offset_0x128<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">tagWndMin_offset_0x128<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset_Min<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">hWndMin<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">hWndMax<\/span><\/li>\n<\/ul>\n<h5><a id=\"post-128698-_1vc6ug2if0ck\"><\/a>7. \u6700\u3082\u4e0b\u4f4d\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30a2\u30c9\u30ec\u30b9\u3067NtUserConsoleControl\u3092\u547c\u3073\u51fa\u3059<\/h5>\n<p>\u6b21\u306b\u3053\u306e\u4f5c\u8005\u306f<span style=\"font-family: 'courier new', courier, monospace;\">hWndMin<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>)\u306b\u5bfe\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>(PoC 501\u884c\u76ee\u3001\u56f315\u306b\u793a\u3059)\u3092\u547c\u3073\u51fa\u3057\u307e\u3059\u3002<a id=\"Figure15\"><\/a><\/p>\n<figure id=\"attachment_128537\" aria-describedby=\"caption-attachment-128537\" style=\"width: 696px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128537 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-15.png\" alt=\"\u753b\u50cf15\u306fPoC 501\u884c\u76ee\u3067\u3059\u3002g_pfnNtUserConsoleControl(6, &amp;hWndMin, 0x10); \u3068\u3044\u3046\u5185\u5bb9\u3067\u3059\u3002\" width=\"696\" height=\"76\" \/><figcaption id=\"caption-attachment-128537\" class=\"wp-caption-text\">\u56f315. PoC 501\u884c\u76ee<\/figcaption><\/figure>\n<p>\u3053\u308c\u3067<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306f\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5909\u63db\u3055\u308c\u307e\u3059\u3002\u305d\u306e\u7d50\u679c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u304c\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30a2\u30c9\u30ec\u30b9 \u30dd\u30a4\u30f3\u30bf\u30fc\u304b\u3089\u30aa\u30d5\u30bb\u30c3\u30c8\u3078\u3068\u5909\u66f4\u3055\u308c\u307e\u3059\u3002Windows\u306f\u3053\u306e\u5f8c\u3001\u3053\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30d9\u30fc\u30b9\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\u6271\u3044\u307e\u3059\u3002\u306a\u305c\u305d\u3046\u306a\u308b\u304b\u3068\u8a00\u3048\u3070\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u306e\u5024\u306b<span style=\"font-family: 'courier new', courier, monospace;\">0x800<\/span>\u3092\u8ffd\u52a0\u3057\u305f\u3053\u3068\u306b\u3088\u308a\u3001\u30a6\u30a3\u30f3\u30c9\u30a6 \u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u306b\u5bfe\u3057\u3066\u3001\u300c\u3053\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306a\u306e\u3067<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30d9\u30fc\u30b9 \u30a2\u30c9\u30ec\u30b9\u304b\u3089\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\u6271\u3063\u3066\u304f\u3060\u3055\u3044\u300d\u3068\u6307\u793a\u3057\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3092\u547c\u3073\u51fa\u3059\u524d\u3068\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u56f316\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure16\"><\/a><\/p>\n<figure id=\"attachment_128539\" aria-describedby=\"caption-attachment-128539\" style=\"width: 402px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128539 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-16.png\" alt=\"\u753b\u50cf16\u306f\u3001NtUserConsoleControl\u3092\u547c\u3073\u51fa\u3059\u524d\u3068\u5f8c\u306eWnd0\u306epExtraBytes\u306e\u5024\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u30b3\u30fc\u30c9\u306e\u306a\u304b\u306b\u306f2\u3064\u9ec4\u8272\u306e\u9577\u65b9\u5f62\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u9818\u57df\u304c\u3042\u308a\u307e\u3059\u3002\" width=\"402\" height=\"347\" \/><figcaption id=\"caption-attachment-128539\" class=\"wp-caption-text\">\u56f316. <span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u547c\u3073\u51fa\u3057\u524d\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u306e\u5024<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306e\u4eee\u60f3\u30a2\u30c9\u30ec\u30b9<span style=\"font-family: 'courier new', courier, monospace;\">0x15ba4b74370<\/span>\u304b\u3089\u3001\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">0x2ae80<\/span>\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0x100100018<\/span>\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">0x100100818<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">0x100100018 + 0x800<\/span>)\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u308c\u3067<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u306f\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u3078\u306e\u30ab\u30fc\u30cd\u30eb \u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u6307\u3059\u3088\u3046\u306b\u306a\u3063\u305f\u306e\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u5185\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306f\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306b\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u52a0\u7b97\u3057\u305f\u7d50\u679c\u3001\u3064\u307e\u308a<span style=\"font-family: 'courier new', courier, monospace;\">0xff8e8201000000 + 0x2ae80 = 0xff8e820102a80<\/span>\u3092\u6307\u3059\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u30a2\u30c9\u30ec\u30b9\u306f\u73fe\u6642\u70b9\u3067\u306f\u610f\u5473\u304c\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u305d\u306e\u4f7f\u3044\u304b\u305f\u306b\u3064\u3044\u3066\u306f\u30b9\u30c6\u30c3\u30d79\u3067\u8a73\u3057\u304f\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<h5><a id=\"post-128698-_xddsw82ff6en\"><\/a>8. 3\u3064\u3081\u306e(magic)\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u3059\u308b<\/h5>\n<p>\u6b21\u306b3\u3064\u3081\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u304c\u4f5c\u6210\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u4e0a\u8a18\u306e\u30b9\u30c6\u30c3\u30d74\u3067\u767b\u9332\u3057\u305f<span style=\"font-family: 'courier new', courier, monospace;\">magicClass<\/span>\u30af\u30e9\u30b9\u306b\u5c5e\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u6700\u521d\u306e2\u3064\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u3068\u540c\u69d8\u306b<span style=\"font-family: 'courier new', courier, monospace;\">somewnd<\/span>\u3068\u3044\u3046\u540d\u524d\u304c\u4e0e\u3048\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u4eca\u5f8c\u306f\u3053\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3092<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u3068\u547c\u3076\u3053\u3068\u306b\u3057\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">CreateWindowExW<\/span>\u306e\u547c\u3073\u51fa\u3057\u306f\u3001\u56f317\u306b\u793a\u3059\u3068\u304a\u308a\u3067\u3059\u3002<a id=\"Figure17\"><\/a><\/p>\n<figure id=\"attachment_128541\" aria-describedby=\"caption-attachment-128541\" style=\"width: 680px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128541 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-17.png\" alt=\"17\u306e\u753b\u50cf\u306fCreateWindowExW\u3092\u547c\u3073\u51fa\u3057\u3066\u3044\u308b\u30b3\u30fc\u30c9\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u308c\u306fmagicClass\u306e\u4e2d\u306b\u3042\u308a\u307e\u3059\u3002\" width=\"680\" height=\"606\" \/><figcaption id=\"caption-attachment-128541\" class=\"wp-caption-text\">\u56f317. <span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e\u4f5c\u6210<\/figcaption><\/figure>\n<p>\u4eca\u56de\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u5f8c\u306e\u5168\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8\u3092\u56f318\u306b\u793a\u3057\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">0x100100818<\/span>\u306b\u5bfe\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">0x10010018<\/span>)\u304c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">0x2ae80<\/span>)\u304c\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u306a\u3063\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u308b\u70b9\u306b\u3054\u6ce8\u76ee\u304f\u3060\u3055\u3044\u3002<\/p>\n<p>\u3053\u306e\u56f3\u304b\u3089\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e\u30ab\u30fc\u30cd\u30eb\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3068\u305d\u306e\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30d4\u30fc\u306e\u4e21\u65b9\u304c\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u5185\u306e\u540c\u3058\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u6307\u3057\u3066\u3044\u308b\u3053\u3068\u3001\u305d\u306e\u4e00\u65b9\u3067\u307b\u304b\u306e2\u3064\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u304c\u30e6\u30fc\u30b6\u30fc \u30e9\u30f3\u30c9\u5185\u306e\u30e1\u30e2\u30ea\u30fc\u3092\u6307\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure18\"><\/a><\/p>\n<figure id=\"attachment_128543\" aria-describedby=\"caption-attachment-128543\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128543 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-18.png\" alt=\"\u753b\u50cf18\u306f\u3001WndMagic\u4f5c\u6210\u76f4\u5f8c\u306e\u30e1\u30e2\u30ea\u30fc\u30ec\u30a4\u30a2\u30a6\u30c8\u3092\u8868\u3057\u305f\u56f3\u3067\u3059\u3002\u5de6\u5074\u304c\u30e6\u30fc\u30b6\u30fc \u30e9\u30f3\u30c9\u3068\u305d\u306e\u30ec\u30a4\u30a2\u30a6\u30c8\u3001\u53f3\u5074\u304c\u30ab\u30fc\u30cd\u30eb \u30e9\u30f3\u30c9\u3067\u3059\u3002\" width=\"900\" height=\"824\" \/><figcaption id=\"caption-attachment-128543\" class=\"wp-caption-text\">\u56f318. <span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u4f5c\u6210\u76f4\u5f8c\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8<\/figcaption><\/figure>\n<p><strong>\u6ce8<\/strong>: \u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u4f5c\u6210\u9806\u5e8f\u304c\u305d\u306e\u307e\u307e\u30e1\u30e2\u30ea\u30fc\u4e0a\u306e\u914d\u7f6e\u9806\u5e8f\u3068\u547c\u5fdc\u3059\u308b\u308f\u3051\u3067\u306f\u306a\u3044\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3059\u3002\u4eca\u56de\u306e\u5834\u5408\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306f2\u756a\u3081\u306b\u4f5c\u6210\u3055\u308c\u305f\u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u3059\u304c\u6700\u3082\u4e0b\u4f4d\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u914d\u7f6e\u3055\u308c\u3066\u3044\u3066\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306f\u6700\u5f8c\u306b\u4f5c\u6210\u3055\u308c\u307e\u3057\u305f\u304c\u3001\u4e0b\u4f4d\u304b\u30892\u756a\u3081\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u914d\u7f6e\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u679c\u305f\u3057\u3066\u30b9\u30c6\u30c3\u30d75\u3067\u6700\u521d\u306b\u4f5c\u6210\u3059\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u6570\u3092\u5897\u3084\u305b\u3070\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8\u304c\u3088\u308a\u4e88\u6e2c\u3057\u3084\u3059\u304f\u306a\u308a\u3001\u30b9\u30c6\u30c3\u30d76\u3067\u306e\u5404\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30e1\u30e2\u30ea\u30fc\u914d\u7f6e\u9806\u5e8f\u6c7a\u5b9a\u306b\u5fc5\u8981\u306a\u8a08\u7b97\u91cf\u304c\u6e1b\u308b\u306e\u304b\u3069\u3046\u304b\u3001\u78ba\u8a8d\u3057\u3066\u307f\u308b\u306e\u3082\u4e00\u8208\u3067\u3057\u3087\u3046\u3002<\/p>\n<h5><a id=\"post-128698-_532yn1gc6kru\"><\/a>9. NtUserConsoleControl\u3068NtCallbackReturn\u547c\u3073\u51fa\u3059\u60aa\u610f\u306e\u3042\u308b\u30d0\u30fc\u30b8\u30e7\u30f3\u3067xxxClientAllocWindowClassExtraBytes\u3092\u30d5\u30c3\u30af\u3057\u3066\u304b\u3089\u6b63\u898f\u306exxxClientAllocWindowClassExtraBytes\u306b\u623b\u308b<\/h5>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e\u4f5c\u6210\u5f8c\u306f\u56f319\u306b\u793a\u3057\u305f\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u307e\u3059(PoC 522\u301c530\u884c\u76ee)\u3002<a id=\"Figure19\"><\/a><\/p>\n<figure id=\"attachment_128545\" aria-describedby=\"caption-attachment-128545\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128545 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-19.png\" alt=\"\u753b\u50cf19\u306fPoC 522\u301c530\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u30b3\u30fc\u30c9\u304cWndMagic\u306e\u751f\u6210\u5f8c\u306b\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002\" width=\"900\" height=\"260\" \/><figcaption id=\"caption-attachment-128545\" class=\"wp-caption-text\">\u56f319 PoC 522\uff5e530\u884c\u76ee<\/figcaption><\/figure>\n<p>\u307e\u305a\u3001<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3068 <span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u3078\u306e\u30e1\u30e2\u30ea\u30fc\u4fdd\u8b77\u304c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">VirtualProtect<\/span>\u306e\u547c\u3073\u51fa\u3057\u306b\u3088\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">PAGE_READONLY<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">0x2<\/span>)\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">PAGE_EXECUTE_READWRITE<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">0x40<\/span>)\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u6b21\u306b<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3068 <span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u306e\u30ab\u30fc\u30cd\u30eb \u30b3\u30fc\u30eb\u30d0\u30c3\u30af \u30c6\u30fc\u30d6\u30eb\u306e\u30dd\u30a4\u30f3\u30bf\u30fc \u30a8\u30f3\u30c8\u30ea\u30fc\u304c\u305d\u308c\u305e\u308c\u3001\u653b\u6483\u8005\u306e\u5b9a\u7fa9\u3059\u308b\u95a2\u6570\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u3068 <span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientFreeWindowClassExtraBytes<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u306b\u3088\u3063\u3066\u4e0a\u66f8\u304d\u3055\u308c\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<p>\u56f320\u306f\u3001\u95a2\u6570\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u4e0a\u66f8\u304d\u3055\u308c\u308b\u524d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure20\"><\/a><\/p>\n<figure id=\"attachment_128547\" aria-describedby=\"caption-attachment-128547\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128547 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-20.png\" alt=\"\u753b\u50cf20\u306f\u3001\u95a2\u6570\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u4e0a\u66f8\u304d\u3055\u308c\u308b\u524d\u306eKernelCallbackTable\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"900\" height=\"176\" \/><figcaption id=\"caption-attachment-128547\" class=\"wp-caption-text\">\u56f320. \u30dd\u30a4\u30f3\u30bf\u30fc\u4e0a\u66f8\u304d\u524d\u306eKernelCallbackTable<\/figcaption><\/figure>\n<p>\u56f321\u306f2\u3064\u306e\u95a2\u6570\u3092\u30d5\u30c3\u30af\u3057\u305f\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span>\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure21\"><\/a><\/p>\n<figure id=\"attachment_128549\" aria-describedby=\"caption-attachment-128549\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128549 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-21.png\" alt=\"\u753b\u50cf21\u306f2\u3064\u306e\u95a2\u6570\u304c\u30d5\u30c3\u30af\u3055\u308c\u3066\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u4e0a\u66f8\u304d\u3055\u308c\u305f\u5f8c\u306eKernelCallbackTable\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"135\" \/><figcaption id=\"caption-attachment-128549\" class=\"wp-caption-text\">\u56f321. \u30dd\u30a4\u30f3\u30bf\u30fc\u4e0a\u66f8\u304d\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">KernelCallbackTable<\/span><\/figcaption><\/figure>\n<p>\u3053\u308c\u3067\u6b63\u898f\u306e\u95a2\u6570\u306b\u60aa\u610f\u306e\u3042\u308b\u95a2\u6570<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u3068 <span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientFreeWindowClassExtraBytes<\/span>\u304c\u3046\u307e\u304f\u30d5\u30c3\u30af\u3055\u308c\u305f\u306e\u3067\u3001\u6b63\u898f\u306e\u95a2\u6570\u304c\u547c\u3073\u51fa\u3055\u308c\u308c\u3070\u3044\u3064\u3067\u3082<span style=\"font-family: 'courier new', courier, monospace;\">g_new<\/span>\u95a2\u6570\u306b\u5b9f\u884c\u304c\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u306a\u305c\u3053\u308c\u3089\u306e\u95a2\u6570\u3092\u30d5\u30c3\u30af\u3057\u305f\u304c\u308b\u4eba\u304c\u3044\u308b\u306e\u304b\u3092\u7406\u89e3\u3059\u308b\u306b\u306f\u3001\u6b63\u898f\u306e\u95a2\u6570\u304c\u4f55\u3092\u3059\u308b\u3082\u306e\u304b\u3092\u7406\u89e3\u3059\u308b\u3068\u3088\u3044\u3067\u3057\u3087\u3046\u3002\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbWndExtra<\/span>\u306e\u5024\u3092\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3068\u3057\u3066\u53d7\u3051\u53d6\u3063\u3066\u3001\u305d\u306e\u30d0\u30a4\u30c8\u6570\u3092\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306b\u5272\u308a\u5f53\u3066\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u306e\u547c\u3073\u51fa\u3057\u306b\u3088\u308a\u3001\u5272\u308a\u5f53\u3066\u5148\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u8fd4\u3055\u308c\u307e\u3059(\u3053\u308c\u304c\u5f8c\u3067\u91cd\u8981\u306b\u306a\u308a\u307e\u3059)\u3002\u305d\u3057\u3066\u3053\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u306f\u3001\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u683c\u7d0d\u3055\u308c\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u30d5\u30c3\u30af\u3067\u304d\u308c\u3070\u3001\u6700\u4f4e\u3067\u3082\u3001\u53c2\u7167\u3055\u308c\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u66f8\u304d\u8fbc\u307e\u308c\u308b\u30dd\u30a4\u30f3\u30bf\u30fc\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u3001\u4efb\u610f\u306e\u3082\u306e\u306b\u3067\u304d\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u3053\u306e\u30a2\u30c9\u30ec\u30b9 \u30dd\u30a4\u30f3\u30bf\u30fc\u306f\u30e6\u30fc\u30b6\u30fc \u30e2\u30fc\u30c9 \u30dd\u30a4\u30f3\u30bf\u30fc\u306a\u306e\u3067\u3001\u30ab\u30fc\u30cd\u30eb\u5185\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u3066System\u30c8\u30fc\u30af\u30f3\u3092\u76d7\u307f\u3001\u305d\u308c\u306b\u3088\u3063\u3066\u7279\u6a29\u3092\u6607\u683c\u3055\u305b\u308b\u3053\u3068\u304c\u76ee\u7684\u306a\u3089\u3001\u3042\u307e\u308a\u610f\u5473\u304c\u3042\u308a\u307e\u305b\u3093\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u30ab\u30fc\u30cd\u30eb \u30e1\u30e2\u30ea\u30fc\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\u3059\u308b\u306b\u306f\u4f55\u304b\u5225\u306e\u3082\u306e\u304c\u5fc5\u8981\u306b\u306a\u308b\u306e\u3067\u3059\u304c\u3001\u3053\u308c\u306b\u3064\u3044\u3066\u306f\u5f8c\u3067\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<p>\u56f322\u306f\u3001\u60aa\u610f\u306e\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u306e\u95a2\u6570\u5b9a\u7fa9\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure22\"><\/a><\/p>\n<figure id=\"attachment_128551\" aria-describedby=\"caption-attachment-128551\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128551 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-22.png\" alt=\"\u753b\u50cf22\u306f\u3001PoC 170\u301c190\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306b\u306f\u60aa\u610f\u306e\u3042\u308bg_newxxxClientAllocWindowClassExtraBytes\u306e\u95a2\u6570\u5b9a\u7fa9\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"355\" \/><figcaption id=\"caption-attachment-128551\" class=\"wp-caption-text\">\u56f322. PoC 170\uff5e190\u884c\u76ee<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u306e\u4e3b\u306a\u76ee\u7684\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3092\u547c\u3073\u51fa\u3057\u3066\u73fe\u5728\u53c2\u7167\u3055\u308c\u3066\u3044\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30cf\u30f3\u30c9\u30eb\u3092\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30cf\u30f3\u30c9\u30eb\u306b\u5909\u66f4\u3059\u308b\u3053\u3068\u3067\u3059\u3002\u30b9\u30c6\u30c3\u30d77\u3067\u8aac\u660e\u3057\u305f\u3088\u3046\u306b\u3001\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u3001\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30d4\u30fc\u5185\u3067\u306f\u8ffd\u52a0\u306e\u30d0\u30a4\u30c8 \u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u7ba1\u7406\u3057\u3066\u304a\u3089\u305a\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u5185\u3067\u3053\u308c\u3092\u76f4\u63a5\u7ba1\u7406\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u305f\u3081\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30dd\u30a4\u30f3\u30bf\u30fc\u3067\u306f\u306a\u304f\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\u6271\u308f\u308c\u307e\u3059\u3002<\/p>\n<p>\u901a\u5e38\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u306f\u6b63\u898f<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u306e\u30b3\u30fc\u30eb \u30b9\u30bf\u30c3\u30af\u5185\u306b\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u3053\u306e\u305f\u3081Windows\u306f<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span> (<span style=\"font-family: 'courier new', courier, monospace;\">0x800<\/span>\u3092\u8ffd\u52a0)\u3084<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u5909\u66f4\u3092\u52a0\u3048\u308b\u3053\u3068\u3092\u4e88\u671f\u3057\u3066\u304a\u3089\u305a\u3001\u30d7\u30ed\u30b0\u30e9\u30e0\u7684\u306b\u3082\u60f3\u5b9a\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3002\u3053\u306e\u7d50\u679c\u3001\u4e88\u671f\u305b\u306c\u30ab\u30fc\u30cd\u30eb \u30e1\u30e2\u30ea\u30fc \u30a2\u30af\u30bb\u30b9\u3078\u3068\u3064\u306a\u304c\u308b\u578b\u306e\u53d6\u308a\u9055\u3048(type confusion)\u30d0\u30b0(CVE-2022-21882)\u304c\u767a\u751f\u3057\u307e\u3059\u3002<\/p>\n<p>\u6a19\u6e96\u306eGUI\u30a6\u30a3\u30f3\u30c9\u30a6\u306f<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u5165\u3063\u305f\u72b6\u614b\u3067\u521d\u671f\u5316\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u4eca\u3067\u306f\u30a6\u30a3\u30f3\u30c9\u30a6 \u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u304c\u3053\u306e\u5024\u3092\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\u6271\u3046\u3088\u3046\u306b\u306a\u3063\u305f\u306e\u3067\u3001\u3053\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u5024\u306f\u5909\u66f4\u3055\u308c\u306d\u3070\u306a\u308a\u307e\u305b\u3093\u3002\u65b0\u3057\u3044\u5024\u306b\u306f\u3001\u4eca\u5b58\u5728\u3059\u308b\u3082\u3063\u3068\u5927\u304d\u306a\u30dd\u30a4\u30f3\u30bf\u30fc\u306e\u5024\u3068\u306f\u5bfe\u7167\u7684\u306b\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30d9\u30fc\u30b9\u304b\u3089\u306e\u6709\u7528\u306a\u30aa\u30d5\u30bb\u30c3\u30c8\u5024\u3092\u53cd\u6620\u3055\u305b\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u306e\u5834\u5408\u3001\u8981\u6c42\u3055\u308c\u305f\u30e1\u30e2\u30ea\u30fc\u306e\u5272\u308a\u5f53\u3066\u304c\u7d42\u308f\u308b\u3068\u3001\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u30e1\u30e2\u30ea\u30fc\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u95a2\u6570\u306b\u6e21\u3057\u3066\u3001\u5b9f\u884c\u3092\u30ab\u30fc\u30cd\u30eb\u306b\u623b\u3057\u307e\u3059\u3002\u3053\u306e\u7d50\u679c\u3001\u6700\u7d42\u7684\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u306e\u30e1\u30e2\u30ea\u30fc\u5272\u308a\u5f53\u3066\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u683c\u7d0d\u3055\u308c\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u304c <span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u3092\u547c\u3073\u51fa\u3059\u76f4\u524d\u3001<span style=\"font-family: 'courier new', courier, monospace;\">qwRet<\/span>\u304c <span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset_Min<\/span>\u306e\u5024\u306b\u8a2d\u5b9a\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u5024\u306f\u524d\u8ff0\u306e\u30b9\u30c6\u30c3\u30d76\u306e\u56f312\u3067\u898b\u305f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u306e\u5024\u3067\u3059\u3002\u56f323\u306f<span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset_Min<\/span>\u306b<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u3092\u5272\u308a\u5f53\u3066\u308bPoC\u306e\u30b3\u30fc\u30c9\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure23\"><\/a><\/p>\n<figure id=\"attachment_128553\" aria-describedby=\"caption-attachment-128553\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128553 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-23.png\" alt=\"\u753b\u50cf23\u306f\u3001kernel_desktop_heap_base_offset_Min\u3067\u59cb\u307e\u308bPoC 496\u884c\u76ee\u3067\u3059\u3002\" width=\"900\" height=\"41\" \/><figcaption id=\"caption-attachment-128553\" class=\"wp-caption-text\">\u56f323. PoC 496\u884c\u76ee<\/figcaption><\/figure>\n<p>\u304a\u3055\u3089\u3044\u3059\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u3092\u547c\u3073\u51fa\u3059\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u304c\u30ab\u30fc\u30cd\u30eb\u3078\u306e<strong>\u30aa\u30d5\u30bb\u30c3\u30c8<\/strong>\u3068\u3057\u3066\u89e3\u91c8\u3055\u308c\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">NtCallbackReturn<\/span>\u306e\u547c\u3073\u51fa\u3057\u306f\u3001\u305d\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u3078\u306e<strong>\u30aa\u30d5\u30bb\u30c3\u30c8<\/strong>\u3067\u4e0a\u66f8\u304d\u3057\u307e\u3059\u3002\u3064\u307e\u308a\u3053\u308c\u3067\u3001\u300c\u3042\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3092<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u6307\u3059\u3088\u3046\u306b\u5909\u66f4\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u300d\u3068\u3044\u3046\u3053\u3068\u3067\u3059\u3002\u3053\u308c\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3059\u95a2\u6570\u304c\u898b\u3064\u304b\u308b\u3053\u3068\u3092\u524d\u63d0\u3068\u3057\u3066\u3044\u307e\u3059(\u6b21\u306e\u30b9\u30c6\u30c3\u30d7\u3067\u8a73\u8ff0)\u3002<\/p>\n<p>\u56f324\u306f\u3001\u30d5\u30c3\u30af\u3055\u308c\u305f2\u3064\u3081\u306e\u95a2\u6570\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientFreeWindowClassExtraBytes<\/span>\u306e\u30b3\u30fc\u30c9(151\u301c164 \u884c\u76ee)\u3067\u3059\u3002<a id=\"Figure24\"><\/a><\/p>\n<figure id=\"attachment_128555\" aria-describedby=\"caption-attachment-128555\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128555 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-24.png\" alt=\"\u753b\u50cf24\u306fPoC 151\u301c164\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u8336\u8272\u3067g_nRandom\u3092\u30cf\u30a4\u30e9\u30a4\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"393\" \/><figcaption id=\"caption-attachment-128555\" class=\"wp-caption-text\">\u56f324. PoC 151\uff5e164\u884c\u76ee<\/figcaption><\/figure>\n<p>\u3053\u306e\u95a2\u6570\u304c\u30d5\u30c3\u30af\u3055\u308c\u308b\u7406\u7531\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserConsoleControl<\/span>\u306e\u547c\u3073\u51fa\u3057\u304c\u5f8c\u3067<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3059\u304b\u3089\u3067\u3059\u3002\u305f\u3060\u3057\u305b\u3063\u304b\u304f<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u30d5\u30c3\u30af\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u3092\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3057\u3084\u3059\u3044\u5024\u306b\u8a2d\u5b9a\u3057\u3066\u3082\u3001<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3057\u3066\u3053\u308c\u3089\u306e\u5024\u3092\u89e3\u653e\u3057\u3066\u3057\u307e\u3063\u305f\u306e\u3067\u306f\u52b9\u679c\u304c\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>\u3053\u308c\u3092\u56de\u907f\u3059\u308b\u305f\u3081\u3001\u6b63\u898f\u306e\u95a2\u6570\u304c\u30d5\u30c3\u30af\u3055\u308c\u3001\u60aa\u610f\u306e\u3042\u308b\u95a2\u6570\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u306b\u6e21\u3055\u308c\u305f\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc(<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9)\u3068\u30e9\u30f3\u30c0\u30e0\u306a\u5024<span style=\"font-family: 'courier new', courier, monospace;\">g_nRandom<\/span>\u3068\u3092\u6bd4\u8f03\u3057\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbExtraBytes<\/span>\u306fPoC\u306e\u6700\u521d\u306e\u65b9\u3067\u3053\u306e\u5024\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u306e\u3067(\u30b9\u30c6\u30c3\u30d74\u53c2\u7167)\u3001\u305d\u306e\u5024\u3067\u6bd4\u8f03\u3059\u308b\u3053\u3068\u3067\u3001\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u30a6\u30a3\u30f3\u30c9\u30a6\u3078\u306e\u53c2\u7167\u4e2d\u306b\u547c\u3073\u51fa\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u5024\u304c\u4e00\u81f4\u3059\u308c\u3070<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientFreeWindowClassExtraBytes<\/span>\u306f\u5358\u306b<span style=\"font-family: 'courier new', courier, monospace;\">1<\/span>\u3092\u8fd4\u3057\u307e\u3059\u3002\u5024\u304c\u4e00\u81f4\u3057\u306a\u3051\u308c\u3070\u3001\u5b9f\u884c\u304c<span style=\"font-family: 'courier new', courier, monospace;\">g_oldxxxClientAllocWindowClassExtraBytes<\/span>\u304b\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u95a2\u6570\u306b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u3053\u308c\u306f\u3053\u306e\u4f5c\u8005\u5074\u306e\u30df\u30b9\u306e\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3068\u3044\u3046\u306e\u3082\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_oldxxxClientFreeWindowClassExtraBytes<\/span>\u3078\u306e\u547c\u3073\u51fa\u3057\u7d4c\u7531\u3067\u610f\u56f3\u3057\u305f\u95a2\u6570(<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>)\u306b\u5236\u5fa1\u3092\u623b\u3059\u65b9\u304c\u7406\u306b\u304b\u306a\u3063\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002\u3053\u306e\u547c\u3073\u51fa\u3057\u306f\u3001PoC 304\u884c\u76ee\u3067\u6b63\u898f<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientFreeWindowClassExtraBytes<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3068\u3057\u3066\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u305f\u3060\u3057\u3001\u3053\u308c\u3089\u306e\u30d5\u30c3\u30af\u3055\u308c\u305f\u95a2\u6570\u306f\u3001\u307b\u304b\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u5165\u529b\u3068\u3057\u3066\u547c\u3073\u51fa\u3055\u308c\u308b\u3053\u3068\u304c\u306a\u3044\u306e\u3067\u3001\u3053\u306e\u30a8\u30e9\u30fc\u304c\u3053\u306ePoC\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u6210\u529f\u306b\u5f71\u97ff\u3059\u308b\u3053\u3068\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u7d9a\u304f\u7b2c4\u90e8\u3067\u306f\u30b9\u30c6\u30c3\u30d710\u301c11\u3092\u898b\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em>\u7d9a\u304d\u3092\u8aad\u3080 \u27a0 <a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/4\">\u30bb\u30af\u30b7\u30e7\u30f3 4 \u2013 \u8a73\u7d30\u5206\u6790\u30b9\u30c6\u30c3\u30d710-11<\/a><\/em><\/strong><\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n<p><!--nextpage--><\/p>\n<h2><a id=\"TOC\"><\/a>\u76ee\u6b21<\/h2>\n<p><a href=\"#post-128698-_gw1lwut00gti\">10. NtUserMessageCall\u3092\u547c\u3073\u51fa\u3057\u3066WndMagic\u306e\u30d5\u30c3\u30af\u3055\u308c\u305f\u95a2\u6570\u3092\u30c8\u30ea\u30ac\u30fc\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_cl30gf7j2mtv\">11. SetWindowLongA\u3092\u4f7f\u3063\u3066\u4efb\u610f\u306ewrite\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u4f5c\u6210\u3059\u308b(PoC 534\u301c542\u884c\u76ee)<\/a><\/p>\n<h2><a id=\"FigToC\"><\/a>\u56f3\u8868\u306e\u76ee\u6b21<\/h2>\n<p><a href=\"#Figure25\">\u56f325. PoC 530\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure26\">\u56f326. NtUserMessageCall\u547c\u3073\u51fa\u3057\u524d\u306eWndMagic\u306etagWND\u69cb\u9020\u4f53<\/a><br \/>\n<a href=\"#Figure27\">\u56f327. NtUserMessageCall\u547c\u3073\u51fa\u3057\u5f8c\u306eWndMagic\u306etagWND\u69cb\u9020\u4f53<\/a><br \/>\n<a href=\"#Figure28\">\u56f328. Wnd0\u306etagWND\u69cb\u9020\u4f53<\/a><br \/>\n<a href=\"#Figure29\">\u56f329. NtUserMessageCall\u547c\u3073\u51fa\u3057\u5f8c\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8<\/a><br \/>\n<a href=\"#Figure30\">\u56f330. SetWindowLongW\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7<\/a><br \/>\n<a href=\"#Figure31\">\u56f331. PoC 534\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure32\">\u56f332. PoC 542\u884c\u76ee<\/a><\/p>\n<h5><a id=\"post-128698-_gw1lwut00gti\"><\/a>10. NtUserMessageCall\u3092\u547c\u3073\u51fa\u3057\u3066WndMagic\u4e0a\u306e\u30d5\u30c3\u30af\u3055\u308c\u305f\u95a2\u6570\u3092\u30c8\u30ea\u30ac\u30fc\u3059\u308b<\/h5>\n<p>\u3053\u3053\u307e\u3067\u3067\u4efb\u610f\u306e\u30a6\u30a3\u30f3\u30c9\u30a6 \u30aa\u30d6\u30b8\u30a7\u30af\u30c8(\u30b9\u30c6\u30c3\u30d79\u3067\u8aac\u660e\u3057\u305f\u3088\u3046\u306b\u3053\u3053\u3067\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>)\u306b\u5bfe\u3059\u308b\u6f5c\u5728\u7684\u306a\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u53d6\u5f97\u3059\u308b\u6e96\u5099\u304c\u3067\u304d\u305f\u306e\u3067\u3001\u3042\u3068\u306f\u30d5\u30c3\u30af\u3055\u308c\u305f\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30af<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3059\u95a2\u6570\u3092\u898b\u3064\u3051\u308b\u3060\u3051\u3067\u3059\u3002<\/p>\n<p>\u3053\u3053\u3067\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u306f\u3001CVE-2021-1732\u3067\u60aa\u7528\u3055\u308c\u305f\u3082\u306e\u3068\u540c\u3058\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u3067\u3042\u308b\u3053\u3068\u3092\u5ff5\u982d\u306b\u7f6e\u304f\u3068\u3088\u3044\u3067\u3057\u3087\u3046\u3002\u3042\u3061\u3089\u306e\u5834\u5408\u3001<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u306f<span style=\"font-family: 'courier new', courier, monospace;\">xxxCreateWindowEX<\/span>\u5185\u3067\u547c\u3073\u51fa\u3055\u308c\u308b\u524d\u306b\u30d5\u30c3\u30af\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<span style=\"font-family: 'courier new', courier, monospace;\">xxxCreateWindowEX<\/span>\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">CreateWindow<\/span>\u30d5\u30a1\u30df\u30ea\u30fc\u306e\u3044\u305a\u308c\u304b\u306e\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u305f\u5f8c\u3067\u547c\u3073\u51fa\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u8106\u5f31\u6027\u3092\u7de9\u548c\u3059\u308b\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u306e\u4e00\u90e8\u3068\u3057\u3066Microsoft\u306f<span style=\"font-family: 'courier new', courier, monospace;\">xxxCreateWindowEX<\/span>\u5185\u306b\u30c1\u30a7\u30c3\u30af\u3092\u8ffd\u52a0\u3057\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u4e2d\u306b<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>(\u30b9\u30c6\u30c3\u30d77\u3067\u89e3\u8aac)\u304c\u5909\u66f4\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3057\u305f\u3002\u3067\u3059\u304c\u305f\u3068\u3048\u3070\u3001Microsoft\u304c\u4fee\u6b63\u3057\u3066\u3044\u306a\u3044\u3001<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3059\u95a2\u6570\u304c\u307b\u304b\u306b\u3082\u3042\u3063\u305f\u3068\u3057\u305f\u3089\u3069\u3046\u3067\u3057\u3087\u3046\u304b\u3002<\/p>\n<p>CVE-2022-21882\u306e\u5834\u5408\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u304c\u3001\u305d\u3046\u3057\u305f\u95a2\u6570\u306e1\u3064\u3067\u3042\u308b\u3053\u3068\u304c\u306e\u3061\u306b\u7279\u5b9a\u3055\u308c\u307e\u3057\u305f\u3002\u5b9f\u969b\u3001CVE-2022-21882\u3092\u767a\u898b\u3057\u305f\u4eba\u7269\u306f\u3001\u5358\u306bCVE-2021-1732\u306e\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u30ec\u30d3\u30e5\u30fc\u3057\u3066\u8106\u5f31\u6027\u306e\u539f\u56e0\u3092\u7279\u5b9a\u3057\u305f\u4e0a\u3067\u3001\u300c<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3059\u307b\u304b\u306e\u95a2\u6570\u306e\u306a\u304b\u306b\u306f\u3001\u307e\u3060<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u306e\u691c\u8a3c\u3092\u884c\u3046\u4fee\u6b63\u304c\u53cd\u6620\u3055\u308c\u3066\u3044\u306a\u3044\u3082\u306e\u304c\u3042\u308b\u306e\u3067\u306f\u306a\u3044\u304b\u300d\u3068\u8003\u3048\u3001\u305d\u308c\u3089\u306e\u95a2\u6570\u3092\u78ba\u8a8d\u3057\u305f\u53ef\u80fd\u6027\u304c\u9ad8\u3044\u3082\u306e\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u306e\u547c\u3073\u51fa\u3057(\u884c530)\u3092\u56f325\u306b\u793a\u3057\u307e\u3059\u3002\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306f\u3001\u6700\u7d42\u7684\u306b<span style=\"font-family: 'courier new', courier, monospace;\">xxxWrapSwitchWndProc<\/span>\u3092\u5b9f\u884c\u3055\u305b\u3001\u6b21\u306b<span style=\"font-family: 'courier new', courier, monospace;\">xxxSwitchWindowProc<\/span>\u3092\u5b9f\u884c\u3055\u305b\u3001\u3055\u3089\u306b<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u3092\u547c\u3073\u51fa\u3057\u307e\u3059\u3002<a id=\"Figure25\"><\/a><\/p>\n<figure id=\"attachment_128557\" aria-describedby=\"caption-attachment-128557\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128557 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-25.png\" alt=\"\u753b\u50cf25\u306f\u3001PoC 530\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002NtUserMessageCall\u3092\u547c\u3073\u51fa\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"119\" \/><figcaption id=\"caption-attachment-128557\" class=\"wp-caption-text\">\u56f325 PoC 530\u884c\u76ee<\/figcaption><\/figure>\n<p>\u3053\u308c\u3067<span style=\"font-family: 'courier new', courier, monospace;\">xxxClientAllocWindowClassExtraBytes<\/span>\u304c\u60aa\u610f\u306e\u3042\u308b\u95a2\u6570\u306b\u30d5\u30c3\u30af\u3055\u308c\u305f\u306e\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u306e\u547c\u3073\u51fa\u3057\u306f<span style=\"font-family: 'courier new', courier, monospace;\">g_newxxxClientAllocWindowClassExtraBytes<\/span>\u306e\u547c\u3073\u51fa\u3057\u306b\u3064\u306a\u304c\u308a\u307e\u3059\u3002\u3053\u306e\u7d50\u679c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306f\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5909\u63db\u3055\u308c\u3001\u305d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30d9\u30fc\u30b9 \u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u8a2d\u5b9a\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u5024\u3078\u306e\u53c2\u7167\u306f\u3059\u3079\u3066<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u4f4d\u7f6e\u3092\u6307\u3059\u3053\u3068\u3092\u610f\u5473\u3057\u307e\u3059\u3002<\/p>\n<p>\u3042\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u5909\u66f4\u3059\u308b\u65b9\u6cd5\u304c\u3042\u308b\u306a\u3089\u3001\u540c\u3058\u65b9\u6cd5\u3067\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u6709\u52b9\u306b\u3057\u3066\u3001\u5c11\u306a\u304f\u3068\u3082<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbWndExtra<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u306e\u9577\u3055\u307e\u3067\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u5909\u66f4\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002\u5b9f\u969b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLong<\/span>\u95a2\u6570\u30d5\u30a1\u30df\u30ea\u30fc\u306f\u307e\u3055\u306b\u3053\u306e\u76ee\u7684\u306e\u305f\u3081\u306b\u4f5c\u3089\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u547c\u3073\u51fa\u3057\u524d\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8\u3092\u305d\u308c\u305e\u308c\u56f326\u3068\u56f327\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure26\"><\/a> <a id=\"Figure27\"><\/a><\/p>\n<figure id=\"attachment_128559\" aria-describedby=\"caption-attachment-128559\" style=\"width: 842px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128559 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-26.png\" alt=\"\u753b\u50cf26\u306f\u3001NtUserMessageCall\u547c\u3073\u51fa\u3057\u524d\u306eWndMagic\u306etagWND\u69cb\u9020\u4f53\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u9ec4\u8272\u3044\u67a0\u3067\u300c018\u300d\u3092\u30cf\u30a4\u30e9\u30a4\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"842\" height=\"356\" \/><figcaption id=\"caption-attachment-128559\" class=\"wp-caption-text\">\u56f326. <span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u547c\u3073\u51fa\u3057\u524d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53<\/figcaption><\/figure>\n<figure id=\"attachment_128561\" aria-describedby=\"caption-attachment-128561\" style=\"width: 842px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128559 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-26.png\" alt=\"\u753b\u50cf26\u306f\u3001NtUserMessageCall\u547c\u3073\u51fa\u3057\u524d\u306eWndMagic\u306etagWND\u69cb\u9020\u4f53\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u9ec4\u8272\u3044\u67a0\u3067\u300c018\u300d\u3092\u30cf\u30a4\u30e9\u30a4\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"842\" height=\"356\" \/><figcaption