mirror of
https://github.com/entropy-z/Kharon
synced 2026-06-06 15:34:34 +00:00
unknown
56 lines
1.7 KiB
C++
56 lines
1.7 KiB
C++
#include "../kit/kit_process_creation.cc"
|
|
|
|
extern "C" auto go( char* args, int argc ) -> void {
|
|
datap data_parser = { 0 };
|
|
|
|
BeaconDataParse( &data_parser, args, argc );
|
|
|
|
// parse bof args
|
|
auto process_method = (Create)BeaconDataInt( &data_parser );
|
|
|
|
auto process_argument = (WCHAR*)BeaconDataExtract( &data_parser, nullptr );
|
|
auto process_state = BeaconDataInt( &data_parser );
|
|
auto process_pipe = BeaconDataInt( &data_parser );
|
|
|
|
auto process_domain = (WCHAR*)BeaconDataExtract( &data_parser, nullptr );
|
|
auto process_username = (WCHAR*)BeaconDataExtract( &data_parser, nullptr );
|
|
auto process_password = (WCHAR*)BeaconDataExtract( &data_parser, nullptr );
|
|
|
|
auto process_token = (HANDLE)BeaconDataInt( &data_parser );
|
|
|
|
NTSTATUS status = STATUS_SUCCESS;
|
|
|
|
PS_CREATE_ARGS create_args = {};
|
|
PROCESS_INFORMATION ps_information = {};
|
|
|
|
create_args.method = process_method;
|
|
create_args.argument = process_argument;
|
|
create_args.pipe = process_pipe;
|
|
|
|
create_args.domain = process_domain;
|
|
create_args.username = process_username;
|
|
create_args.password = process_password;
|
|
|
|
PBYTE output_ptr = nullptr;
|
|
ULONG output_len = 0;
|
|
|
|
if ( process_state ) {
|
|
create_args.state = CREATE_SUSPENDED;
|
|
}
|
|
|
|
kh_process_creation( &create_args, &ps_information, &output_ptr, &output_len, FALSE );
|
|
|
|
if ( ps_information.dwProcessId && ps_information.dwThreadId ) {
|
|
BeaconPkgInt32( ps_information.dwProcessId );
|
|
BeaconPkgInt32( ps_information.dwThreadId );
|
|
}
|
|
|
|
if ( output_ptr && output_len ) {
|
|
BeaconPkgBytes( output_ptr, output_len );
|
|
|
|
free( output_ptr );
|
|
}
|
|
|
|
return;
|
|
}
|