New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for PPID spoofing #374
Conversation
@@ -407,7 +480,7 @@ DWORD request_sys_process_execute(Remote *remote, Packet *packet) | |||
|
|||
if (session_id(GetCurrentProcessId()) == session || !hWtsapi32) | |||
{ | |||
if (!CreateProcess(NULL, commandLine, NULL, NULL, inherit, createFlags, NULL, NULL, &si, &pi)) | |||
if (!CreateProcess(NULL, commandLine, NULL, NULL, inherit, createFlags, NULL, NULL, (STARTUPINFOA*)&si, &pi)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why cast this larger object to a smaller contained object rather than pass the smaller contained object in itself? To be more specific, why use this:
(STARTUPINFOA*)&si
When you're effectively passing in this:
si.StartupInfo
?
It will work because the first object in the STARTUPINFOEXA
object is a STARTUPINFOA
object, but it would seem to be better and more clear to just pass in the STARTUPINFOA
object itself? Or am I missing something?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the manually declared _STARTUPINFOEXA
extends the existing STARTUPINFOEXA
by adding LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList
since it's not available on win xp.
when i wrote the code, i thought to make explicit the fact that the struct is effectively casted down to STARTUPINFOA
, but it gets interpreted as STARTUPINFOEXA
when the flag EXTENDED_STARTUPINFO_PRESENT
is specified.
it will work in both ways, maybe si.StartupInfo
is more clear, but since the CreateProcess
function can potentially access data outside si.StartupInfo
i preferred to use an explicit cast. feel free to send a PR with the proposed change.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Apologies for the long delay...
Wow.... I did not know about the EXTENDED_STARTUPINFO_PRESENT
attribute bit. That's.... uh... certainly one way to overload a method, and I'm a little sad that's the route MS took on it. In light of that, what you have makes perfect sense, though it's necessity makes me sad.
Merge branch 'land-374' into upstream-master
Release Notes:This adds the ability to spoof parent process ID when creating a new process. |
will fix #373