├── README.md
├── bin
├── MessageBox32.dll
└── MessageBox64.dll
└── src
├── MessageBox.sdf
├── MessageBox.sln
└── MessageBox
├── MessageBox.cpp
├── MessageBox.vcxproj
├── MessageBox.vcxproj.filters
├── dllmain.cpp
├── stdafx.cpp
├── stdafx.h
└── targetver.h
/README.md:
--------------------------------------------------------------------------------
1 | # MessageBox
2 | PoC dlls for Task Scheduler COM Hijacking
3 |
--------------------------------------------------------------------------------
/bin/MessageBox32.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/enigma0x3/MessageBox/a240ca7c609acf76a0f56a91b9d81d62ad032240/bin/MessageBox32.dll
--------------------------------------------------------------------------------
/bin/MessageBox64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/enigma0x3/MessageBox/a240ca7c609acf76a0f56a91b9d81d62ad032240/bin/MessageBox64.dll
--------------------------------------------------------------------------------
/src/MessageBox.sdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/enigma0x3/MessageBox/a240ca7c609acf76a0f56a91b9d81d62ad032240/src/MessageBox.sdf
--------------------------------------------------------------------------------
/src/MessageBox.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 2013
4 | VisualStudioVersion = 12.0.40629.0
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MessageBox", "MessageBox\MessageBox.vcxproj", "{307DDB8D-73FA-47A1-AD96-924DBBE21C4C}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Win32 = Debug|Win32
11 | Debug|x64 = Debug|x64
12 | Release|Win32 = Release|Win32
13 | Release|x64 = Release|x64
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Debug|Win32.ActiveCfg = Debug|Win32
17 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Debug|Win32.Build.0 = Debug|Win32
18 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Debug|x64.ActiveCfg = Debug|x64
19 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Debug|x64.Build.0 = Debug|x64
20 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Release|Win32.ActiveCfg = Release|Win32
21 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Release|Win32.Build.0 = Release|Win32
22 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Release|x64.ActiveCfg = Release|x64
23 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}.Release|x64.Build.0 = Release|x64
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | EndGlobal
29 |
--------------------------------------------------------------------------------
/src/MessageBox/MessageBox.cpp:
--------------------------------------------------------------------------------
1 | // MessageBox.cpp : Defines the exported functions for the DLL application.
2 | //
3 |
4 | #include "stdafx.h"
5 |
6 |
7 |
--------------------------------------------------------------------------------
/src/MessageBox/MessageBox.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Debug
10 | x64
11 |
12 |
13 | Release
14 | Win32
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | {307DDB8D-73FA-47A1-AD96-924DBBE21C4C}
23 | Win32Proj
24 | MessageBox
25 |
26 |
27 |
28 | DynamicLibrary
29 | true
30 | v120
31 | Unicode
32 |
33 |
34 | DynamicLibrary
35 | true
36 | v120
37 | Unicode
38 |
39 |
40 | DynamicLibrary
41 | false
42 | v120
43 | true
44 | Unicode
45 |
46 |
47 | DynamicLibrary
48 | false
49 | v120
50 | true
51 | Unicode
52 |
53 |
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 | true
71 |
72 |
73 | true
74 |
75 |
76 | false
77 |
78 |
79 | false
80 |
81 |
82 |
83 | Use
84 | Level3
85 | Disabled
86 | WIN32;_DEBUG;_WINDOWS;_USRDLL;MESSAGEBOX_EXPORTS;%(PreprocessorDefinitions)
87 | true
88 |
89 |
90 | Windows
91 | true
92 |
93 |
94 |
95 |
96 | Use
97 | Level3
98 | Disabled
99 | WIN32;_DEBUG;_WINDOWS;_USRDLL;MESSAGEBOX_EXPORTS;%(PreprocessorDefinitions)
100 | true
101 |
102 |
103 | Windows
104 | true
105 |
106 |
107 |
108 |
109 | Level3
110 | Use
