infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refactor GetProcessSid to remove do while FALSE

master
Spencer McIntyre 2017-11-07 19:11:24 -05:00
parent 7d1de9bc48
commit c2578c1487
3 changed files with 19 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/exploits/cve-2017-8464/template_x64_windows.dll
View File

Binary file not shown.

BIN
data/exploits/cve-2017-8464/template_x86_windows.dll
View File

Binary file not shown.

51
external/source/exploits/cve-2017-8464/template.c vendored
View File

@ -48,44 +48,31 @@ BOOL GetProcessSid(HANDLE hProc, PSID *pSid) {
SIZE_T szSid = 0;
*pSid = NULL;
do {
if (!OpenProcessToken(hProc, (TOKEN_READ), &hToken)) {
return FALSE;
}
if (!OpenProcessToken(hProc, (TOKEN_READ), &hToken)) {
return FALSE;
}
GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength);
tuUser = (TOKEN_USER *)malloc(dwLength);
if (tuUser == NULL) {
break;
}
GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength);
tuUser = (TOKEN_USER *)malloc(dwLength);
if (!tuUser) {
return FALSE;
}
if (!GetTokenInformation(hToken, TokenUser, tuUser, dwLength, &dwLength)) {
break;
}
szSid = GetLengthSid(tuUser->User.Sid);
*pSid = LocalAlloc(LPTR, szSid);
if (*pSid == NULL) {
break;
}
if (!CopySid((DWORD)szSid, *pSid, tuUser->User.Sid)) {
LocalFree(*pSid);
*pSid = NULL;
}
} while (FALSE);
if (tuUser != NULL) {
if (!GetTokenInformation(hToken, TokenUser, tuUser, dwLength, &dwLength)) {
free(tuUser);
}
if (hToken) {
CloseHandle(hToken);
return FALSE;
}
if (*pSid != NULL) {
return TRUE;
szSid = GetLengthSid(tuUser->User.Sid);
*pSid = LocalAlloc(LPTR, szSid);
if ((*pSid) && (!CopySid((DWORD)szSid, *pSid, tuUser->User.Sid))) {
LocalFree(*pSid);
*pSid = NULL;
}
return FALSE;
free(tuUser);
CloseHandle(hToken);
return *pSid != NULL;
}
BOOL IsProcessRunningAsSidString(HANDLE hProc, LPCTSTR sStringSid, PBOOL pbResult) {