mirror of
https://github.com/netero1010/EDRSilencer.git
synced 2026-06-08 09:05:23 +00:00
netero1010
247 lines
7.9 KiB
C
247 lines
7.9 KiB
C
#include "utils.h"
|
|
|
|
BOOL CheckProcessIntegrityLevel() {
|
|
HANDLE hToken = NULL;
|
|
DWORD dwLength = 0;
|
|
PTOKEN_MANDATORY_LABEL pTIL = NULL;
|
|
DWORD dwIntegrityLevel = 0;
|
|
BOOL isHighIntegrity = FALSE;
|
|
|
|
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken)) {
|
|
if (GetLastError() != ERROR_NO_TOKEN) {
|
|
printf("[-] OpenThreadToken failed with error code: 0x%x.\n", GetLastError());
|
|
return FALSE;
|
|
}
|
|
|
|
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
|
|
printf("[-] OpenProcessToken failed with error code: 0x%x.\n", GetLastError());
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
// Get the size of the integrity level information
|
|
if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLength) &&
|
|
GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
|
|
printf("[-] GetTokenInformation failed with error code: 0x%x.\n", GetLastError());
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(LPTR, dwLength);
|
|
if (pTIL == NULL) {
|
|
printf("[-] LocalAlloc failed with error code: 0x%x.\n", GetLastError());
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
if (!GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLength, &dwLength)) {
|
|
printf("[-] GetTokenInformation failed with error code: 0x%x.\n", GetLastError());
|
|
LocalFree(pTIL);
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
if (pTIL->Label.Sid == NULL || *GetSidSubAuthorityCount(pTIL->Label.Sid) < 1) {
|
|
printf("[-] SID structure is invalid.\n");
|
|
LocalFree(pTIL);
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1));
|
|
|
|
if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID) {
|
|
isHighIntegrity = TRUE;
|
|
} else {
|
|
printf("[-] This program requires to run in high integrity level.\n");
|
|
}
|
|
|
|
LocalFree(pTIL);
|
|
CloseHandle(hToken);
|
|
return isHighIntegrity;
|
|
}
|
|
|
|
// Enable SeDebugPrivilege to obtain full path of running processes
|
|
BOOL EnableSeDebugPrivilege() {
|
|
HANDLE hToken = NULL;
|
|
TOKEN_PRIVILEGES tokenPrivileges = {0};
|
|
|
|
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, TRUE, &hToken)) {
|
|
if (GetLastError() != ERROR_NO_TOKEN) {
|
|
printf("[-] OpenThreadToken failed with error code: 0x%x.\n", GetLastError());
|
|
return FALSE;
|
|
}
|
|
|
|
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
|
|
printf("[-] OpenProcessToken failed with error code: 0x%x.\n", GetLastError());
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &tokenPrivileges.Privileges[0].Luid)){
|
|
printf("[-] LookupPrivilegeValueA failed with error code: 0x%x.\n", GetLastError());
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
tokenPrivileges.PrivilegeCount = 1;
|
|
tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
|
|
|
if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
|
|
printf("[-] AdjustTokenPrivileges failed with error code: 0x%x.\n", GetLastError());
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) {
|
|
printf("[-] Failed to get SeDebugPrivilege. You might not be able to get the process handle of the EDR process.\n");
|
|
CloseHandle(hToken);
|
|
return FALSE;
|
|
}
|
|
|
|
CloseHandle(hToken);
|
|
return TRUE;
|
|
}
|
|
|
|
void CharArrayToWCharArray(const char charArray[], WCHAR wCharArray[], size_t wCharArraySize) {
|
|
int result = MultiByteToWideChar(CP_UTF8, 0, charArray, -1, wCharArray, wCharArraySize);
|
|
|
|
if (result == 0) {
|
|
printf("[-] MultiByteToWideChar failed with error code: 0x%x.\n", GetLastError());
|
|
wCharArray[0] = L'\0';
|
|
}
|
|
}
|
|
|
|
BOOL GetDriveName(PCWSTR filePath, wchar_t* driveName, size_t driveNameSize) {
