-
IncomingCallRequest – 客户端用于请求新的传入虚拟呼叫请求。
-
IncomingCallReply – 由服务器发送用于表示自己是否正在接受虚拟呼叫。它还设置用于跟踪呼叫请求的请求 ID（Call ID）。
-
IncomingCallConnected – 客户端使用它来确认虚拟呼叫的连接并让服务器对其进行完全初始化以准备发送网络数据。
StartControlConnectionRequest() Client -> Server
StartControlConnectionReply() Server -> Client
IncomingCallRequest() Client -> Server
IncomingCallReply() Server -> Client
IncomingCallConnected() Client -> Server
IncomingCallConnected() Client -> Server
void __fastcall PptpCmRegSapPassive(__int64 a1)
{
...
v3 = PptpInitialize(CallMgrAfContext); // 创建第一个socket，可能是GRE的socket？
if ( v3
&& WPP_GLOBAL_Control != (PDEVICE_OBJECT)&WPP_GLOBAL_Control
&& (HIDWORD(WPP_GLOBAL_Control->Timer) & 4) != 0
&& BYTE1(WPP_GLOBAL_Control->Timer) )
{
WPP_SF_(WPP_GLOBAL_Control->AttachedDevice, 26i64, &WPP_a989452d2ce136f272e3b9b86b31e890_Traceguids);
}
v4 = CtlListen(CallMgrAfContext);
if ( v4 )
{
if ( WPP_GLOBAL_Control != (PDEVICE_OBJECT)&WPP_GLOBAL_Control
&& (HIDWORD(WPP_GLOBAL_Control->Timer) & 4) != 0
&& BYTE1(WPP_GLOBAL_Control->Timer) )
{
WPP_SF_(WPP_GLOBAL_Control->AttachedDevice, 27i64, &WPP_a989452d2ce136f272e3b9b86b31e890_Traceguids);
}
if ( v4 < 0 )
goto LABEL_38;
}
...
}
__int64 __fastcall CtlListen(__int64 CallMgrAfContext)
{
...
WORD1(v10) = __ROR2__(PptpControlPort, 8); // 看样子是端口号码，固定的
WORD1(v11) = WORD1(v10);
LOWORD(v10) = 2;
v9 = (__int64)&v10;
v7[0] = 1;
v8 = 1i64;
v7[1] = 6;
SockContext = (__int64)WskCreateAndIntializeSockContext();
v5 = SockContext;
if ( SockContext )
{
*(_QWORD *)(SockContext + 8) = CallMgrAfContext;
*(_QWORD *)(SockContext + 32) = CtlConnectQueryCallback;
*(_QWORD *)(SockContext + 24) = CtlDisconnectCallback;
*(_QWORD *)(SockContext + 16) = CtlReceiveCallback;
*(_QWORD *)(SockContext + 64) = CtlpSendMessageComplete;
*(_QWORD *)(SockContext + 72) = CallMgrAfContext + 96;
*(_QWORD *)(SockContext + 48) = CtlLogWskLibActivity;
ServerSocket = WskCreateServerSocket((__int64)v7, v4, SockContext);
if ( (ServerSocket & 0x80000000) == 0 )
*(_QWORD *)(CallMgrAfContext + 56) = v5;
else
WskDestroySockContext(v5);
}
else
{
ServerSocket = 0xC000009A;
if ( WPP_GLOBAL_Control == (PDEVICE_OBJECT)&WPP_GLOBAL_Control )
return ServerSocket;
if ( (HIDWORD(WPP_GLOBAL_Control->Timer) & 8) != 0 && BYTE1(WPP_GLOBAL_Control->Timer) )
WPP_SF_d(
WPP_GLOBAL_Control->AttachedDevice,
88i64,
&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,
0xC000009Ai64);
}
...
}
... <- (Windows Bug check handling)
NDIS!NdisMCmActivateVc+0x2d
raspptp!CallEventCallInConnect+0x71
raspptp!CtlpEngine+0xe63
raspptp!CtlReceiveCallback+0x4b
... <- (TCP/IP Handling)
case IncomingCallConnected:
// Ensure the client has sent a valid StartControlConnectionRequest message
if ( lpPptpCtlCx->CtlCurrentState == CtlStateWaitStop )
{
// BigEndian To LittleEndian Conversion
CallIdSentInReply = (unsigned __int16)__ROR2__(lpCtlPayloadBuffer->IncomingCallConnected.PeersCallId, 8);
if ( PptpClientSide ) // If we are the client
CallIdSentInReply &= 0x3FFFu; // Maximum ID mask
// Get the context structure for this call ID if it exists
IncomingCallCallCtx = CallGetCall(lpPptpCtlCx->pPptpAdapterCtx, CallIdSentInReply);
// Handle the incoming call connected event
if ( IncomingCallCallCtx )
CallEventCallInConnect(IncomingCallCallCtx, lpCtlPayloadBuffer);
__int64 __fastcall CallEventCallInConnect(CtlCall *IncomingCallCallCtx, CtlMsgStructs *IncomingCallMsg)
{
unsigned int ActiveateVcRetCode;
...
ActiveateVcRetCode = NdisMCmActivateVc(lpCallCtx->NdisVcHandle, (PCO_CALL_PARAMETERS)lpCallCtx->CallParams);
if ( ActiveateVcRetCode != STATUS_PENDING )
{
if...
PptpCmActivateVcComplete(ActiveateVcRetCode, lpCallCtx, (PVOID)lpCallCtx->CallParams);
}
return 0i64;
}
...
NDIS_STATUS __stdcall NdisMCmActivateVc(NDIS_HANDLE NdisVcHandle, PCO_CALL_PARAMETERS CallParameters)
{
__int64 v2; // rbx
PCO_CALL_PARAMETERS lpCallParameters; // rdi
KIRQL OldIRQL; // al
_CO_MEDIA_PARAMETERS *lpMediaParameters; // rcx
__int64 v6; // rcx
v2 = *((_QWORD *)NdisVcHandle + 9);
lpCallParameters = CallParameters;
OldIRQL = KeAcquireSpinLockRaiseToDpc((PKSPIN_LOCK)(v2 + 8));
*(_DWORD *)(v2 + 4) |= 1u;
lpMediaParameters = lpCallParameters->MediaParameters;
if ( lpMediaParameters->MediaSpecific.Length < 8 )
v6 = (unsigned int)v2;
else
v6 = *(_QWORD *)lpMediaParameters->MediaSpecific.Parameters;
*(_QWORD *)(v2 + 136) = v6;
*(_QWORD *)(v2 + 136) = *(_QWORD *)lpCallParameters->MediaParameters->MediaSpecific.Parameters;
KeReleaseSpinLock((PKSPIN_LOCK)(v2 + 8), OldIRQL);
return 0;
}
void __fastcall PptpCmActivateVcComplete(unsigned int OutGoingCallReplyStatusCode, CtlCall *CallContext, PVOID CallParams)
{
CtlCall *lpCallContext; // rdi
...
if ( lpCallContext->UnkownFlag )
{
if ( lpCallParams )
ExFreePoolWithTag((PVOID)lpCallContext->CallParams, 0);
lpCallContext->CallParams = 0i64;
...
https://labs.nettitude.com/blog/cve-2022-23253-windows-vpn-remote-kernel-null-pointer-dereference/
原文始发于微信公众号（山石网科安全技术研究院）：Microsoft VPN远程代码执行漏洞分析1-CVE-2022-23252
