AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2025-07-07 00:04:57 +03:00
Code Releases Activity

Preventing the Win32 API LoadLibrary() current directory DLL injection issue.

Browse Source 
When loading the DLL file by the LoadLibrary() function in Windows VPN programs, we changed the behavior not to search the current directory. Based on this improvement, even if there are untrusted DLL files in the calendar directory, it is now safe to avoid the problem of unexpected security problem caused by the default loading behavior of Windows. Acknowledgments: This is based on a report by Herman Groeneveld, aka Sh4d0wman.
This commit is contained in:
Daiyuu Nobori
2018-04-22 18:21:19 +09:00
parent b1f74268b1
commit 241813e827
13 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/Mayaqua/Microsoft.c
View File

@ -273,6 +273,43 @@ typedef struct MS_MSCHAPV2_PARAMS
UCHAR ResponseBuffer[MAX_SIZE];
} MS_MSCHAPV2_PARAMS;
// The function which should be called once as soon as possible after the process is started
void MsInitProcessCallOnce()
{
// Mitigate the DLL injection attack
char system_dir[MAX_PATH];
char kernel32_path[MAX_PATH];
UINT len;
HINSTANCE hKernel32;
// Get the full path of kernel32.dll
memset(system_dir, 0, sizeof(system_dir));
GetSystemDirectory(system_dir, sizeof(system_dir));
len = lstrlenA(system_dir);
if (system_dir[len] == '\\')
{
system_dir[len] = 0;
}
wsprintfA(kernel32_path, "%s\\kernel32.dll", system_dir);
// Load kernel32.dll
hKernel32 = LoadLibraryA(kernel32_path);
if (hKernel32 != NULL)
{
BOOL (WINAPI *_SetDllDirectoryA)(LPCTSTR);
_SetDllDirectoryA = (BOOL (WINAPI *)(LPCTSTR))
GetProcAddress(hKernel32, "SetDllDirectoryA");
if (_SetDllDirectoryA != NULL)
{
_SetDllDirectoryA("");
}
FreeLibrary(hKernel32);
}
}
// Collect the information of the VPN software
bool MsCollectVpnInfo(BUF *bat, char *tmpdir, char *svc_name, wchar_t *config_name, wchar_t *logdir_name)
{