Skip to content

Commit a1aef92

Browse files
OJOJ
committed
Land rapid7#2431 - In-memory bypass uac
2 parents 7cb6e7e + 7877589 commit a1aef92

File tree

16 files changed

+845
-0
lines changed

16 files changed

+845
-0
lines changed

‎data/post/bypassuac-x64.dll‎

82 KB
Binary file not shown.

‎data/post/bypassuac-x86.dll‎

70.5 KB
Binary file not shown.

‎data/templates/template_x64_windows.dll‎

0 Bytes
Binary file not shown.

‎data/templates/template_x86_windows.dll‎

-9 KB
Binary file not shown.

‎external/source/exploits/bypassuac_injection/.gitignore‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
## Ignore Visual Studio temporary files, build results, and
2+
## files generated by popular Visual Studio add-ons.
3+
4+
# User-specific files
5+
*.suo
6+
*.user
7+
*.sln.docstates
8+
9+
# Build results
10+
11+
[Dd]ebug/
12+
[Rr]elease/
13+
x64/
14+
build/
15+
[Bb]in/
16+
[Oo]bj/
17+
18+
# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
19+
!packages/*/build/
20+
21+
# MSTest test Results
22+
[Tt]est[Rr]esult*/
23+
[Bb]uild[Ll]og.*
24+
25+
*_i.c
26+
*_p.c
27+
*.ilk
28+
*.meta
29+
*.obj
30+
*.pch
31+
*.pdb
32+
*.pgc
33+
*.pgd
34+
*.rsp
35+
*.sbr
36+
*.tlb
37+
*.tli
38+
*.tlh
39+
*.tmp
40+
*.tmp_proj
41+
*.log
42+
*.vspscc
43+
*.vssscc
44+
.builds
45+
*.pidb
46+
*.log
47+
*.scc
48+
49+
# Visual C++ cache files
50+
ipch/
51+
*.aps
52+
*.ncb
53+
*.opensdf
54+
*.sdf
55+
*.cachefile
56+
57+
# Visual Studio profiler
58+
*.psess
59+
*.vsp
60+
*.vspx
61+
62+
# Guidance Automation Toolkit
63+
*.gpState
64+
65+
# ReSharper is a .NET coding add-in
66+
_ReSharper*/
67+
*.[Rr]e[Ss]harper
68+
69+
# TeamCity is a build add-in
70+
_TeamCity*
71+
72+
# DotCover is a Code Coverage Tool
73+
*.dotCover
74+
75+
# NCrunch
76+
*.ncrunch*
77+
.*crunch*.local.xml
78+
79+
# Installshield output folder
80+
[Ee]xpress/
81+
82+
# DocProject is a documentation generator add-in
83+
DocProject/buildhelp/
84+
DocProject/Help/*.HxT
85+
DocProject/Help/*.HxC
86+
DocProject/Help/*.hhc
87+
DocProject/Help/*.hhk
88+
DocProject/Help/*.hhp
89+
DocProject/Help/Html2
90+
DocProject/Help/html
91+
92+
# Click-Once directory
93+
publish/
94+
95+
# Publish Web Output
96+
*.Publish.xml
97+
*.pubxml
98+
99+
# NuGet Packages Directory
100+
## TODO: If you have NuGet Package Restore enabled, uncomment the next line
101+
#packages/
102+
103+
# Windows Azure Build Output
104+
csx
105+
*.build.csdef
106+
107+
# Windows Store app package directory
108+
AppPackages/
109+
110+
# Others
111+
sql/
112+
*.Cache
113+
ClientBin/
114+
[Ss]tyle[Cc]op.*
115+
~$*
116+
*~
117+
*.dbmdl
118+
*.[Pp]ublish.xml
119+
*.pfx
120+
*.publishsettings
121+
122+
# RIA/Silverlight projects
123+
Generated_Code/
124+
125+
# Backup & report files from converting an old project file to a newer
126+
# Visual Studio version. Backup files are not needed, because we have git ;-)
127+
_UpgradeReport_Files/
128+
Backup*/
129+
UpgradeLog*.XML
130+
UpgradeLog*.htm
131+
132+
# SQL Server files
133+
App_Data/*.mdf
134+
App_Data/*.ldf
135+
136+
# =========================
137+
# Windows detritus
138+
# =========================
139+
140+
# Windows image file caches
141+
Thumbs.db
142+
ehthumbs.db
143+
144+
# Folder config file
145+
Desktop.ini
146+
147+
# Recycle Bin used on file shares
148+
$RECYCLE.BIN/
149+
150+
# Mac crap
151+
.DS_Store

