TeamViewer Permissions Hook V1

vendor:

TeamViewer

by:

@timse93

N/A

CVSS

N/A

Injection

CWE

Product Name: TeamViewer

Affected Version From: 13.0.5058

Affected Version To: 13.0.5058

Patch Exists: NO

Related CWE: N/A

CPE: a:teamviewer:teamviewer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2020

TeamViewer Permissions Hook V1

TeamViewer Permissions Hook V1 is a proof of concept injectable C++ DLL, that uses naked inline hooking and direct memory modification to change TeamViewer permissions. It utilizes signature/pattern scanning to dynamically locate key parts in the code at which the assembly registers hold pointers to interesting classes. Applies inline naked hooks a.k.a code caves, to hi-jack the pointers to use for modification via direct memory access to their reversed classes. It was built on Windows 10, for TeamViewer x86 Version 13.0.5058.

Mitigation:

Developed for educational purposes as a proof of concept for testing. I do not condone the or support the use of this software for unethical or illicit purposes. No responsibility is held or accepted for misuse.

Source

Exploit-DB raw data:

# TeamViewer Permissions Hook V1
---
[![License](http://img.shields.io/badge/license-MIT-green.svg)](https://github.com/gellin/TeamViewer_Permissions_Hook_V1/blob/master/LICENSE)

**A proof of concept injectable C++ DLL, that uses naked inline hooking and direct memory modification to change TeamViewer permissions.**

## Features
* **As the Server** - Enables extra menu item options on the right side pop-up menu. Most useful so far to enable the "switch sides" feature which is normally only active after you have already authenticated control with the client, and initiated a change of control/sides.
* **As the Client** - Allows for control of mouse with disregard to servers current control settings and permissions.

## Demo

#### As the Server
![](https://raw.githubusercontent.com/gellin/TeamViewer_Permissions_Hook_V1/84b3aecd8f65f138989d460740b52195f0b1e1ac/server_switch_sides.gif)

#### Client
![](https://raw.githubusercontent.com/gellin/TeamViewer_Permissions_Hook_V1/84b3aecd8f65f138989d460740b52195f0b1e1ac/client_takes_control.gif)

## Rundown
* Utilizes signature/pattern scanning to dynamically locate key parts in the code at which the assembly registers hold pointers to interesting classes. Applies inline naked hooks a.k.a code caves, to hi-jack the pointers to use for modification via direct memory access to their reversed classes.
* Inject and follow the steps

## Requirements
* Your favorite Manual Mapper, PE Loader, DLL Injector, inject into - "TeamViewer.exe"
* This version was Built on Windows 10, for TeamViewer x86 Version 13.0.5058 - (Other versions of TeamViewer have not been tested but with more robust signatures it may work, linux not supported)

## Disclaimer
* Developed for educational purposes as a proof of concept for testing. I do not condone the or support the use of this software for unethical or illicit purposes. No responsibility is held or accepted for misuse.

## Credit
[@timse93](https://github.com/timse93) - Research and Testing

## EDB-Note
Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43366.zip