mirror of https://github.com/hfiref0x/UACME.git
215 lines
9.9 KiB
C
215 lines
9.9 KiB
C
/*******************************************************************************
|
|
*
|
|
* (C) COPYRIGHT AUTHORS, 2015 - 2018
|
|
*
|
|
* TITLE: CONSTS.H
|
|
*
|
|
* VERSION: 2.88
|
|
*
|
|
* DATE: 11 May 2018
|
|
*
|
|
* Global consts definition file.
|
|
*
|
|
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
|
|
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
|
|
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
|
|
* PARTICULAR PURPOSE.
|
|
*
|
|
*******************************************************************************/
|
|
#pragma once
|
|
|
|
#define AKAGI_XOR_KEY 'naka'
|
|
#define FUBUKI_EXT_ENTRYPOINT "_FubukiProc1"
|
|
#define FUBUKI_DEFAULT_ENTRYPOINT "_FubukiProc3"
|
|
|
|
#define T_WINDOWS_CURRENT_VERSION L"MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
|
|
#define T_IFEO L"MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options"
|
|
#define T_UACKEY L"MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system"
|
|
|
|
#define T_APP_PATH L"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\"
|
|
#define T_DISPLAY_CALIBRATION L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ICM\\Calibration"
|
|
#define T_DOTNET_CLIENT L"Software\\Microsoft\\Windows NT\\CurrentVersion\\KnownFunctionTableDlls"
|
|
#define T_MSC_SHELL L"Software\\Classes\\mscfile"
|
|
#define T_EXEFILE_SHELL L"Software\\Classes\\exefile"
|
|
#define T_MSSETTINGS L"Software\\Classes\\ms-settings"
|
|
#define T_SHELL_OPEN_COMMAND L"\\shell\\open\\command"
|
|
#define T_SHELL_RUNAS_COMMAND L"\\shell\\runas\\command"
|
|
|
|
#define T_FILE_PREP L"file://"
|
|
|
|
#define T_SCHTASKS_CMD L"/run /tn \"\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup\" /i"
|
|
#define T_CLSID_MYCOMPUTER_COMET L"\\Comet.{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
|
|
#define T_SDDL_ALL_FOR_EVERYONE L"D:(A;;GA;;;WD)"
|
|
#define T_PROGRAMDATA L"ProgramData"
|
|
#define T_WINDIR L"windir"
|
|
#define T_WINDOWSMEDIAPLAYER L"Windows Media Player"
|
|
|
|
#define T_ISOLATEDCOMMAND L"IsolatedCommand"
|
|
#define T_DELEGATEEXECUTE L"DelegateExecute"
|
|
|
|
#define BINARYPATH_TAG L"binarypatch01"
|
|
|
|
#define MSFT_FULL L"Microsoft Corporation"
|
|
#define MSFT_MIN L"Microsoft"
|
|
|
|
#define INAZUMA_REV L"amuzani"
|
|
|
|
#define MANIFEST_EXT L".manifest"
|
|
#define ELLOCNAK_MSU L"ellocnak.msu"
|
|
|
|
#define ACTIONQUEUE_DLL L"ActionQueue.dll"
|
|
#define COMCTL32_DLL L"comctl32.dll"
|
|
#define CRYPTBASE_DLL L"cryptbase.dll"
|
|
#define DBGCORE_DLL L"dbgcore.dll"
|
|
#define DEVOBJ_DLL L"devobj.dll"
|
|
#define DISMCORE_DLL L"dismcore.dll"
|
|
#define DUSER_DLL L"duser.dll"
|
|
#define ELSEXT_DLL L"elsext.dll"
|
|
#define FUJINAMI_DLL L"fujinami.dll"
|
|
#define GDIPLUS_DLL L"GdiPlus.dll"
|
|
#define HIBIKI_DLL L"Hibiki.dll"
|
|
#define KERNEL32_DLL L"kernel32.dll"
|
|
#define LOGPROVIDER_DLL L"LogProvider.dll"
|
|
#define MSCOREE_DLL L"MSCOREE.DLL"
|
|