111 | MaxSpeed
112 | true
113 | true
114 | WIN32;NDEBUG;_WINDOWS;_USRDLL;MESSAGEBOX_EXPORTS;%(PreprocessorDefinitions)
115 | true
116 |
117 |
118 | Windows
119 | true
120 | true
121 | true
122 |
123 |
124 |
125 |
126 | Level3
127 | Use
128 | MaxSpeed
129 | true
130 | true
131 | WIN32;NDEBUG;_WINDOWS;_USRDLL;MESSAGEBOX_EXPORTS;%(PreprocessorDefinitions)
132 | true
133 |
134 |
135 | Windows
136 | true
137 | true
138 | true
139 |
140 |
141 |
142 |
143 |
144 |
145 |
146 |
147 |
148 |
149 |
150 | false
151 | false
152 |
153 |
154 |
155 |
156 | false
157 | false
158 |
159 |
160 |
161 |
162 |
163 |
164 |
165 | Create
166 | Create
167 | Create
168 | Create
169 |
170 |
171 |
172 |
173 |
174 |
--------------------------------------------------------------------------------
/src/MessageBox/MessageBox.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 | Header Files
23 |
24 |
25 | Header Files
26 |
27 |
28 |
29 |
30 | Source Files
31 |
32 |
33 | Source Files
34 |
35 |
36 | Source Files
37 |
38 |
39 |
--------------------------------------------------------------------------------
/src/MessageBox/dllmain.cpp:
--------------------------------------------------------------------------------
1 | // dllmain.cpp : Defines the entry point for the DLL application.
2 | #include "stdafx.h"
3 | #include
4 |
5 | BOOL IsElevated() {
6 | BOOL fRet = FALSE;
7 | HANDLE hToken = NULL;
8 | if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
9 | TOKEN_ELEVATION Elevation;
10 | DWORD cbSize = sizeof(TOKEN_ELEVATION);
11 | if (GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &cbSize)) {
12 | fRet = Elevation.TokenIsElevated;
13 | }
14 | }
15 | if (hToken) {
16 | CloseHandle(hToken);
17 | }
18 | return fRet;
19 | }
20 |
21 | BOOL APIENTRY DllMain(HMODULE hModule,
22 | DWORD ul_reason_for_call,
23 | LPVOID lpReserved
24 | )
25 | {
26 | switch (ul_reason_for_call)
27 | {
28 | case DLL_PROCESS_ATTACH:
29 | BOOL isAdmin;
30 | isAdmin = IsElevated();
31 | if (isAdmin) {
32 | MessageBox(0, L"High Integrity!", 0, 0);
33 | break;
34 | }
35 | else {
36 | MessageBox(0, L"Not High Integrity", 0, 0);
37 | break;
38 | }
39 | case DLL_THREAD_ATTACH:
40 | case DLL_THREAD_DETACH:
41 | case DLL_PROCESS_DETACH:
42 | break;
43 | }
44 | return TRUE;
45 | }
46 |
--------------------------------------------------------------------------------
/src/MessageBox/stdafx.cpp:
--------------------------------------------------------------------------------
1 | // stdafx.cpp : source file that includes just the standard includes
2 | // MessageBox.pch will be the pre-compiled header
3 | // stdafx.obj will contain the pre-compiled type information
4 |
5 | #include "stdafx.h"
6 |
7 | // TODO: reference any additional headers you need in STDAFX.H
8 | // and not in this file
9 |
--------------------------------------------------------------------------------
/src/MessageBox/stdafx.h:
--------------------------------------------------------------------------------
1 | // stdafx.h : include file for standard system include files,
2 | // or project specific include files that are used frequently, but
3 | // are changed infrequently
4 | //
5 |
6 | #pragma once
7 |
8 | #include "targetver.h"
9 |
10 | #define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
11 | // Windows Header Files:
12 | #include
13 |
14 |
15 |
16 | // TODO: reference additional headers your program requires here
17 |
--------------------------------------------------------------------------------
/src/MessageBox/targetver.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 |
3 | // Including SDKDDKVer.h defines the highest available Windows platform.
4 |
5 | // If you wish to build your application for a previous Windows platform, include WinSDKVer.h and
6 | // set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h.
7 |
8 | #include
9 |
--------------------------------------------------------------------------------