public static extern bool CreateProcessWithTokenW(
IntPtr hToken,
Winbase.LOGON_FLAGS dwLogonFlags,
string lpApplicationName,
string lpCommandLine,
Winbase.CREATION_FLAGS dwCreationFlags,
IntPtr lpEnvironment,
string lpCurrentDirectory,
ref Winbase._STARTUPINFO lpStartupInfo,
out Winbase._PROCESS_INFORMATION lpProcessInfo
);
public static extern Boolean CreateProcess(
String lpApplicationName,
String lpCommandLine,
ref Winbase._SECURITY_ATTRIBUTES lpProcessAttributes,
ref Winbase._SECURITY_ATTRIBUTES lpThreadAttributes,
Boolean bInheritHandles,
Winbase.CREATION_FLAGS dwCreationFlags,
IntPtr lpEnvironment,
String lpCurrentDirectory,
ref Winbase._STARTUPINFO lpStartupInfo,
out Winbase._PROCESS_INFORMATION lpProcessInformation
);
public static extern Boolean CreateProcessWithLogonW(
String lpUsername,
String lpDomain,
String lpPassword,
Winbase.LOGON_FLAGS dwLogonFlags,
String lpApplicationName,
String lpCommandLine,
Winbase.CREATION_FLAGS dwCreationFlags,
IntPtr lpEnvironment,
String lpCurrentDirectory,
ref Winbase._STARTUPINFO lpStartupInfo,
out Winbase._PROCESS_INFORMATION lpProcessInformation
);
////////////////////////////////////////////////////////////////////////////////
// Wrapper for CreateProcessWithTokenW
////////////////////////////////////////////////////////////////////////////////
public static Boolean CreateProcessWithTokenW(IntPtr phNewToken, String name, String arguments)
{
if (name.Contains(@"\"))
{
name = System.IO.Path.GetFullPath(name);
if (!System.IO.File.Exists(name))
{
Console.WriteLine("[-] File Not Found");
return(false);
}
}
else
{
name = FindFilePath(name);
if (String.Empty == name)
{
Console.WriteLine("[-] Unable to find file");
return(false);
}
}
Console.WriteLine("[*] CreateProcessWithTokenW");
Winbase._STARTUPINFO startupInfo = new Winbase._STARTUPINFO
{
cb = (UInt32)Marshal.SizeOf(typeof(Winbase._STARTUPINFO))
};
Winbase._PROCESS_INFORMATION processInformation = new Winbase._PROCESS_INFORMATION();
if (!advapi32.CreateProcessWithTokenW(
phNewToken,
Winbase.LOGON_FLAGS.LOGON_NETCREDENTIALS_ONLY,
name,
name + " " + arguments,
Winbase.CREATION_FLAGS.NONE,
IntPtr.Zero,
Environment.CurrentDirectory,
ref startupInfo,
out processInformation
))
{
Tokens.GetWin32Error("CreateProcessWithTokenW");
return(false);
}
Console.WriteLine(" [+] Created process: " + processInformation.dwProcessId);
Console.WriteLine(" [+] Created thread: " + processInformation.dwThreadId);
return(true);
}
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
public static void GetPipeToken(String pipeName, String command)
{
Console.WriteLine("[*] Creating Listener Thread");
Thread thread = new Thread(() => _GetPipeToken(pipeName));
thread.Start();
waitHandle.WaitOne();
Console.WriteLine("[*] Joining Thread");
thread.Join();
Console.WriteLine("[*] Joined Thread");
if (IntPtr.Zero != hToken)
{
Console.WriteLine("[*] CreateProcessWithLogonW");
Winbase._STARTUPINFO startupInfo = new Winbase._STARTUPINFO();
startupInfo.cb = (UInt32)Marshal.SizeOf(typeof(Winbase._STARTUPINFO));
Winbase._PROCESS_INFORMATION processInformation = new Winbase._PROCESS_INFORMATION();
if (!advapi32.CreateProcessWithLogonW(
"i", "j", "k",
Winbase.LOGON_FLAGS.LOGON_NETCREDENTIALS_ONLY,
command, command,
Winbase.CREATION_FLAGS.CREATE_DEFAULT_ERROR_MODE,
IntPtr.Zero,
Environment.CurrentDirectory,
ref startupInfo,
out processInformation
))
{
Tokens.GetWin32Error("CreateProcessWithLogonW");
}
else
{
Console.WriteLine(" [+] Created process: {0}", processInformation.dwProcessId);
Console.WriteLine(" [+] Created thread: {1}", processInformation.dwThreadId);
}
kernel32.CloseHandle(hToken);
hToken = IntPtr.Zero;
}
}
////////////////////////////////////////////////////////////////////////////////
// Default Constructor
////////////////////////////////////////////////////////////////////////////////
internal HollowProcess()
{
lpProcessInformation = new Winbase._PROCESS_INFORMATION();
}
public static extern bool CreateProcessAsUserW(IntPtr hToken, IntPtr lpApplicationName, IntPtr lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, Winbase.CREATION_FLAGS dwCreationFlags, IntPtr lpEnvironment, IntPtr lpCurrentDirectory, ref Winbase._STARTUPINFO lpStartupInfo, out Winbase._PROCESS_INFORMATION lpProcessInfo);