#define NETUTILS_DLL L"netutils.dll"
|
|
#define NTDLL_DLL L"ntdll.dll"
|
|
#define NTWDBLIB_DLL L"ntwdblib.dll"
|
|
#define OLE32_DLL L"ole32.dll"
|
|
#define OSKSUPPORT_DLL L"OskSupport.dll"
|
|
#define POWRPROF_DLL L"powrprof.dll"
|
|
#define PROVPROVIDER_DLL L"ProvProvider.dll"
|
|
#define SHCORE_DLL L"shcore.dll"
|
|
#define SHELL32_DLL L"shell32.dll"
|
|
#define SLC_DLL L"SLC.dll"
|
|
#define UNBCL_DLL L"unbcl.dll"
|
|
#define WBEMCOMN_DLL L"wbemcomn.dll"
|
|
#define WDSCORE_DLL L"wdscore.dll"
|
|
#define WINDOWS_STORAGE_DLL L"windows.storage.dll"
|
|
#define WOW64LOG_DLL L"wow64log.dll"
|
|
#define BITLOCKERWIZARDELEV_EXE L"BitlockerWizardElev.exe"
|
|
#define CMD_EXE L"cmd.exe"
|
|
#define CLICONFG_EXE L"cliconfg.exe"
|
|
#define COMPMGMTLAUNCHER_EXE L"CompMgmtLauncher.exe"
|
|
#define COMPUTERDEFAULTS_EXE L"computerdefaults.exe"
|
|
#define CONSENT_EXE L"consent.exe"
|
|
#define CONTROL_EXE L"control.exe"
|
|
#define CREDWIZ_EXE L"credwiz.exe"
|
|
#define DCOMCNFG_EXE L"dcomcnfg.exe"
|
|
#define DCCW_EXE L"dccw.exe"
|
|
#define EVENTVWR_EXE L"eventvwr.exe"
|
|
#define EXPLORER_EXE L"explorer.exe"
|
|
#define FODHELPER_EXE L"fodhelper.exe"
|
|
#define FUBUKI_EXE L"Fubuki.exe"
|
|
#define INETMGR_EXE L"InetMgr.exe"
|
|
#define INFDEFAULTINSTALL_EXE L"InfDefaultInstall.exe"
|
|
#define ISCSICLI_EXE L"iscsicli.exe"
|
|
#define MIGWIZ_EXE L"migwiz.exe"
|
|
#define MMC_EXE L"mmc.exe"
|
|
#define OOBE_EXE L"oobe.exe"
|
|
#define SETUPSQM_EXE L"oobe\\setupsqm.exe"
|
|
#define OSK_EXE L"osk.exe"
|
|
#define PERFMON_EXE L"perfmon.exe"
|
|
#define PKGMGR_EXE L"pkgmgr.exe"
|
|
#define SCHTASKS_EXE L"schtasks.exe"
|
|
#define SDBINST_EXE L"sdbinst.exe"
|
|
#define SDCLT_EXE L"sdclt.exe"
|
|
#define SLUI_EXE L"slui.exe"
|
|
#define SYSPREP_EXE L"sysprep.exe"
|
|
#define TASKHOST_EXE L"taskhost.exe"
|
|
#define TZSYNC_EXE L"tzsync.exe"
|
|
#define WINSAT_EXE L"winsat.exe"
|
|
#define WUSA_EXE L"wusa.exe"
|
|
#define INETSRV_DIR L"inetsrv\\"
|
|
#define MIGWIZ_DIR L"migwiz\\"
|
|
#define SYSPREP_DIR L"sysprep\\"
|
|
#define SYSTEM32_DIR L"\\system32\\"
|
|
#define SYSWOW64_DIR L"\\syswow64\\"
|
|
#define WBEM_DIR L"wbem\\"
|
|
#define MANAGE_VERB L"Manage"
|
|
#define RUNAS_VERB L"runas"
|
|
#define EVENTVWR_MSC L"eventvwr.msc"
|
|
#define KAMIKAZE_MSC L"kmkze.msc"
|
|
#define RSOP_MSC L"rsop.msc"
|
|
#define PACKAGE_XML L"ellocnak.xml"
|
|
#define PACKAGE_INF L"ellocnak.inf"
|
|
|
|
#ifdef _WIN64
|
|
#define KONGOU_CD L"Kongou64.cd"
|
|
#else
|
|
#define KONGOU_CD L"Kongou32.cd"
|
|
#endif
|
|
|
|
#define MYSTERIOUSCUTETHING L"pe386"
|
|
#define SOMEOTHERNAME L"huy32"
|
|
|
|
#define T_KUREND L"KureND"
|
|
|
|
#define T_AKAGI_LINK L"\\Rpc Control\\Akagi"
|
|
|
|
#define LOCAL_SXS L".local"
|
|
#define FAKE_LOCAL_SXS L".hawawa"
|
|
#define INETMGR_SXS L"microsoft-windows-iis-managementconsole"
|
|
#define COMCTL32_SXS L"microsoft.windows.common-controls"
|
|
#define GDIPLUS_SXS L"microsoft.windows.gdiplus"
|
|
|
|
#define APPCMDLINE L"Not a security boundary! Just hack-o-rama. Keep it as is!"
