Skip to content

Commit 2a6258b

Browse files
Meatballs1Meatballs1
committed
Merge remote-tracking branch 'upstream/master' into bypassuac_redo
Conflicts: external/source/exploits/make.bat
2 parents 97a9a91 + ac446d3 commit 2a6258b

File tree

40 files changed

+1044
-380
lines changed

40 files changed

+1044
-380
lines changed

‎data/js/detect/os.js‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,7 @@ window.os_detect.getVersion = function(){
196196
if (!ua_version || 0 == ua_version.length) {
197197
ua_is_lying = true;
198198
}
199-
} else if (!document.all && navigator.taintEnabled ||
200-
'MozBlobBuilder' in window) {
199+
} else if (navigator.oscpu && !document.all && navigator.taintEnabled || 'MozBlobBuilder' in window) {
201200
// Use taintEnabled to identify FF since other recent browsers
202201
// implement window.getComputedStyle now. For some reason, checking for
203202
// taintEnabled seems to cause IE 6 to stop parsing, so make sure this
@@ -882,6 +881,18 @@ window.os_detect.getVersion = function(){
882881
os_flavor = "7";
883882
os_sp = "SP1";
884883
break;
884+
case "11016428":
885+
// IE 11.0.9600.16428 / Windows 7 SP1
886+
ua_version = "11.0";
887+
os_flavor = "7";
888+
os_sp = "SP1";
889+
break;
890+
case "10016384":
891+
// IE 10.0.9200.16384 / Windows 8 x86
892+
ua_version = "10.0";
893+
os_flavor = "8";
894+
os_sp = "SP0";
895+
break;
885896
case "1000":
886897
// IE 10.0.8400.0 (Pre-release + KB2702844), Windows 8 x86 English Pre-release
887898
ua_version = "10.0";

‎data/post/bypassuac-x64.exe‎

-22 KB
Binary file not shown.

‎data/post/bypassuac-x86.exe‎

-15 KB
Binary file not shown.

‎external/source/exploits/bypassuac/CMMN.cpp‎

100644100755
Lines changed: 0 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -8,46 +8,6 @@
88
#include <windows.h>
99
#include <WinIOCtl.h>
1010

11-
/*************************************************************************************************/
12-
/*************************************************************************************************/
13-
/*************************************************************************************************/
14-
15-
std::wstring CError::Format( DWORD ErrorCode )
16-
{
17-
return Format( ErrorCode, NULL, NULL );
18-
}
19-
20-
std::wstring CError::Format(DWORD ErrorCode, const TCHAR *Title, const TCHAR *API)
21-
{
22-
LPVOID lpvMessageBuffer;
23-
24-
FormatMessage(
25-
FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
26-
NULL, ErrorCode,
27-
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
28-
(LPTSTR)&lpvMessageBuffer, 0, NULL);
29-
30-
std::wstring result;
31-
32-
std::wostringstream es(TEXT(""));
33-
es << ErrorCode;
34-
35-
if ( Title )
36-
{ result.append( Title ); result.append( TEXT("\n") ); }
37-
else
38-
{ result.append( TEXT("ERROR") ); result.append( TEXT("\n") ); }
39-
40-
if ( API )
41-
{ result.append( TEXT("API = ") );result.append( API ); result.append( TEXT("\n") ); }
42-
result.append( TEXT("error code = ") );result.append( es.str() );result.append( TEXT("\n") );
43-
if( lpvMessageBuffer )
44-
{ result.append( TEXT("message = ") );result.append( (TCHAR *)lpvMessageBuffer );result.append( TEXT("\n") ); }
45-
46-
if ( lpvMessageBuffer )
47-
{ LocalFree(lpvMessageBuffer); }
48-
49-
return result;
50-
}
5111

5212
/*************************************************************************************************/
5313
/*************************************************************************************************/
@@ -142,90 +102,3 @@ CInterprocessStorage::~CInterprocessStorage()
142102
CloseHandle( _hMapping );
143103
}
144104