‎external/source/exploits/bypassuac_injection/bypassuac_injection.sln‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2013
4+
VisualStudioVersion = 12.0.21005.1
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "bypassuac", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Win32 = Debug|Win32
11+
Debug|x64 = Debug|x64
12+
Release|Win32 = Release|Win32
13+
Release|x64 = Release|x64
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32
17+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32
18+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.ActiveCfg = Release|x64
19+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.Build.0 = Release|x64
20+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32
21+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32
22+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.ActiveCfg = Release|x64
23+
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.Build.0 = Release|x64
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
EndGlobal

‎external/source/exploits/bypassuac_injection/dll/reflective_dll.vcxproj‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Debug|x64">
9+
<Configuration>Debug</Configuration>
10+
<Platform>x64</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Release|Win32">
13+
<Configuration>Release</Configuration>
14+
<Platform>Win32</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}</ProjectGuid>
23+
<RootNamespace>reflective_dll</RootNamespace>
24+
<Keyword>Win32Proj</Keyword>
25+
<ProjectName>bypassuac</ProjectName>
26+
</PropertyGroup>
27+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
28+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
29+
<ConfigurationType>DynamicLibrary</ConfigurationType>
30+
<PlatformToolset>v120</PlatformToolset>
31+
<CharacterSet>MultiByte</CharacterSet>
32+
<WholeProgramOptimization>false</WholeProgramOptimization>
33+
</PropertyGroup>
34+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
35+
<ConfigurationType>DynamicLibrary</ConfigurationType>
36+
<PlatformToolset>v120</PlatformToolset>
37+
<CharacterSet>Unicode</CharacterSet>
38+
</PropertyGroup>
39+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
40+
<ConfigurationType>DynamicLibrary</ConfigurationType>
41+
<CharacterSet>MultiByte</CharacterSet>
42+
<WholeProgramOptimization>false</WholeProgramOptimization>
43+
<PlatformToolset>v120</PlatformToolset>
44+
</PropertyGroup>
45+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
46+
<ConfigurationType>DynamicLibrary</ConfigurationType>
47+
<PlatformToolset>v120</PlatformToolset>
48+
<CharacterSet>Unicode</CharacterSet>
49+
</PropertyGroup>
50+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
51+
<ImportGroup Label="ExtensionSettings">
52+
</ImportGroup>
53+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets">
54+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
55+
</ImportGroup>
56+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets">
57+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
58+
</ImportGroup>
59+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
60+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
61+
</ImportGroup>
62+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
63+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
64+
</ImportGroup>
65+
<PropertyGroup Label="UserMacros" />
66+
<PropertyGroup>
67+
<_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion>
68+
</PropertyGroup>
69+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
70+
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
71+
<IntDir>$(Configuration)\</IntDir>
72+
<LinkIncremental>true</LinkIncremental>
73+
</PropertyGroup>
74+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
75+
<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
76+
<IntDir>$(Platform)\$(Configuration)\</IntDir>
77+
<LinkIncremental>true</LinkIncremental>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
80+
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
81+
<IntDir>$(Configuration)\</IntDir>
82+
<LinkIncremental>false</LinkIncremental>
83+
<TargetName>$(ProjectName)-x86</TargetName>
84+
<IncludePath>$(VCInstallDir)include;$(VCInstallDir)atlmfc\include;$(WindowsSDK_IncludePath);..\..\..\ReflectiveDLLInjection\common\;..\..\..\ReflectiveDLLInjection\dll\src\</IncludePath>
85+
</PropertyGroup>
86+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
87+
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
88+
<IntDir>$(Configuration)\</IntDir>
89+
<LinkIncremental>false</LinkIncremental>
90+
<TargetName>$(ProjectName)-x64</TargetName>
91+
<IncludePath>$(VCInstallDir)include;$(VCInstallDir)atlmfc\include;$(WindowsSDK_IncludePath);..\..\..\ReflectiveDLLInjection\common\;..\..\..\ReflectiveDLLInjection\dll\src\;</IncludePath>
