1

How would you scann all sections mapped in the local memory context to find gsharedinfo?

gsharedinfo is not exported from user32.dll on Windows server 2008 !!!

I would be grateful if you could help me.

0

See https://github.com/Meatballs1/cve-2013-1300/blob/master/cve-2013-1300/exploit.c#L16 for a way to find gSharedInfo by scanning UserRegisterWowHandlers:

PSHAREDINFO LocateSharedInfo()
{
    ULONG i;
    ...
    ULONG_PTR pfnUserRegisterWowHandlers = (ULONG_PTR)GetProcAddress(GetModuleHandle("USER32.dll"), "UserRegisterWowHandlers");

    ...

    for (i = pfnUserRegisterWowHandlers; 
         i <= pfnUserRegisterWowHandlers +0x250; 
         ++i )
    {
        if (0x40c7 == *(WORD*)i && 
            0xb8 == *(BYTE*)(i + 7))
        {
            return (PSHAREDINFO)(*(DWORD*)(i + 8));
        }
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.