145-
/*************************************************************************************************/
146-
/*************************************************************************************************/
147-
/*************************************************************************************************/
148-
149-
std::wstring CLogger::GetPath()
150-
{
151-
std::wstring path;
152-
153-
TCHAR buffer[MAX_PATH];
154-
if ( GetTempPath( MAX_PATH, buffer ) )
155-
{
156-
path.assign( buffer );
157-
path.append( TEXT("w7e.log") );
158-
}
159-
160-
return path;
161-
}
162-
163-
void CLogger::Reset()
164-
{
165-
DeleteFile( GetPath().c_str() );
166-
}
167-
168-
void CLogger::LogLine( std::wstring& Text )
169-
{
170-
std::wstring tmp( Text.c_str() );
171-
tmp.append( TEXT("\n") );
172-
Log( tmp );
173-
}
174-
175-
void CLogger::LogLine( )
176-
{
177-
Log( TEXT("\n") );
178-
}
179-
180-
void CLogger::LogLine( const TCHAR *Text )
181-
{
182-
if ( Text )
183-
LogLine( std::wstring( Text ) );
184-
}
185-
186-
void CLogger::Log( const TCHAR Char )
187-
{
188-
std::wstring tmp;
189-
tmp.append( &Char, 1 );
190-
Log( tmp );
191-
}
192-
193-
void CLogger::Log( const TCHAR *Text )
194-
{
195-
if ( Text )
196-
Log( std::wstring( Text ) );
197-
}
198-
199-
void CLogger::Log( std::wstring& Text )
200-
{
201-
TCHAR buffer[MAX_PATH];
202-
//
203-
// We have to check it every time to be reflective if user created this file
204-
// while program was runnig.
205-
//
206-
if ( GetModuleFileName( NULL, buffer, MAX_PATH ) )
207-
{
208-
std::wstring dbg( buffer );
209-
dbg.append( TEXT(".debug") );
210-
HANDLE hdbg = CreateFile( dbg.c_str(), FILE_READ_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL );
211-
if ( INVALID_HANDLE_VALUE == hdbg )
212-
return;
213-
214-
CloseHandle( hdbg );
215-
}
216-
217-
HANDLE mutex = CreateMutex( NULL, FALSE, TEXT("CLoggerSync") );
218-
if ( mutex ) WaitForSingleObject( mutex , INFINITE );
219-
HANDLE hFile = CreateFile( GetPath().c_str(), FILE_ALL_ACCESS, 0, NULL, OPEN_ALWAYS, FILE_FLAG_WRITE_THROUGH, NULL );
220-
if( INVALID_HANDLE_VALUE != hFile )
221-
{
222-
SetFilePointer( hFile, 0, NULL, FILE_END );
223-
224-
DWORD written;
225-
WriteFile( hFile, Text.data(), Text.size() * sizeof(TCHAR), &written, NULL );
226-
227-
CloseHandle( hFile );
228-
}
229-
if ( mutex ) ReleaseMutex( mutex );
230-
if ( mutex ) CloseHandle( mutex );
231-
}

‎external/source/exploits/bypassuac/Redirector.cpp‎

100644100755
Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@ DWORD WINAPI Redirector( LPVOID Parameter )
1313
assert( Parameter );
1414
TRedirectorPair *pair = reinterpret_cast<TRedirectorPair*>( Parameter );
1515

16-
CLogger::Log( TEXT("Hello redirector thread: ") );
17-
CLogger::LogLine( pair->Name );
18-
1916
CHAR read_buff[2];
2017
DWORD nBytesRead,nBytesWrote;
2118

@@ -25,11 +22,7 @@ DWORD WINAPI Redirector( LPVOID Parameter )
2522
{
2623
if( ! ReadFile( pair->Source, read_buff, 1, &nBytesRead, NULL) )
2724
{
28-
CLogger::LogLine(
29-
CError::Format(
30-
GetLastError(),
31-
pair->Name.c_str(),
32-
TEXT("ReadFile") ) );
25+
3326
error = true && (!pair->KeepAlive);
3427
break;
3528
}
@@ -67,11 +60,6 @@ DWORD WINAPI Redirector( LPVOID Parameter )
6760

