infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/external/source/exploits/CVE-2010-0232/kitrap0d/kitrap0d.vcxproj

145 lines
7.0 KiB
XML
Raw Normal View History

Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ProjectGuid>{6B678096-E18A-427A-A8A3-C268AD2E12B8}</ProjectGuid>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<RootNamespace>kitrap0d</RootNamespace>
<Keyword>Win32Proj</Keyword>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<CharacterSet>MultiByte</CharacterSet>
<WholeProgramOptimization>false</WholeProgramOptimization>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
</ImportGroup>
<ImportGroup Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup>
<_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
<OutDir>$(Configuration)\$(Platform)\</OutDir>
<IntDir>$(Configuration)\$(Platform)\</IntDir>
<LinkIncremental>false</LinkIncremental>
<GenerateManifest>false</GenerateManifest>
<CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
<CodeAnalysisRules />
<CodeAnalysisRuleAssemblies />
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<Optimization>Disabled</Optimization>
<AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<MinimalRebuild>true</MinimalRebuild>
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
</ClCompile>
<Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>true</GenerateDebugInformation>
<SubSystem>Windows</SubSystem>
<TargetMachine>MachineX86</TargetMachine>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</Link>
<PostBuildEvent>
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
</PostBuildEvent>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ResourceCompile>
<PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
</ResourceCompile>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<Optimization>MinSpace</Optimization>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<IntrinsicFunctions>false</IntrinsicFunctions>
<AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<FunctionLevelLinking>false</FunctionLevelLinking>
<PrecompiledHeader>
</PrecompiledHeader>
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
<ObjectFileName>$(OutDir)\</ObjectFileName>
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
<WarningLevel>Level3</WarningLevel>
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
<BufferSecurityCheck>false</BufferSecurityCheck>
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
</ClCompile>
<Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
<IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>false</GenerateDebugInformation>
<GenerateMapFile>true</GenerateMapFile>
<MapFileName>$(OutDir)\kitrap0d.map</MapFileName>
<SubSystem>Windows</SubSystem>
<OptimizeReferences>
</OptimizeReferences>
<EnableCOMDATFolding>
</EnableCOMDATFolding>
<RandomizedBaseAddress>false</RandomizedBaseAddress>
<DataExecutionPrevention>
</DataExecutionPrevention>
<ImportLibrary>$(OutDir)\kitrap0d.lib</ImportLibrary>
<TargetMachine>MachineX86</TargetMachine>
<Profile>false</Profile>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</Link>
<PostBuildEvent>
Finalise the local exploit for kitrap0d The exploit now properly injects the DLL using RDI and invokes the exploit based on a parameter passed by the Ruby module. The elevate code is 'generic' with a goal of possibly supporting more exploits down the track. New sessions are now created with the SYSTEM creds, rather than modifying the existing session. This is now inline with how things are done with other local modules.
2013-11-12 10:10:31 +00:00
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemGroup>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ClCompile Include="..\common\LoadLibraryR.c" />
<ClCompile Include="..\common\ResourceLoader.c" />
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
<ClCompile Include="kitrap0d.c" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\common\common.h" />
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
<ClInclude Include="..\common\LoadLibraryR.h" />
<ClInclude Include="..\common\ResourceLoader.h" />
<ClInclude Include="resource.h" />
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="kitrap0d.rc" />
Move kitrap0d exploit from getsystem to local exploit This version modifies the existing meterpreter session and bumps the privs up to SYSTEM. However it's not how local exploits are supposed to work. More work will be done to make this create a new session with the elevated privs instead.
2013-11-11 01:11:42 +00:00
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
</ImportGroup>
Remove genericity, x64 and renamed stuff As per discussion on the github issue, the following changes were made: * Project renamed from elevate to kitrap0d, implying that this is not intended to be a generic local priv esc exploit container. * Container DLL no longer generic, always calls the kitrap0d exploit. * Removal of all x64 code and project configurations. * Invocation of the exploit changed so that the address of the payload is passed in to the exploit entry point. The exploit is now responsible for executing the payload if the exploit is successful. This removes the possibility of the payload getting executed when the exploit fails. * Source moved to the appropriate CVE folder. * Binary moved to the appropriate CVE folder. * Little bit of source rejigging to tidy things up.
2013-11-14 02:17:07 +00:00
</Project>