OJ
defc0ebe5c
This commit contains a few changes for the ppr_flatten_rec local windows exploit. First, the exploit binary itself: * Updated to use the RDI submodule. * Updated to build with VS2013. * Updated to generate a binary called `ppr_flatten_rc.x86.dll`. * Invocation of the exploit requires address of the payload to run. Second, the module in MSF behaved a little strange. I expected it to create a new session with system privs and leave the existing session alone. This wasn't the case. It used to create an instance of notepad, migrate the _existing_ session to it, and run the exploit from there. This behaviour didn't seem to be consistent with other local exploits. The changes include: * Existing session is now left alone, only used as a proxy. * New notepad instance has exploit reflectively loaded. * New notepad instance has payload directly injected. * Exploit invocation takes the payload address as a parameter. * A wait is added as the exploit is slow to run (nature of the exploit). * Payloads are executed on successful exploit.
47 lines
1.1 KiB
Batchfile
Executable File
47 lines
1.1 KiB
Batchfile
Executable File
@ECHO OFF
|
|
IF "%VCINSTALLDIR%" == "" GOTO NEED_VS
|
|
|
|
IF "%1"=="x86" GOTO BUILD_X86
|
|
IF "%1"=="X86" GOTO BUILD_X86
|
|
IF "%1"=="x64" GOTO BUILD_X64
|
|
IF "%1"=="X64" GOTO BUILD_X64
|
|
|
|
ECHO "Building Exploits x64 and x86 (Release)"
|
|
SET PLAT=all
|
|
GOTO RUN
|
|
|
|
:BUILD_X86
|
|
ECHO "Building Exploits x86 (Release)"
|
|
SET PLAT=x86
|
|
GOTO RUN
|
|
|
|
:BUILD_X64
|
|
ECHO "Building Exploits x64 (Release)"
|
|
SET PLAT=x64
|
|
GOTO RUN
|
|
|
|
:RUN
|
|
ECHO "Building CVE-2010-0232 (KiTrap0D)"
|
|
PUSHD CVE-2010-0232
|
|
msbuild.exe make.msbuild /target:%PLAT%
|
|
POPD
|
|
|
|
IF "%ERRORLEVEL%"=="0" (
|
|
ECHO "Building CVE-2013-3660 (ppr_flatten_rec)"
|
|
PUSHD CVE-2013-3660
|
|
msbuild.exe make.msbuild /target:%PLAT%
|
|
POPD
|
|
)
|
|
|
|
FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET LDT=%%j
|
|
SET LDT=%LDT:~0,4%-%LDT:~4,2%-%LDT:~6,2% %LDT:~8,2%:%LDT:~10,2%:%LDT:~12,6%
|
|
echo Finished %ldt%
|
|
|
|
GOTO :END
|
|
|
|
:NEED_VS
|
|
ECHO "This command must be executed from within a Visual Studio Command prompt."
|
|
ECHO "This can be found under Microsoft Visual Studio 2013 -> Visual Studio Tools"
|
|
|
|
:END
|