Skip to content

Commit 4742918

Browse files
AscotbeAscotbe
committed
Add 3 vulnerabilities details and fix documents:egg:
1 parent 284443a commit 4742918

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+6009
-1
lines changed

‎CVE-2020-1066/CVE-2020-1066.exe

741 KB
Binary file not shown.

‎CVE-2020-1066/CommonUtils/CommonUtils.cpp

+176
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
// Copyright 2015 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http ://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#include "stdafx.h"
16+
#include "CommonUtils.h"
17+
#include <strsafe.h>
18+
#include "ntimports.h"
19+
20+
void __stdcall my_puts(const char* str)
21+
{
22+
fwrite(str, 1, strlen(str), stdout);
23+
}
24+
25+
static console_output _pout = my_puts;
26+
27+
void DebugSetOutput(console_output pout)
28+
{
29+
_pout = pout;
30+
}
31+
32+
void DebugPrintf(const char* lpFormat, ...)
33+
{
34+
CHAR buf[1024];
35+
va_list va;
36+
37+
va_start(va, lpFormat);
38+
39+
StringCbVPrintfA(buf, sizeof(buf), lpFormat, va);
40+
41+
_pout(buf);
42+
}
43+
44+
std::wstring GetErrorMessage(DWORD dwError)
45+
{
46+
LPWSTR pBuffer = NULL;
47+
48+
DWORD dwSize = FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS |
49+
FORMAT_MESSAGE_ALLOCATE_BUFFER, 0, dwError, 0, (LPWSTR)&pBuffer, 32 * 1024, nullptr);
50+
51+
if (dwSize > 0)
52+
{
53+
std::wstring ret = pBuffer;
54+
55+
LocalFree(pBuffer);
56+
57+
return ret;
58+
}
59+
else
60+
{
61+
printf("Error getting message %d\n", GetLastError());
62+
WCHAR buf[64];
63+
StringCchPrintf(buf, _countof(buf), L"%d", dwError);
64+
return buf;
65+
}
66+
}
67+
68+
std::wstring GetErrorMessage()
69+
{
70+
return GetErrorMessage(GetLastError());
71+
}
72+
73+
74+
BOOL SetPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege)
75+
{
76+
TOKEN_PRIVILEGES tp;
77+
LUID luid;
78+
79+
if (!LookupPrivilegeValue(NULL, lpszPrivilege, &luid))
80+
{
81+
return FALSE;
82+
}
83+
84+
tp.PrivilegeCount = 1;
85+
tp.Privileges[0].Luid = luid;
86+
if (bEnablePrivilege)
87+
{
88+
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
89+
}
90+
else
91+
{
92+
tp.Privileges[0].Attributes = 0;
93+
}
94+
95+
if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL))
96+
{
97+
return FALSE;
98+
}
99+
100+
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
101+
{
102+
return FALSE;
103+
}
104+
105+
return TRUE;
106+
}
107+
108+
DWORD NtStatusToDosError(NTSTATUS status)
109+
{
110+
DEFINE_NTDLL(RtlNtStatusToDosError);
111+
return fRtlNtStatusToDosError(status);
112+
}
113+
114+
void SetNtLastError(NTSTATUS status)
115+
{
116+
SetLastError(NtStatusToDosError(status));
117+
}
118+
119+
FARPROC GetProcAddressNT(LPCSTR lpName)
120+
{
121+
return GetProcAddress(GetModuleHandleW(L"ntdll"), lpName);
122+
}
123+
124+
HANDLE OpenFileNative(LPCWSTR path, HANDLE root, ACCESS_MASK desired_access, ULONG share_access, ULONG open_options)
125+
{
126+
UNICODE_STRING name = { 0 };
127+
OBJECT_ATTRIBUTES obj_attr = { 0 };
128+
129+
DEFINE_NTDLL(RtlInitUnicodeString);
130+
DEFINE_NTDLL(NtOpenFile);
131+
132+
if (path)
133+
{
134+
fRtlInitUnicodeString(&name, path);
135+
InitializeObjectAttributes(&obj_attr, &name, OBJ_CASE_INSENSITIVE, root, nullptr);
136+
}
137+
else
138+
{
139+
InitializeObjectAttributes(&obj_attr, nullptr, OBJ_CASE_INSENSITIVE, root, nullptr);
140+
}
141+
142+
HANDLE h = nullptr;
143+
IO_STATUS_BLOCK io_status = { 0 };
144+
NTSTATUS status = fNtOpenFile(&h, desired_access, &obj_attr, &io_status, share_access, open_options);
145+
if (NT_SUCCESS(status))
146+
{
147+
return h;
148+
}
149+
else
150+
{
151+
SetNtLastError(status);
152+
return nullptr;
153+
}
154+
}
155+
156+
std::wstring BuildFullPath(const std::wstring& path, bool native)
157+
{
158+
std::wstring ret;
159+
WCHAR buf[MAX_PATH];
160+
161+
if (native)
162+
{
163+
ret = L"\\??\\";
164+
}
165+
166+
if (GetFullPathName(path.c_str(), MAX_PATH, buf, nullptr) > 0)
167+
{
168+
ret += buf;
169+
}
170+
else
171+
{
172+
ret += path;
173+
}
174+
175+
return ret;
176+
}

