Mirrors/netero1010-edrsilencer
1
0
Fork 0
mirror of https://github.com/netero1010/EDRSilencer.git synced 2026-06-08 09:05:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 1.3

Browse Source
This commit is contained in:
netero1010
2024-01-07 21:18:23 +08:00
parent fb8f4b43a9
commit 57f6bb6b24
4 changed files with 253 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
utils.c
+141 -10
View File
@@ -9,12 +9,12 @@ BOOL CheckProcessIntegrityLevel() {
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) {
printf("[-] OpenThreadToken failed with error code: 0x%x\n", GetLastError());
printf("[-] OpenThreadToken failed with error code: 0x%x.\n", GetLastError());
return FALSE;
}
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
printf("[-] OpenProcessToken failed with error code: 0x%x\n", GetLastError());
printf("[-] OpenProcessToken failed with error code: 0x%x.\n", GetLastError());
return FALSE;
}
}
@@ -22,20 +22,20 @@ BOOL CheckProcessIntegrityLevel() {
// Get the size of the integrity level information
if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLength) &&
GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
printf("[-] GetTokenInformation failed with error code: 0x%x\n", GetLastError());
printf("[-] GetTokenInformation failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(LPTR, dwLength);
if (pTIL == NULL) {
printf("[-] LocalAlloc failed with error code: 0x%x\n", GetLastError());
printf("[-] LocalAlloc failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
if (!GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLength, &dwLength)) {
printf("[-] GetTokenInformation failed with error code: 0x%x\n", GetLastError());
printf("[-] GetTokenInformation failed with error code: 0x%x.\n", GetLastError());
LocalFree(pTIL);
CloseHandle(hToken);
return FALSE;
@@ -61,18 +61,18 @@ BOOL EnableSeDebugPrivilege() {
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, TRUE, &hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) {
printf("[-] OpenThreadToken failed with error code: 0x%x\n", GetLastError());
printf("[-] OpenThreadToken failed with error code: 0x%x.\n", GetLastError());
return FALSE;
}
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
printf("[-] OpenProcessToken failed with error code: 0x%x\n", GetLastError());
printf("[-] OpenProcessToken failed with error code: 0x%x.\n", GetLastError());
return FALSE;
}
}
if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &tokenPrivileges.Privileges[0].Luid)){
printf("[-] LookupPrivilegeValueA failed with error code: 0x%x\n", GetLastError());
printf("[-] LookupPrivilegeValueA failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
@@ -81,7 +81,7 @@ BOOL EnableSeDebugPrivilege() {
tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
printf("[-] AdjustTokenPrivileges failed with error code: 0x%x\n", GetLastError());
printf("[-] AdjustTokenPrivileges failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
@@ -100,7 +100,138 @@ void CharArrayToWCharArray(const char charArray[], WCHAR wCharArray[], size_t wC
int result = MultiByteToWideChar(CP_UTF8, 0, charArray, -1, wCharArray, wCharArraySize);
if (result == 0) {
printf("[-] MultiByteToWideChar failed with error code: 0x%x\n", GetLastError());
printf("[-] MultiByteToWideChar failed with error code: 0x%x.\n", GetLastError());
wCharArray[0] = L'\0';
}
}
BOOL GetDriveName(PCWSTR filePath, wchar_t* driveName, size_t driveNameSize) {
if (!filePath) {
return FALSE;
}
const wchar_t *colon = wcschr(filePath, L':');
if (colon && (colon - filePath + 1) < driveNameSize) {
wcsncpy(driveName, filePath, colon - filePath + 1);
driveName[colon - filePath + 1] = L'\0';
return TRUE;
} else {
return FALSE;
}
}
ErrorCode ConvertToNtPath(PCWSTR filePath, wchar_t* ntPathBuffer, size_t bufferSize) {
WCHAR driveName[10];
WCHAR ntDrivePath[MAX_PATH];
if (!filePath || !ntPathBuffer) {
return CUSTOM_NULL_INPUT;
}
if (!GetDriveName(filePath, driveName, sizeof(driveName) / sizeof(WCHAR))) {
return CUSTOM_DRIVE_NAME_NOT_FOUND;
}
if (QueryDosDeviceW(driveName, ntDrivePath, sizeof(ntDrivePath) / sizeof(WCHAR)) == 0) {
return CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME;
}
swprintf(ntPathBuffer, bufferSize, L"%S%S", ntDrivePath, filePath + wcslen(driveName));
for (size_t i = 0; ntPathBuffer[i] != L'\0'; ++i) {
ntPathBuffer[i] = towlower(ntPathBuffer[i]);
}
return CUSTOM_SUCCESS;
}
BOOL FileExists(PCWSTR filePath) {
if (!filePath) {
return FALSE;
}
DWORD fileAttrib = GetFileAttributesW(filePath);
if (fileAttrib == INVALID_FILE_ATTRIBUTES) {
return FALSE;
}
return TRUE;
}
ErrorCode CustomFwpmGetAppIdFromFileName0(PCWSTR filePath, FWP_BYTE_BLOB** appId) {
if (!FileExists(filePath)) {
return CUSTOM_FILE_NOT_FOUND;
}
WCHAR ntPath[MAX_PATH];
ErrorCode errorCode = ConvertToNtPath(filePath, ntPath, sizeof(ntPath));
if (errorCode != CUSTOM_SUCCESS) {
return errorCode;
}
*appId = (FWP_BYTE_BLOB*)malloc(sizeof(FWP_BYTE_BLOB));
if (!*appId) {
return CUSTOM_MEMORY_ALLOCATION_ERROR;
}
(*appId)->size = wcslen(ntPath) * sizeof(WCHAR) + sizeof(WCHAR);
(*appId)->data = (UINT8*)malloc((*appId)->size);
if (!(*appId)->data) {
free(*appId);
return CUSTOM_MEMORY_ALLOCATION_ERROR;
}
memcpy((*appId)->data, ntPath, (*appId)->size);
return CUSTOM_SUCCESS;
}
void FreeAppId(FWP_BYTE_BLOB* appId) {
if (appId) {
if (appId->data) {
free(appId->data);
}
free(appId);
}
}
// Get provider GUID by description
BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderGUID) {
DWORD result = 0;
HANDLE hEngine = NULL;
HANDLE enumHandle = NULL;
FWPM_PROVIDER0** providers = NULL;
UINT32 numProviders = 0;
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
return FALSE;
}
result = FwpmProviderCreateEnumHandle0(hEngine, NULL, &enumHandle);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderCreateEnumHandle0 failed with error code: 0x%x.\n", result);
FwpmEngineClose0(hEngine);
return FALSE;
}
result = FwpmProviderEnum0(hEngine, enumHandle, 100, &providers, &numProviders);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderEnum0 failed with error code: 0x%x.\n", result);
FwpmEngineClose0(hEngine);
return FALSE;
}
for (UINT32 i = 0; i < numProviders; i++) {
if (providers[i]->displayData.description != NULL) {
if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) {
*outProviderGUID = providers[i]->providerKey;
return TRUE;
}
}
}
if (providers) {
FwpmFreeMemory0((void**)&providers);
}
FwpmProviderDestroyEnumHandle0(hEngine, enumHandle);
FwpmEngineClose0(hEngine);
return FALSE;
}