1

How would you scann all sections mapped in the local memory context to find gsharedinfo?

gsharedinfo is not exported from user32.dll on Windows server 2008 !!!

I would be grateful if you could help me.

1 Answer 1

0

See https://github.com/Meatballs1/cve-2013-1300/blob/master/cve-2013-1300/exploit.c#L16 for a way to find gSharedInfo by scanning UserRegisterWowHandlers:

PSHAREDINFO LocateSharedInfo()
{
    ULONG i;
    ...
    ULONG_PTR pfnUserRegisterWowHandlers = (ULONG_PTR)GetProcAddress(GetModuleHandle("USER32.dll"), "UserRegisterWowHandlers");

    ...

    for (i = pfnUserRegisterWowHandlers; 
         i <= pfnUserRegisterWowHandlers +0x250; 
         ++i )
    {
        if (0x40c7 == *(WORD*)i && 
            0xb8 == *(BYTE*)(i + 7))
        {
            return (PSHAREDINFO)(*(DWORD*)(i + 8));
        }
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.