id=\"caption-attachment-128561\" class=\"wp-caption-text\">\u56f327. <span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u547c\u3073\u51fa\u3057\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53<\/figcaption><\/figure>\n<p>\u4eca<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExtraFlag<\/span>\u306f <span style=\"font-family: 'courier new', courier, monospace;\">0x100100818<\/span>\u3067\u3001\u3053\u308c\u306f\u3046\u307e\u304f\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5909\u63db\u3055\u308c\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u306e\u5024\u306f<span style=\"font-family: 'courier new', courier, monospace;\">0x2ad30<\/span>\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306f\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u306a\u3063\u305f\u306e\u3067\u3001\u3053\u306e\u5024\u306f\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30d9\u30fc\u30b9\u304b\u3089\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u8868\u3057\u3066\u3044\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u3053\u308c\u304c<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u304c\u914d\u7f6e\u3055\u308c\u3066\u3044\u308b\u306e\u3068\u540c\u3058\u30aa\u30d5\u30bb\u30c3\u30c8\u3067\u3042\u308b\u3053\u3068\u3092\u601d\u3044\u51fa\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u308c\u306f\u3064\u307e\u308a\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u3001\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u4e0a\u306e<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u6307\u3059\u3088\u3046\u306b\u306a\u3063\u305f\u3068\u3044\u3046\u3053\u3068\u3067\u3059\u3002<\/p>\n<p>\u56f328\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3068\u305d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">OffsetToDesktopHeap<\/span>\u306e\u5024\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">0x2ad30<\/span>\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u4eca\u3053\u306e\u5024\u3092\u6307\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure28\"><\/a><\/p>\n<figure id=\"attachment_128563\" aria-describedby=\"caption-attachment-128563\" style=\"width: 878px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128563 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-28.png\" alt=\"\u753b\u50cf28\u306f\u3001Wnd0\u306etagWND\u69cb\u9020\u4f53\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u9ec4\u8272\u3044\u67a0\u30670002ad30\u304c\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"878\" height=\"392\" \/><figcaption id=\"caption-attachment-128563\" class=\"wp-caption-text\">\u56f328. <span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53<\/figcaption><\/figure>\n<p>\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8\u3068\u3001\u3053\u306e\u6bb5\u968e\u3067\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u53c2\u7167\u3092\u56f329\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure29\"><\/a><\/p>\n<figure id=\"attachment_128565\" aria-describedby=\"caption-attachment-128565\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128565 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-29.png\" alt=\"\u753b\u50cf29\u306f\u3001NtUserMessageCall\u547c\u3073\u51fa\u3057\u76f4\u5f8c\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8\u3092\u8868\u3059\u56f3\u3067\u3059\u3002\u5de6\u5074\u304c\u30e6\u30fc\u30b6\u30fc \u30e9\u30f3\u30c9\u3068\u305d\u306e\u30ec\u30a4\u30a2\u30a6\u30c8\u3001\u53f3\u5074\u304c\u30ab\u30fc\u30cd\u30eb \u30e9\u30f3\u30c9\u3067\u3059\u3002\" width=\"900\" height=\"827\" \/><figcaption id=\"caption-attachment-128565\" class=\"wp-caption-text\">\u56f329. <span style=\"font-family: 'courier new', courier, monospace;\">NtUserMessageCall<\/span>\u547c\u3073\u51fa\u3057\u5f8c\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8<\/figcaption><\/figure>\n<h5><a id=\"post-128698-_cl30gf7j2mtv\"><\/a>11. SetWindowLongA\u3092\u4f7f\u3063\u3066\u4efb\u610f\u306ewrite\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u4f5c\u6210\u3059\u308b(PoC 534\u301c542\u884c\u76ee)<\/h5>\n<p>\u56f330\u306b\u793a\u3059\u3088\u3046\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u95a2\u6570\u306f\u30a6\u30a3\u30f3\u30c9\u30a6 \u30cf\u30f3\u30c9\u30eb\u3092\u6700\u521d\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3068\u3057\u3066\u53d7\u3051\u53d6\u308a\u307e\u3059\u3002\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u306e\u30e1\u30e2\u30ea\u30fc\u5272\u308a\u5f53\u3066\u306e\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u3067\u3059\u3002<\/p>\n<p>\u6a19\u6e96\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u5834\u5408\u3001\u3053\u306e\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u306b\u683c\u7d0d\u3055\u308c\u305f\u30dd\u30a4\u30f3\u30bf\u30fc\u304b\u3089\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\u53c2\u7167\u3055\u308c\u307e\u3059\u3002\u3067\u3059\u304c\u30b3\u30f3\u30bd\u30fc\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u5834\u5408\u3001\u3053\u306e\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u30aa\u30d5\u30bb\u30c3\u30c8\u5024\u3068\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30d9\u30fc\u30b9\u304b\u3089\u53c2\u7167\u3055\u308c\u307e\u3059\u3002\u6700\u5f8c\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc<span style=\"font-family: 'courier new', courier, monospace;\">dwNewLong<\/span>\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u306b\u3042\u308b\u30e1\u30e2\u30ea\u30fc\u3092\u5909\u66f4\u3059\u308b\u5024\u3067\u3059\u3002<a id=\"Figure30\"><\/a><\/p>\n<figure id=\"attachment_128567\" aria-describedby=\"caption-attachment-128567\" style=\"width: 358px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128567 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-30.png\" alt=\"\u753b\u50cf30\u306fSetWindowLongW\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"358\" height=\"190\" \/><figcaption id=\"caption-attachment-128567\" class=\"wp-caption-text\">\u56f330. <span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7<\/figcaption><\/figure>\n<p>\u3057\u305f\u304c\u3063\u3066\u3001\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u8ffd\u52a0\u30d0\u30a4\u30c8\u306e\u5185\u5bb9\u3092\u5909\u66f4\u3059\u308b\u306b\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u3092\u547c\u3073\u51fa\u305b\u3070\u3088\u3044\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306b\u5bfe\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u304c\u547c\u3073\u51fa\u3055\u308c\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u306f<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u5185\u306b\u3042\u308b\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u51e6\u7406\u5b9f\u884c\u7528\u306e\u30e1\u30e2\u30ea\u30fc\u7a7a\u9593\u3068\u3057\u3066\u53c2\u7167\u3057\u307e\u3059\u3002<\/p>\n<p>\u8981\u3059\u308b\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u3092<span style=\"font-family: 'courier new', courier, monospace;\">HWND<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3068\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u3092\u547c\u3073\u51fa\u3057\u305f\u5834\u5408\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u30d9\u30fc\u30b9 \u30a2\u30c9\u30ec\u30b9\u306b<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u304c\u8a2d\u5b9a\u3055\u308c\u305f\u30aa\u30d5\u30bb\u30c3\u30c8\u5024\u3092\u52a0\u3048\u305f\u7bc4\u56f2\u5185\u306b\u3042\u308b\u30e1\u30e2\u30ea\u30fc\u304c\u5909\u66f4\u3055\u308c\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u304c\u73fe\u5728<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u30d9\u30fc\u30b9\u3092\u6307\u3057\u3066\u3044\u308b\u305f\u3081\u3067\u3059\u3002<\/p>\n<p>\u56f331\u306b\u793a\u3059<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u306e\u6700\u521d\u306e\u547c\u3073\u51fa\u3057(\u884c534)\u3067\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u3078\u306e\u30cf\u30f3\u30c9\u30eb\u304c\u6e21\u3055\u308c\u3001\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x128 + 0x10<\/span>\u304c\u3001\u30b9\u30c6\u30c3\u30d76\u3067<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\u5b9a\u7fa9\u3055\u308c\u305f<span style=\"font-family: 'courier new', courier, monospace;\">kernel_desktop_heap_base_offset_Min<\/span>\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306f\u3001\u5b9f\u969b\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">0x128<\/span>\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u904e\u304e\u307e\u305b\u3093\u3002\u306a\u305c<span style=\"font-family: 'courier new', courier, monospace;\">0x10<\/span>\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u304b\u306b\u3064\u3044\u3066\u306f\u3001\u4ee5\u4e0b\u306e\u6ce8\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p>\u305f\u3060\u3057\u3001<span style=\"font-family: 'courier new', courier, monospace;\">WndMagic<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30aa\u30d5\u30bb\u30c3\u30c8\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u3092\u53c2\u7167\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u3078\u306e\u547c\u3073\u51fa\u3057\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x128<\/span><span style=\"font-family: 'courier new', courier, monospace;\">(tagWND.pExtraBytes<\/span>)\u3092\u81ea\u8eab\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.OffsetToDesktopHeap<\/span>\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u5909\u66f4\u3057\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u3053\u308c\u4ee5\u964d<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u3067<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLong<\/span>\u30d5\u30a1\u30df\u30ea\u30fc\u306e\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u5834\u5408\u3001\u6a5f\u80fd\u7684\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u958b\u59cb\u4f4d\u7f6e\u304b\u3089\u306e\u76f8\u5bfe\u30aa\u30d5\u30bb\u30c3\u30c8\u3067\u64cd\u4f5c\u3059\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u307e\u305f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtr<\/span>\u3078\u306e\u547c\u3073\u51fa\u3057\u306f\u3001\u305d\u306e\u95a2\u6570\u547c\u3073\u51fa\u3057\u304c\u884c\u308f\u308c\u308b\u524d\u306e\u3001\u6307\u5b9a\u3055\u308c\u305f\u30aa\u30d5\u30bb\u30c3\u30c8(<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>)\u306e\u4ee5\u524d\u306e\u5024\u3092\u8fd4\u3059\u3053\u3068\u306b\u3082\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001<span style=\"font-family: 'courier new', courier, monospace;\">dwRet<\/span>\u5909\u6570(\u56f331\u306b\u793a\u3059)\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u3092\u547c\u3073\u51fa\u3059\u524d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>(\u4e0a\u306e\u56f316\u306b\u793a\u3059<span style=\"font-family: 'courier new', courier, monospace;\">0x2ae80<\/span>)\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.pExtraBytes<\/span>\u3068\u7b49\u3057\u304f\u306a\u308a\u307e\u3059\u3002<\/p>\n<p><strong>\u6ce8<\/strong>: <span style=\"font-family: 'courier new', courier, monospace;\">0x10<\/span>\u306e\u8ffd\u52a0\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">xxxSetWindowLongW<\/span>\u5185\u3067\u884c\u308f\u308c\u308b\u6e1b\u7b97\u3092\u8003\u616e\u3057\u305f\u3082\u306e\u3067\u3059\u3002\u3053\u308c\u306f\u5947\u5999\u306b\u601d\u3048\u308b\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u304c\u3001\u3053\u308c\u3089\u306e\u95a2\u6570\u306f\u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3 \u30b3\u30fc\u30c9\u304b\u3089\u306e\u547c\u3073\u51fa\u3057\u3092\u60f3\u5b9a\u3057\u3066\u3044\u306a\u3044\u306e\u3067\u3001Microsoft\u306f\u3068\u304f\u306b\u30b3\u30fc\u30c9\u3092\u30e6\u30fc\u30b6\u30fc\u30d5\u30ec\u30f3\u30c9\u30ea\u30fc\u306a\u3082\u306e\u306b\u5909\u66f4\u3059\u308b\u5fc5\u8981\u6027\u3092\u611f\u3058\u3066\u3044\u306a\u3044\u70b9\u3092\u601d\u3044\u51fa\u3057\u3066\u304f\u3060\u3055\u3044\u3002<a id=\"Figure31\"><\/a><\/p>\n<figure id=\"attachment_128569\" aria-describedby=\"caption-attachment-128569\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128569 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-31.png\" alt=\"\u753b\u50cf31\u306f\u3001PoC 534\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u308c\u306f DWORD dwRet = SetWindowLongW \u3067\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"55\" \/><figcaption id=\"caption-attachment-128569\" class=\"wp-caption-text\">\u56f331 PoC 534\u884c\u76ee<\/figcaption><\/figure>\n<p>\u56f332\u306b\u793a\u3059<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u3078\u306e\u6b21\u306e\u547c\u3073\u51fa\u3057(542\u884c\u76ee)\u3067\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.cbWndExtra<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3092<span style=\"font-family: 'courier new', courier, monospace;\">0xFFFFFFF<\/span>\u306b\u5909\u66f4\u3057\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">cbWndExtra<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u304c<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u30b5\u30a4\u30ba\u3092\u5b9a\u7fa9\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u601d\u3044\u51fa\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u308c\u306b\u3088\u3063\u3066\u3001\u8ffd\u52a0\u306e\u30d0\u30a4\u30c8 \u30d5\u30a3\u30fc\u30eb\u30c9 \u30b5\u30a4\u30ba\u304c\u975e\u5e38\u306b\u5927\u304d\u306a\u6570\u5b57\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u6761\u4ef6\u304c\u6709\u52b9\u306b\u306a\u308a\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306b\u3088\u308b\u96a3\u63a5\u3059\u308b\u30ab\u30fc\u30cd\u30eb \u30e1\u30e2\u30ea\u30fc\u3078\u306e\u66f8\u304d\u8fbc\u307f\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<a id=\"Figure32\"><\/a><\/p>\n<figure id=\"attachment_128571\" aria-describedby=\"caption-attachment-128571\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128571 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-32.png\" alt=\"\u753b\u50cf32\u306f\u3001PoC 542\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u308c\u306fSetWindowLongW\u3067\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"76\" \/><figcaption id=\"caption-attachment-128571\" class=\"wp-caption-text\">\u56f332 PoC 542\u884c\u76ee<\/figcaption><\/figure>\n<p>\u6b21\u306e\u30b9\u30c6\u30c3\u30d7\u3067\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3092\u4f7f\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u6f0f\u3048\u3044\u3055\u305b\u3001\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u7f6e\u304d\u63db\u3048\u307e\u3059\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em>\u7d9a\u304d\u3092\u8aad\u3080 \u27a0 <a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/5\">\u30bb\u30af\u30b7\u30e7\u30f3 5 \u2013 \u8a73\u7d30\u5206\u6790\u30b9\u30c6\u30c3\u30d712<\/a><\/em><\/strong><\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n<p><!--nextpage--><\/p>\n<h2><a id=\"TOC\"><\/a>\u76ee\u6b21<\/h2>\n<p><a href=\"#post-128698-_cskzsodmsq7y\">12. SetWindowLongPtrA\u3092\u4f7f\u3063\u3066Wnd1\u306espmenu\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u6f0f\u3048\u3044\u3055\u305b\u3001\u305d\u308c\u3092\u507d\u306espmenu\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u7f6e\u304d\u63db\u3048\u308b<\/a><\/p>\n<h2><a id=\"FigToC\"><\/a>\u56f3\u8868\u306e\u76ee\u6b21<\/h2>\n<p><a href=\"#Figure33\">\u56f333. PoC 546\u301c549\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure34\">\u56f334. PoC 552\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure35\">\u56f335. SetWindowLongPrtA\u306enIndex\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306b\u95a2\u3059\u308bMSDN\u306e\u6587\u66f8<\/a><br \/>\n<a href=\"#Figure36\">\u56f336. MSDN\u306b\u3088\u308bhMenu\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306e\u5b9a\u7fa9<\/a><br \/>\n<a href=\"#Figure37\">\u56f337. PoC 355\uff5e385\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure38\">\u56f338. \u89aa\u306etagWND\u69cb\u9020\u4f53<\/a><br \/>\n<a href=\"#Figure39\">\u56f339. xxxSetWindowData (SetWindowLongPtrA\u304b\u3089\u547c\u3073\u51fa\u3055\u308c\u308b)\u306e\u9006\u30a2\u30bb\u30f3\u30d6\u30eb<\/a><br \/>\n<a href=\"#Figure40\">\u56f340. \u5909\u66f4\u524d\u306espmenu\u5024\u3092\u793a\u3057\u3066\u3044\u308bWinDbg\u306e\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure41\">\u56f341. SetWindowLongPtrW\u304b\u3089\u623b\u308b\u76f4\u524d\u306e\u30ec\u30b8\u30b9\u30bf\u30fc\u306e\u5024<\/a><br \/>\n<a href=\"#Figure42\">\u56f342. PoC 566\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure43\">\u56f343. PoC 546\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure44\">\u56f344. Wnd1\u306e\u5b50\u306etagWND\u69cb\u9020\u4f53\u306eWinDbg\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure45\">\u56f345. \u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 + 0x3a850<\/a><br \/>\n<a href=\"#Figure46\">\u56f346. Wnd1\u306e\u89aa\u306etagWND\u69cb\u9020\u4f53 + 0xa8<\/a><\/p>\n<h5><a id=\"post-128698-_cskzsodmsq7y\"><\/a>12. SetWindowLongPtrA\u3092\u4f7f\u3063\u3066Wnd1\u306espmenu\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u6f0f\u3048\u3044\u3055\u305b\u3001\u305d\u308c\u3092\u507d\u306espmenu\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u7f6e\u304d\u63db\u3048\u308b<\/h5>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u306b\u5bfe\u3059\u308b2\u56de\u306e\u547c\u3073\u51fa\u3057\u306e\u5f8c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3092\u8907\u6570\u56de\u547c\u3073\u51fa\u3057\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u306f\u3088\u308a\u53e4\u3044\u3001\u5c06\u6765\u5ec3\u6b62\u304c\u4e88\u5b9a\u3055\u308c\u3066\u3044\u308b\u95a2\u6570\u3067\u300132-bit\u306e<span style=\"font-family: 'courier new', courier, monospace;\">LONG<\/span>\u6574\u6570\u3092\u64cd\u4f5c\u3057\u307e\u3059\u3002\u4e00\u65b9\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongW<\/span>\u306b\u304b\u308f\u3063\u306632-bit\u306864-bit\u306e<span style=\"font-family: 'courier new', courier, monospace;\">LONG_PTR<\/span>\u6574\u6570\u3092\u64cd\u4f5c\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u56f333(546\u884c\u76ee\u304b\u3089549\u884c\u76ee)\u306b\u793a\u3059<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3078\u306e\u6700\u521d\u306e\u547c\u3073\u51fa\u3057\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExStyle<\/span>\u3092<span style=\"font-family: 'courier new', courier, monospace;\">0x40000000<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/winmsg\/window-styles\" target=\"_blank\" rel=\"noopener\">WS_CHILD<\/a><\/span>)\u306b\u5909\u66f4\u3057\u307e\u3059\u3002\u3053\u308c\u3067\u3053\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306f\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u306a\u308a\u307e\u3059\u3002\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306b\u3088\u304f\u6ce8\u610f\u3057\u3066\u8a08\u7b97\u3092\u3057\u3066\u307f\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u306e\u95a2\u6570\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e\u30cf\u30f3\u30c9\u30eb\u3092\u4e0e\u3048\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u79c1\u305f\u3061\u306f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u304c\u305d\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u64cd\u4f5c\u3059\u308b\u3053\u3068\u3092\u77e5\u3063\u3066\u3044\u307e\u3059\u3002\u305d\u3057\u3066\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pExtraBytes<\/span>\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u4eca\u73fe\u5728\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u6307\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30d9\u30fc\u30b9 \u30aa\u30d5\u30bb\u30c3\u30c8(<span style=\"font-family: 'courier new', courier, monospace;\">0x38390<\/span>)\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30d9\u30fc\u30b9 \u30aa\u30d5\u30bb\u30c3\u30c8(<span style=\"font-family: 'courier new', courier, monospace;\">0x2ad30<\/span>)\u3092\u5f15\u3044\u3066(<span style=\"font-family: 'courier new', courier, monospace;\">0x18<\/span>)\u3092\u8db3\u3059\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xd678<\/span>\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u308c\u3092<span style=\"font-family: 'courier