hasherezade/hollows_hunter
1
0
Fork 0
mirror of https://github.com/hasherezade/hollows_hunter.git synced 2026-10-12 02:15:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
gh-pages
hollows_hunter/process__privilege_8cpp_source.html
T
hasherezade ae87485a2f deploy: 6b1db85cc4
2026-05-29 13:09:32 +00:00

223 lines
19 KiB
HTML
Raw Permalink Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
<head>
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=11"/>
<meta name="generator" content="Doxygen 1.17.0"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>HollowsHunter: util/process_privilege.cpp Source File</title>
<link href="tabs.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="codefolding.js"></script>
<script type="text/javascript" src="clipboard.js"></script>
<script type="text/javascript" src="cookie.js"></script>
<link href="search/search.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="search/searchdata.js"></script>
<script type="text/javascript" src="search/search.js"></script>
<script type="module">
import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';
const theme = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'default';
mermaid.initialize({ startOnLoad: true, theme: theme });
</script>
<link href="doxygen.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
<div id="titlearea">
<table cellspacing="0" cellpadding="0">
<tbody>
<tr id="projectrow">
<td id="projectlogo"><img alt="Logo" src="logo2_128.png"/></td>
<td id="projectalign">
<div id="projectname">HollowsHunter
</div>
<div id="projectbrief">Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).</div>
</td>
</tr>
</tbody>
</table>
</div>
<!-- end header part -->
<!-- Generated by Doxygen 1.17.0 -->
<script type="text/javascript">
let searchBox = new SearchBox("searchBox", "search/",'.html');
</script>
<script type="text/javascript">
document.addEventListener('DOMContentLoaded', codefold.init);
</script>
<script type="text/javascript" src="menudata.js"></script>
<script type="text/javascript" src="menu.js"></script>
<script type="text/javascript">
document.addEventListener('DOMContentLoaded', () => {
initMenu('',false);
init_search();
});
</script>
<div id="main-nav-mobile">
<div class="sm sm-dox"><input id="main-menu-state" type="checkbox"/>
<label class="main-menu-btn" for="main-menu-state">
<span class="main-menu-btn-icon"></span> Toggle main menu visibility</label>
<span id="searchBoxPos1" style="position:absolute;right:8px;top:8px;height:36px;"></span>
</div>
</div><!-- main-nav-mobile -->
<div id="main-nav">
<ul class="sm sm-dox" id="main-menu">
<li id="searchBoxPos2" style="float:right">
<div id="MSearchBox" class="MSearchBoxInactive">
<span class="left">
<span id="MSearchSelect" class="search-icon" onmouseover="return searchBox.OnSearchSelectShow()" onmouseout="return searchBox.OnSearchSelectHide()"><span class="search-icon-dropdown"></span></span>
<input type="text" id="MSearchField" value="" placeholder="Search" accesskey="S"
onfocus="searchBox.OnSearchFieldFocus(true)"
onblur="searchBox.OnSearchFieldFocus(false)"
onkeyup="searchBox.OnSearchFieldChange(event)"/>
</span><span class="right">
<a id="MSearchClose" href="javascript:searchBox.CloseResultsWindow()"><div id="MSearchCloseImg" class="close-icon"></div></a>
</span>
</div>
</li>
</ul>
</div><!-- main-nav -->
<!-- window showing the filter options -->
<div id="MSearchSelectWindow"
onmouseover="return searchBox.OnSearchSelectShow()"
onmouseout="return searchBox.OnSearchSelectHide()"
onkeydown="return searchBox.OnSearchSelectKey(event)">
</div>
<!-- iframe showing the search results (closed by default) -->
<div id="MSearchResultsWindow">
<div id="MSearchResults">
