54 lines
1.6 KiB
C++
54 lines
1.6 KiB
C++
#pragma once
|
|
|
|
#include <windows.h>
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
struct HostInfo
|
|
{
|
|
DWORD pid = 0;
|
|
DWORD sessionId = 0;
|
|
std::wstring imagePath;
|
|
std::wstring imageName;
|
|
bool systemToken = false; // token SID is S-1-5-18
|
|
bool injectable = false; // not PPL-protected, thread/VM rights available
|
|
int score = 0; // higher = better host candidate
|
|
};
|
|
|
|
struct SpawnResult
|
|
{
|
|
bool ok = false;
|
|
DWORD pid = 0;
|
|
DWORD parentPid = 0;
|
|
DWORD sessionId = 0;
|
|
std::wstring hostImage;
|
|
std::wstring method;
|
|
std::wstring error;
|
|
};
|
|
|
|
// Enumerates processes that hold a SYSTEM token, sorted best-first.
|
|
std::vector<HostInfo> EnumerateSystemHosts();
|
|
|
|
// Same enumeration, optionally including non-SYSTEM hosts. Used for testing the
|
|
// token/parent plumbing without elevation.
|
|
std::vector<HostInfo> EnumerateHosts(bool requireSystem);
|
|
|
|
// Starts an arbitrary command as SYSTEM, with the chosen host as its parent
|
|
// process. The child carries the host's token, so the process tree reads as
|
|
// legitimate: svchost.exe -> your program.
|
|
//
|
|
// preferredImage may be empty; pass "svchost.exe" to force that host family.
|
|
// userSession = true moves the child into the active console session so a GUI
|
|
// appears on the logged-in desktop.
|
|
SpawnResult SpawnThroughHost(
|
|
const std::wstring& commandLine,
|
|
const std::wstring& preferredImage,
|
|
bool userSession,
|
|
bool requireSystem = true);
|
|
|
|
// One-line summary for command ACKs.
|
|
std::wstring FormatHostList(const std::vector<HostInfo>& hosts);
|
|
std::wstring FormatSpawnResult(const SpawnResult& r);
|
|
|