CVE-2021-21551.cpp at main - STRLCPY/CVE-2021-21551

ROOT /

CVE-2021-21551 /

CVE-2021-21551.cpp

651 lines | ISO-8859-1 | 26 KB

Blame Outline

Outline

_CRT_SECURE_NO_WARNINGS

SHELLCODE_BUILD

INTERACTIVE_PROCESS

SYNC_EVENT_NAME

SystemHandleInformation

SystemHandleInformationSize

privMap : std::map<std::string, uint64_t>

ioctl_input_params_write

padding1 : uint64_t

address : uint64_t

padding2 : uint64_t

value_to_write : uint64_t

ioctl_input_params_read

padding1 : uint64_t

what : uint64_t

padding2 : uint64_t

where : uint64_t

_SYSTEM_HANDLE_TABLE_ENTRY_INFO

UniqueProcessId : USHORT

CreatorBackTraceIndex : USHORT

ObjectTypeIndex : UCHAR

HandleAttributes : UCHAR

HandleValue : USHORT

GrantedAccess : ULONG

SYSTEM_HANDLE_TABLE_ENTRY_INFO : struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO

UniqueProcessId : USHORT

CreatorBackTraceIndex : USHORT

ObjectTypeIndex : UCHAR

HandleAttributes : UCHAR

HandleValue : USHORT

GrantedAccess : ULONG

_SYSTEM_HANDLE_INFORMATION

NumberOfHandles : ULONG

Handles : SYSTEM_HANDLE_TABLE_ENTRY_INFO[1]

SYSTEM_HANDLE_INFORMATION : struct _SYSTEM_HANDLE_INFORMATION

NumberOfHandles : ULONG

Handles : SYSTEM_HANDLE_TABLE_ENTRY_INFO[1]

DebugLog(const wchar_t*,...) {...} : void

EnablePrivilege(const wchar_t*) {...} : BOOL

CreateFakeSpoolPipe(HANDLE*,HANDLE*,wchar_t**) {...} : BOOL

TriggerPrintSpoolerRpc(wchar_t*) {...} : uint32_t

LaunchImpersonatedProcess(HANDLE,const wchar_t*,uint32_t,BOOL) {...} : BOOL

SpoolPotato() {...} : BOOL

KernelRead(HANDLE,uint64_t,uint64_t*) {...} : BOOL

KernelWrite(HANDLE,uint64_t,uint64_t) {...} : BOOL

ConvertUserToKernelAddress(HMODULE,FARPROC,UINT64) {...} : UINT64

ResolveBaseAddressFor(const wchar_t*,PUINT64) {...} : bool

exploit(int,char**) {...} : void

main(int,char**) {...} : __declspec(dllexport) void

Please wait...

Page is in error, reload to recover