<div class="SRPage">
<div id="SRIndex">
<div id="SRResults"></div>
<div class="SRStatus" id="Loading">Loading...</div>
<div class="SRStatus" id="Searching">Searching...</div>
<div class="SRStatus" id="NoMatches">No Matches</div>
</div>
</div>
</div>
</div>
<div id="nav-path" class="navpath">
<ul>
<li class="navelem"><a href="dir_23ec12649285f9fabf3a6b7380226c28.html">util</a></li> </ul>
</div>
</div><!-- top -->
<div id="doc-content">
<div class="header">
<div class="headertitle"><div class="title">process_privilege.cpp</div></div>
</div><!--header-->
<div class="contents">
<a href="process__privilege_8cpp.html">Go to the documentation of this file.</a><div class="fragment"><div class="line"><a id="l00001" name="l00001"></a><span class="lineno"> 1</span><span class="preprocessor">#include &quot;<a class="code" href="process__privilege_8h.html">process_privilege.h</a>&quot;</span></div>
<div class="line"><a id="l00002" name="l00002"></a><span class="lineno"> 2</span> </div>
<div class="line"><a id="l00003" name="l00003"></a><span class="lineno"> 3</span><span class="preprocessor">#include &lt;iostream&gt;</span></div>
<div class="line"><a id="l00004" name="l00004"></a><span class="lineno"> 4</span> </div>
<div class="foldopen" id="foldopen00005" data-start="{" data-end="}">
<div class="line"><a id="l00005" name="l00005"></a><span class="lineno"><a class="line" href="namespacehhunter.html"> 5</a></span><span class="keyword">namespace </span><a class="code hl_namespace" href="namespacehhunter.html">hhunter</a> {</div>
<div class="foldopen" id="foldopen00006" data-start="{" data-end="}">
<div class="line"><a id="l00006" name="l00006"></a><span class="lineno"><a class="line" href="namespacehhunter_1_1util.html"> 6</a></span> <span class="keyword">namespace </span><a class="code hl_namespace" href="namespaceutil.html">util</a> {</div>
<div class="line"><a id="l00007" name="l00007"></a><span class="lineno"> 7</span> </div>
<div class="line"><a id="l00008" name="l00008"></a><span class="lineno"> 8</span> <span class="comment">/*</span></div>
<div class="line"><a id="l00009" name="l00009"></a><span class="lineno"> 9</span><span class="comment"> based on: https://support.microsoft.com/en-us/help/131065/how-to-obtain-a-handle-to-any-process-with-sedebugprivilege</span></div>
<div class="line"><a id="l00010" name="l00010"></a><span class="lineno"> 10</span><span class="comment"> */</span></div>
<div class="foldopen" id="foldopen00011" data-start="{" data-end="}">
<div class="line"><a id="l00011" name="l00011"></a><span class="lineno"><a class="line" href="namespacehhunter_1_1util.html#a0a7f83c9acd615ee401364757a03341e"> 11</a></span> BOOL <a class="code hl_function" href="namespacehhunter_1_1util.html#a0a7f83c9acd615ee401364757a03341e">set_privilege</a>(</div>
<div class="line"><a id="l00012" name="l00012"></a><span class="lineno"> 12</span> HANDLE hToken, <span class="comment">// token handle</span></div>
<div class="line"><a id="l00013" name="l00013"></a><span class="lineno"> 13</span> LPCTSTR Privilege, <span class="comment">// Privilege to enable/disable</span></div>
<div class="line"><a id="l00014" name="l00014"></a><span class="lineno"> 14</span> BOOL bEnablePrivilege <span class="comment">// TRUE to enable. FALSE to disable</span></div>
<div class="line"><a id="l00015" name="l00015"></a><span class="lineno"> 15</span> )</div>
<div class="line"><a id="l00016" name="l00016"></a><span class="lineno"> 16</span> {</div>
<div class="line"><a id="l00017" name="l00017"></a><span class="lineno"> 17</span> TOKEN_PRIVILEGES tp;</div>
<div class="line"><a id="l00018" name="l00018"></a><span class="lineno"> 18</span> LUID luid;</div>
