1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
| #include <windows.h>
#include <tlhelp32.h>
#include <cstdio>
BOOL EnableDebugPriv() {
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
return FALSE;
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)) {
CloseHandle(hToken);
return FALSE;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL)) {
CloseHandle(hToken);
}
return TRUE;
}
BOOL SelectMyParent(LPWSTR CommandLine, DWORD dwParentID) {
if (!EnableDebugPriv()) {
return FALSE;
}
SIZE_T cbAttributeListSize = 0;
InitializeProcThreadAttributeList(NULL, 1, 0, &cbAttributeListSize);
PPROC_THREAD_ATTRIBUTE_LIST pAttributeList = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, cbAttributeListSize);
if (!pAttributeList){
return FALSE;
}
if (!InitializeProcThreadAttributeList(pAttributeList, 1, 0, &cbAttributeListSize)) {
return FALSE;
}
HANDLE hParentProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwParentID);
if (!hParentProcess){
return FALSE;
}
if (!UpdateProcThreadAttribute(pAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &hParentProcess, sizeof(HANDLE), NULL, NULL)){
return FALSE;
}
PROCESS_INFORMATION pi = {0};
STARTUPINFOEXW sie = { 0 };
sie.StartupInfo.cb = sizeof(STARTUPINFOEXW);
sie.lpAttributeList = pAttributeList;
if (!CreateProcessW(NULL,
CommandLine,
NULL,
NULL,
FALSE,
EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE,
NULL,
NULL,
&sie.StartupInfo,
&pi))
{
return FALSE;
}
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
CloseHandle(hParentProcess);
DeleteProcThreadAttributeList(pAttributeList);
HeapFree(GetProcessHeap(), HEAP_NO_SERIALIZE, sie.lpAttributeList);
return TRUE;
}
BOOL CreateSystemProcess_SelectParent(LPCWSTR CommandLine) {
DWORD idL;
PROCESSENTRY32W pe = {0};
pe.dwSize = sizeof(PROCESSENTRY32W);
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (Process32FirstW(hSnapshot, &pe)) {
do {
if (0 == wcscmp(pe.szExeFile, L"lsass.exe")) {
break;
}
} while (Process32NextW(hSnapshot, &pe));
}
CloseHandle(hSnapshot);
wchar_t temp[MAX_PATH] = { 0 };
wcscpy_s(temp, CommandLine);
return SelectMyParent(temp, pe.th32ProcessID);
}
int main() {
CreateSystemProcess_SelectParent(L"C:\\Users\\ADMIN\\Desktop\\Project1.exe");
}
|