‎CVE-2020-1066/CommonUtils/CommonUtils.h

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#pragma once
2+
3+
#include <Windows.h>
4+
#include <string>
5+
6+
typedef void(__stdcall *console_output)(const char*);
7+
8+
void DebugSetOutput(console_output pout);
9+
void DebugPrintf(const char* lpFormat, ...);
10+
HANDLE CreateSymlink(HANDLE root, LPCWSTR linkname, LPCWSTR targetname);
11+
HANDLE OpenSymlink(HANDLE root, LPCWSTR linkname);
12+
HANDLE CreateObjectDirectory(HANDLE hRoot, LPCWSTR dirname, HANDLE hShadow);
13+
HANDLE OpenObjectDirectory(HANDLE hRoot, LPCWSTR dirname);
14+
std::wstring GetErrorMessage(DWORD dwError);
15+
std::wstring GetErrorMessage();
16+
BOOL SetPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege);
17+
bool CreateRegSymlink(LPCWSTR lpSymlink, LPCWSTR lpTarget, bool bVolatile);
18+
bool DeleteRegSymlink(LPCWSTR lpSymlink);
19+
DWORD NtStatusToDosError(NTSTATUS status);
20+
bool CreateNativeHardlink(LPCWSTR linkname, LPCWSTR targetname);
21+
HANDLE OpenFileNative(LPCWSTR path, HANDLE root, ACCESS_MASK desired_access, ULONG share_access, ULONG open_options);
22+
std::wstring BuildFullPath(const std::wstring& path, bool native);

‎CVE-2020-1066/CommonUtils/CommonUtils.vcxproj

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
</ItemGroup>
13+
<PropertyGroup Label="Globals">
14+
<ProjectGuid>{2AA6AB5E-18A8-49F4-B25D-587E8C3E4432}</ProjectGuid>
15+
<Keyword>Win32Proj</Keyword>
16+
<RootNamespace>CommonUtils</RootNamespace>
17+
</PropertyGroup>
18+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
19+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
20+
<ConfigurationType>StaticLibrary</ConfigurationType>
21+
<UseDebugLibraries>true</UseDebugLibraries>
22+
<PlatformToolset>v120</PlatformToolset>
23+
<CharacterSet>Unicode</CharacterSet>
24+
<UseOfMfc>Static</UseOfMfc>
25+
</PropertyGroup>
26+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
27+
<ConfigurationType>StaticLibrary</ConfigurationType>
28+
<UseDebugLibraries>false</UseDebugLibraries>
29+
<PlatformToolset>v140</PlatformToolset>
30+
<WholeProgramOptimization>true</WholeProgramOptimization>
31+
<CharacterSet>Unicode</CharacterSet>
32+
</PropertyGroup>
33+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
34+
<ImportGroup Label="ExtensionSettings">
35+
</ImportGroup>
36+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
37+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
38+
</ImportGroup>
39+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
40+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
41+
</ImportGroup>
42+
<PropertyGroup Label="UserMacros" />
43+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
44+
<OutDir>$(SolutionDir)Build\</OutDir>
45+
</PropertyGroup>
46+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
47+
<ClCompile>
48+
<PrecompiledHeader>Use</PrecompiledHeader>
49+
<WarningLevel>Level3</WarningLevel>
50+
<Optimization>Disabled</Optimization>
51+
<PreprocessorDefinitions>WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
52+
<SDLCheck>true</SDLCheck>
53+
</ClCompile>
54+
<Link>
55+
<SubSystem>Windows</SubSystem>
56+
<GenerateDebugInformation>true</GenerateDebugInformation>
57+
</Link>
58+
</ItemDefinitionGroup>
59+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
60+
<ClCompile>
61+
<WarningLevel>Level3</WarningLevel>
62+
<PrecompiledHeader>Use</PrecompiledHeader>
63+
<Optimization>MaxSpeed</Optimization>
64+
<FunctionLevelLinking>true</FunctionLevelLinking>
65+
<IntrinsicFunctions>true</IntrinsicFunctions>
66+
<PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
67+
<SDLCheck>true</SDLCheck>
68+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
69+
</ClCompile>
70+
<Link>
71+
<SubSystem>Windows</SubSystem>
72+
<GenerateDebugInformation>true</GenerateDebugInformation>
73+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
74+
<OptimizeReferences>true</OptimizeReferences>
75+
</Link>
76+
</ItemDefinitionGroup>
77+
<ItemGroup>
78+
<ClInclude Include="CommonUtils.h" />
79+
<ClInclude Include="FileOpLock.h" />
80+
<ClInclude Include="FileSymlink.h" />
81+
<ClInclude Include="ntimports.h" />
82+
<ClInclude Include="ReparsePoint.h" />
83+
<ClInclude Include="ScopedHandle.h" />
84+
<ClInclude Include="stdafx.h" />
85+
<ClInclude Include="targetver.h" />
86+
<ClInclude Include="typed_buffer.h" />
87+
</ItemGroup>
88+
<ItemGroup>
89+
<ClCompile Include="CommonUtils.cpp" />
90+
<ClCompile Include="DirectoryObject.cpp" />
91+
<ClCompile Include="FileOpLock.cpp" />
92+
<ClCompile Include="FileSymlink.cpp" />
93+
<ClCompile Include="Hardlink.cpp" />
94+
<ClCompile Include="NativeSymlink.cpp" />
95+
<ClCompile Include="RegistrySymlink.cpp" />
96+
<ClCompile Include="ReparsePoint.cpp" />
97+
<ClCompile Include="ScopedHandle.cpp" />
98+
<ClCompile Include="stdafx.cpp">
99+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
100+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
101+
</ClCompile>
102+
</ItemGroup>
103+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
104+
<ImportGroup Label="ExtensionTargets">
105+
</ImportGroup>
106+
</Project>

