Re: Faulty Terminal Services API in XP SP2?

From: Max Burmistrov (bugs-=do-not-spaam-pls=-bunny_at_e-mail.ru)
Date: 12/15/04 

Date: Thu, 16 Dec 2004 00:02:04 +0300

That's how it looks in CPP (the problem still the same):

#include "windows.h"
#include "stdio.h"
#include <iostream>
#include "Wtsapi32.h"

using namespace std;

int __stdcall TimerProc(DWORD a, DWORD b, DWORD c, DWORD d)
{
    DWORD SessionsCount;
    PWTS_SESSION_INFO Sessions, CSession;
    int i;

    WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, &Sessions,
&SessionsCount);

    if (Sessions != NULL)
    {
        CSession = Sessions;

        for (i = 0; i < SessionsCount; i++)
        {
            PCHAR Info;
            DWORD BytesRet;

            WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE,
CSession->SessionId, WTSUserName, &Info, &BytesRet);

            cout << '<' << BytesRet << ">\n";
            cout << "Session " << CSession->SessionId << '(' << i << ") ["
<< Info << "] ";

            if (CSession->State == WTSActive) cout << "Active"; else
            if (CSession->State == WTSListen) cout << "Listen"; else
            if (CSession->State == WTSDisconnected) cout << "Disconnected";
else
            if (CSession->State == WTSConnected) cout << "Connected"; else
                cout << CSession->State;

            cout << "\n";

            WTSFreeMemory(Info); //Here the bug occurs
            CSession++;
       }
} else
{
    i = GetLastError();
    cout << "Terminal services are not installed or faulty (" << i << ')';
}
return 0;
}

int main(int argc, char *argv[])
{
    SetTimer(0, 0, 500, (TIMERPROC)&TimerProc);

    MSG Msg;

    while (GetMessage(&Msg, 0, 0, 0))
    {
        TranslateMessage(&Msg);
        DispatchMessage(&Msg);
    }
}

Relevant Pages

  • Bypassing Personal Firewalls
    ... typedef SOCKET (int, int, int); ... typedef int (__stdcall *func_connect)(SOCKET, const struct sockaddr ... typedef HANDLE (LPCTSTR, DWORD, DWORD, ...
    (Bugtraq)
  • Bypassing Personal Firewalls
    ... typedef SOCKET (int, int, int); ... typedef int (__stdcall *func_connect)(SOCKET, const struct sockaddr ... typedef HANDLE (LPCTSTR, DWORD, DWORD, ...
    (Vuln-Dev)
  • [NT] Multiple Windows XP Kernel Vulnerability Allow User Mode Programs To Gain Kernel Privileges
    ... Kernel Privileges ... entry with a pointer to your code and execute an INT n instruction. ... DWORD NotUsed; // Never accessed by the kernel ... mov ecx,esp ...
    (Securiteam)
  • Re: Windows CE BinaryCompression
    ... Save Space Using Windows CE Built-in Compression API's ... You can use BinaryCompress and BinaryDecompress to perform buffer ... DWORD BinaryCompress(LPBYTE bufin, DWORD lenin, LPBYTE bufout, DWORD ... public static extern unsafe int BinaryCompress(byte* bufferIn, ...
    (microsoft.public.windowsce.app.development)
  • Re: Windows CE BinaryCompression
    ... Save Space Using Windows CE Built-in Compression API's ... You can use BinaryCompress and BinaryDecompress to perform buffer ... DWORD BinaryCompress(LPBYTE bufin, DWORD lenin, LPBYTE bufout, DWORD ... public static extern unsafe int BinaryCompress(byte* bufferIn, ...
    (microsoft.public.windowsce.app.development)