6861
if ( ! WriteConsoleInput( pair->Destination, &inp, 1, &nBytesWrote) )
6962
{
70-
CLogger::LogLine(
71-
CError::Format(
72-
GetLastError(),
73-
pair->Name.c_str(),
74-
TEXT("WriteConsoleInput") ) );
7563
error = true && (!pair->KeepAlive);
7664
break;
7765
}
@@ -80,20 +68,13 @@ DWORD WINAPI Redirector( LPVOID Parameter )
8068
{
8169
if ( ! WriteFile( pair->Destination, &read_buff[i], 1, &nBytesWrote, NULL) )
8270
{
83-
CLogger::LogLine(
84-
CError::Format(
85-
GetLastError(),
86-
pair->Name.c_str(),
87-
TEXT("WriteFile") ) );
8871
error = true && (!pair->KeepAlive);
8972
break;
9073
}
9174
}
9275
}
9376
}
9477

95-
CLogger::Log( TEXT("Bye redirector thread: ") );
96-
CLogger::LogLine( pair->Name );
9778
return EXIT_SUCCESS;
9879
}
9980

‎external/source/exploits/bypassuac/TIOR/TIOR.cpp‎

100644100755
Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020

2121
int _tmain(int argc, _TCHAR* argv[])
2222
{
23-
CLogger::LogLine(TEXT("TIOR: Hello"));
2423

2524
TRedirectorPair in = {0};
2625
in.Source = CreateFile( STDIn_PIPE, FILE_ALL_ACCESS, 0, NULL, OPEN_EXISTING, 0, 0);
@@ -79,9 +78,6 @@ int _tmain(int argc, _TCHAR* argv[])
7978
CInterprocessStorage::GetString( TEXT("w7e_TIORArgs"), args );
8079
CInterprocessStorage::GetString( TEXT("w7e_TIORDir"), dir );
8180

82-
CLogger::LogLine(TEXT("TIOR: shell=")); CLogger::LogLine(shell);
83-
CLogger::LogLine(TEXT("TIOR: args=")); CLogger::LogLine(args);
84-
CLogger::LogLine(TEXT("TIOR: dir=")); CLogger::LogLine(dir);
8581

8682
STARTUPINFO si = {0};si.cb = sizeof(si);
8783
PROCESS_INFORMATION pi = {0};
@@ -100,11 +96,6 @@ int _tmain(int argc, _TCHAR* argv[])
10096

10197
if ( ! created )
10298
{
103-
CLogger::LogLine(
104-
CError::Format(
105-
GetLastError(),
106-
TEXT("TIOR: Unable to create child process"),
107-
TEXT("CreateProcess")));
10899

109100
return EXIT_FAILURE;
110101
}
@@ -113,14 +104,12 @@ int _tmain(int argc, _TCHAR* argv[])
113104
CloseHandle( pi.hThread );
114105
}
115106

116-
CLogger::LogLine(TEXT("TIOR: Shell has been started. Waiting..."));
117107
HANDLE waiters[4] = {pi.hProcess, in.Thread, out.Thread, err.Thread} ;
118108
//
119109
// Waiting for eny handle to be freed.
120110
// Either some IO thread will die or process will be oevered.
121111
//
122112
WaitForMultipleObjects( 4, waiters, FALSE, INFINITE );
123-
CLogger::LogLine(TEXT("TIOR: Ensure that we processed all data in pipes"));
124113

125114
//
126115
// Even if process was overed, we need to be sure that we readed all data from the redirected pipe.
@@ -132,11 +121,9 @@ int _tmain(int argc, _TCHAR* argv[])
132121
// Dont forget to close child process. We need to be sure, if user terminated app which
133122
// reads our redirected data, we terminate the target child app.
134123
//
135-
CLogger::LogLine(TEXT("TIOR: Killing child process"));
136124
TerminateProcess( pi.hProcess, EXIT_FAILURE );
137125
CloseHandle( pi.hProcess );
138126

139-
CLogger::LogLine(TEXT("TIOR: Exit"));
140127

141128
//
142129
// I will not close any handles here - system will terminate and close all by it self.

0 commit comments

Comments
 (0)