new', courier, monospace;\">Wnd0<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u5148\u982d(<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e820102ad30<\/span>)\u306b\u8db3\u3059\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e820102010383a8<\/span>\u304c\u5f97\u3089\u308c\u307e\u3059\u3002\u3053\u308c\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x18<\/span>\u3001\u307e\u305f\u306f\u305d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExStyle<\/span>\u3067\u3059\u3002<a id=\"Figure33\"><\/a><\/p>\n<figure id=\"attachment_128573\" aria-describedby=\"caption-attachment-128573\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128573 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-33.png\" alt=\"\u753b\u50cf33\u306f\u3001PoC 546\u301c549\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u308c\u306fSetWindowLongPtrA\u306e\u6700\u521d\u306e\u547c\u3073\u51fa\u3057\u3067\u3059\u3002\" width=\"900\" height=\"98\" \/><figcaption id=\"caption-attachment-128573\" class=\"wp-caption-text\">\u56f333 PoC 546\u301c549\u884c\u76ee<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30b9\u30bf\u30a4\u30eb\u3092\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5909\u66f4\u3059\u308b\u3053\u3068\u306f\u3001\u6b21\u306e<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3078\u306e\u547c\u3073\u51fa\u3057\u306b\u3068\u3063\u3066\u91cd\u8981\u3067\u3059\u3002<\/p>\n<p>\u6b21\u306e\u547c\u3073\u51fa\u3057(\u56f334)\u306f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u30cf\u30f3\u30c9\u30eb\u3092\u76f4\u63a5\u6e21\u3057\u3001<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092<span style=\"font-family: 'courier new', courier, monospace;\">-12<\/span>\u306b\u8a2d\u5b9a\u3057\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>\u3092<span style=\"font-family: 'courier new', courier, monospace;\">dwNewLong<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3068\u3057\u3066\u6e21\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure34\"><\/a><\/p>\n<figure id=\"attachment_128575\" aria-describedby=\"caption-attachment-128575\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128575 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-34.png\" alt=\"\u753b\u50cf34\u306f\u3001PoC 552\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u308c\u306f\u753b\u50cf33\u306b\u793a\u3057\u305f\u547c\u3073\u51fa\u3057\u306e\u6b21\u306e\u547c\u3073\u51fa\u3057\u3067\u3059\u3002\" width=\"900\" height=\"121\" \/><figcaption id=\"caption-attachment-128575\" class=\"wp-caption-text\">\u56f334 PoC 552\u884c\u76ee<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc(\u56f335)\u306b\u95a2\u3059\u308bMSDN\u306e\u6587\u66f8\u3092\u53c2\u7167\u3059\u308b\u3068\u3001\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">-12<\/span>\u306f\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5bfe\u3059\u308b<a href=\"https:\/\/learn.microsoft.com\/ja-jp\/windows\/win32\/winprog\/using-the-windows-headers\">\u30de\u30af\u30ed<\/a>\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">GWL_ID<\/span>\u3092\u53c2\u7167\u3057\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">GWL_ID<\/span>\u306e\u5909\u66f4\u306f\u30c8\u30c3\u30d7\u30ec\u30d9\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u306f\u3067\u304d\u306a\u3044\u306e\u3067\u3001\u305d\u306e\u524d\u306b\u884c\u308f\u308c\u305f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306e\u547c\u3073\u51fa\u3057\u306f\u3001\u3053\u306e\u547c\u3073\u51fa\u3057\u306e\u305f\u3081\u306b<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u3092\u6e96\u5099\u3059\u308b\u305f\u3081\u306b\u884c\u308f\u308c\u3066\u3044\u307e\u3059\u3002<a id=\"Figure35\"><\/a><\/p>\n<p><figure id=\"attachment_128577\" aria-describedby=\"caption-attachment-128577\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128577 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/on-nlnde-type-int-the-zero-based-offset-to-th.png\" alt=\"\u753b\u50cf35\u306f\u3001SetWindowLongPrtA\u306enIndex\u306b\u95a2\u9023\u3059\u308bMicrosoft\u306e\u6587\u66f8\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306b\u306f\u8868\u304c\u542b\u307e\u308c\u3066\u304a\u308a\u3001\u305d\u306e1\u5217\u76ee\u306f\u300cValue\u300d\u3067\u3059\u30022\u5217\u76ee\u306f\u300cMeaning\u300d\u3067\u3059\u3002[in] nIndex, Type: int, The zero-based offset to the value to be set. Valid values are in the range zero through the number of bytes of extra window memory, minus the size of an integer. To set any other value, specify one of the following values. Value GWL EXSTYLE -20 GWL HINSTANCE -6 GWL_ID -12 GWL STYLE -16 GWL USERDATA -21 GWL_WNDPROC -4 Meaning Sets a new extended window style. Sets a new application instance handle. Sets a new identifier of the child window. The window cannot be a top-level window. Sets a new window style. Sets the user data associated with the window. This data is intended for use by the application that created the window. Its value is initially zero. Sets a new address for the window procedure. You cannot change this attribute if the window does not belong to the same process as the calling thread. \" width=\"900\" height=\"588\" \/><figcaption id=\"caption-attachment-128577\" class=\"wp-caption-text\">\u56f335. <span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPrtA<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306b\u95a2\u3059\u308bMSDN\u306e\u6587\u66f8<\/figcaption><\/figure>\u3053\u3053\u3067\u4f55\u304c\u8d77\u3053\u3063\u3066\u3044\u308b\u304b\u3092\u3088\u304f\u7406\u89e3\u3059\u308b\u306b\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>(\u30b9\u30c6\u30c3\u30d78\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u4f5c\u6210\u6642\u306b\u5b9a\u7fa9)\u306f\u3001\u30e1\u30cb\u30e5\u30fc\u3078\u306e\u30cf\u30f3\u30c9\u30eb\u3092\u6307\u3059\u304b\u3001\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u8b58\u5225\u5b50\u3092\u6307\u5b9a\u3059\u308b\u3053\u3068\u3092\u899a\u3048\u3066\u304a\u304f\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306eMSDN\u306b\u3088\u308b\u5b9a\u7fa9\u3092\u56f336\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure36\"><\/a><\/p>\n<figure id=\"attachment_128579\" aria-describedby=\"caption-attachment-128579\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128579 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/type-hmenu-a-handle-to-a-menu-or-specifies-a-ch.png\" alt=\"Type: HMENU A handle to a menu, or specifies a child-window identifier, depending on the window style. For an overlapped or pop-up window, hMenu identifies the menu to be used with the window; it can be NULL if the class menu is to be used. For a child window, hMenu specifies the child-window identifier, an integer value used by a dialog box control to notify its parent about events. The application determines the child-window identifier; it must be unique for all child windows with the same parent window.\" width=\"900\" height=\"171\" \/><figcaption id=\"caption-attachment-128579\" class=\"wp-caption-text\">\u56f336 MSDN\u306b\u3088\u308b<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306e\u5b9a\u7fa9<\/figcaption><\/figure>\n<p>\u30b9\u30c6\u30c3\u30d78\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u304c\u5404\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u5bfe\u3057<span style=\"font-family: 'courier new', courier, monospace;\">CreateMenu<\/span>\u3092\u547c\u3073\u51fa\u3059\u305f\u3081\u306b\u8a2d\u5b9a\u3055\u308c\u305f\u3053\u3068\u3092\u601d\u3044\u51fa\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u305d\u306e\u305f\u3081\u3001\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u4f5c\u6210\u3059\u308b\u3064\u3069\u3001\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30cf\u30f3\u30c9\u30eb(\u5b9f\u8cea\u7684\u306b\u306f\u30ab\u30fc\u30cd\u30eb\u5185\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc)\u304c<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306b\u5272\u308a\u5f53\u3066\u3089\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3057\u304b\u3057\u3001\u73fe\u5728\u306e<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306f\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u306a\u306e\u3067\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3092\u4f7f\u3063\u3066\u3053\u306e\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u8b58\u5225\u5b50\u3092<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>\u306e\u305d\u308c\u306b\u5909\u66f4\u3067\u304d\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u304c\u4eca\u3082\u89aa\u30a6\u30a3\u30f3\u30c9\u30a6\u306a\u3089\u3001<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u30cf\u30f3\u30c9\u30eb\u306e\u5909\u66f4\u306f\u3067\u304d\u306a\u304b\u3063\u305f\u3053\u3068\u3067\u3057\u3087\u3046\u3002<\/p>\n<p>\u6700\u5f8c\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_qwExploit<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306e\u623b\u308a\u5024\u306b\u8a2d\u5b9a\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u306f\u547c\u3073\u51fa\u3057\u524d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u306e\u5024(\u30a6\u30a3\u30f3\u30c9\u30a6\u4f5c\u6210\u6642\u306b\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u30cf\u30f3\u30c9\u30eb)\u3068\u7b49\u3057\u304f\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u30cf\u30f3\u30c9\u30eb\u306f\u5358\u306bWindows\u30ab\u30fc\u30cd\u30eb\u304c\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u8ffd\u8de1\u3059\u308b\u305f\u3081\u306b\u4f7f\u3046\u30e1\u30e2\u30ea\u30fc\u4f4d\u7f6e\u3067\u3057\u304b\u3042\u308a\u307e\u305b\u3093\u3002\u3053\u306e\u305f\u3081\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_qwExploit<\/span>\u306f\u3053\u306e\u6642\u70b9\u3067<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u542b\u3093\u3067\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u308c\u307e\u3067\u306f\u307e\u3060\u8aac\u660e\u3057\u3066\u3044\u307e\u305b\u3093\u3067\u3057\u305f\u304c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>\u306f\u524d\u306b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8 \u30b3\u30fc\u30c9\u3067\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002355\u301c385\u884c\u76ee\u3067\u306f\u3001\u56f337\u306b\u793a\u30595\u3064\u306e\u30e1\u30e2\u30ea\u30fc\u5272\u308a\u5f53\u3066(<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem1<\/span>\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem5<\/span>\u307e\u3067)\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure37\"><\/a><\/p>\n<figure id=\"attachment_128581\" aria-describedby=\"caption-attachment-128581\" style=\"width: 824px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128581 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-37.png\" alt=\"\u753b\u50cf37\u306fPoC 355\u301c385\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u30e1\u30e2\u30ea\u30fc\u30925\u3064\u5272\u308a\u5f53\u3066\u3066\u3044\u307e\u3059\u3002\" width=\"824\" height=\"246\" \/><figcaption id=\"caption-attachment-128581\" class=\"wp-caption-text\">\u56f337 PoC 355-385\u884c\u76ee<\/figcaption><\/figure>\n<p>\u3053\u308c\u3089\u306e\u5272\u308a\u5f53\u3066\u3068\u305d\u308c\u306b\u7d9a\u304f\u30b3\u30fc\u30c9\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u672c\u7269\u306e\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u7f6e\u304d\u63db\u3048\u308b\u305f\u3081\u306b\u507d\u306e\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u3057\u3066\u3044\u307e\u3059\u3002\u507d\u306e\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092<a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/7\/#Figure58\">\u56f358<\/a>\u306b\u793a\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3064\u3044\u3066\u306f\u5f8c\u3067\u3082\u3046\u5c11\u3057\u8a73\u3057\u304f\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<p>\u307e\u305f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306f<span style=\"font-family: 'courier new', courier, monospace;\">nIndex<\/span>\u306e\u53e4\u3044\u5024\u3092\u8fd4\u3059\u306e\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">hMenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u8fd4\u3055\u308c\u307e\u3059\u3002\u5b9f\u969b\u306b\u306f\u3001\u8fd4\u3055\u308c\u308b\u30dd\u30a4\u30f3\u30bf\u30fc\u306f\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u5185\u306e<span style=\"font-family: 'courier new', courier, monospace;\">*spmenu<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u3067\u3001\u3053\u308c\u306f\u30ab\u30fc\u30cd\u30eb \u30dd\u30a4\u30f3\u30bf\u30fc\u3067\u3059\u3002\u3053\u308c\u306f\u3001\u56f338\u3068\u3057\u3066\u518d\u63b2\u3057\u305f<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u5185\u306e\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0xa8<\/span>\u306b\u5b58\u5728\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure38\"><\/a><\/p>\n<figure id=\"attachment_128583\" aria-describedby=\"caption-attachment-128583\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128583 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-38.png\" alt=\"\u753b\u50cf38\u306f\u3001\u89aa\u306etagWNG\u69cb\u9020\u4f53\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"900\" height=\"690\" \/><figcaption id=\"caption-attachment-128583\" class=\"wp-caption-text\">\u56f338 \u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">GWL_ID<\/span>\u3092\u6307\u5b9a\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3092\u547c\u3073\u51fa\u3057\u305f\u5834\u5408\u3001\u56f339\u306b\u793a\u3059\u3088\u3046\u306b\u3001\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3068\u3001\u5b50\/\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30b3\u30d4\u30fc(\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x98<\/span>)\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u4e21\u65b9\u306b\u5bfe\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">*spmenu<\/span>\u3092\u5909\u66f4\u3059\u308b\u5b9f\u884c\u30d1\u30b9\u3092\u30c8\u30ea\u30ac\u30fc\u3059\u308b(\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">r15<\/span>\u306f <span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>\u3068\u7b49\u3057\u3044)\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u56f339\u3067\u306f<span style=\"font-family: 'courier new', courier, monospace;\">rsi<\/span>\u304c\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3067\u3059\u3002\u5b50\u3067\u3042\u308a\u30b3\u30d4\u30fc\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u306f\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x28<\/span>\u306e\u4f4d\u7f6e\u306b\u3042\u308a\u3001\u3053\u308c\u304c<span style=\"font-family: 'courier new', courier, monospace;\">rax<\/span>\u30ec\u30b8\u30b9\u30bf\u30fc\u306b\u30b3\u30d4\u30fc\u3055\u308c\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001\u5404<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u304c<span style=\"font-family: 'courier new', courier, monospace;\">r15<\/span>\u5185\u306e\u5024 (<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>)\u306b\u5909\u66f4\u3055\u308c\u307e\u3059\u3002<a id=\"Figure39\"><\/a><\/p>\n<figure id=\"attachment_128585\" aria-describedby=\"caption-attachment-128585\" style=\"width: 616px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128585 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-39.png\" alt=\"\u753b\u50cf39\u306f\u9006\u30a2\u30bb\u30f3\u30d6\u30eb\u3057\u305fxxxSetWindowData\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"616\" height=\"462\" \/><figcaption id=\"caption-attachment-128585\" class=\"wp-caption-text\">\u56f339 <span style=\"font-family: 'courier new', courier, monospace;\">xxxSetWindowData<\/span> (<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u304b\u3089\u547c\u3073\u51fa\u3055\u308c\u308b)\u306e\u9006\u30a2\u30bb\u30f3\u30d6\u30eb<\/figcaption><\/figure>\n<p>\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306e\u547c\u3073\u51fa\u3057\u5f8c\u306b\u8fd4\u3055\u308c\u308b\u5024\u306f\u3001\u5909\u66f4\u3055\u308c\u308b\u524d\u306e\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53 + <span style=\"font-family: 'courier new', courier, monospace;\">0xa8<\/span> (<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>)\u306e\u5024\u3067\u3059\u3002\u3053\u308c\u306f\u4e0a\u306e\u56f339\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8eac5a15c386<\/span>\u306b\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">rsi+0xa8<\/span>\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u6642\u70b9\u3067<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u5185\u306b\u30d6\u30ec\u30fc\u30af\u30dd\u30a4\u30f3\u30c8\u3092\u8a2d\u5b9a\u3059\u308c\u3070\u3001\u30ec\u30b8\u30b9\u30bf\u30fc\u306e\u5185\u5bb9\u3068<span style=\"font-family: 'courier new', courier, monospace;\">rsi+0xa8<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">0xfff8e82008218c0<\/span>)\u306e\u30c0\u30f3\u30d7\u3092\u78ba\u8a8d\u3067\u304d\u307e\u3059(\u56f340)\u3002<a id=\"Figure40\"><\/a><\/p>\n<figure id=\"attachment_128587\" aria-describedby=\"caption-attachment-128587\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128587 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-40.png\" alt=\"\u753b\u50cf40\u306f\u5909\u66f4\u524d\u306espmenu\u306e\u5024\u3092\u793a\u3057\u3066\u3044\u308bWinDbg\u306e\u51fa\u529b\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306b\u306f\u30ec\u30b8\u30b9\u30bf\u30fc\u306e\u5185\u5bb9\u3068rsi+0xa8 (0xfff8e82008218c0)\u306e\u30c0\u30f3\u30d7\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"227\" \/><figcaption id=\"caption-attachment-128587\" class=\"wp-caption-text\">\u56f340 \u5909\u66f4\u524d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u306e\u5024\u3092\u793a\u3057\u3066\u3044\u308b<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306e\u51fa\u529b<\/figcaption><\/figure>\n<p>\u623b\u308a\u5024\u304c\u5b9f\u969b\u306b\u79c1\u305f\u3061\u304c\u8003\u3048\u3066\u3044\u308b\u901a\u308a\u306e\u5185\u5bb9\u306a\u306e\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u56f341\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrW<\/span>\u306e\u547c\u3073\u51fa\u3057\u304c\u7d42\u308f\u3063\u305f\u3068\u304d\u306e\u30ec\u30b8\u30b9\u30bf\u30fc\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><strong>\u6ce8: <\/strong>\u6df7\u4e71\u3092\u907f\u3051\u308b\u305f\u3081\u306b\u7533\u3057\u6dfb\u3048\u3066\u304a\u304d\u307e\u3059\u3002\u4e00\u90e8\u306e\u56f3\u3067<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3067\u306f\u306a\u304f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrW<\/span>\u304c\u4f7f\u308f\u308c\u3066\u3044\u308b\u306e\u306b\u306f\u7406\u7531\u304c\u3042\u308a\u307e\u3059\u3002Windows\u304c\u76f4\u63a5\u6271\u3046\u306e\u306fUnicode\u6587\u5b57\u3060\u3051\u306a\u306e\u3067\u3059\u304c\u3001\u3053\u306eUnicode\u6587\u5b57\u3092\u6271\u3046\u95a2\u6570\u306e\u540d\u524d\u306f<span style=\"font-family: 'courier new', courier, monospace;\">W<\/span>\u3067\u7d42\u308f\u3063\u3066\u3044\u308b\u95a2\u6570\u3067\u3059\u3002\u305d\u3057\u3066\u3001ASCII\u306b\u5bfe\u5fdc\u3059\u308b\u305f\u3081\u306bMicrosoft\u306f\u30e9\u30c3\u30d1\u30fc\u95a2\u6570\u3092\u4f5c\u6210\u3057\u3066\u3044\u3066\u3001\u3053\u308c\u3089\u306e\u30e9\u30c3\u30d1\u30fc\u95a2\u6570\u304c\u540d\u524d\u304c<span style=\"font-family: 'courier new', courier, monospace;\">A<\/span>\u3067\u7d42\u308f\u308b\u95a2\u6570\u3067\u3059\u3002\u30e9\u30c3\u30d1\u30fc\u95a2\u6570\u306f\u3001\u5358\u7d14\u306b\u5909\u63db\u3092\u884c\u3063\u3066\u304b\u3089Unicode\u7528\u306e\u95a2\u6570\u3092\u76f4\u63a5\u547c\u3073\u51fa\u3057\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u306e\u547c\u3073\u51fa\u3057\u3092\u30c7\u30d0\u30c3\u30b0\u3059\u308b\u5834\u5408\u3001\u5b9f\u969b\u306e\u4ed5\u4e8b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrW<\/span>\u306e\u4e2d\u3067\u884c\u308f\u308c\u3066\u3044\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<a id=\"Figure41\"><\/a><\/p>\n<figure id=\"attachment_128589\" aria-describedby=\"caption-attachment-128589\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128589 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/kdgreater-g-break-instruction-exception-code-8oeeeoe.png\" alt=\"\u753b\u50cf41\u306f\u3001SetWindowLongPtrW\u304b\u3089\u623b\u308b\u524d\u306e\u30ec\u30b8\u30b9\u30bf\u30fc\u306e\u5024\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002rax\u306f\u524d\u56f3\u3068\u540c\u3058\u5024\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002. kd&gt; g