Mirrors/netero1010-edrsilencer
1
0
Fork 0
mirror of https://github.com/netero1010/EDRSilencer.git synced 2026-06-11 02:11:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

checking the SID structure for TokenIntegrityLevel

Browse Source 
if the SID for TokenIntegrityLevel isn't the expected structure, GetSidSubAuthority might produce UB.
This commit is contained in:
Dani Kamanovsky
2024-11-03 15:43:31 +02:00
committed by GitHub
parent 9863ce4193
commit 73b18abe6f
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
utils.c
+9 -4
View File
@@ -41,6 +41,13 @@ BOOL CheckProcessIntegrityLevel() {
return FALSE; return FALSE;
} }
if (pTIL->Label.Sid == NULL || *GetSidSubAuthorityCount(pTIL->Label.Sid) < 1) {
printf("[-] SID structure is invalid.\n");
LocalFree(pTIL);
CloseHandle(hToken);
return FALSE;
}
dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1)); dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1));
if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID) { if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID) {
@@ -218,13 +225,11 @@ BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderG
return FALSE; return FALSE;
} }
BOOL found = FALSE;
for (UINT32 i = 0; i < numProviders; i++) { for (UINT32 i = 0; i < numProviders; i++) {
if (providers[i]->displayData.description != NULL) { if (providers[i]->displayData.description != NULL) {
if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) { if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) {
*outProviderGUID = providers[i]->providerKey; *outProviderGUID = providers[i]->providerKey;
found = TRUE; return TRUE;
break;
} }
} }
} }
@@ -235,5 +240,5 @@ BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderG
FwpmProviderDestroyEnumHandle0(hEngine, enumHandle); FwpmProviderDestroyEnumHandle0(hEngine, enumHandle);
FwpmEngineClose0(hEngine); FwpmEngineClose0(hEngine);
return found; return FALSE;
} }