<div class="line"><a id="l00019" name="l00019"></a><span class="lineno"> 19</span> TOKEN_PRIVILEGES tpPrevious;</div>
<div class="line"><a id="l00020" name="l00020"></a><span class="lineno"> 20</span> DWORD cbPrevious = <span class="keyword">sizeof</span>(TOKEN_PRIVILEGES);</div>
<div class="line"><a id="l00021" name="l00021"></a><span class="lineno"> 21</span> </div>
<div class="line"><a id="l00022" name="l00022"></a><span class="lineno"> 22</span> <span class="keywordflow">if</span> (!LookupPrivilegeValue(<span class="keyword">nullptr</span>, Privilege, &amp;luid)) {</div>
<div class="line"><a id="l00023" name="l00023"></a><span class="lineno"> 23</span> <span class="keywordflow">return</span> FALSE;</div>
<div class="line"><a id="l00024" name="l00024"></a><span class="lineno"> 24</span> }</div>
<div class="line"><a id="l00025" name="l00025"></a><span class="lineno"> 25</span> <span class="comment">// get current privilege</span></div>
<div class="line"><a id="l00026" name="l00026"></a><span class="lineno"> 26</span> tp.PrivilegeCount = 1;</div>
<div class="line"><a id="l00027" name="l00027"></a><span class="lineno"> 27</span> tp.Privileges[0].Luid = luid;</div>
<div class="line"><a id="l00028" name="l00028"></a><span class="lineno"> 28</span> tp.Privileges[0].Attributes = 0;</div>
<div class="line"><a id="l00029" name="l00029"></a><span class="lineno"> 29</span> </div>
<div class="line"><a id="l00030" name="l00030"></a><span class="lineno"> 30</span> AdjustTokenPrivileges(</div>
<div class="line"><a id="l00031" name="l00031"></a><span class="lineno"> 31</span> hToken,</div>
<div class="line"><a id="l00032" name="l00032"></a><span class="lineno"> 32</span> FALSE,</div>
<div class="line"><a id="l00033" name="l00033"></a><span class="lineno"> 33</span> &amp;tp,</div>
<div class="line"><a id="l00034" name="l00034"></a><span class="lineno"> 34</span> <span class="keyword">sizeof</span>(TOKEN_PRIVILEGES),</div>
<div class="line"><a id="l00035" name="l00035"></a><span class="lineno"> 35</span> &amp;tpPrevious,</div>
<div class="line"><a id="l00036" name="l00036"></a><span class="lineno"> 36</span> &amp;cbPrevious</div>
<div class="line"><a id="l00037" name="l00037"></a><span class="lineno"> 37</span> );</div>
<div class="line"><a id="l00038" name="l00038"></a><span class="lineno"> 38</span> </div>
<div class="line"><a id="l00039" name="l00039"></a><span class="lineno"> 39</span> <span class="keywordflow">if</span> (GetLastError() != ERROR_SUCCESS) {</div>
<div class="line"><a id="l00040" name="l00040"></a><span class="lineno"> 40</span> <span class="keywordflow">return</span> FALSE;</div>
<div class="line"><a id="l00041" name="l00041"></a><span class="lineno"> 41</span> }</div>
<div class="line"><a id="l00042" name="l00042"></a><span class="lineno"> 42</span> <span class="comment">// set privilege based on previous setting</span></div>
<div class="line"><a id="l00043" name="l00043"></a><span class="lineno"> 43</span> tpPrevious.PrivilegeCount = 1;</div>
<div class="line"><a id="l00044" name="l00044"></a><span class="lineno"> 44</span> tpPrevious.Privileges[0].Luid = luid;</div>
<div class="line"><a id="l00045" name="l00045"></a><span class="lineno"> 45</span> </div>
<div class="line"><a id="l00046" name="l00046"></a><span class="lineno"> 46</span> <span class="keywordflow">if</span> (bEnablePrivilege) {</div>
<div class="line"><a id="l00047" name="l00047"></a><span class="lineno"> 47</span> tpPrevious.Privileges[0].Attributes |= (SE_PRIVILEGE_ENABLED);</div>
<div class="line"><a id="l00048" name="l00048"></a><span class="lineno"> 48</span> }</div>
<div class="line"><a id="l00049" name="l00049"></a><span class="lineno"> 49</span> <span class="keywordflow">else</span> {</div>