Break instruction exception - code 8\u00f8eee\u00f8e3 (first chance) USER 32 !SetWindowLongPtrW+0xc4 : \u00f8e33:e\u00f8ee7ff8\u2022 664ab814 c3 ret rax=ffff8e820e8218co rdx-eeeeee\u00f8eeee\u00f8\u00f8eeo rip-eeee7ff8664ab814 r8-eeeeee36bd4f34e8 ril=ee\u00f8eee\u00f8eeee\u00f8\u00f8246 r14-eeeeee\u00f8eeee\u00f8\u00f8eeo iopl=e nv up rbx=e\u00f8eee15ba502839\u00f8 rsi-eeee\u00f8\u00f8ee\u00f8euaeg\u00f8 rsp=e\u00f8eeee36bd4f3528 r9-e\u00f8eee\u00f836bd4f363\u00f8 r12=e\u00f8eee\u00f8ee\u00f8eeeeee\u00f8 r15-e\u00f8eee\u00f8ee\u00f8ee3839\u00f8 ei pl nz na pe nc rcx=\u00f8ee07ff86535b4a4 rdi-\u00f8ee07ff7ed32ee\u00f8e rbp=\u00f8eeeee36bd4f363e rlo-\u00f8eeeee\u00f8\u00f8ee\u00f8ee\u00f8\u00f8e r13=\u00f8eee7ff866532e7e cs-ee33 ss-ee2b ds=ee2b es-\u00f8e2b fs=e\u00f853 gs=ee2b 1 ef1=e\u00f8eeme2 USER32 !SetWindowLongPtrW+0xc4 : ee33:eeee7ffC 664ab814 c3 ret \" width=\"900\" height=\"370\" \/><figcaption id=\"caption-attachment-128589\" class=\"wp-caption-text\">\u56f341. <span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrW<\/span>\u304b\u3089\u623b\u308b\u76f4\u524d\u306e\u30ec\u30b8\u30b9\u30bf\u30fc\u306e\u5024<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">rax<\/span>\u304c\u3001\u56f340\u306e<span style=\"font-family: 'courier new', courier, monospace;\">rsi+0xa8<\/span>\u3068\u540c\u3058\u5024\u3067\u3042\u308b\u3053\u3068\u306b\u6ce8\u76ee\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u3053\u308c\u306f\u3001\u30b9\u30c6\u30c3\u30d78\u3067\u4f5c\u6210\u3057\u305f\u3001\u5143\u306e\u30e1\u30cb\u30e5\u30fc\u9805\u76ee\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3067\u3059\u3002\u3053\u306e\u30a2\u30c9\u30ec\u30b9\u306f\u3001\u5f8c\u306e\u30b9\u30c6\u30c3\u30d7\u3067\u3001\u30ab\u30fc\u30cd\u30eb\u306e<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u69cb\u9020\u4f53\u3092\u898b\u3064\u3051\u3001\u7279\u6a29\u6607\u683c\u7528System\u30c8\u30fc\u30af\u30f3\u3092\u30b3\u30d4\u30fc\u3059\u308b\u306e\u306b\u4f7f\u308f\u308c\u307e\u3059\u3002\u3053\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u306fPoC\u5185\u306e\u5909\u6570<span style=\"font-family: 'courier new', courier, monospace;\">g_qwExploit<\/span>\u306b\u4fdd\u5b58\u3055\u308c\u3066\u3044\u307e\u3059(\u4e0a\u56f334)\u3002<\/p>\n<p>\u56f342\u306b\u793a\u3057\u305f<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLongPtrA<\/span>\u3078\u306e\u6b21\u306e\u547c\u3073\u51fa\u3057(566\u884c\u76ee)\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND.dwExStyle<\/span>\u3092\u4ee5\u524d\u306e\u5024\u306b\u30ea\u30bb\u30c3\u30c8\u3057\u307e\u3059\u3002\u3053\u306e\u5024\u306fPoC 546\u884c\u76ee\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059(\u56f343)\u3002\u3057\u305f\u304c\u3063\u3066\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306f\u3082\u3046\u5b50\u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u306f\u306a\u304f\u306a\u308a\u307e\u3059\u3002<a id=\"Figure42\"><\/a> <a id=\"Figure43\"><\/a><\/p>\n<figure id=\"attachment_128591\" aria-describedby=\"caption-attachment-128591\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128591 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-42.png\" alt=\"\u753b\u50cf42\u306fPoC 566\u884c\u76ee\u3067\u3059\u3002\u3053\u306e\u56f3\u306fSetWindowLongPtrA\u3067\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002 \" width=\"900\" height=\"34\" \/><figcaption id=\"caption-attachment-128591\" class=\"wp-caption-text\">\u56f342. PoC 566\u884c\u76ee<\/figcaption><\/figure>\n<figure id=\"attachment_128593\" aria-describedby=\"caption-attachment-128593\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128593 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-43.png\" alt=\"\u753b\u50cf43\u306fPoC 546\u884c\u76ee\u3067\u3059\u3002\u3053\u306e\u56f3\u306f g_qwrpdesk \u3078\u306e\u4ee3\u5165\u304b\u3089\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002 \" width=\"900\" height=\"78\" \/><figcaption id=\"caption-attachment-128593\" class=\"wp-caption-text\">\u56f343. PoC 546\u884c\u76ee<\/figcaption><\/figure>\n<p>\u300c<span style=\"font-family: 'courier new', courier, monospace;\">SetWindowLong<\/span>\u95a2\u6570\u3092\u4f7f\u3063\u3066\u30ab\u30fc\u30cd\u30eb \u30e1\u30e2\u30ea\u30fc\u306b\u66f8\u304d\u8fbc\u3081\u308b\u306a\u3089\u3001\u306a\u305c\u3053\u3093\u306a\u3053\u3093\u306a\u306b\u82e6\u52b4\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u6f0f\u3048\u3044\u3055\u305b\u308b\u5fc5\u8981\u304c\u3042\u308b\u306e?\u300d\u3068\u3044\u3046\u7591\u554f\u304c\u6d6e\u304b\u3076\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002\u5358\u306b<span style=\"font-family: 'courier new', courier, monospace;\">GetWindowLong<\/span>\u3092\u4f7f\u3063\u3066\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u8aad\u307f\u53d6\u308c\u3070\u3088\u3044\u306e\u3067\u306f\u306a\u3044\u3067\u3057\u3087\u3046\u304b\u3002<\/p>\n<p>\u305d\u3046\u3059\u308c\u3070\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u5f97\u3089\u308c\u308b\u308f\u3051\u3067\u3059\u3002\u3067\u3059\u304c\u305d\u306e\u5834\u5408\u3001\u5b50\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u304b\u3089\u306e\u8aad\u307f\u53d6\u308a\u306b\u306a\u308a\u3001\u305d\u3053\u306b\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u306f\u683c\u7d0d\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3002\u56f344\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u5b50\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u51fa\u529b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x98<\/span>(<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>)\u3092\u898b\u308b\u3068\u3053\u308c\u304c\u7d76\u5bfe\u306b\u30ab\u30fc\u30cd\u30eb \u30dd\u30a4\u30f3\u30bf\u30fc\u3067\u306f\u306a\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u5f8c\u3067\u3059\u3050\u8aac\u660e\u3057\u307e\u3059\u304c\u3001\u3053\u308c\u306f\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306a\u306e\u3067\u3059\u3002<a id=\"Figure44\"><\/a><\/p>\n<figure id=\"attachment_128595\" aria-describedby=\"caption-attachment-128595\" style=\"width: 834px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128595 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-44.png\" alt=\"\u753b\u50cf44\u306f\u3001Wnd1\u306e\u5b50\u306etagWND\u69cb\u9020\u4f53\u306eWinDbg\u51fa\u529b\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u30020003a850 00000000\u304c\u9ec4\u8272\u306e\u67a0\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002 \" width=\"834\" height=\"334\" \/><figcaption id=\"caption-attachment-128595\" class=\"wp-caption-text\">\u56f344. <span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u5b50\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u51fa\u529b<\/figcaption><\/figure>\n<p>\u30b9\u30c6\u30c3\u30d77\u3067\u8a08\u7b97\u3057\u305f\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 \u30d9\u30fc\u30b9\u306b\u3001\u5b50\u306e\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND+0x98<\/span>\u5185\u306e\u5024\u3092\u52a0\u3048\u308b\u3068\u3001\u56f345\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<a id=\"Figure45\"><\/a><\/p>\n<figure id=\"attachment_128597\" aria-describedby=\"caption-attachment-128597\" style=\"width: 854px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128597 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-45.png\" alt=\"\u753b\u50cf45\u306f\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7 + 0x3a850\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002 \" width=\"854\" height=\"142\" \/><figcaption id=\"caption-attachment-128597\" class=\"wp-caption-text\">\u56f345. \u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7+<span style=\"font-family: 'courier new', courier, monospace;\">0x3a850<\/span><\/figcaption><\/figure>\n<p>\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53(\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0xa8<\/span>)\u304b\u3089\u6f0f\u3048\u3044\u3055\u305b\u305f\u30a2\u30c9\u30ec\u30b9\u3092\u78ba\u8a8d\u3059\u308b\u3068\u3001\u56f346\u306e\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<a id=\"Figure46\"><\/a><\/p>\n<figure id=\"attachment_128599\" aria-describedby=\"caption-attachment-128599\" style=\"width: 852px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128599 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-46.png\" alt=\"\u753b\u50cf46\u306fWnd1\u306e\u89aa\u306etagWND\u69cb\u9020\u4f53+0xa8\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"852\" height=\"138\" \/><figcaption id=\"caption-attachment-128599\" class=\"wp-caption-text\">\u56f346. <span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53 + <span style=\"font-family: 'courier new', courier, monospace;\">0xa8<\/span><\/figcaption><\/figure>\n<p>\u6700\u521d\u306e\u5024\u304c\u540c\u3058\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30d5\u30ec\u30f3\u30c9\u30ea\u30fc\u306a\u30b3\u30d4\u30fc\u304c\u5b58\u5728\u3059\u308b\u3088\u3046\u306b\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30d5\u30ec\u30f3\u30c9\u30ea\u30fc\u306a<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u3088\u3046\u306a\u3082\u306e\u3082\u5b58\u5728\u3057\u3066\u3044\u308b\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002<\/p>\n<p>\u3057\u304b\u3057\u3001\u3053\u306e\u30ab\u30fc\u30cd\u30eb\u30a2\u30c9\u30ec\u30b9\u304c\u624b\u306b\u5165\u3063\u305f\u3068\u3057\u3066\u3053\u308c\u3092\u4f7f\u3063\u3066\u4f55\u304c\u3067\u304d\u308b\u306e\u3067\u3057\u3087\u3046\u304b\u3002\u3053\u308c\u306b\u3064\u3044\u3066\u306f\u7b2c6\u90e8\u306e\u30b9\u30c6\u30c3\u30d713\u3067\u691c\u8a0e\u3057\u307e\u3059\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em>\u7d9a\u304d\u3092\u8aad\u3080 \u27a0 <a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/6\">\u30bb\u30af\u30b7\u30e7\u30f3 6 \u2013 \u8a73\u7d30\u5206\u6790\u30b9\u30c6\u30c3\u30d713<\/a><\/em><\/strong><\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n<p><!--nextpage--><\/p>\n<h2><a id=\"TOC\"><\/a>\u76ee\u6b21<\/h2>\n<p><a href=\"#post-128698-_45ute1x5rd0o\">13. \u4efb\u610f\u306eread\/write\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u306b\u3088\u308aSystem\u306e\u30c8\u30fc\u30af\u30f3\u3092\u8907\u88fd\u3057\u3066\u7279\u6a29\u6607\u683c\u3059\u308b<\/a><\/p>\n<h2><a id=\"FigToC\"><\/a>\u56f3\u8868\u306e\u76ee\u6b21<\/h2>\n<p><a href=\"#Figure47\">\u56f347. PoC 355\u301c359\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure48\">\u56f348. \u6f0f\u3048\u3044\u3055\u305b\u305fspmenu\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306eWinDbg\u30c0\u30f3\u30d7<\/a><br \/>\n<a href=\"#Figure49\">\u56f349. WinDbg\u306b\u3088\u308bspmenu + 0x50\u306e\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure50\">\u56f350. WinDbg\u306b\u3088\u308b*spmenu + 0x50\u306e\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure51\">\u56f351. PoC 570\uff5e598\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure52\">\u56f352. THREADINFO\u69cb\u9020\u4f53<\/a><br \/>\n<a href=\"#Figure53\">\u56f353. WinDbg\u306b\u3088\u308bETHREAD\u69cb\u9020\u4f53\u306e\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure54\">\u56f354. EPROCESS\u30a8\u30f3\u30c8\u30ea\u30fc\u3092\u793a\u3059WinDbg\u306b\u3088\u308bKTHREAD + 0x220\u306e\u51fa\u529b<\/a><br \/>\n<a href=\"#Figure55\">\u56f355. PoC 601\u301c637\u884c\u76ee<\/a><\/p>\n<h5><a id=\"post-128698-_45ute1x5rd0o\"><\/a>13. \u4efb\u610f\u306eread\/write\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u306b\u3088\u308aSystem\u306e\u30c8\u30fc\u30af\u30f3\u3092\u8907\u88fd\u3057\u3066\u7279\u6a29\u6607\u683c\u3059\u308b<\/h5>\n<p>\u3053\u306e\u6642\u70b9\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u5143\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u5f97\u3089\u308c\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u30ab\u30fc\u30cd\u30eb \u30e1\u30e2\u30ea\u30fc\u306e\u30a2\u30c9\u30ec\u30b9\u3067\u3082\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u5143\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u3001<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u3088\u3063\u3066\u7f6e\u304d\u63db\u3048\u307e\u3057\u305f\u3002<\/p>\n<p>\u3053\u308c\u304b\u3089\u8aac\u660e\u3059\u308b\u3088\u3046\u306b\u3001\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f7f\u3063\u3066\u3001\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u30e1\u30cb\u30e5\u30fc \u30d0\u30fc\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u4eca\u306e\u507d<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9 \u30a2\u30c9\u30ec\u30b9\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u76f4\u63a5\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u3067\u3059\u3002\u3053\u3053\u3067Windows\u3092\u9a19\u3057\u3066\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u306e\u30e1\u30f3\u30d0\u30fc\u306e1\u3064\u307e\u305f\u306f\u305d\u308c\u4ee5\u4e0a\u306b\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u5165\u529b\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u308c\u3070\u3001\u30ab\u30fc\u30cd\u30eb\u306e\u4efb\u610f\u306eread\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u624b\u306b\u5165\u308c\u3089\u308c\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u305f\u3060\u3057Microsoft\u306f\u3053\u306e\u69cb\u9020\u4f53\u7528\u306e\u30b7\u30f3\u30dc\u30eb\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u305b\u3093\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u3053\u306e\u69cb\u9020\u4f53\u306b\u3069\u306e\u3088\u3046\u306a\u30e1\u30f3\u30d0\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u306e\u304b\u7279\u5b9a\u3059\u308b\u306b\u306f\u3001\u591a\u5c11\u306e\u5206\u6790\u304c\u5fc5\u8981\u3067\u3059\u3002\u3053\u3053\u3067\u306f\u624b\u3092\u629c\u3044\u3066\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306ePoC\u3092\u5229\u7528\u3059\u308b\u3053\u3068\u306b\u3057\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>\u306e\u5272\u308a\u5f53\u3066(355\u301c359\u884c\u76ee)\u304b\u3089\u3001<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u69cb\u9020\u4f53\u306e\u30b5\u30a4\u30ba\u306f<span style=\"font-family: 'courier new', courier, monospace;\">0xa0<\/span>\u30d0\u30a4\u30c8\u3067\u3042\u308d\u3046\u3068\u898b\u5f53\u3092\u3064\u3051\u3089\u308c\u307e\u3059\u3002\u3053\u308c\u3092PoC 355\u301c359\u884c\u76ee\u306b\u3042\u305f\u308b\u56f347\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure47\"><\/a><\/p>\n<figure id=\"attachment_128601\" aria-describedby=\"caption-attachment-128601\" style=\"width: 822px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128601 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-47.png\" alt=\"\u753b\u50cf47\u306f\u3001PoC 355\u301c359\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u6700\u521d\u306e4\u884c\u306fQWORD\u3067\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002\u6700\u5f8c\u306e5\u884c\u76ee\u306fHLOCAL\u3067\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002\" width=\"822\" height=\"226\" \/><figcaption id=\"caption-attachment-128601\" class=\"wp-caption-text\">\u56f347. PoC 355\u301c359\u884c\u76ee<\/figcaption><\/figure>\n<p>\u6f0f\u3048\u3044\u3055\u305b\u305f\u30a2\u30c9\u30ec\u30b9\u306e\u30e1\u30e2\u30ea\u30fc\u3092\u30c0\u30f3\u30d7\u3057\u3001\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0xa0<\/span>\u307e\u3067\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u8208\u5473\u306e\u5bfe\u8c61\u304c\u898b\u3064\u304b\u308b\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u304b\u3089\u306e\u30c0\u30f3\u30d7\u3092\u56f348\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure48\"><\/a><\/p>\n<figure id=\"attachment_128603\" aria-describedby=\"caption-attachment-128603\" style=\"width: 846px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128603 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-48.png\" alt=\"\u753b\u50cf48\u306fWinDbg\u304b\u3089\u306e\u30c0\u30f3\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306b\u306f\u6f0f\u3048\u3044\u3055\u305b\u305fspmenu\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u304c\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"846\" height=\"394\" \/><figcaption id=\"caption-attachment-128603\" class=\"wp-caption-text\">\u56f348. \u6f0f\u3048\u3044\u3055\u305b\u305f<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u30c0\u30f3\u30d7<\/figcaption><\/figure>\n<p>\u6700\u521d\u306e\u30a8\u30f3\u30c8\u30ea\u30fc\u306b\u4f55\u3089\u304b\u306eID\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3089\u3057\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u306e\u89aa\u3068\u5b50\u306e\u69cb\u9020\u4f53\u3067\u5171\u6709\u3055\u308c\u3066\u3044\u305f\u5024\u3067\u3059\u3002<\/p>\n<p>\u6b21\u306e2\u3064\u306e\u30a8\u30f3\u30c8\u30ea\u30fc\u306f\u305d\u308c\u307b\u3069\u8208\u5473\u3092\u305d\u305d\u308b\u3082\u306e\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u6b21\u306e3\u3064\u306e\u30a8\u30f3\u30c8\u30ea\u30fc\u306b\u306f\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u304c\u7d9a\u3044\u3066\u3044\u308b\u306e\u3067\u3001\u3053\u308c\u3089\u3092\u30c0\u30f3\u30d7\u3057\u3066\u306a\u306b\u304b\u6c17\u306b\u306a\u308b\u3082\u306e\u304c\u3042\u308b\u304b\u78ba\u8a8d\u3057\u3066\u307f\u3066\u3082\u3088\u3044\u3067\u3057\u3087\u3046\u3002<\/p>\n<p>\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x30<\/span>\u306b\u306f\u3001\u4e0a\u8a18\u306e\u30e6\u30fc\u30b6\u30fc \u30e2\u30fc\u30c9 \u30bb\u30fc\u30d5\u306a<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8(\u56f344)\u306e\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x98<\/span>\u306b\u3042\u308b\u5024\u3068\u540c\u3058\u5024\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u304a\u305d\u3089\u304f\u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u304b\u3089\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3067\u3042\u308d\u3046\u3068\u5224\u65ad\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u30ab\u30fc\u30cd\u30eb \u30c7\u30b9\u30af\u30c8\u30c3\u30d7 \u30d2\u30fc\u30d7\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u52a0\u7b97\u3059\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e8201000000<\/span> + <span style=\"font-family: 'courier new', courier, monospace;\">0x3a850<\/span> = <span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e820103a850<\/span>\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u4e0a\u56f348\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>+<span style=\"font-family: 'courier new', courier, monospace;\">0x28<\/span>\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u5024\u3068\u540c\u3067\u3059\u3002\u3053\u306e\u7d50\u679c\u306f\u79c1\u305f\u3061\u306e\u63a8\u6e2c\u3057\u305f\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u652f\u6301\u3059\u308b\u3082\u306e\u3067\u3059\u3002<\/p>\n<p>\u3053\u3053\u3067\u306f\u3001\u307b\u304b\u306e2\u3064\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u898b\u3066\u3082\u4f55\u3082\u767a\u898b\u304c\u306a\u304b\u3063\u305f\u3068\u3057\u307e\u3057\u3087\u3046\u3002\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>+<span style=\"font-family: 'courier new', courier, monospace;\">0x50<\/span>\u306e\u30e1\u30e2\u30ea\u30fc\u3092\u30c0\u30f3\u30d7\u3059\u308b\u3068\u3001\u56f349\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<a id=\"Figure49\"><\/a><\/p>\n<figure id=\"attachment_128605\" aria-describedby=\"caption-attachment-128605\" style=\"width: 838px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128605 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-49.png\" alt=\"\u753b\u50cf49\u306fspmenu+0x50\u306eWinDbg\u306e\u51fa\u529b\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"838\" height=\"74\" \/><figcaption id=\"caption-attachment-128605\" class=\"wp-caption-text\">\u56f349. <span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308b<span style=\"font-family: 'courier new', courier, monospace;\">spmenu + 0x50<\/span>\u306e\u51fa\u529b<\/figcaption><\/figure>\n<p>\u5206\u6790\u3057\u3066\u307f\u308b\u3068\u3053\u306e\u30a2\u30c9\u30ec\u30b9\u306f\u898b\u899a\u3048\u304c\u3042\u308b\u3082\u306e\u3067\u3059(\u56f340\u306e<span style=\"font-family: 'courier