|
|
#define PROGRAMTITLE L"UACMe"
|
|
#define WOW64STRING L"Wow64 detected, use x64 version of this tool."
|
|
#define WOW64WIN32ONLY L"This method only works with x86-32 Windows or from Wow64"
|
|
#define UACFIX L"This method fixed/unavailable in the current version of Windows, do you still want to continue?"
|
|
#define T_AKAGI_KEY L"Software\\Akagi"
|
|
#define T_AKAGI_PARAM L"LoveLetter"
|
|
#define T_AKAGI_FLAG L"Flag"
|
|
#define T_AKAGI_SESSION L"SessionId"
|
|
#define T_AKAGI_DESKTOP L"Desktop"
|
|
#define T_VOLATILE_ENV L"Volatile Environment"
|
|
#define T_SYSTEMROOT_VAR L"SYSTEMROOT"
|
|
#define T_REGISTRY_PREP L"\\REGISTRY\\" //end slash included
|
|
|
|
#define COR_PROFILER L"COR_PROFILER"
|
|
#define COR_PROFILER_PATH L"COR_PROFILER_PATH"
|
|
#define COR_ENABLE_PROFILING L"COR_ENABLE_PROFILING"
|
|
|
|
#define T_CALIBRATOR_VALUE L"DisplayCalibrator"
|
|
|
|
//
|
|
// COM related trash.
|
|
//
|
|
#define T_REG_SOFTWARECLASSESCLSID L"Software\\Classes\\CLSID\\"
|
|
#define T_REG_INPROCSERVER32 L"\\InProcServer32"
|
|
#define T_REG_SHELLFOLDER L"\\ShellFolder"
|
|
|
|
#define T_THREADINGMODEL L"ThreadingModel"
|
|
#define T_APARTMENT L"Apartment"
|
|
#define T_LOADWITHOUTCOM L"LoadWithoutCOM"
|
|
#define T_HIDEONDESKTOPPERUSER L"HideOnDesktopPerUser"
|
|
#define T_ATTRIBUTES L"Attributes"
|
|
#define T_ASSEMBLY L"Assembly"
|
|
#define T_CLASS L"Class"
|
|
#define T_CODEBASE L"CodeBase"
|
|
|
|
//
|
|
// COM objects elevation.
|
|
//
|
|
#define T_CLSID_ColorDataProxy L"{D2E7041B-2927-42fb-8E9F-7CE93B6DC937}"
|
|
#define T_CLSID_CMSTPLUA L"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"
|
|
#define T_CLSID_FileOperation L"{3AD05575-8857-4850-9277-11B85BDB8E09}"
|
|
#define T_CLSID_FwCplLua L"{752438CB-E941-433F-BCB4-8B7D2329F0C8}"
|
|
#define T_CLSID_ShellSecurityEditor L"{4D111E08-CBF7-4f12-A926-2C7920AF52FC}"
|
|
#define T_CLSID_UninstallStringLauncher L"{FCC74B77-EC3E-4DD8-A80B-008A702075A9}"
|
|
|
|
#define T_IID_IColorDataProxy L"{0A16D195-6F47-4964-9287-9F4BAB6D9827}"
|
|
#define T_IID_ICMLuaUtil L"{6EDD6D74-C007-4E75-B76A-E5740995E24C}"
|
|
#define T_IID_IFwCplLua L"{56DA8B35-7FC3-45DF-8768-664147864573}"
|
|
#define T_IID_ISecurityEditor L"{14B2C619-D07A-46EF-8B62-31B64F3B845C}"
|
|
#define T_IID_IARPUninstallStringLauncher L"{F885120E-3789-4FD9-865E-DC9B4A6412D2}"
|
|
|
|
//
|
|
// COM Handlers hijack.
|
|
//
|
|
#define T_CLSID_EVENTVWR_BYPASS L"{0A29FF9E-7F9C-4437-8B11-F424491E3931}"
|
|
#define T_MMCFrameworkSnapInFactory L"{D5AB5662-131D-453D-88C8-9BBA87502ADE}"
|
|
|
|
#define T_FUJINAMI_ASSEMBLY L"Fujinami, Version=0.0.0.0, Culture=neutral"
|
|
#define T_FUJINAMI_CLASS L"Fujinami.EntryPoint"
|