<div class="line"><a id="l00050" name="l00050"></a><span class="lineno"> 50</span> tpPrevious.Privileges[0].Attributes ^= (SE_PRIVILEGE_ENABLED &amp; tpPrevious.Privileges[0].Attributes);</div>
<div class="line"><a id="l00051" name="l00051"></a><span class="lineno"> 51</span> }</div>
<div class="line"><a id="l00052" name="l00052"></a><span class="lineno"> 52</span> </div>
<div class="line"><a id="l00053" name="l00053"></a><span class="lineno"> 53</span> AdjustTokenPrivileges(</div>
<div class="line"><a id="l00054" name="l00054"></a><span class="lineno"> 54</span> hToken,</div>
<div class="line"><a id="l00055" name="l00055"></a><span class="lineno"> 55</span> FALSE,</div>
<div class="line"><a id="l00056" name="l00056"></a><span class="lineno"> 56</span> &amp;tpPrevious,</div>
<div class="line"><a id="l00057" name="l00057"></a><span class="lineno"> 57</span> cbPrevious,</div>
<div class="line"><a id="l00058" name="l00058"></a><span class="lineno"> 58</span> NULL,</div>
<div class="line"><a id="l00059" name="l00059"></a><span class="lineno"> 59</span> NULL</div>
<div class="line"><a id="l00060" name="l00060"></a><span class="lineno"> 60</span> );</div>
<div class="line"><a id="l00061" name="l00061"></a><span class="lineno"> 61</span> </div>
<div class="line"><a id="l00062" name="l00062"></a><span class="lineno"> 62</span> <span class="keywordflow">if</span> (GetLastError() != ERROR_SUCCESS) {</div>
<div class="line"><a id="l00063" name="l00063"></a><span class="lineno"> 63</span> <span class="keywordflow">return</span> FALSE;</div>
<div class="line"><a id="l00064" name="l00064"></a><span class="lineno"> 64</span> }</div>
<div class="line"><a id="l00065" name="l00065"></a><span class="lineno"> 65</span> <span class="keywordflow">return</span> TRUE;</div>
<div class="line"><a id="l00066" name="l00066"></a><span class="lineno"> 66</span> }</div>
</div>
<div class="line"><a id="l00067" name="l00067"></a><span class="lineno"> 67</span> </div>
<div class="line"><a id="l00068" name="l00068"></a><span class="lineno"> 68</span> };</div>
</div>
<div class="line"><a id="l00069" name="l00069"></a><span class="lineno"> 69</span>};</div>
</div>
<div class="line"><a id="l00070" name="l00070"></a><span class="lineno"> 70</span> </div>
<div class="foldopen" id="foldopen00071" data-start="{" data-end="}">
<div class="line"><a id="l00071" name="l00071"></a><span class="lineno"><a class="line" href="namespacehhunter_1_1util.html#a71c3879cac544c11cb2391e6c030c347"> 71</a></span><span class="keywordtype">bool</span> <a class="code hl_function" href="namespacehhunter_1_1util.html#a71c3879cac544c11cb2391e6c030c347">hhunter::util::set_debug_privilege</a>()</div>
<div class="line"><a id="l00072" name="l00072"></a><span class="lineno"> 72</span>{</div>
<div class="line"><a id="l00073" name="l00073"></a><span class="lineno"> 73</span> HANDLE hToken;</div>
<div class="line"><a id="l00074" name="l00074"></a><span class="lineno"> 74</span> <span class="keywordflow">if</span> (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &amp;hToken)) {</div>
<div class="line"><a id="l00075" name="l00075"></a><span class="lineno"> 75</span> <span class="keywordflow">if</span> (GetLastError() == ERROR_NO_TOKEN) {</div>
<div class="line"><a id="l00076" name="l00076"></a><span class="lineno"> 76</span> <span class="keywordflow">if</span> (!ImpersonateSelf(SecurityImpersonation)) <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
<div class="line"><a id="l00077" name="l00077"></a><span class="lineno"> 77</span> <span class="keywordflow">if</span>(!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &amp;hToken)){</div>