new', courier, monospace;\">rsi<\/span>)\u3002\u5b9f\u306f\u3053\u308c\u306f\u56f350\u306b\u793a\u3057\u305f<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30a2\u30c9\u30ec\u30b9\u3067\u3059\u3002<a id=\"Figure50\"><\/a><\/p>\n<figure id=\"attachment_128607\" aria-describedby=\"caption-attachment-128607\" style=\"width: 846px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128607 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-50.png\" alt=\"\u753b\u50cf50\u306f*spmenu + 0\u00d750\u306eWinDbg\u51fa\u529b\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"846\" height=\"304\" \/><figcaption id=\"caption-attachment-128607\" class=\"wp-caption-text\">\u56f350. <span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308b<span style=\"font-family: 'courier new', courier, monospace;\">*spmenu + 0x50<\/span>\u306e\u51fa\u529b<\/figcaption><\/figure>\n<p>\u3053\u308c\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u304b\u3089\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u79fb\u52d5\u3059\u308b\u65b9\u6cd5\u304c\u3042\u308b\u3053\u3068\u3092\u610f\u5473\u3057\u307e\u3059\u3002PoC 507\u884c\u76ee(\u56f351\u306e1\u884c\u76ee)\u3092\u898b\u308b\u3068\u3001\u6f0f\u3048\u3044\u3055\u305b\u305f<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>+<span style=\"font-family: 'courier new', courier, monospace;\">0x50<\/span>\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u306b\u3088\u3063\u3066\u8aad\u307f\u8fbc\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u95a2\u6570\u304c\u3069\u306e\u3088\u3046\u306b\u6a5f\u80fd\u3059\u308b\u304b\u306f\u6b21\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u8aac\u660e\u3057\u307e\u3059\u304c\u3001\u3055\u3057\u3042\u305f\u3063\u3066\u306f\u3001\u3053\u308c\u304c\u6e21\u3055\u308c\u305f\u5f15\u6570\u306e\u30ab\u30fc\u30cd\u30eb \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u53d6\u5f97\u3059\u308b\u3001\u3068\u3044\u3046\u3053\u3068\u3060\u3051\u7406\u89e3\u3057\u3066\u304a\u3044\u3066\u304f\u3060\u3055\u3044\u3002\u3057\u305f\u304c\u3063\u3066\u3001<span style=\"font-family: 'courier new', courier, monospace;\">qwFrist<\/span>\u306b\u306f\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30a2\u30c9\u30ec\u30b9\u304c\u683c\u7d0d\u3055\u308c\u308b\u3068\u4eee\u5b9a\u3067\u304d\u307e\u3059\u3002<a id=\"Figure51\"><\/a><\/p>\n<figure id=\"attachment_128609\" aria-describedby=\"caption-attachment-128609\" style=\"width: 439px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128609 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-51.png\" alt=\"\u753b\u50cf51\u306fPoC 570\u301c598\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306f\u6e21\u3055\u308c\u305f\u5f15\u6570\u306e\u30ab\u30fc\u30cd\u30eb \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u53d6\u5f97\u3059\u308b\u95a2\u6570\u3092\u542b\u3093\u3067\u3044\u307e\u3059\u3002\" width=\"439\" height=\"609\" \/><figcaption id=\"caption-attachment-128609\" class=\"wp-caption-text\">\u56f351. PoC 570\uff5e598\u884c\u76ee<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u5185\u5bb9\u3092\u3082\u3046\u4e00\u5ea6\u898b\u76f4\u3057\u3066(<a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/5\/#Figure38\">\u56f338<\/a>)\u3001\u7279\u6a29\u6607\u683c\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u3057\u304f\u307f\u306b\u3064\u3044\u3066\u5c11\u3057\u308f\u304b\u3063\u3066\u304f\u308b\u3068(\u30c8\u30fc\u30af\u30f3\u306e\u7a83\u53d6\u306b\u95a2\u3057\u3066\u306f<a href=\"https:\/\/amriunix.com\/post\/windows-kernel-shellcode-tokenstealer\/\">\u3053\u3061\u3089\u306e\u89e3\u8aac<\/a>\u304c\u53c2\u8003\u306b\u306a\u308b)\u3001\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x10<\/span>\u306b\u306f <span style=\"font-family: 'courier new', courier, monospace;\">THREADINFO<\/span>\u3068\u3044\u3046\u30a8\u30f3\u30c8\u30ea\u30fc\u304c\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">THREADINFO<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">W32THREAD<\/span>\u3068\u3044\u3046\u30a8\u30f3\u30c8\u30ea\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">W32THREAD<\/span>\u3068\u3044\u3046\u30a8\u30f3\u30c8\u30ea\u30fc\u306f\u3001\u30ab\u30fc\u30cd\u30eb\u5185\u306e\u73fe\u5728\u306e\u30b9\u30ec\u30c3\u30c9\u306e<span style=\"font-family: 'courier new', courier, monospace;\">ETHREAD<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u3092\u6307\u3057\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">THREADINFO<\/span>\u69cb\u9020\u4f53\u3092\u56f352\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure52\"><\/a><\/p>\n<figure id=\"attachment_128611\" aria-describedby=\"caption-attachment-128611\" style=\"width: 550px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128611 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-52.png\" alt=\"\u753b\u50cf52\u306fTHREADINFO\u69cb\u9020\u4f53\u3092\u793a\u3057\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"550\" height=\"536\" \/><figcaption id=\"caption-attachment-128611\" class=\"wp-caption-text\">\u56f352. <span style=\"font-family: 'courier new', courier, monospace;\">THREADINFO<\/span>\u69cb\u9020\u4f53<\/figcaption><\/figure>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">ETHREAD + 0x00<\/span> (\u56f353)\u306f<span style=\"font-family: 'courier new', courier, monospace;\">KTHREAD<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3067\u3059\u3002\u305d\u3057\u3066\u3053\u306e\u69cb\u9020\u4f53\u306f\u3055\u3089\u306b\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">0x220<\/span>\u306b<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u6301\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u69cb\u9020\u4f53\u5185\u306etoken\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u306f\u3001\u5404\u30d7\u30ed\u30bb\u30b9\u306b\u7d10\u3065\u304f\u7279\u6a29\u3092\u6c7a\u3081\u308b\u30d7\u30ed\u30bb\u30b9 \u30c8\u30fc\u30af\u30f3\u304c\u683c\u7d0d\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u3001\u3053\u306ePoC\u306e<span style=\"font-family: 'courier new', courier, monospace;\">qwfourth<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">qwfifth<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">qwEprocess<\/span>\u5909\u6570\u3067\u53d6\u5f97\u3055\u308c\u3066\u3044\u307e\u3059(\u4e0a\u56f352)\u3002<span style=\"font-family: 'courier new', courier, monospace;\">ETHREAD<\/span>\u306e\u5185\u5bb9\u306e<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308b\u51fa\u529b\u3092\u56f353\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure53\"><\/a><\/p>\n<p><figure id=\"attachment_128613\" aria-describedby=\"caption-attachment-128613\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128613 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/t-nt-exeee-ex438-0less438-ex448-0less448-ex.png\" alt=\"\u753b\u50cf53\u306f\u3001ETHREAD\u69cb\u9020\u4f53\u3092WinDbg\u3067\u51fa\u529b\u3057\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002t nt!+exeee +ex438 +0&lt;438 +ex448 +0&lt;448 +ex45e +ex458 +ex46e +0&lt;468 +0&lt;488 +ex488 +8x4a8 +ex4be +ex4ce +ex4c8 +ex4de Tcb CreateTime ExitT ime KeyedWaitChain PostB10ckList ForwardLinkShadow : StartAddress TerminationPort ReaperLink KeyedWaitVa1ue KTHREAD LARGE INTEGER exe LARGE INTEGER exe _ LIST_ENTRY [ exeeee\u00f8eee\u2022ee\u00f8eeeee - _ LIST ENTRY [ exfffff807* 70e36f6e oxfffff8eT70e36f6e void \u2022 exffffd4e1* \u00f8fOf3688 Void : (null) (null) \u2022 (null) ActiveTimerListLock : Ox144dec\u00f81* m\u00f8\u00f8deee ActiveTimerListHead . _LIST_ENTRY [ \u00f8xe1d81f9f' 9658137e oxeeeeeeee\u2022 eee\u00f8e394 - exffffd4\u00d81*0f0f3688 ] - ex\u00f8ee\u00f8ee\u00f8\u00f8\u2022 eeee1ca8 ] Cid CLIENT ID KeyedWaitSemaphore : _ KSEMAP}ORE Alpcwaitsemaphore : KSEMAPHORE ClientSecurity ps CLIENT SECURITY CONTEXT IrpList _ LIST_ENTRY [ exffffd4Ff5d82b6e - TopLeve11rp DeviceToverify : (null) (null) Win32StartAddress . exffffc2\u00f8a\u2022 89e9267e ] \" width=\"900\" height=\"429\" \/><figcaption id=\"caption-attachment-128613\" class=\"wp-caption-text\">\u56f353. <span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308b<span style=\"font-family: 'courier new', courier, monospace;\">ETHREAD<\/span>\u69cb\u9020\u4f53\u306e\u51fa\u529b<\/figcaption><\/figure><span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308b\u30aa\u30d5\u30bb\u30c3\u30c8<span style=\"font-family: 'courier new', courier, monospace;\">KTHREAD + 0x220<\/span>\u306e\u51fa\u529b\u306b\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059(\u56f354)\u3002<a id=\"Figure54\"><\/a><\/p>\n<figure id=\"attachment_128615\" aria-describedby=\"caption-attachment-128615\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128615 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/ex22e-ex228-process-useraffinity-useraffinit.png\" alt=\"\u753b\u50cf54\u306f\u3001EPROCESS\u30a8\u30f3\u30c8\u30ea\u30fc\u3092\u793a\u3059KTHREAD + 0x220\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u3053\u306b\u306f\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"99\" \/><figcaption id=\"caption-attachment-128615\" class=\"wp-caption-text\">\u56f354. <span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u30a8\u30f3\u30c8\u30ea\u30fc\u3092\u793a\u3059<span style=\"font-family: 'courier new', courier, monospace;\">WinDbg<\/span>\u306b\u3088\u308b<span style=\"font-family: 'courier new', courier, monospace;\">KTHREAD + 0x220<\/span>\u306e\u51fa\u529b<\/figcaption><\/figure>\n<p>\u73fe\u5728\u306e\u30d7\u30ed\u30bb\u30b9\u306e<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u304c\u308f\u304b\u3063\u305f\u306e\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">ActiveProcessLinks<\/span>\u3092\u4f7f\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">0x4<\/span>\u306e\u30d7\u30ed\u30bb\u30b9ID (PID)\u304c\u3064\u3044\u3066\u3044\u308b\u4e00\u610f\u306b\u8b58\u5225\u3055\u308c\u308b\u30b7\u30b9\u30c6\u30e0 \u30d7\u30ed\u30bb\u30b9\u3092\u691c\u7d22\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<span style=\"font-family: 'courier new', courier, monospace;\">ActiveProcessLinks<\/span>\u306f\u73fe\u5728\u5b9f\u884c\u4e2d\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u30ea\u30f3\u30af\u30ea\u30b9\u30c8\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u69cb\u9020\u4f53\u5185\u306b\u3082\u5b58\u5728\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>PID\u304c\u898b\u3064\u304b\u3063\u305f\u3089\u3001\u4e0a\u8a18\u3068\u540c\u3058\u65b9\u6cd5\u3067\u30c8\u30fc\u30af\u30f3\u3092\u898b\u3064\u3051\u3066\u73fe\u5728\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u30c8\u30fc\u30af\u30f3\u306b\u30b3\u30d4\u30fc\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u305d\u306e\u7279\u6a29\u3092System\u306e\u3082\u3064\u7279\u6a29\u306b\u6607\u683c\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u56f355\u306b\u793a\u3059PoC 601\u301c637\u884c\u76ee\u304c\u3053\u308c\u3092\u9054\u6210\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure55\"><\/a><\/p>\n<figure id=\"attachment_128617\" aria-describedby=\"caption-attachment-128617\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128617 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-55.png\" alt=\"\u753b\u50cf55\u306f\u3001PoC 601\u301c637\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u3053\u3067\u7279\u6a29\u6607\u683c\u3092\u884c\u3063\u3066\u3044\u307e\u3059\u3002\" width=\"900\" height=\"686\" \/><figcaption id=\"caption-attachment-128617\" class=\"wp-caption-text\">\u56f355. PoC 601\u301c637\u884c\u76ee<\/figcaption><\/figure>\n<p>\u4ee5\u4e0a\u306eSystem\u30c8\u30fc\u30af\u30f3\u306e\u7a83\u53d6\u624b\u6cd5\u3092\u307e\u3068\u3081\u308b\u3068\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<ol style=\"list-style-type: upper-alpha;\">\n<li><span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS<\/span>\u69cb\u9020\u4f53\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">KTHREAD.ApcState.Process<\/span>\u3092\u4fdd\u5b58\u3059\u308b<\/li>\n<li>\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u73fe\u5728\u5b9f\u884c\u4e2d\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u30ea\u30f3\u30af\u30ea\u30b9\u30c8\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">EPROCESS.ActiveProcessLinks.Flink<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u4fdd\u5b58\u3059\u308b<\/li>\n<li>\u5404\u30d7\u30ed\u30bb\u30b9\u306ePID\u3092<span style=\"font-family: 'courier new', courier, monospace;\">0x4<\/span>\u3068\u6bd4\u8f03\u3057\u3066System\u30d7\u30ed\u30bb\u30b9\u3092\u898b\u3064\u3051\u308b<\/li>\n<li>PID\u304c\u898b\u3064\u304b\u3063\u305f\u3089System\u30d7\u30ed\u30bb\u30b9\u306e\u30c8\u30fc\u30af\u30f3\u3092\u4fdd\u5b58\u3059\u308b<\/li>\n<li>\u73fe\u5728\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u30c8\u30fc\u30af\u30f3\u3092System\u30d7\u30ed\u30bb\u30b9\u306e\u30c8\u30fc\u30af\u30f3\u3067\u7f6e\u304d\u63db\u3048\u308b<\/li>\n<li>\u65b0\u3057\u3044\u30bf\u30fc\u30df\u30ca\u30eb \u30d7\u30ed\u30bb\u30b9\u3092\u8d77\u52d5\u3057\u3066System\u30c8\u30fc\u30af\u30f3\u306e\u7279\u6a29\u3092\u7d99\u627f\u3055\u305b\u308b<\/li>\n<\/ol>\n<p>\u3053\u308c\u3089\u69cb\u9020\u4f53\u306e\u30e1\u30f3\u30d0\u30fc\u306f\u3059\u3079\u3066\u3001PoC\u306e<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u3092\u4f7f\u3063\u3066\u8aad\u307f\u8fbc\u307e\u308c\u307e\u3059\u3002\u3053\u306e\u95a2\u6570\u306f\u3001\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u5229\u7528\u3057\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u95a2\u6570\u3092\u4f7f\u3063\u3066\u3053\u306e\u69cb\u9020\u4f53\u306e\u8aad\u307f\u53d6\u308a\/\u66f8\u304d\u8fbc\u307f\u3092\u884c\u3044\u3001<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u304b\u3089\u30c8\u30fc\u30af\u30f3\u307e\u3067\u3092\u8d70\u67fb\u3057\u307e\u3059\u3002<\/p>\n<p>\u6700\u5f8c\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u306f\u3001\u5206\u6790\u306e\u6700\u7d42\u6bb5\u968e\u3067\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u3092\u5206\u6790\u3057\u3001\u7d50\u8ad6\u3092\u307e\u3068\u3081\u307e\u3059\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em>\u7d9a\u304d\u3092\u8aad\u3080 \u27a0 <a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/7\">\u30bb\u30af\u30b7\u30e7\u30f3 7 \u2013 \u8a73\u7d30\u5206\u6790\u30b9\u30c6\u30c3\u30d714\u3001read64\u95a2\u6570\u306e\u5206\u6790\u3068\u7d50\u8ad6<\/a><\/em><\/strong><\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n<p><!--nextpage--><\/p>\n<h2><a id=\"TOC\"><\/a>\u76ee\u6b21<\/h2>\n<p><a href=\"#post-128698-_35occalwmifn\">14. System\u6a29\u9650\u3067\u65b0\u3057\u3044\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u66f4\u65b0\u3055\u308c\u305f\u69cb\u9020\u4f53\u306b\u5909\u66f4\u3092\u5fa9\u5143\u3059\u308b<\/a><br \/>\n<a href=\"#post-128698-_7vhv0vcx9tf4\">read64\u95a2\u6570\u306e\u5206\u6790<\/a><br \/>\n<a href=\"#post-128698-_imj2wld0o8dl\">\u7d50\u8ad6<\/a><\/p>\n<h2><a id=\"FigToC\"><\/a>\u56f3\u8868\u306e\u76ee\u6b21<\/h2>\n<p><a href=\"#Figure56\">\u56f356. PoC 206\u301c266\u884c\u76ee<\/a><br \/>\n<a href=\"#Figure57\">\u56f357. PoC 355-385\u884c\u76ee<\/a><a href=\"#Figure58\">\u56f358. \u507dspmenu\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8<\/a><a href=\"#Figure57\"><br \/>\n<\/a><a href=\"#Figure59\">\u56f359. GetMenuBarInfo\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7<\/a><a href=\"#Figure57\"><br \/>\n<\/a><a href=\"#Figure60\">\u56f360. PMENUBARINFO\u69cb\u9020\u4f53<\/a><a href=\"#Figure57\"><br \/>\n<\/a><a href=\"#Figure61\">\u56f361. \u521d\u671f\u5316\u5f8c\u306eref_g_pMem5\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/a><a href=\"#Figure57\"><br \/>\n<\/a><a href=\"#Figure62\">\u56f362. RECT (rcbar)\u69cb\u9020\u4f53\u306b\u95a2\u3059\u308bMSDN\u306e\u6587\u66f8<\/a><a href=\"#Figure57\"><br \/>\n<\/a><a href=\"#Figure63\">\u56f363. GetMenuBarItem\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u5f8c\u306epmbi\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/a><a href=\"#Figure57\"><br \/>\n<\/a><a href=\"#Figure64\">\u56f364. PoC 249\u884c\u76ee<\/a><a href=\"#Figure65\">\u56f365. PoC 261\u884c\u76ee<\/a><a href=\"#Figure64\"><br \/>\n<\/a><a href=\"#Figure66\">\u56f366. GetMenuBarItem\u306e2\u56de\u76ee\u306e\u547c\u3073\u51fa\u3057\u5f8c\u306epmbi\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/a><a href=\"#Figure64\"><br \/>\n<\/a><a href=\"#Figure67\">\u56f367. Wnd1\u306e\u89aa\u306etagWND\u69cb\u9020\u4f53\u306e\u30a2\u30c9\u30ec\u30b9 \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u793a\u3059\u30e1\u30e2\u30ea\u30fc\u30c0\u30f3\u30d7<\/a><\/p>\n<h5><a id=\"post-128698-_35occalwmifn\"><\/a>14. System\u6a29\u9650\u3067\u65b0\u3057\u3044\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u66f4\u65b0\u3055\u308c\u305f\u69cb\u9020\u4f53\u306b\u5909\u66f4\u3092\u5fa9\u5143\u3059\u308b<\/h5>\n<p>PoC\u306e\u6b8b\u308a\u306e\u884c(640\u301c726)\u3067\u306f\u3001\u73fe\u5728\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fc \u30c8\u30fc\u30af\u30f3(System\u30c8\u30fc\u30af\u30f3)\u3092\u7d99\u627f\u3059\u308b\u65b0\u3057\u3044\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3059\u308b\u3060\u3051\u3067\u3059\u3002\u305d\u308c\u304b\u3089\u3001Windows\u304c\u4eca\u5f8c\u3053\u308c\u3089\u306e\u69cb\u9020\u4f53\u306e\u3044\u305a\u308c\u304b\u306b\u30a2\u30af\u30bb\u30b9\u3057\u305f\u5834\u5408\u306b\u30b7\u30b9\u30c6\u30e0 \u30af\u30e9\u30c3\u30b7\u30e5\u304c\u767a\u751f\u3057\u306a\u3044\u3088\u3046\u3001\u3053\u308c\u307e\u3067\u66f4\u65b0\u3057\u305f\u69cb\u9020\u4f53\u3092\u5143\u306e\u72b6\u614b\u306b\u30ea\u30bb\u30c3\u30c8\u3057\u307e\u3059\u3002<\/p>\n<h2><a id=\"post-128698-_7vhv0vcx9tf4\"><\/a>read64\u95a2\u6570\u306e\u5206\u6790<\/h2>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u306e\u8aac\u660e\u3067\u306f\u56f356\u306e\u30b3\u30fc\u30c9\u3092\u53c2\u7167\u3057\u307e\u3059\u3002\u3053\u306e\u56f3\u3067\u306f\u30b3\u30fc\u30c9\u5185\u306e\u7a7a\u767d\u3092\u524a\u9664\u3057\u3066\u30af\u30ea\u30fc\u30f3\u30a2\u30c3\u30d7\u3057\u3066\u3044\u307e\u3059\u3002<a id=\"Figure56\"><\/a><\/p>\n<figure id=\"attachment_128619\" aria-describedby=\"caption-attachment-128619\" style=\"width: 549px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128619 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/qword-myread64qword-qwoestaddr-menubarinfo-pmbi.png\" alt=\"\u753b\u50cf56\u306f\u3001PoC 206\u301c266\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306f\u30b3\u30fc\u30c9\u5185\u306b\u3042\u3063\u305f\u7a7a\u767d\u3092\u53d6\u308a\u9664\u3044\u3066\u30af\u30ea\u30fc\u30f3\u30a2\u30c3\u30d7\u3057\u3066\u3042\u308a\u307e\u3059\u3002QWORD MyRead64(QWORD qwOestAddr) MENUBARINFO pmbi = O; pmbi.cbSize = sizeof(MENUBARINFO); if (g_blslnit) else QWORD *pTemp = memset(pTemp, \u00f8, \u00f8x20e) ; QWORD qwBase = \u00f8xeo\u00f8oe\u00f84\u00f8\u00f8\u00f8\u00f8\u00f8\u00f8\u00f8\u00f8; QWORD qwAdd = \u00f8xe\u00f8\u00f8\u00f8oe\u00f88e\u00f8\u00f8\u00f8\u00f8e\u00f88; for (int i = 0; i &lt; \u00f8x4\u00f8; i++) *(pTemp + i) = qwBase + qwAdd*i; = (QWORD)pTemp; -3, 1, &amp;pmbi) ; g_pmbi_rcBar_teft = pmbi. rcBar. left; \u00f8x2\u00f8\u00f8) ; \" width=\"549\" height=\"583\" \/><figcaption id=\"caption-attachment-128619\" class=\"wp-caption-text\">\u56f356. PoC 206\u301c266\u884c\u76ee<\/figcaption><\/figure>\n<p>\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u3068\u3044\u3046\u95a2\u6570\u3092\u5206\u6790\u3059\u308b\u524d\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u3066\u304a\u304d\u307e\u3059\u3002\u306a\u305c\u3053\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u3064\u3044\u3066\u306e\u8aac\u660e\u304c\u91cd\u8981\u304b\u3068\u3044\u3046\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u69cb\u9020\u4f53\u5185\u306b\u8fd4\u3055\u308c\u305f\u60c5\u5831\u3092\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u304c\u5f15\u304d\u51fa\u3057\u3066\u3044\u308b\u5834\u6240\u304c\u3001\u3053\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3060\u304b\u3089\u3067\u3059\u3002\u305d\u3053\u3067<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u5168\u4f53\u7684\u306a\u30ec\u30a4\u30a2\u30a6\u30c8\u3092\u77e5\u3063\u3066\u304a\u304f\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n<p>Microsoft\u306f\u3053\u3053\u3067\u53d6\u308a\u4e0a\u3052\u308b\u3069\u306e\u69cb\u9020\u4f53\u306e\u30c7\u30d0\u30c3\u30b0 \u30b7\u30f3\u30dc\u30eb\u3082\u63d0\u4f9b\u3057\u3066\u3044\u306a\u3044\u306e\u3067\u3001\u91cd\u8981\u306a\u69cb\u9020\u4f53\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u30dd\u30a4\u30f3\u30bf\u30fc\u306e\u95a2\u4fc2\u3092\u7279\u5b9a\u3059\u308b\u306b\u306f\u3001PoC\u3068\u591a\u5c11\u306e\u30ea\u30d0\u30fc\u30b9 \u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u306b\u983c\u3089\u3056\u308b\u3092\u5f97\u307e\u305b\u3093\u3002\u56f357\u306ePoC\u30b3\u30fc\u30c9\u3067\u3001\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u304c\u4f5c\u6210\u3055\u308c\u305f\u7b87\u6240(355\u301c385\u884c\u76ee)\u3092\u898b\u3066\u307f\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u91cd\u8981\u306a\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u69cb\u9020\u4f53\u306e\u30b5\u30a4\u30ba\u3092\u63a8\u6e2c\u3067\u304d\u307e\u3059\u3002<a id=\"Figure57\"><\/a><\/p>\n<figure id=\"attachment_128621\" aria-describedby=\"caption-attachment-128621\" style=\"width: 657px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128621 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-57.png\" alt=\"\u753b\u50cf57\u306fPoC 355\u301c385\u884c\u76ee\u307e\u3067\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u507d\u306espmenu\u304c\u4f5c\u6210\u3055\u308c\u3066\u3044\u307e\u3059\u3002\" width=\"657\" height=\"656\" \/><figcaption id=\"caption-attachment-128621\" class=\"wp-caption-text\">\u56f357. PoC 355-385\u884c\u76ee<\/figcaption><\/figure>\n<p>\u56f358\u306f\u4e0a\u8a18\u306ePoC\u30b3\u30fc\u30c9\u306b\u3082\u3068\u3065\u304f\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30ec\u30a4\u30a2\u30a6\u30c8\u56f3\u3067\u3059\u3002<a id=\"Figure58\"><\/a><\/p>\n<figure id=\"attachment_128623\" aria-describedby=\"caption-attachment-128623\" style=\"width: 900px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128623 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-58.png\" alt=\"\u753b\u50cf58\u306f\u3001\u507d\u306espmenu\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8\u56f3\u3067\u3059\u3002\u5de6\u304b\u3089\u53f3\u306b\u9806\u306bg_pMem4\u3001g_pMem3\u3001g_pMem1\u3001g_pMem2\u304c\u4e26\u3093\u3067\u3044\u307e\u3059\u3002\" width=\"900\" height=\"336\" \/><figcaption id=\"caption-attachment-128623\" class=\"wp-caption-text\">\u56f358. \u507d<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30e1\u30e2\u30ea\u30fc \u30ec\u30a4\u30a2\u30a6\u30c8<\/figcaption><\/figure>\n<p>\u3053\u3053\u3067\u3001\u4ee5\u524d\u30b9\u30c6\u30c3\u30d712\u3067<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u6b63\u898f\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u304c <span style=\"font-family: 'courier new', courier, monospace;\">g_pMem4<\/span>\u306b\u3088\u3063\u3066\u7f6e\u304d\u63db\u3048\u3089\u308c\u3066\u3044\u305f\u3053\u3068\u3092\u601d\u3044\u51fa\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u56f358\u3092\u898b\u308b\u3068\u308f\u304b\u308b\u3088\u3046\u306b\u3001\u3053\u3053\u306b\u306f\u4e0a\u56f357\u306e\u30b3\u30fc\u30c9 \u30b9\u30cb\u30da\u30c3\u30c8\u3067\u8a2d\u5b9a\u3057\u305f\u3001\u3088\u308a\u5927\u304d\u3044\u507d<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u3078\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u9ad8\u30ec\u30d9\u30eb\u3067\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u306f\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u3092\u53d7\u3051\u53d6\u308a\u3001\u305d\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u3042\u308b\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u8fd4\u3057\u307e\u3059\u3002\u3053\u3053\u3067\u306f\u3053\u306e\u6a5f\u80fd\u304c\u5fc5\u8981\u306b\u306a\u308a\u307e\u3059\u3002\u306a\u305c\u306a\u3089\u3001\u6f0f\u3048\u3044\u3055\u305b\u305f<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u3082\u3068\u3065\u3044\u3066<span style=\"font-family: 'courier new', courier, monospace;\">spmenu + 0x50<\/span> (<span style=\"font-family: 'courier new', courier, monospace;\">0xfff8e82008218c0 + 0x50 = 0xfff8e8200821910<\/span>)\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u8a08\u7b97\u3059\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u3059\u304c\u3001\u305d\u306e\u30a2\u30c9\u30ec\u30b9\u306f\u3001\u79c1\u305f\u3061\u304c\u3053\u3053\u3067\u5fc5\u8981\u3068\u3057\u3066\u3044\u308b\u3082\u306e\u3067\u306f\u306a\u3044\u304b\u3089\u3067\u3059\u3002\u79c1\u305f\u3061\u304c\u5fc5\u8981\u3068\u3057\u3066\u3044\u308b\u306e\u306f\u3001\u305d\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u3042\u308b\u30dd\u30a4\u30f3\u30bf\u30fc\u3067\u3059\u3002<\/p>\n<p>\u3068\u3053\u308d\u304c\u3001\u6f0f\u3048\u3044\u3055\u305b\u305f<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u306e\u30a2\u30c9\u30ec\u30b9\u306f\u30ab\u30fc\u30cd\u30eb \u30a2\u30c9\u30ec\u30b9\u306a\u306e\u3067\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">spmenu<\/span>\u69cb\u9020\u4f53\u5185\u306e\u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u76f4\u63a5\u8aad\u3080\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u3002\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u3068\u3044\u3046\u95a2\u6570\u306f\u3053\u306e\u6a5f\u80fd\u306e\u63d0\u4f9b\u306e\u305f\u3081\u306b\u8a2d\u8a08\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>\u3053\u306eread64\u3068\u3044\u3046\u95a2\u6570\u306e\u4e2d\u306b\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u306e\u547c\u3073\u51fa\u3057\u304c2\u56de\u3068\u3001\u521d\u671f\u5316<span style=\"font-family: 'courier new', courier, monospace;\">flag (g_bIsInit)<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">menubar<\/span>\u306e\u60c5\u5831\u69cb\u9020\u4f53(<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>)\u3001\u30b5\u30a4\u30ba\u304c<span style=\"font-family: 'courier new', courier, monospace;\">0x200<\/span>\u30d0\u30a4\u30c8\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u30e1\u30e2\u30ea\u30fc \u30c1\u30e3\u30f3\u30af\u304c\u5b58\u5728\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u305d\u308c\u305e\u308c\u306b\u3064\u3044\u3066\u306f\u3053\u306e\u5f8c\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u95a2\u6570\u3092\u4f7f\u3046\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">PMENUBARINFO<\/span> (<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>)\u69cb\u9020\u4f53\u3092\u4ecb\u3057\u3066\u3001\u6307\u5b9a\u3057\u305f\u30a6\u30a3\u30f3\u30c9\u30a6(<span style=\"font-family: 'courier new', courier, monospace;\">hwnd<\/span>)\u306e\u30e1\u30cb\u30e5\u30fc\u30d0\u30fc\u60c5\u5831\u3092\u53d6\u5f97\u3067\u304d\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u95a2\u6570\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7\u3092\u56f3 59 \u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure59\"><\/a><\/p>\n<figure id=\"attachment_128625\" aria-describedby=\"caption-attachment-128625\" style=\"width: 652px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128625 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-59.png\" alt=\"\u753b\u50cf59\u306f\u3001GetMenuBarInfo\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"652\" height=\"286\" \/><figcaption id=\"caption-attachment-128625\" class=\"wp-caption-text\">\u56f359. <span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u306e\u95a2\u6570\u30d7\u30ed\u30c8\u30bf\u30a4\u30d7<\/figcaption><\/figure>\n<p>\u30e1\u30cb\u30e5\u30fc\u30d0\u30fc <span style=\"font-family: 'courier new', courier, monospace;\"><a href=\"https:\/\/learn.microsoft.com\/ja-jp\/windows\/win32\/api\/winuser\/nf-winuser-getmenubarinfo\">GetMenuBarInfo<\/a><\/span>\u95a2\u6570\u306f\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u30924\u3064\u53d6\u308a\u307e\u3059\u3002\u6700\u521d\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc(<span style=\"font-family: 'courier new', courier, monospace;\">hwnd<\/span>)\u306f\u3001\u60c5\u5831\u3092\u7167\u4f1a\u3059\u308b\u5bfe\u8c61\u3068\u306a\u3063\u3066\u3044\u308b\u30e1\u30cb\u30e5\u30fc \u30d0\u30fc\u3092\u6240\u6709\u3057\u3066\u3044\u308b\u30a6\u30a3\u30f3\u30c9\u30a6\u3078\u306e\u30cf\u30f3\u30c9\u30eb\u3067\u3059\u30022\u3064\u3081\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc(<span style=\"font-family: 'courier new', courier, monospace;\">idObject<\/span>)\u306f\u3001\u7167\u4f1a\u5bfe\u8c61\u3068\u306a\u308b\u30e1\u30cb\u30e5\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3067\u3059\u3002\u3053\u308c\u306f\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7 \u30e1\u30cb\u30e5\u30fc\u3001\u30e1\u30cb\u30e5\u30fc \u30d0\u30fc\u3001\u30b7\u30b9\u30c6\u30e0 \u30e1\u30cb\u30e5\u30fc\u306e\u3044\u305a\u308c\u3067\u3082\u304b\u307e\u3044\u307e\u305b\u3093\u3002\u305f\u3060\u3057\u3001\u3053\u306ePoC\u3067\u306f\u3001\u30e1\u30cb\u30e5\u30fc \u30d0\u30fc\u306b\u76f8\u5f53\u3059\u308b<span style=\"font-family: 'courier new', courier, monospace;\">-3<\/span> (<span style=\"font-family: 'courier new', courier, monospace;\">0xFFFFFFFD<\/span>)\u3060\u3051\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>3\u3064\u3081\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc(<span style=\"font-family: 'courier new', courier, monospace;\">idItem<\/span>)\u306b\u306f\u60c5\u5831\u306e\u53d6\u5f97\u5bfe\u8c61\u3068\u306a\u308b\u9805\u76ee\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002\u3053\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u304c<span style=\"font-family: 'courier new', courier, monospace;\">0<\/span>\u306e\u5834\u5408\u3001\u3053\u306e\u95a2\u6570\u306f\u30e1\u30cb\u30e5\u30fc\u81ea\u4f53\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u3053\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u304c<span style=\"font-family: 'courier new', courier, monospace;\">1<\/span>\u306e\u5834\u5408\u3001\u3053\u306e\u95a2\u6570\u306f\u30e1\u30cb\u30e5\u30fc\u306e1\u3064\u3081\u306e\u9805\u76ee\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u4ee5\u4e0b\u306f\u540c\u69d8\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u3053\u306ePoC\u5185\u3067\u306f\u3001\u3059\u3079\u3066\u306e\u547c\u3073\u51fa\u3057\u304c\u5024<span style=\"font-family: 'courier new', courier, monospace;\">1<\/span>\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u30e1\u30cb\u30e5\u30fc\u306e\u6700\u521d\u306e\u9805\u76ee\u3092\u53c2\u7167\u3057\u307e\u3059\u3002\u6700\u5f8c\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc(<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>)\u306f\u8fd4\u3055\u308c\u305f\u60c5\u5831\u3092\u683c\u7d0d\u3059\u308b\u69cb\u9020\u4f53\u3067\u3059\u3002\u3053\u306e\u69cb\u9020\u4f53\u306f <span style=\"font-family: 'courier new', courier, monospace;\"><a href=\"https:\/\/learn.microsoft.com\/ja-jp\/windows\/win32\/api\/winuser\/ns-winuser-menubarinfo\">PMENUBARINFO<\/a><\/span>\u578b\u3067\u3059(\u56f360)\u3002<a id=\"Figure60\"><\/a><\/p>\n<figure id=\"attachment_128627\" aria-describedby=\"caption-attachment-128627\" style=\"width: 806px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128627 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-60.png\" alt=\"\u753b\u50cf60\u306fPMENUBARINFO\u578b\u306e\u69cb\u9020\u4f53\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u306efBarFocused\u3068fFocused\u306f1\u306e\u5024\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\" width=\"806\" height=\"390\" \/><figcaption id=\"caption-attachment-128627\" class=\"wp-caption-text\">\u56f360. <span style=\"font-family: 'courier new', courier, monospace;\">PMENUBARINFO<\/span>\u69cb\u9020\u4f53<\/figcaption><\/figure>\n<p>\u3053\u3053\u3067<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u3092\u898b\u76f4\u3057\u3066\u307f\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u3068\u3044\u3046 <span style=\"font-family: 'courier new', courier, monospace;\">PMENUBARINFO<\/span>\u69cb\u9020\u4f53\u304c\u5272\u308a\u5f53\u3066\u3089\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u305d\u306e\u5f8c<span style=\"font-family: 'courier new', courier, monospace;\">g_bIsInit<\/span>\u30d5\u30e9\u30b0\u304c\u30c1\u30a7\u30c3\u30af\u3055\u308c\u307e\u3059\u3002\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">g_bIsInit<\/span>\u30d5\u30e9\u30b0\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u5f8c\u306b\u8a2d\u5b9a\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>PoC(246\u301c252\u884c\u76ee)\u3092\u898b\u3066\u307f\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u6642\u306f\u3001\u305d\u306e\u547c\u3073\u51fa\u3057\u306e\u5f8c\u306b<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left<\/span>\u306e\u5024\u3092\u4f7f\u3063\u3066\u30b0\u30ed\u30fc\u30d0\u30eb\u5909\u6570<span style=\"font-family: 'courier new', courier, monospace;\">g_pmbi_rcBar_left<\/span>\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059(249\u884c\u76ee)\u3002\u3053\u308c\u304c\u5b8c\u4e86\u3059\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_bIsInit<\/span>\u30d5\u30e9\u30b0\u304ctrue\u306b\u8a2d\u5b9a\u3055\u308c\u307e\u3059(252\u884c\u76ee)\u3002<\/p>\n<p>\u3053\u306ePoC\u306f\u307e\u305f\u3001\u30b5\u30a4\u30ba\u304c<span style=\"font-family: 'courier new', courier, monospace;\">0x200<\/span>\u30d0\u30a4\u30c8\u306e\u914d\u5217\u3092\u5272\u308a\u5f53\u3066\u3066\u4f5c\u6210\u3057\u307e\u3059\u3002\u305d\u3057\u3066for\u30eb\u30fc\u30d7\u3067\u3053\u306e\u914d\u5217\u3092\u521d\u671f\u5316\u3057\u3001\u5404<span style=\"font-family: 'courier new', courier, monospace;\">DWORD<\/span>(32\u30d3\u30c3\u30c8)\u306b\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u3053\u306e\u30e1\u30e2\u30ea\u30fc\u306e\u90e8\u5206\u7684\u306a\u30c0\u30f3\u30d7\u3092\u56f361\u306b\u793a\u3057\u307e\u3059\u3002<a id=\"Figure61\"><\/a><\/p>\n<figure id=\"attachment_128629\" aria-describedby=\"caption-attachment-128629\" style=\"width: 425px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128629 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/4-8-00000-ox15ba4b7fc10-ox15ba4b7fc20-00000010.png\" alt=\"\u753b\u50cf61\u306f\u3001\u521d\u671f\u5316\u5f8c\u306eref_g_pMem5\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u56f3\u3067\u306f\u3001\u914d\u5217\u306e\u66f8\u5f0f\u304c\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u5217\u540d\u306f Offset\u30010\u30014\u30018\u3001C\u3067\u3059\u3002\u6700\u521d\u306e\u884c\u306e2\u5217\u5206\u306e\u30bb\u30eb\u304c\u9752\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u305d\u308c\u305e\u308c\u5185\u5bb9\u306f00000000\u306800000004\u3067\u3059\u3002\" width=\"425\" height=\"200\" \/><figcaption id=\"caption-attachment-128629\" class=\"wp-caption-text\">\u56f361. \u521d\u671f\u5316\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5<\/span>\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/figcaption><\/figure>\n<p>\u6700\u5f8c\u306b\u3001\u30b0\u30ed\u30fc\u30d0\u30eb\u5909\u6570<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5<\/span>\u304c\u3001\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u3053\u306e\u30e1\u30e2\u30ea\u30fc\u3092\u6307\u3059\u3088\u3046\u306b\u8a2d\u5b9a\u3055\u308c\u307e\u3059\u3002\u3053\u306e<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5<\/span>\u306f\u3001PoC\u30b3\u30fc\u30c9\u304c<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u672c\u7269\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu\u3092<\/span>\u7f6e\u304d\u63db\u3048\u305f\u507d\u306e<span style=\"font-family: 'courier new', courier, monospace;\">spmenu\u306e<\/span>\u4e00\u90e8\u3067\u3042\u308b\u3053\u3068\u3092\u601d\u3044\u51fa\u3057\u3066\u304f\u3060\u3055\u3044(<a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/7\/#Figure58\">\u56f358<\/a>)\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u95a2\u6570\u306f\u3001\u8981\u6c42\u3055\u308c\u305f\u30e1\u30cb\u30e5\u30fc \u30d0\u30fc\u60c5\u5831\u306e\u683c\u7d0d\u306b<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u3092\u4f7f\u3046\u3053\u3068\u304c\u5206\u304b\u3063\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u95a2\u6570\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u53c2\u7167\u3055\u308c\u3066\u3044\u308b<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u30e1\u30f3\u30d0\u30fc\u306f<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left<\/span> (249\u884c\u76ee\u3001265\u884c\u76ee)\u3068<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.top<\/span> (265\u884c\u76ee)\u3060\u3051\u3067\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u3053\u3053\u3067\u4f55\u304c\u8d77\u3053\u3063\u3066\u3044\u308b\u306e\u304b\u3092\u7406\u89e3\u3059\u308b\u306b\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u304c\u3069\u3046\u3084\u3063\u3066\u3053\u308c\u3089\u306e\u5024\u306e\u8a08\u7b97\u3057\u3066\u3044\u308b\u306e\u304b\u3092\u7279\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u95a2\u6570\u3092\u30ea\u30d0\u30fc\u30b9 \u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u3057\u3066\u307f\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar<\/span>\u306e\u5024\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u8a08\u7b97\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left = pmbi[0x4] = ref_g_pmem5[0x40] + tagWND[0x58]<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.top = pmbi[0x8] = ref_g_pmem5[0x44] + tagWND[0x5c]<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.right = pmbi[0xc] = ref_g_pmem5[0x40] + g_pmem5[0x48]<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.bottom = pmbi[0x10] = ref_g_pmem5[0x4c] + pmbi[0x8]<\/span><\/li>\n<\/ul>\n<p>\u56f362\u306b\u793a\u3057\u305fMicrosoft\u306eMSDN\u306e\u6587\u66f8\u3092\u78ba\u8a8d\u3059\u308b\u3068\u3001\u3069\u306e<span style=\"font-family: 'courier new', courier, monospace;\">rcbar<\/span>\u5909\u6570\u304c<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u3069\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u5bfe\u5fdc\u3059\u308b\u304b\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure62\"><\/a><\/p>\n<figure id=\"attachment_128631\" aria-describedby=\"caption-attachment-128631\" style=\"width: 596px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128631 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-62.png\" alt=\"\u753b\u50cf62\u306f\u3001Microsoft\u306eRECT (rcbar)\u69cb\u9020\u4f53\u306b\u95a2\u3059\u308b\u6587\u66f8\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"596\" height=\"268\" \/><figcaption id=\"caption-attachment-128631\" class=\"wp-caption-text\">\u56f362. RECT (<span style=\"font-family: 'courier new', courier, monospace;\">rcbar<\/span>)\u69cb\u9020\u4f53\u306b\u95a2\u3059\u308bMSDN\u306e\u6587\u66f8<\/figcaption><\/figure>\n<p>\u3057\u305f\u304c\u3063\u3066\u4e0a\u8a18\u306e\u5206\u6790\u306b\u3082\u3068\u3065\u3044\u305f<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuItem<\/span>\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar<\/span>\u306f\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left = 0x40 + 0x00 = 0x40<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.right = 0x44 + 0x00 = 0x44<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.top = 0x40 + 0x48 = 0x88<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.bottom = 0x4c + 0x44 = 0x90<\/span><\/li>\n<\/ul>\n<p>\u56f363\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarItem<\/span>\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u3067\u3059\u3002\u3053\u306e\u56f3\u304b\u3089\u4e0a\u8a18\u306e\u8a08\u7b97\u304c\u6b63\u3057\u3044\u3053\u3068\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<a id=\"Figure63\"><\/a><\/p>\n<figure id=\"attachment_128633\" aria-describedby=\"caption-attachment-128633\" style=\"width: 425px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128633 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/oxffff810ad8c84b80-00030-00000-000c-oxffff810ad.png\" alt=\"\u753b\u50cf63\u306f\u3001GetMenuBarItem\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u5f8c\u306epmbi\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u914d\u5217\u306e\u5f62\u5f0f\u3067\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u30021\u884c\u76ee\u306e1\u5217\u76ee\u30682\u5217\u76ee\u306e2\u3064\u306e\u30bb\u30eb\u304c\u9752\u304f\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u305d\u308c\u305e\u308c\u5185\u5bb9\u306f00000030\u306800000040\u3067\u3059\u3002\" width=\"425\" height=\"100\" \/><figcaption