‎CVE-2020-1066/CommonUtils/CommonUtils.vcxproj.filters

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClInclude Include="stdafx.h">
19+
<Filter>Header Files</Filter>
20+
</ClInclude>
21+
<ClInclude Include="targetver.h">
22+
<Filter>Header Files</Filter>
23+
</ClInclude>
24+
<ClInclude Include="FileOpLock.h">
25+
<Filter>Header Files</Filter>
26+
</ClInclude>
27+
<ClInclude Include="CommonUtils.h">
28+
<Filter>Header Files</Filter>
29+
</ClInclude>
30+
<ClInclude Include="FileSymlink.h">
31+
<Filter>Header Files</Filter>
32+
</ClInclude>
33+
<ClInclude Include="ScopedHandle.h">
34+
<Filter>Header Files</Filter>
35+
</ClInclude>
36+
<ClInclude Include="ReparsePoint.h">
37+
<Filter>Header Files</Filter>
38+
</ClInclude>
39+
<ClInclude Include="typed_buffer.h">
40+
<Filter>Header Files</Filter>
41+
</ClInclude>
42+
<ClInclude Include="ntimports.h">
43+
<Filter>Header Files</Filter>
44+
</ClInclude>
45+
</ItemGroup>
46+
<ItemGroup>
47+
<ClCompile Include="stdafx.cpp">
48+
<Filter>Source Files</Filter>
49+
</ClCompile>
50+
<ClCompile Include="FileOpLock.cpp">
51+
<Filter>Source Files</Filter>
52+
</ClCompile>
53+
<ClCompile Include="NativeSymlink.cpp">
54+
<Filter>Source Files</Filter>
55+
</ClCompile>
56+
<ClCompile Include="CommonUtils.cpp">
57+
<Filter>Source Files</Filter>
58+
</ClCompile>
59+
<ClCompile Include="FileSymlink.cpp">
60+
<Filter>Source Files</Filter>
61+
</ClCompile>
62+
<ClCompile Include="ScopedHandle.cpp">
63+
<Filter>Source Files</Filter>
64+
</ClCompile>
65+
<ClCompile Include="ReparsePoint.cpp">
66+
<Filter>Source Files</Filter>
67+
</ClCompile>
68+
<ClCompile Include="DirectoryObject.cpp">
69+
<Filter>Source Files</Filter>
70+
</ClCompile>
71+
<ClCompile Include="RegistrySymlink.cpp">
72+
<Filter>Source Files</Filter>
73+
</ClCompile>
74+
<ClCompile Include="Hardlink.cpp">
75+
<Filter>Source Files</Filter>
76+
</ClCompile>
77+
</ItemGroup>
78+
</Project>

0 commit comments

Comments
 (0)