92+
</PropertyGroup>
93+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
94+
<ClCompile>
95+
<Optimization>Disabled</Optimization>
96+
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
97+
<MinimalRebuild>true</MinimalRebuild>
98+
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
99+
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
100+
<PrecompiledHeader />
101+
<WarningLevel>Level3</WarningLevel>
102+
<DebugInformationFormat>EditAndContinue</DebugInformationFormat>
103+
</ClCompile>
104+
<Link>
105+
<GenerateDebugInformation>true</GenerateDebugInformation>
106+
<SubSystem>Windows</SubSystem>
107+
<TargetMachine>MachineX86</TargetMachine>
108+
</Link>
109+
</ItemDefinitionGroup>
110+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
111+
<Midl>
112+
<TargetEnvironment>X64</TargetEnvironment>
113+
</Midl>
114+
<ClCompile>
115+
<Optimization>Disabled</Optimization>
116+
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
117+
<MinimalRebuild>true</MinimalRebuild>
118+
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
119+
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
120+
<PrecompiledHeader />
121+
<WarningLevel>Level3</WarningLevel>
122+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
123+
</ClCompile>
124+
<Link>
125+
<GenerateDebugInformation>true</GenerateDebugInformation>
126+
<SubSystem>Windows</SubSystem>
127+
<TargetMachine>MachineX64</TargetMachine>
128+
</Link>
129+
</ItemDefinitionGroup>
130+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
131+
<ClCompile>
132+
<Optimization>MaxSpeed</Optimization>
133+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
134+
<IntrinsicFunctions>true</IntrinsicFunctions>
135+
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_X86;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
136+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
137+
<FunctionLevelLinking>true</FunctionLevelLinking>
138+
<PrecompiledHeader />
139+
<WarningLevel>Level3</WarningLevel>
140+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
141+
</ClCompile>
142+
<Link>
143+
<GenerateDebugInformation>true</GenerateDebugInformation>
144+
<SubSystem>Windows</SubSystem>
145+
<OptimizeReferences>true</OptimizeReferences>
146+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
147+
<TargetMachine>MachineX86</TargetMachine>
148+
</Link>
149+
<PostBuildEvent>
150+
<Command>
151+
IF EXIST "..\..\..\..\..\data\post\" GOTO COPY
152+
mkdir "..\..\..\..\..\data\post\"
153+
:COPY
154+
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\post\"</Command>
155+
</PostBuildEvent>
156+
</ItemDefinitionGroup>
157+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
158+
<Midl>
159+
<TargetEnvironment>X64</TargetEnvironment>
160+
</Midl>
161+
<ClCompile>
162+
<Optimization>MaxSpeed</Optimization>
163+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
164+
<IntrinsicFunctions>true</IntrinsicFunctions>
165+
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
166+
<WholeProgramOptimization>false</WholeProgramOptimization>
167+
<PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
168+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
169+
<FunctionLevelLinking>true</FunctionLevelLinking>
170+
<PrecompiledHeader />
171+
<WarningLevel>Level3</WarningLevel>
172+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
173+
<CompileAs>CompileAsCpp</CompileAs>
174+
</ClCompile>
175+
<Link>
176+
<OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
177+
<GenerateDebugInformation>true</GenerateDebugInformation>
178+
<SubSystem>Windows</SubSystem>
179+
<OptimizeReferences>true</OptimizeReferences>
180+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
181+
<TargetMachine>MachineX64</TargetMachine>
182+
</Link>
183+
<PostBuildEvent>
184+
<Command>
185+
IF EXIST "..\..\..\..\..\data\post\" GOTO COPY
186+
mkdir "..\..\..\..\..\data\post\"
187+
:COPY
188+
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\post\"</Command>
189+
</PostBuildEvent>
190+
</ItemDefinitionGroup>
191+
<ItemGroup>
192+
<ClCompile Include="src\Exploit.cpp" />
193+
<ClCompile Include="src\ReflectiveDll.c" />
194+
<ClCompile Include="..\..\..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.c" />
195+
</ItemGroup>
196+
<ItemGroup>
197+
<ClInclude Include="src\Exploit.h" />
198+
<ClInclude Include="..\..\..\ReflectiveDLLInjection\common\ReflectiveDLLInjection.h" />
199+
<ClInclude Include="..\..\..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.h" />
200+
</ItemGroup>
201+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
202+
<ImportGroup Label="ExtensionTargets">
203+
</ImportGroup>
204+
</Project>

0 commit comments

Comments
 (0)