H4ck3r's boX

版权声明：转载时请以超链接形式标明文章原始出处和作者信息及本声明
http://h4ck3r.blogbus.com/logs/5175743.html

MS Windows (.ANI) GDI Remote Elevation
of Privilege Exploit (MS07-017)

Compatibility
All MS Windows 2000/XP before MS07-017 patch with IE 6 (and later ???).

References
http://www.microsoft.com/technet/security/advisory/935423.mspx
http://research.eeye.com/html/alerts/zeroday/20061106.html
http://www.milw0rm.com/exploits/3688
http://ivanlef0u.free.fr/?p=41

Used technique for this exploit (C langage) :
-> http://www.milw0rm.com/exploits/3755
The same but the code is updated :
-> http://www.labo-asso.com/download/gdi_local_elevation_privilege_exploit_ms07_017.zip

This exploit with source of payload (nasm) :
http://www.labo-asso.com/download/gdi_remote_elevation_privilege_exploit_ms07_017.zip

Study (in French) :
http://www.labo-asso.com/php/travaux/gdi_kernel_exploit.php

Patch
http://www.microsoft.com/technet/security/Bulletin/MS07-017.mspx

For educational only !

if (success) displays some kernel informations with help a MessageBox;
else alone knows...;

Coded by Lionel d'Hauenens
bugs, comments,... : http://www.labo-asso.com/ or http://www.labo-asso.com/forum
Avril 20, 2007