mirror of
https://github.com/pathtofile/SealighterTI
synced 2026-06-06 16:34:29 +00:00
pathtofile
42 lines
2.0 KiB
C
42 lines
2.0 KiB
C
#pragma once
|
|
|
|
#include "utils.h"
|
|
#include "resource.h"
|
|
|
|
#include <versionhelpers.h>
|
|
#include <aclapi.h>
|
|
|
|
#define PPL_BINARY L"services.exe"
|
|
#define DLL_TO_HIJACK_WIN10 L"EventAggregation.dll"
|
|
//#define DLL_TO_HIJACK_WIN10 L"api-ms-win-eventing-classicprovider-l1-1-0.dll"
|
|
|
|
#define DLL_TO_HIJACK_WIN81 L"SspiCli.dll"
|
|
|
|
#ifndef STATUS_INFO_LENGTH_MISMATCH
|
|
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
|
|
#endif
|
|
|
|
extern BOOL g_bVerbose;
|
|
extern BOOL g_bDebug;
|
|
extern BOOL g_bForce;
|
|
extern HANDLE g_hEventStopTrace;
|
|
|
|
_Success_(return) BOOL StartETWLogger();
|
|
_Success_(return) BOOL CheckRequirements();
|
|
_Success_(return) BOOL WINAPI CtrlCHandler(DWORD fdwCtrlType);
|
|
_Success_(return) BOOL IsCurrentUserSystem(_Out_ PBOOL pbResult);
|
|
_Success_(return) BOOL GetHijackableDllName(_Out_ LPWSTR* ppwszDllName);
|
|
_Success_(return) BOOL GetPayloadDll(_Out_ LPVOID* ppBuffer, _Out_ PDWORD pdwSize);
|
|
_Success_(return) BOOL FindFileForTransaction(_In_ DWORD dwMinSize, _Out_ LPWSTR* ppwszFilePath);
|
|
_Success_(return) BOOL WritePayloadDllTransacted(_Out_ PHANDLE pdhFile);
|
|
_Success_(return) BOOL FindProcessTokenAndDuplicate(_In_ LPCWSTR pwszTargetSid, _Out_ PHANDLE phToken, _In_opt_ LPCWSTR pwszPrivileges[], _In_ DWORD dwPrivilegeCount);
|
|
_Success_(return) BOOL Impersonate(_In_ HANDLE hToken);
|
|
_Success_(return) BOOL ImpersonateUser(_In_ LPCWSTR pwszSid, _Out_ PHANDLE phToken, _In_opt_ LPCWSTR pwszPrivileges[], _In_ DWORD dwPrivilegeCount);
|
|
_Success_(return) BOOL ImpersonateSystem(_Out_ PHANDLE phSystemToken);
|
|
_Success_(return) BOOL ImpersonateLocalService(_Out_ PHANDLE phLocalServiceToken);
|
|
_Success_(return) BOOL CheckKnownDllSymbolicLink(_In_ LPCWSTR pwszDllName, _In_ LPWSTR pwszTarget);
|
|
_Success_(return) BOOL MapDll(_In_ LPWSTR pwszSectionName, _Out_ PHANDLE phSection);
|
|
_Success_(return) BOOL UnmapDll(_In_ HANDLE hSection);
|
|
_Success_(return) BOOL PrepareCommandLine(_In_ LPWSTR pwszRandomGuid, _Out_ LPWSTR* ppwszCommandLine);
|
|
_Success_(return) BOOL CreateProtectedProcessAsUser(_In_ HANDLE hToken, _In_ LPWSTR pwszCommandLine, _Out_ PPROCESS_INFORMATION pProcessInfo);
|