<div class="line"><a id="l00078" name="l00078"></a><span class="lineno"> 78</span> std::cerr &lt;&lt; <span class="stringliteral">&quot;Error: cannot open the token&quot;</span> &lt;&lt; std::endl;</div>
<div class="line"><a id="l00079" name="l00079"></a><span class="lineno"> 79</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
<div class="line"><a id="l00080" name="l00080"></a><span class="lineno"> 80</span> }</div>
<div class="line"><a id="l00081" name="l00081"></a><span class="lineno"> 81</span> }</div>
<div class="line"><a id="l00082" name="l00082"></a><span class="lineno"> 82</span> }</div>
<div class="line"><a id="l00083" name="l00083"></a><span class="lineno"> 83</span> <span class="keywordtype">bool</span> is_ok = <span class="keyword">false</span>;</div>
<div class="line"><a id="l00084" name="l00084"></a><span class="lineno"> 84</span> <span class="comment">// enable SeDebugPrivilege</span></div>
<div class="line"><a id="l00085" name="l00085"></a><span class="lineno"> 85</span> <span class="keywordflow">if</span> (<a class="code hl_function" href="namespacehhunter_1_1util.html#a0a7f83c9acd615ee401364757a03341e">set_privilege</a>(hToken, SE_DEBUG_NAME, TRUE)) {</div>
<div class="line"><a id="l00086" name="l00086"></a><span class="lineno"> 86</span> is_ok = <span class="keyword">true</span>;</div>
<div class="line"><a id="l00087" name="l00087"></a><span class="lineno"> 87</span> }</div>
<div class="line"><a id="l00088" name="l00088"></a><span class="lineno"> 88</span> <span class="comment">// close token handle</span></div>
<div class="line"><a id="l00089" name="l00089"></a><span class="lineno"> 89</span> CloseHandle(hToken);</div>
<div class="line"><a id="l00090" name="l00090"></a><span class="lineno"> 90</span> <span class="keywordflow">return</span> is_ok;</div>
<div class="line"><a id="l00091" name="l00091"></a><span class="lineno"> 91</span>}</div>
</div>
<div class="line"><a id="l00092" name="l00092"></a><span class="lineno"> 92</span> </div>
<div class="ttc" id="anamespacehhunter_1_1util_html_a0a7f83c9acd615ee401364757a03341e"><div class="ttname"><a href="namespacehhunter_1_1util.html#a0a7f83c9acd615ee401364757a03341e">hhunter::util::set_privilege</a></div><div class="ttdeci">BOOL set_privilege(HANDLE hToken, LPCTSTR Privilege, BOOL bEnablePrivilege)</div><div class="ttdef"><b>Definition</b> <a href="#l00011">process_privilege.cpp:11</a></div></div>
<div class="ttc" id="anamespacehhunter_1_1util_html_a71c3879cac544c11cb2391e6c030c347"><div class="ttname"><a href="namespacehhunter_1_1util.html#a71c3879cac544c11cb2391e6c030c347">hhunter::util::set_debug_privilege</a></div><div class="ttdeci">bool set_debug_privilege()</div><div class="ttdef"><b>Definition</b> <a href="#l00071">process_privilege.cpp:71</a></div></div>
<div class="ttc" id="anamespacehhunter_html"><div class="ttname"><a href="namespacehhunter.html">hhunter</a></div><div class="ttdef"><b>Definition</b> <a href="#l00005">process_privilege.cpp:5</a></div></div>
<div class="ttc" id="anamespaceutil_html"><div class="ttname"><a href="namespaceutil.html">util</a></div><div class="ttdef"><b>Definition</b> <a href="etw__settings_8cpp_source.html#l00014">etw_settings.cpp:14</a></div></div>
<div class="ttc" id="aprocess__privilege_8h_html"><div class="ttname"><a href="process__privilege_8h.html">process_privilege.h</a></div></div>
</div><!-- fragment --></div><!-- contents -->
<!-- start footer part -->
<hr class="footer"/><address class="footer"><small>
Generated by&#160;<a href="https://www.doxygen.org/index.html"><img class="footer" src="doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.17.0
</small></address>
</div><!-- doc-content -->
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink