Skip to content

Commit d92259f

Browse files
zeroSteinerzeroSteiner
committed
One exploit for CVE-2021-1732 and CVE-2022-21882 
1 parent 4130c61 commit d92259f

File tree

10 files changed

+924
-1
lines changed

10 files changed

+924
-1
lines changed

‎data/exploits/CVE-2022-21882/CVE-2022-21882.x64.dll‎

109 KB
Binary file not shown.

‎external/source/exploits/CVE-2022-21882/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
~AutoRecover*
2+
.vs/*

‎external/source/exploits/CVE-2022-21882/CVE-2022-21882.sln‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.0.32112.339
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2022-21882", "CVE-2022-21882.vcxproj", "{15A43727-B35C-44C5-B9A5-26920658FC4D}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x64.ActiveCfg = Debug|x64
17+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x64.Build.0 = Debug|x64
18+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x86.ActiveCfg = Debug|Win32
19+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x86.Build.0 = Debug|Win32
20+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x64.ActiveCfg = Release|x64
21+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x64.Build.0 = Release|x64
22+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x86.ActiveCfg = Release|Win32
23+
{15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {0CED6045-2F20-480C-BC68-7471D40E453B}
30+
EndGlobalSection
31+
EndGlobal

‎external/source/exploits/CVE-2022-21882/CVE-2022-21882.vcxproj‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<ProjectGuid>{15a43727-b35c-44c5-b9a5-26920658fc4d}</ProjectGuid>
24+
<Keyword>Win32Proj</Keyword>
25+
<RootNamespace>CVE_2022_21882</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>DynamicLibrary</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v142</PlatformToolset>
33+
<CharacterSet>MultiByte</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>DynamicLibrary</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v142</PlatformToolset>
39+
<WholeProgramOptimization>false</WholeProgramOptimization>
40+
<CharacterSet>MultiByte</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>DynamicLibrary</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v142</PlatformToolset>
46+
<CharacterSet>MultiByte</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>DynamicLibrary</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v142</PlatformToolset>
52+
<WholeProgramOptimization>false</WholeProgramOptimization>
53+
<CharacterSet>MultiByte</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
76+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
77+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
80+
<LinkIncremental>true</LinkIncremental>
81+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
82+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
83+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
84+
</PropertyGroup>
85+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
86+
<LinkIncremental>false</LinkIncremental>
87+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
88+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
89+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
90+
<GenerateManifest>false</GenerateManifest>
91+
</PropertyGroup>
92+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
93+
<LinkIncremental>false</LinkIncremental>
94+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
95+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
96+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
97+
<GenerateManifest>false</GenerateManifest>
98+
</PropertyGroup>
99+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
100+
<ClCompile>
101+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
102+
<WarningLevel>Level3</WarningLevel>
103+
<SDLCheck>true</SDLCheck>
104+
<PreprocessorDefinitions>WIN32;_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
105+
<ConformanceMode>false</ConformanceMode>
106+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
107+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
108+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
109+
<TreatWarningAsError>true</TreatWarningAsError>
110+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
111+
<StringPooling>true</StringPooling>
112+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
113+
<FunctionLevelLinking>false</FunctionLevelLinking>
114+
</ClCompile>
115+
<Link>
116+
<SubSystem>Windows</SubSystem>
117+
<GenerateDebugInformation>true</GenerateDebugInformation>
118+
<EnableUAC>false</EnableUAC>
119+
<GenerateMapFile>true</GenerateMapFile>
120+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
121+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
122+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
123+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
124+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
125+
</Link>
126+
</ItemDefinitionGroup>
127+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
128+
<ClCompile>
129+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
130+
<WarningLevel>Level3</WarningLevel>
131+
<SDLCheck>true</SDLCheck>
132+
<PreprocessorDefinitions>_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133+
<ConformanceMode>false</ConformanceMode>
134+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
135+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
136+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
137+
<TreatWarningAsError>true</TreatWarningAsError>
138+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
139+
<StringPooling>true</StringPooling>
140+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
141+
<FunctionLevelLinking>false</FunctionLevelLinking>
142+
</ClCompile>
143+
<Link>
144+
<SubSystem>Windows</SubSystem>
145+
<GenerateDebugInformation>true</GenerateDebugInformation>
146+
<EnableUAC>false</EnableUAC>
147+
<GenerateMapFile>true</GenerateMapFile>
148+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
149+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
150+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
151+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
152+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
153+
</Link>
154+
</ItemDefinitionGroup>
155+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
156+
<ClCompile>
157+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
158+
<WarningLevel>Level3</WarningLevel>
159+
<FunctionLevelLinking>false</FunctionLevelLinking>
160+
<IntrinsicFunctions>false</IntrinsicFunctions>
161+
<SDLCheck>
162+
</SDLCheck>
163+
<PreprocessorDefinitions>WIN32;NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
164+
<ConformanceMode>false</ConformanceMode>
165+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
166+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
167+
<TreatWarningAsError>true</TreatWarningAsError>
168+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
169+
<StringPooling>true</StringPooling>
170+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
171+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
172+
<ObjectFileName>$(OutDir)\</ObjectFileName>
173+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
174+
</ClCompile>
175+
<Link>
176+
<SubSystem>Windows</SubSystem>
177+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
178+
<OptimizeReferences>true</OptimizeReferences>
179+
<GenerateDebugInformation>false</GenerateDebugInformation>
180+
<EnableUAC>false</EnableUAC>
181+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
182+
<GenerateMapFile>false</GenerateMapFile>
183+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
184+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
185+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
186+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
187+
</Link>
188+
</ItemDefinitionGroup>
189+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
190+
<ClCompile>
191+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
192+
<WarningLevel>Level3</WarningLevel>
193+
<FunctionLevelLinking>false</FunctionLevelLinking>
194+
<IntrinsicFunctions>false</IntrinsicFunctions>
195+
<SDLCheck>
196+
</SDLCheck>
197+
<PreprocessorDefinitions>NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
198+
<ConformanceMode>false</ConformanceMode>
199+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
200+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
201+
<TreatWarningAsError>true</TreatWarningAsError>
202+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
203+
<StringPooling>true</StringPooling>
204+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
205+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
206+
<ObjectFileName>$(OutDir)\</ObjectFileName>
207+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
208+
</ClCompile>
209+
<Link>
210+
<SubSystem>Windows</SubSystem>
211+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
212+
<OptimizeReferences>true</OptimizeReferences>
213+
<GenerateDebugInformation>false</GenerateDebugInformation>
214+
<EnableUAC>false</EnableUAC>
215+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
216+
<GenerateMapFile>false</GenerateMapFile>
217+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
218+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
219+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
220+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
221+
</Link>
222+
<PostBuildEvent>
223+
<Command>IF EXIST "..\..\..\..\data\exploits\$(ProjectName)\" GOTO COPY
224+
mkdir "..\..\..\..\data\exploits\$(ProjectName)\"
225+
:COPY
226+
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\data\exploits\$(ProjectName)\"</Command>
227+
</PostBuildEvent>
228+
<PostBuildEvent>
229+
<Message>
230+
</Message>
231+
</PostBuildEvent>
232+
</ItemDefinitionGroup>
233+
<ItemGroup>
234+
<ClCompile Include="dllmain.c" />
235+
<ClCompile Include="exploit.c" />
236+
</ItemGroup>
237+
<ItemGroup>
238+
<ClInclude Include="exploit.h" />
239+
</ItemGroup>
240+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
241+
<ImportGroup Label="ExtensionTargets">
242+
</ImportGroup>
243+
</Project>

‎external/source/exploits/CVE-2022-21882/dllmain.c‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
2+
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
3+
#include "ReflectiveLoader.c"
4+
5+
#include <stdio.h>
6+
#include <stdint.h>
7+
#include <windows.h>
8+
9+
DWORD Exploit(PVOID pPayload);
10+
11+
LPVOID main(LPVOID lpReserved) {
12+
Exploit(lpReserved);
13+
return;
14+
}
15+
16+
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
17+
{
18+
switch (dwReason)
19+
{
20+
case DLL_QUERY_HMODULE:
21+
hAppInstance = hinstDLL;
22+
if (lpReserved != NULL)
23+
{
24+
*(HMODULE*)lpReserved = hAppInstance;
25+
}
26+
break;
27+
case DLL_PROCESS_ATTACH:
28+
hAppInstance = hinstDLL;
29+
main(lpReserved);
30+
break;
31+
case DLL_PROCESS_DETACH:
32+
case DLL_THREAD_ATTACH:
33+
case DLL_THREAD_DETACH:
34+
break;
35+
}
36+
return TRUE;
37+
}
38+

0 commit comments

Comments
 (0)