infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/external/source/exploits/CVE-2010-0232/kitrap0d/kitrap0d.vcxproj

150 lines
7.3 KiB
XML
Raw Normal View History

Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ProjectGuid>{6B678096-E18A-427A-A8A3-C268AD2E12B8}</ProjectGuid>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<RootNamespace>kitrap0d</RootNamespace>
<Keyword>Win32Proj</Keyword>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<CharacterSet>MultiByte</CharacterSet>
<WholeProgramOptimization>false</WholeProgramOptimization>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
</ImportGroup>
<ImportGroup Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup>
<_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
<OutDir>$(Configuration)\$(Platform)\</OutDir>
<IntDir>$(Configuration)\$(Platform)\</IntDir>
<LinkIncremental>false</LinkIncremental>
<GenerateManifest>false</GenerateManifest>
<CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
<CodeAnalysisRules />
<CodeAnalysisRuleAssemblies />
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<Optimization>Disabled</Optimization>
Add RDI submodule, port Kitrap0d This commit is the first in a series that will move all the exploits that use RDI over to the R7 fork. The RDI source will be in a single known location and each exploit will have to work from that location. The kitrap0d exploit has been migrated over to use this submodule so that there's one example of how it's done for future contributions to follow.
2013-11-27 06:04:41 +00:00
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<MinimalRebuild>true</MinimalRebuild>
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
</ClCompile>
<Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>true</GenerateDebugInformation>
<SubSystem>Windows</SubSystem>
<TargetMachine>MachineX86</TargetMachine>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</Link>
<PostBuildEvent>
Quick fix to x64 kitrap0d project Stops errors on debug builds, not that anyone cares.
2013-12-19 23:51:24 +00:00
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
exit 0</Command>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</PostBuildEvent>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ResourceCompile>
<PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
</ResourceCompile>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<Optimization>MinSpace</Optimization>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<IntrinsicFunctions>false</IntrinsicFunctions>
Add RDI submodule, port Kitrap0d This commit is the first in a series that will move all the exploits that use RDI over to the R7 fork. The RDI source will be in a single known location and each exploit will have to work from that location. The kitrap0d exploit has been migrated over to use this submodule so that there's one example of how it's done for future contributions to follow.
2013-11-27 06:04:41 +00:00
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<FunctionLevelLinking>false</FunctionLevelLinking>
<PrecompiledHeader>
</PrecompiledHeader>
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
<ObjectFileName>$(OutDir)\</ObjectFileName>
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
<WarningLevel>Level3</WarningLevel>
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
<BufferSecurityCheck>false</BufferSecurityCheck>
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
</ClCompile>
<Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
<IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>false</GenerateDebugInformation>
<GenerateMapFile>true</GenerateMapFile>
<MapFileName>$(OutDir)\kitrap0d.map</MapFileName>
<SubSystem>Windows</SubSystem>
<OptimizeReferences>
</OptimizeReferences>
<EnableCOMDATFolding>
</EnableCOMDATFolding>
<RandomizedBaseAddress>false</RandomizedBaseAddress>
<DataExecutionPrevention>
</DataExecutionPrevention>
<ImportLibrary>$(OutDir)\kitrap0d.lib</ImportLibrary>
<TargetMachine>MachineX86</TargetMachine>
<Profile>false</Profile>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</Link>
<PostBuildEvent>
Add RDI submodule, port Kitrap0d This commit is the first in a series that will move all the exploits that use RDI over to the R7 fork. The RDI source will be in a single known location and each exploit will have to work from that location. The kitrap0d exploit has been migrated over to use this submodule so that there's one example of how it's done for future contributions to follow.
2013-11-27 06:04:41 +00:00
<Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
IF EXIST "..\..\..\..\..\data\exploits\CVE-2010-0232\" GOTO COPY
mkdir "..\..\..\..\..\data\exploits\CVE-2010-0232\"
:COPY
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2010-0232\"</Command>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemGroup>
Add RDI submodule, port Kitrap0d This commit is the first in a series that will move all the exploits that use RDI over to the R7 fork. The RDI source will be in a single known location and each exploit will have to work from that location. The kitrap0d exploit has been migrated over to use this submodule so that there's one example of how it's done for future contributions to follow.
2013-11-27 06:04:41 +00:00
<ClCompile Include="..\..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.c" />
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ClCompile Include="..\common\ResourceLoader.c" />
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<ClCompile Include="kitrap0d.c" />
</ItemGroup>
<ItemGroup>
Add RDI submodule, port Kitrap0d This commit is the first in a series that will move all the exploits that use RDI over to the R7 fork. The RDI source will be in a single known location and each exploit will have to work from that location. The kitrap0d exploit has been migrated over to use this submodule so that there's one example of how it's done for future contributions to follow.
2013-11-27 06:04:41 +00:00
<ClInclude Include="..\..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.h" />
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<ClInclude Include="..\common\common.h" />
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ClInclude Include="..\common\ResourceLoader.h" />
<ClInclude Include="resource.h" />
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="kitrap0d.rc" />
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
</ImportGroup>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
</Project>