.data
;
/// Adjust some privileges for current process
;
Do not change order
szSeDebug
db "SeDebugPrivilege",0
szAdvApi
db "advapi32.dll",0
db "AdjustTokenPrivileges", 0
db "InitializeAcl",0
db "LookupPrivilegeValueA",0
db "OpenProcessToken",0
db "SetSecurityInfo",0,0
szKernel32
db "kernel32.dll",0
db "RegisterServiceProcess",0,0
dwAdjustTokenPrivileges dd 0
dwInitializeAcl dd 0
dwLookupPrivilegeValue dd 0
dwOpenProcessToken dd 0
dwSetSecurityInfo dd 0
dwRegServiceProcess dd 0
;
/// Adjust some privileges for current process
;lpSubKey
db "SOFTWARE\Adobe\",0
lpSubKey
db "SOFTWARE\Classes\*",0
lpSubKey_target
db "SOFTWARE\Classes\.3gp2\",0
phkResult dd 0
phkResult_target dd 0
.data?
pSecurityDescriptor SECURITY_DESCRIPTOR <>
buffer_addr dd ?
buffer_size dd ?
.code
; Load
dll functions
PayLoadDll proc
uses ebx esi edi szLib, dwFuncs: DWORD
INVOKE LoadLibrary, szLib
test eax, eax
jz @plg_err
mov ebx, eax
mov edi, szLib
mov esi, dwFuncs
@l:
cld
xor eax, eax
or ecx, -1
repnz scasb
cmp byte ptr[edi], 0
jz @e
INVOKE GetProcAddress, ebx, edi
.
IF !eax
ret
.ENDIF
mov dword ptr[esi], eax
add esi, 4
jmp @l
@e:
mov eax, 1
@plg_err:
ret
PayLoadDll endp
ZeroMemory proc
uses edi lpMem, Len: DWORD
cld
mov edi, lpMem
mov ecx, Len
shr ecx, 2
xor eax, eax
rep stosd
mov ecx, Len
and ecx, 3
rep stosb
ret
ZeroMemory endp
; Adjust some privileges
for current process
ProcessStartup proc
uses esi edi
LOCAL hToken: DWORD
LOCAL SeDebugNameValue: QWORD
LOCAL tkp: TOKEN_PRIVILEGES
LOCAL len: DWORD
LOCAL myACL:
ACL
; Load libraries
INVOKE PayLoadDll, offset szAdvApi, offset dwAdjustTokenPrivileges
INVOKE PayLoadDll, offset szKernel32, offset dwRegServiceProcess
; Win95/98 only
; Hide
in taskmanager
.
IF dwRegServiceProcess
push 1
INVOKE GetCurrentProcessId
push eax
call dwRegServiceProcess
.ENDIF
.
IF !dwAdjustTokenPrivileges || !dwInitializeAcl || !dwLookupPrivilegeValue || !dwOpenProcessToken || !dwSetSecurityInfo
ret
.ENDIF
;
WinNT/2k/XP only
;
Set debug status
INVOKE ZeroMemory, addr myACL, sizeof
ACL
push 2
push sizeof
ACL
lea eax, myACL
push eax
call dwInitializeAcl
INVOKE GetCurrentProcess
push eax
xchg eax, edx
push 0
lea eax, myACL
push eax
push 0
push 0
push 4
push 6
push edx
call dwSetSecurityInfo
; Adjust debug privilege
pop edx
lea eax, hToken
push eax
push TOKEN_ADJUST_PRIVILEGES
or TOKEN_QUERY
push edx
call dwOpenProcessToken
lea eax, SeDebugNameValue
push eax
push offset szSeDebug
push NULL
call dwLookupPrivilegeValue
lea esi, SeDebugNameValue
lea edi, tkp.Privileges[0].Luid
mov ecx, 8
rep movsb
mov tkp.PrivilegeCount, 1
mov tkp.Privileges[0].Attributes, SE_PRIVILEGE_ENABLED
lea eax, len
push eax
lea eax, tkp
push eax
push sizeof TOKEN_PRIVILEGES
push eax
push FALSE
push hToken
call dwAdjustTokenPrivileges
ret
ProcessStartup endp
start:
Call ProcessStartup
nop
xor eax,eax
nop
nop
push offset phkResult
push KEY_ALL_ACCESS
push 0
push offset lpSubKey
push HKEY_LOCAL_MACHINE
call RegOpenKeyEx ; EAX must zero
nop
nop
xor eax,eax
nop
nop
push SECURITY_DESCRIPTOR_MIN_LENGTH
push GPTR
call GlobalAlloc ; EAX must nonzero
nop ; EAX = (new
object handle)
nop
mov buffer_addr,eax
nop
nop
xor eax,eax
nop
nop
push SECURITY_DESCRIPTOR_REVISION
push offset buffer_addr
call InitializeSecurityDescriptor ; EAX must nonzero
nop
nop
xor eax,eax
nop
nop
push offset buffer_addr
call IsValidSecurityDescriptor ; EAX must nonzero
nop ; EAX = 00000001
nop
xor eax,eax
nop
nop
mov eax,sizeof buffer_addr
mov buffer_size,eax
nop
nop
xor eax,eax
nop
nop
push offset buffer_size
push offset buffer_addr
push DACL_SECURITY_INFORMATION
push offset phkResult
call RegGetKeySecurity
nop
nop
xor eax,eax
nop
nop
push offset buffer_addr
call IsValidSecurityDescriptor ; EAX must nonzero
nop ; EAX = 00000001
nop
xor eax,eax
nop
nop
push phkResult
call RegCloseKey
nop
nop
xor eax,eax
nop
nop
push offset phkResult_target
push KEY_ALL_ACCESS
push 0
push offset lpSubKey_target
push HKEY_LOCAL_MACHINE
call RegOpenKeyEx ; EAX must zero
nop
nop
xor eax,eax
nop
nop
push offset buffer_addr
push DACL_SECURITY_INFORMATION
push offset phkResult_target
call RegSetKeySecurity
nop
nop
xor eax,eax
nop
COMMENT *
LONG
WINAPI RegSetKeySecurity(
__in HKEY hKey,
__in SECURITY_INFORMATION SecurityInformation,
__in PSECURITY_DESCRIPTOR pSecurityDescriptor
);
*
@_CleanUp:
nop
push phkResult
call RegCloseKey
nop
nop
push offset buffer_addr
call GlobalFree
nop
@_ExitProcess:
push 0
call ExitProcess
@_Error:
push 0
push 0
push 0
push 0
Call MessageBox
jmp @_CleanUp
end start