id=\"caption-attachment-128633\" class=\"wp-caption-text\">\u56f363. <span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarItem<\/span>\u306e\u521d\u56de\u547c\u3073\u51fa\u3057\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/figcaption><\/figure>\n<p>\u4e0a\u8a18\u306e\u5909\u6570\u304b\u3089\u3001\u56f364\u306b\u793a\u3057\u305fPoC 249\u884c\u76ee\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">g_pmbi_rcBar_left<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left<\/span>\u3001\u3064\u307e\u308a<span style=\"font-family: 'courier new', courier, monospace;\">0x40<\/span>\u306b\u7b49\u3057\u304f\u306a\u308b\u3088\u3046\u8a2d\u5b9a\u3055\u308c\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure64\"><\/a><\/p>\n<figure id=\"attachment_128635\" aria-describedby=\"caption-attachment-128635\" style=\"width: 600px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128635 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-64.png\" alt=\"\u753b\u50cf64\u306fPoC 249\u884c\u76ee\u3001g_pmbi_rcBar_left = pmbi.rcbar.left\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\" width=\"600\" height=\"56\" \/><figcaption id=\"caption-attachment-128635\" class=\"wp-caption-text\">\u56f364. PoC 249\u884c\u76ee<\/figcaption><\/figure>\n<p>\u56f365\u306b\u793a\u3057\u305fPoC 261\u884c\u76ee\u3067\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr<\/span>\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">g_pmbi_rcBar_left<\/span>\u306e\u5024\u3092\u5f15\u3044\u3066\u3044\u307e\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr<\/span>\u306f<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u3078\u6e21\u3055\u308c\u305f\u5165\u529b\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3001\u3064\u307e\u308a\u79c1\u305f\u3061\u304c\u30c7\u30ea\u30d5\u30a1\u30ec\u30f3\u30b9\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u308b\u30a2\u30c9\u30ec\u30b9\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001PoC\u306f\u3053\u306e\u30a2\u30c9\u30ec\u30b9\u304b\u3089<span style=\"font-family: 'courier new', courier, monospace;\">0x40<\/span>\u3092\u5f15\u3044\u3066<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5<\/span>\u306b\u5272\u308a\u5f53\u3066\u3066\u3044\u307e\u3059\u3002<a id=\"Figure65\"><\/a><\/p>\n<figure id=\"attachment_128637\" aria-describedby=\"caption-attachment-128637\" style=\"width: 848px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128637 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/word-image-128506-65.png\" alt=\"\u753b\u50cf65\u306f\u3001PoC 261\u884c\u76ee\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002*(QWORD *)ref_g_pMem5 \u304b\u3089\u59cb\u307e\u3063\u3066\u3044\u307e\u3059\u3002\" width=\"848\" height=\"74\" \/><figcaption id=\"caption-attachment-128637\" class=\"wp-caption-text\">\u56f365. PoC 261\u884c\u76ee<\/figcaption><\/figure>\n<p>\u3071\u3063\u3068\u898b\u3067\u306f\u6df7\u4e71\u3059\u308b\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002\u305f\u3060\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u3092\u8a08\u7b97\u3059\u308b\u65b9\u6cd5\u304b\u3089\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u6700\u521d\u306e2\u3064\u306e\u5024\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5[0x40]<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5[0x44]<\/span>\u304b\u3089\u5f97\u3089\u308c\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u3066\u3044\u308b\u308f\u3051\u3067\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.top<\/span>\u3092\u4f7f\u3063\u3066<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u3067<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr<\/span>\u3092\u30c7\u30ea\u30d5\u30a1\u30ec\u30f3\u30b9\u3059\u308b\u5834\u5408\u3001<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u304c\u3053\u308c\u3089\u306e\u5024\u306e\u8a08\u7b97\u306b<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5[0x40]<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5[0x44]<\/span>\u3092\u53c2\u7167\u3057\u3066\u3044\u308b\u70b9\u3092\u8003\u616e\u305b\u306d\u3070\u306a\u308a\u307e\u305b\u3093\u3002\u305d\u308c\u304cPoC 261\u884c\u76ee\u304c\u884c\u3063\u3066\u3044\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<p><strong>\u6ce8<\/strong>: <span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.top<\/span>\u306e\u4e21\u65b9\u3092\u4f7f\u3046\u5fc5\u8981\u304c\u3042\u308b\u306e\u306f\u3001\u79c1\u305f\u3061\u306f64\u30d3\u30c3\u30c8\u306e\u5024\u3092\u683c\u7d0d\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u306e\u306b\u3001\u305d\u308c\u305e\u308c\u306e\u5024\u304c32\u30d3\u30c3\u30c8\u3057\u304b\u306a\u3044\u305f\u3081\u3067\u3059\u3002<\/p>\n<p>\u3053\u308c\u3067<span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5<\/span>\u304c<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr - 0x40<\/span>\u3092\u6307\u3059\u3088\u3046\u306b\u306a\u3063\u305f\u306e\u3067\u3001\u6b21\u306b<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarInfo<\/span>\u3092\u547c\u3073\u51fa\u3059\u3068\u3001\u6b21\u306e\u3088\u3046\u306a\u5024\u304c\u5f97\u3089\u308c\u307e\u3059\u3002<\/p>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">ref_g_pMem5 = qwDestAddr - 0x40<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.left = qwDestAddr<\/span> (\u4e0b\u4f4d\u30d3\u30c3\u30c8)<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">pmbi.rcbar.right = qwDestAddr<\/span> (\u4e0a\u4f4d\u30d3\u30c3\u30c8)<\/li>\n<\/ul>\n<p>\u56f366\u306f\u30012\u56de\u76ee\u306e<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarItem<\/span>\u547c\u3073\u51fa\u3057\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002<span style=\"font-family: 'courier new', courier, monospace;\">pmbi[0x4]<\/span>\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr<\/span>\u306e\u4e0b\u4f4d\u30d3\u30c3\u30c8\u304c\u78ba\u304b\u306b\u542b\u307e\u308c\u3001<span style=\"font-family: 'courier new', courier, monospace;\">pmbi[0x8]<\/span>\u306b\u306f<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr<\/span>\u306e\u4e0a\u4f4d\u30d3\u30c3\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure66\"><\/a><\/p>\n<figure id=\"attachment_128639\" aria-describedby=\"caption-attachment-128639\" style=\"width: 394px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128639 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/oxffff810ad8c84b80-ffff.png\" alt=\"\u753b\u50cf66\u306f\u30012\u56de\u76ee\u306eGetMenuBarItem\u547c\u3073\u51fa\u3057\u5f8c\u306epmbi\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u914d\u5217\u306e\u5f62\u5f0f\u3067\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u30021\u884c\u76ee\u306e1\u5217\u76ee\u30682\u5217\u76ee\u306e2\u3064\u306e\u30bb\u30eb\u304c\u9752\u304f\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u305d\u308c\u305e\u308c\u5185\u5bb9\u306f00000030\u3068008437e0\u3067\u3059\u3002 \" width=\"394\" height=\"66\" \/><figcaption id=\"caption-attachment-128639\" class=\"wp-caption-text\">\u56f366. <span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarItem<\/span>\u306e2\u56de\u76ee\u306e\u547c\u3073\u51fa\u3057\u5f8c\u306e<span style=\"font-family: 'courier new', courier, monospace;\">pmbi<\/span>\u306e\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/figcaption><\/figure>\n<p>\u79c1\u305f\u3061\u306f\u3059\u3067\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">spmenu\uff0b0x50<\/span>\u304c\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3092\u6307\u3057\u3066\u3044\u308b\u306f\u305a\u3068\u77e5\u3063\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u56f367\u304b\u3089\u306f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xffff8e82008427e0<\/span>\u304c\u5b9f\u969b\u306b<span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<a id=\"Figure67\"><\/a><\/p>\n<figure id=\"attachment_128641\" aria-describedby=\"caption-attachment-128641\" style=\"width: 770px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-128641 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/06\/oxffff8e82008437ee-0000000000000005-oxffff8e8200.png\" alt=\"\u753b\u50cf67\u306f\u3001Wnd1\u306e\u89aa\u306etagWND\u69cb\u9020\u4f53\u306e\u30a2\u30c9\u30ec\u30b9 \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u793a\u3057\u3066\u3044\u308b\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u914d\u5217\u306e\u5f62\u5f0f\u3067\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u6700\u521d\u306e\u884c\u306e0000000000050330\u306e\u30bb\u30eb\u304c\u9752\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002oxffff8e82008437ee 0000000000000005 oxffff8e82008437f0 ffff8e8202cc0010 ffffd40ff34ea4b0 oxffff8e820084380e ffff8e82008437ee ffff8e8201038390 \" width=\"770\" height=\"182\" \/><figcaption id=\"caption-attachment-128641\" class=\"wp-caption-text\">\u56f367. <span style=\"font-family: 'courier new', courier, monospace;\">Wnd1<\/span>\u306e\u89aa\u306e<span style=\"font-family: 'courier new', courier, monospace;\">tagWND<\/span>\u69cb\u9020\u4f53\u306e\u30a2\u30c9\u30ec\u30b9 \u30dd\u30a4\u30f3\u30bf\u30fc\u3092\u793a\u3059\u30e1\u30e2\u30ea\u30fc \u30c0\u30f3\u30d7<\/figcaption><\/figure>\n<p>\u3053\u308c\u3067\u3001<span style=\"font-family: 'courier new', courier, monospace;\">read64<\/span>\u3092\u547c\u3073\u51fa\u3059\u3068\u3001\u5165\u529b\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc<span style=\"font-family: 'courier new', courier, monospace;\">qwDestAddr<\/span>\u306e\u4f4d\u7f6e\u306b\u3042\u308b\u3001\u30c7\u30ea\u30d5\u30a1\u30ec\u30f3\u30b9\u3055\u308c\u305f\u30a2\u30c9\u30ec\u30b9\u304c\u8fd4\u3055\u308c\u3001\u4efb\u610f\u306eread\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u63d0\u4f9b\u306b\u6210\u529f\u3057\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<h2><a id=\"post-128698-_imj2wld0o8dl\"><\/a>\u7d50\u8ad6<\/h2>\n<p>Win32k\u306b\u95a2\u3059\u308b2\u90e8\u69cb\u6210\u306e\u9023\u8f09\u306f\u4eca\u56de\u3067\u5b8c\u7d50\u3067\u3059\u3002\u7b2c1\u90e8\u3067\u306fWin32 API\u3092\u4f7f\u3063\u3066\u30a6\u30a3\u30f3\u30c9\u30a6\u3084\u30e1\u30cb\u30e5\u30fc\u306a\u3069\u306eGUI\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f5c\u6210\u3059\u308b\u65b9\u6cd5\u3092\u8aac\u660e\u3057\u307e\u3057\u305f\u3002\u6b21\u306b\u3001\u3053\u308c\u3089\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u7ba1\u7406\u306b\u4f7f\u308f\u308c\u308b\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u3068\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u306e\u30c7\u30fc\u30bf\u69cb\u9020\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u307e\u3057\u305f\u3002\u3055\u3089\u306b\u3001\u305d\u308c\u3089\u306e\u30c7\u30fc\u30bf\u69cb\u9020\u304c\u3001\u30e6\u30fc\u30b6\u30fc\u30e2\u30fc\u30c9\u3068\u30ab\u30fc\u30cd\u30eb\u30e2\u30fc\u30c9\u3068\u306e\u9593\u3067\u6700\u9069\u304b\u3064\u5b89\u5168\u306b\u79fb\u884c\u3067\u304d\u308b\u3088\u3046\u3001\u9577\u5e74\u304b\u3051\u3066\u3069\u306e\u3088\u3046\u306b\u5909\u5316\u3057\u3066\u304d\u305f\u306e\u304b\u3092\u8aac\u660e\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u7b2c2\u90e8\u3067\u306f\u6700\u8fd1\u306e\u8106\u5f31\u6027(CVE-2022-21882)\u3068\u3001\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3066\u7279\u6a29\u3092\u6607\u683c\u3055\u305b\u308b\u65b9\u6cd5\u306b\u3064\u3044\u3066\u5206\u6790\u3057\u307e\u3057\u305f\u3002\u79c1\u305f\u3061\u306f\u516c\u958bPoC\u306e\u5185\u90e8\u69cb\u9020\u306b\u3064\u3044\u3066\u8ad6\u3058\u3001\u305d\u308c\u306b\u3088\u3063\u3066Microsoft\u304c\u904e\u53bb20\u5e74\u3092\u8cbb\u3084\u3057\u5165\u5ff5\u306b\u5b9f\u88c5\u3057\u3066\u304d\u305f\u4fdd\u8b77\u3092\u56de\u907f\u3059\u308b\u306b\u306f\u4eca\u65e5\u4f55\u304c\u6c42\u3081\u3089\u308c\u308b\u306e\u304b\u3092\u793a\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u305d\u3057\u3066\u79c1\u305f\u3061\u306f\u3001CVE-2022-21882\u306eCVE-2021-1732\u3068\u306e\u985e\u4f3c\u6027\u3084\u3001CVE-2021-1732\u7528\u306e\u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u304c\u306a\u305cCVE-2022-21882\u306e\u9632\u6b62\u306b\u4e0d\u5341\u5206\u3060\u3063\u305f\u306e\u304b\u3092\u793a\u3057\u307e\u3057\u305f\u3002\u6700\u5f8c\u306b\u3001\u3053\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u304c\u3069\u306e\u3088\u3046\u306b\u507d\u306e\u30e1\u30cb\u30e5\u30fc\u69cb\u9020\u4f53\u3068\u7d44\u307f\u5408\u308f\u305b\u3066<span style=\"font-family: 'courier new', courier, monospace;\">GetMenuBarItem<\/span>\u95a2\u6570\u3092\u4f7f\u3046\u306e\u304b\u3084\u3001\u305d\u308c\u306b\u3088\u3063\u3066\u7279\u6a29\u6607\u683c\u306b\u5fc5\u8981\u306aSystem\u30c8\u30fc\u30af\u30f3\u3092\u767a\u898b\u30fb\u30b3\u30d4\u30fc\u3057\u3001\u4efb\u610f\u306eread\u30d7\u30ea\u30df\u30c6\u30a3\u30d6\u3092\u63d0\u4f9b\u3059\u308b\u306e\u304b\u3001\u3053\u308c\u3089\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u307e\u3057\u305f\u3002<\/p>\n<p style=\"text-align: center;\"><strong><em><a href=\"https:\/\/unit42.paloaltonetworks.jp\/win32k-analysis-part-2\/\">\u30c8\u30c3\u30d7\u306b\u623b\u308b<\/a><\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 Microsoft Windows\u306b\u304a\u3051\u308b2\u3064\u306e\u985e\u4f3c\u3057\u305f\u7279\u6a29\u6607\u683c\u306e\u8106\u5f31\u6027(CVE-2021-1732\u3068CVE-2022-21882)\u306e\u5831\u544a\u3092\u898b\u305f\u79c1\u305f\u3061\u306f\u3001\u305d\u308c\u305e\u308c\u306b\u95a2\u308f\u308b\u30b3\u30fc\u30c9\u3092\u6df1\u304f\u7406\u89e3\u3059\u308b\u305f\u3081\u3001\u3053\u308c\u3089\u306eCVE\u3092\u5206<\/p>\n","protected":false},"author":323,"featured_media":134380,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4428,4470],"tags":[5129,5131,5051],"product_categories":[4448],"coauthors":[2575],"class_list":["post-128698","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-research-ja","category-vulnerabilities-ja","tag-cve-2021-1732-ja","tag-cve-2022-21882-ja","tag-microsoft-windows-ja","product_categories-cortex-xdr-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790<\/title>\n<meta name=\"description\" content=\"\u3053\u306e\u9023\u8f09\u30b7\u30ea\u30fc\u30ba\u306e\u7b2c2\u90e8\u3067\u306f\u3044\u3088\u3044\u3088CVE-2021-1732\u3068CVE-2022-21882\u306e2\u3064\u306eWin32k\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306ePoC\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u65b9\u306e\u653b\u6483\u3092\u53ef\u80fd\u3068\u3059\u308b\u8106\u5f31\u6027\u3067\u3001Win32k\u30ab\u30fc\u30cd\u30eb\u3092\u6a19\u7684\u3068\u3057\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790\" \/>\n<meta property=\"og:description\" content=\"\u3053\u306e\u9023\u8f09\u30b7\u30ea\u30fc\u30ba\u306e\u7b2c2\u90e8\u3067\u306f\u3044\u3088\u3044\u3088CVE-2021-1732\u3068CVE-2022-21882\u306e2\u3064\u306eWin32k\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306ePoC\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u65b9\u306e\u653b\u6483\u3092\u53ef\u80fd\u3068\u3059\u308b\u8106\u5f31\u6027\u3067\u3001Win32k\u30ab\u30fc\u30cd\u30eb\u3092\u6a19\u7684\u3068\u3057\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-03T07:35:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-07-31T01:08:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Security-Technology_Category_1920x900.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Shawn Westfall\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790","description":"\u3053\u306e\u9023\u8f09\u30b7\u30ea\u30fc\u30ba\u306e\u7b2c2\u90e8\u3067\u306f\u3044\u3088\u3044\u3088CVE-2021-1732\u3068CVE-2022-21882\u306e2\u3064\u306eWin32k\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306ePoC\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u65b9\u306e\u653b\u6483\u3092\u53ef\u80fd\u3068\u3059\u308b\u8106\u5f31\u6027\u3067\u3001Win32k\u30ab\u30fc\u30cd\u30eb\u3092\u6a19\u7684\u3068\u3057\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/","next":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/2\/","og_locale":"ja_JP","og_type":"article","og_title":"\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790","og_description":"\u3053\u306e\u9023\u8f09\u30b7\u30ea\u30fc\u30ba\u306e\u7b2c2\u90e8\u3067\u306f\u3044\u3088\u3044\u3088CVE-2021-1732\u3068CVE-2022-21882\u306e2\u3064\u306eWin32k\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306ePoC\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u65b9\u306e\u653b\u6483\u3092\u53ef\u80fd\u3068\u3059\u308b\u8106\u5f31\u6027\u3067\u3001Win32k\u30ab\u30fc\u30cd\u30eb\u3092\u6a19\u7684\u3068\u3057\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/","og_site_name":"Unit 42","article_published_time":"2023-07-03T07:35:23+00:00","article_modified_time":"2024-07-31T01:08:21+00:00","og_image":[{"width":1920,"height":900,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Security-Technology_Category_1920x900.jpg","type":"image\/jpeg"}],"author":"Shawn Westfall","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/"},"author":{"name":"Ayako Kimijima","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/5502567dd627cdd5a306432cd651a90e"},"headline":"\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790","datePublished":"2023-07-03T07:35:23+00:00","dateModified":"2024-07-31T01:08:21+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/"},"wordCount":2069,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Security-Technology_Category_1920x900.jpg","keywords":["CVE-2021-1732","CVE-2022-21882","Microsoft Windows"],"articleSection":["\u8105\u5a01\u30ea\u30b5\u30fc\u30c1","\u8106\u5f31\u6027"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/","name":"\u30a4\u30f3\u30b5\u30a4\u30c9Win32k\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8: CVE-2022-21882\u3068CVE-2021-1732\u306e\u5206\u6790","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Security-Technology_Category_1920x900.jpg","datePublished":"2023-07-03T07:35:23+00:00","dateModified":"2024-07-31T01:08:21+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/5502567dd627cdd5a306432cd651a90e"},"description":"\u3053\u306e\u9023\u8f09\u30b7\u30ea\u30fc\u30ba\u306e\u7b2c2\u90e8\u3067\u306f\u3044\u3088\u3044\u3088CVE-2021-1732\u3068CVE-2022-21882\u306e2\u3064\u306eWin32k\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306ePoC\u3092\u5206\u6790\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u30c7\u30fc\u30bf\u30aa\u30f3\u30ea\u30fc\u65b9\u306e\u653b\u6483\u3092\u53ef\u80fd\u3068\u3059\u308b\u8106\u5f31\u6027\u3067\u3001Win32k\u30ab\u30fc\u30cd\u30eb\u3092\u6a19\u7684\u3068\u3057\u307e\u3059\u3002","inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/win32k-analysis-part-2\/#primaryimage","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Security-Technology_Category_1920x900.jpg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/06_Security-Technology_Category_1920x900.jpg","width":1920,"height":900,"caption":"A woman working intently on a laptop in a server room filled with equipment racks. The environment is dimly lit with ambient blue lights highlighting the rows of servers. She is wearing a grey polo and a blue lanyard for an ID badge, focused on the screen of the laptop."},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/5502567dd627cdd5a306432cd651a90e","name":"Ayako Kimijima","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/4ffb3c2d260a0150fb91b3715442f8b3","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Ayako Kimijima"},"url":"https:\/\/unit42.paloaltonetworks.com\/ja\/author\/akimijima\/"}]}},"_links":{"self":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/128698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/323"}],"replies":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=128698"}],"version-history":[{"count":12,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/128698\/revisions"}],"predecessor-version":[{"id":135972,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/128698\/revisions\/135972"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/134380"}],"wp:attachment":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=128698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=128698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=128698"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=128698"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=128698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}