sync/es3n1n-defendnot
1
0
Fork 0
mirror of https://github.com/es3n1n/defendnot.git synced 2026-08-02 10:32:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(autorun): add AS_SYSTEM_ON_BOOT autorun type

Browse Source
This commit is contained in:
es3n1n
2025-05-15 21:51:22 +09:00
parent ad032ab0d5
commit 96d0cddf8c
4 changed files with 58 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cxx-shared/shared/names.hpp
View File

@@ -7,4 +7,6 @@ namespace names {
constexpr std::string_view kVictimProcess = "Taskmgr.exe";
constexpr std::string_view kDllName = "defendnot.dll";
constexpr std::string_view kVersion = "1.0.0";
} // namespace names

26
defendnot-loader/core/autorun.cpp
View File

@@ -90,10 +90,20 @@ namespace loader {
}
} // namespace
[[nodiscard]] bool add_to_autorun() {
[[nodiscard]] bool add_to_autorun(AutorunType type) {
const auto bin_path = shared::get_this_module_path();
return with_service([bin_path](ITaskService* service, ITaskFolder* folder) -> bool {
return with_service([bin_path, type](ITaskService* service, ITaskFolder* folder) -> bool {
/// Deduce the autorun config based on type
const auto task_trigger = type == AutorunType::AS_SYSTEM_ON_BOOT ? TASK_TRIGGER_BOOT : TASK_TRIGGER_LOGON;
const auto logon_type = type == AutorunType::AS_SYSTEM_ON_BOOT ? TASK_LOGON_SERVICE_ACCOUNT : TASK_LOGON_INTERACTIVE_TOKEN;
BSTR user_id = nullptr;
auto bstr_sys = bstr_t(L"SYSTEM");
if (type == AutorunType::AS_SYSTEM_ON_BOOT) {
user_id = bstr_sys;
}
ComPtr<ITaskDefinition> task;
auto hr = service->NewTask(0, task.ref_to_ptr());
if (FAILED(hr)) {
@@ -119,7 +129,7 @@ namespace loader {
}
ComPtr<ITrigger> trigger;
hr = trigger_collection->Create(TASK_TRIGGER_LOGON, trigger.ref_to_ptr());
hr = trigger_collection->Create(task_trigger, trigger.ref_to_ptr());
if (FAILED(hr)) {
return false;
}
@@ -148,9 +158,9 @@ namespace loader {
return false;
}
/// Elevated, when any user logs in
principal->put_GroupId(bstr_t("BUILTIN\\Users"));
principal->put_LogonType(TASK_LOGON_INTERACTIVE_TOKEN);
/// Elevated, when system boots
principal->put_UserId(user_id);
principal->put_LogonType(logon_type);
principal->put_RunLevel(TASK_RUNLEVEL_HIGHEST);
/// Info
@@ -166,8 +176,8 @@ namespace loader {
/// Register the task and we are done
ComPtr<IRegisteredTask> registered_task;
hr = folder->RegisterTaskDefinition(bstr_t(kTaskName.data()), task.get(), TASK_CREATE_OR_UPDATE, VARIANT{}, VARIANT{},
TASK_LOGON_INTERACTIVE_TOKEN, variant_t(L""), registered_task.ref_to_ptr());
hr = folder->RegisterTaskDefinition(bstr_t(kTaskName.data()), task.get(), TASK_CREATE_OR_UPDATE, VARIANT{}, VARIANT{}, TASK_LOGON_NONE,
variant_t(L""), registered_task.ref_to_ptr());
return SUCCEEDED(hr);
});
}

8
defendnot-loader/core/core.hpp
View File

@@ -5,15 +5,21 @@
#include <Windows.h>
namespace loader {
enum class AutorunType : std::uint8_t {
AS_SYSTEM_ON_BOOT = 0, ///< launch on system boot as NT AUTHORITY\SYSTEM
AS_CURRENT_USER_ON_LOGIN = 1, ///< launch on user login
};
struct Config {
public:
std::string name;
bool disable;
bool verbose;
bool from_autorun;
AutorunType autorun_type;
};
[[nodiscard]] HANDLE inject(std::string_view dll_path, std::string_view proc_name);
[[nodiscard]] bool add_to_autorun();
[[nodiscard]] bool add_to_autorun(AutorunType type);
[[nodiscard]] bool remove_from_autorun();
} // namespace loader

37
defendnot-loader/main.cpp
View File

@@ -57,7 +57,7 @@ namespace {
void process_autorun(const loader::Config& config) {
if (shared::ctx.state == shared::State::ON) {
std::println("** added to autorun: {}", loader::add_to_autorun());
std::println("** added to autorun: {}", loader::add_to_autorun(config.autorun_type));
} else {
std::println("** removed from autorun: {}", loader::remove_from_autorun());
}
@@ -75,19 +75,41 @@ namespace {
} // namespace
int main(int argc, char* argv[]) try {
argparse::ArgumentParser program(std::format("{}-loader", names::kProjectName), "1.0.0");
argparse::ArgumentParser program(std::format("{}-loader", names::kProjectName), names::kVersion.data(), argparse::default_arguments::none);
const auto fatal_print = [](const std::string_view str) -> void {
shared::alloc_console();
std::cerr << str << std::endl;
system("pause");
std::exit(EXIT_FAILURE);
};
/// We are registering these ourselves because we have to alloc console first
program.add_argument("-h", "--help")
.help("prints help message and exits")
.default_value(false)
.implicit_value(true)
.action([&fatal_print, &program](const auto& /*unused*/) -> void { fatal_print(program.help().str()); });
program.add_argument("--version")
.help("shows version and exits")
.default_value(false)
.implicit_value(true)
.action([&fatal_print](const auto& /*unused*/) -> void { fatal_print(names::kVersion); });
/// defendnot-loader parameters:
program.add_argument("-n", "--name").help("av display name").default_value(std::string(names::kRepoUrl)).nargs(1);
program.add_argument("-d", "--disable").help(std::format("disable {}", names::kProjectName)).default_value(false).implicit_value(true);
program.add_argument("-v", "--verbose").help("verbose logging").default_value(false).implicit_value(true);
program.add_argument("--autorun-as-user").help("create autorun task as currently logged in user").default_value(false).implicit_value(true);
program.add_argument("--from-autorun").hidden().default_value(false).implicit_value(true);
try {
program.parse_args(argc, argv);
} catch (...) {
shared::alloc_console();
std::cerr << program;
system("pause");
} catch (std::exception& e) {
std::stringstream ss;
ss << e.what() << '\n';
ss << program.help().str();
fatal_print(ss.str());
return EXIT_FAILURE;
}
@@ -96,6 +118,9 @@ int main(int argc, char* argv[]) try {
.disable = program.get<bool>("-d"),
.verbose = program.get<bool>("-v"),
.from_autorun = program.get<bool>("--from-autorun"),
.autorun_type = program.get<bool>("--autorun-as-user") ? /// As system on boot is the default value
loader::AutorunType::AS_CURRENT_USER_ON_LOGIN :
loader::AutorunType::AS_SYSTEM_ON_BOOT,
};
setup_window(config);