|
|
if (!filePath) {
|
|
return FALSE;
|
|
}
|
|
const wchar_t *colon = wcschr(filePath, L':');
|
|
if (colon && (colon - filePath + 1) < driveNameSize) {
|
|
wcsncpy(driveName, filePath, colon - filePath + 1);
|
|
driveName[colon - filePath + 1] = L'\0';
|
|
return TRUE;
|
|
} else {
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
ErrorCode ConvertToNtPath(PCWSTR filePath, wchar_t* ntPathBuffer, size_t bufferSize) {
|
|
WCHAR driveName[10];
|
|
WCHAR ntDrivePath[MAX_PATH];
|
|
if (!filePath || !ntPathBuffer) {
|
|
return CUSTOM_NULL_INPUT;
|
|
}
|
|
|
|
if (!GetDriveName(filePath, driveName, sizeof(driveName) / sizeof(WCHAR))) {
|
|
return CUSTOM_DRIVE_NAME_NOT_FOUND;
|
|
}
|
|
|
|
if (QueryDosDeviceW(driveName, ntDrivePath, sizeof(ntDrivePath) / sizeof(WCHAR)) == 0) {
|
|
return CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME;
|
|
}
|
|
|
|
swprintf(ntPathBuffer, bufferSize, L"%ls%ls", ntDrivePath, filePath + wcslen(driveName));
|
|
|
|
for (size_t i = 0; ntPathBuffer[i] != L'\0'; ++i) {
|
|
ntPathBuffer[i] = towlower(ntPathBuffer[i]);
|
|
}
|
|
return CUSTOM_SUCCESS;
|
|
}
|
|
|
|
BOOL FileExists(PCWSTR filePath) {
|
|
if (!filePath) {
|
|
return FALSE;
|
|
}
|
|
|
|
DWORD fileAttrib = GetFileAttributesW(filePath);
|
|
if (fileAttrib == INVALID_FILE_ATTRIBUTES) {
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
ErrorCode CustomFwpmGetAppIdFromFileName0(PCWSTR filePath, FWP_BYTE_BLOB** appId) {
|
|
if (!FileExists(filePath)) {
|
|
return CUSTOM_FILE_NOT_FOUND;
|
|
}
|
|
|
|
WCHAR ntPath[MAX_PATH];
|
|
ErrorCode errorCode = ConvertToNtPath(filePath, ntPath, sizeof(ntPath));
|
|
if (errorCode != CUSTOM_SUCCESS) {
|
|
return errorCode;
|
|
}
|
|
*appId = (FWP_BYTE_BLOB*)malloc(sizeof(FWP_BYTE_BLOB));
|
|
if (!*appId) {
|
|
return CUSTOM_MEMORY_ALLOCATION_ERROR;
|
|
}
|
|
|
|
(*appId)->size = wcslen(ntPath) * sizeof(WCHAR) + sizeof(WCHAR);
|
|
|
|
(*appId)->data = (UINT8*)malloc((*appId)->size);
|
|
if (!(*appId)->data) {
|
|
free(*appId);
|
|
return CUSTOM_MEMORY_ALLOCATION_ERROR;
|
|
}
|
|
memcpy((*appId)->data, ntPath, (*appId)->size);
|
|
return CUSTOM_SUCCESS;
|
|
}
|
|
|
|
void FreeAppId(FWP_BYTE_BLOB* appId) {
|
|
if (appId) {
|
|
if (appId->data) {
|
|
free(appId->data);
|
|
}
|
|
free(appId);
|
|
}
|
|
}
|
|
|
|
// Get provider GUID by description
|
|
BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderGUID) {
|
|
DWORD result = 0;
|
|
HANDLE hEngine = NULL;
|
|
HANDLE enumHandle = NULL;
|
|
FWPM_PROVIDER0** providers = NULL;
|
|
UINT32 numProviders = 0;
|
|
|
|
result = FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
|
|
if (result != ERROR_SUCCESS) {
|
|
printf("[-] FwpmEngineOpen0 failed with error code: 0x%x.\n", result);
|
|
return FALSE;
|
|
}
|
|
|
|
result = FwpmProviderCreateEnumHandle0(hEngine, NULL, &enumHandle);
|
|
if (result != ERROR_SUCCESS) {
|
|
printf("[-] FwpmProviderCreateEnumHandle0 failed with error code: 0x%x.\n", result);
|
|
FwpmEngineClose0(hEngine);
|
|
return FALSE;
|
|
}
|
|
|
|
result = FwpmProviderEnum0(hEngine, enumHandle, 100, &providers, &numProviders);
|
|
if (result != ERROR_SUCCESS) {
|
|
printf("[-] FwpmProviderEnum0 failed with error code: 0x%x.\n", result);
|
|
FwpmEngineClose0(hEngine);
|
|
return FALSE;
|
|
}
|
|
|
|
BOOL found = FALSE;
|
|
for (UINT32 i = 0; i < numProviders; i++) {
|
|
if (providers[i]->displayData.description != NULL) {
|
|
if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) {
|
|
*outProviderGUID = providers[i]->providerKey;
|
|
found = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (providers) {
|
|
FwpmFreeMemory0((void**)&providers);
|
|
}
|
|
|
|
FwpmProviderDestroyEnumHandle0(hEngine, enumHandle);
|
|
FwpmEngineClose0(hEngine);
|
|
return found;
|
|
}
|