diff --git a/src/ProcessHandlerWin.c b/src/ProcessHandlerWin.c index 4ec69cc..ec5cd27 100644 --- a/src/ProcessHandlerWin.c +++ b/src/ProcessHandlerWin.c @@ -15,6 +15,8 @@ #include "utils/Helper.h" #include "utils/Strings.h" +//#include "utils/win/processes.h" + #define PAGE_R_W_E ((PAGE_READONLY|PAGE_READWRITE|PAGE_WRITECOPY|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)) typedef int (*MemInfoCallback)(HANDLE, MEMORY_BASIC_INFORMATION*); @@ -800,7 +802,10 @@ BOOL openProcess(HANDLE* process, uint32_t pid) { // uint32_t lpExitCode = 0; - (*process) = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); + uint32_t access = PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION; + //uint32_t access = PROCESS_ALL_ACCESS; + + (*process) = OpenProcess(access, FALSE, pid); if ((*process) == NULL) { printf("ERROR (0x%lx): OpenProcess %u failed\n", GetLastError(), pid); diff --git a/src/hexter.c b/src/hexter.c index 79cb19f..976f1c3 100644 --- a/src/hexter.c +++ b/src/hexter.c @@ -30,6 +30,7 @@ #elif defined(_WIN32) #include #include + #include "utils/win/processes.h" #include "ProcessHandlerWin.h" #endif #include "utils/Strings.h" @@ -154,10 +155,25 @@ int run(const char payload_format, const char* raw_payload) if ( pid == 0 ) pid = getpid(); -//#if defined(__linux__) || defined(__linux) || defined(linux) -// pid = getpid(); -//#elif defined(_WIN32) -//#endif + +#ifdef _WIN32 + if ( IsProcessElevated(pid) ) + { + debug_info("elevated!\n"); + PCHAR privileges[1] = { + SE_DEBUG_NAME + }; + ULONG privilegesCount = _countof(privileges); + + s = AddPrivileges(privileges, privilegesCount); + if ( s != 0 ) + { + EPrint("AddPrivileges failed! (0x%x)\n", GetLastError()); + } + debug_info("debug enabled!\n"); + } +#endif + file_size = getSizeOfProcess(pid); if ( file_size == 0 ) return -2; diff --git a/src/utils/win/processes.h b/src/utils/win/processes.h new file mode 100644 index 0000000..dd747a5 --- /dev/null +++ b/src/utils/win/processes.h @@ -0,0 +1,91 @@ +#pragma once + +typedef struct _MODULE_INFO { + PVOID Base; + ULONG Size; +} MODULE_INFO, *PMODULE_INFO; + + +/** + * + */ +INT AddPrivileges( + PCHAR *Privileges, + UINT32 PrivilegeCount +) +{ + INT s = 0; + HANDLE htoken; + ULONG i; + + TOKEN_PRIVILEGES* p = NULL; + + if ( OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &htoken) ) + { + size_t htokenSize = sizeof(TOKEN_PRIVILEGES) + (PrivilegeCount-1) * sizeof(LUID_AND_ATTRIBUTES); + p = (PTOKEN_PRIVILEGES)malloc(htokenSize); + if ( !p ) + { + s = GetLastError(); + goto clean; + } + + for ( i = 0; i < PrivilegeCount; i++ ) + { + if ( !LookupPrivilegeValueA(NULL, Privileges[i], &(p->Privileges[i].Luid)) ) + { + s = GetLastError(); + goto clean; + } + + p->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED; + } + p->PrivilegeCount = PrivilegeCount; + + if ( !AdjustTokenPrivileges(htoken, FALSE, p, (ULONG)htokenSize, NULL, NULL) + || GetLastError() != ERROR_SUCCESS ) + { + s = GetLastError(); + goto clean; + } + } + else + { + s = GetLastError(); + goto clean; + } + +clean: + if ( p ) + free(p); + + return s; +} + +BOOL IsProcessElevated() +{ + BOOL fIsElevated = FALSE; + HANDLE hToken = NULL; + TOKEN_ELEVATION elevation; + DWORD dwSize; + + if ( !OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken) ) + { + goto clean; // if Failed, we treat as False + } + + if (!GetTokenInformation(hToken, TokenElevation, &elevation, sizeof(elevation), &dwSize)) + { + goto clean;// if Failed, we treat as False + } + + fIsElevated = elevation.TokenIsElevated; + +clean: + if (hToken) + { + CloseHandle(hToken); + hToken = NULL; + } + return fIsElevated; +}