Advertisement
Guest User

Untitled

a guest
Jan 5th, 2023
46
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.20 KB | None | 0 0
  1. function Enable-Privilege {
  2. param(
  3. [ValidateSet(
  4. "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
  5. "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
  6. "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
  7. "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
  8. "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
  9. "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
  10. "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
  11. "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
  12. "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
  13. "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
  14. "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
  15. $Privilege,
  16. $ProcessId = $pid,
  17. [Switch] $Disable
  18. )
  19.  
  20. $definition = @'
  21. using System;
  22. using System.Runtime.InteropServices;
  23.  
  24. public class AdjPriv
  25. {
  26. [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  27. internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
  28. ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
  29.  
  30. [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  31. internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
  32. [DllImport("advapi32.dll", SetLastError = true)]
  33. internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
  34. [StructLayout(LayoutKind.Sequential, Pack = 1)]
  35. internal struct TokPriv1Luid
  36. {
  37. public int Count;
  38. public long Luid;
  39. public int Attr;
  40. }
  41.  
  42. internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
  43. internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
  44. internal const int TOKEN_QUERY = 0x00000008;
  45. internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
  46. public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
  47. {
  48. bool retVal;
  49. TokPriv1Luid tp;
  50. IntPtr hproc = new IntPtr(processHandle);
  51. IntPtr htok = IntPtr.Zero;
  52. retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
  53. tp.Count = 1;
  54. tp.Luid = 0;
  55. if(disable)
  56. {
  57. tp.Attr = SE_PRIVILEGE_DISABLED;
  58. }
  59. else
  60. {
  61. tp.Attr = SE_PRIVILEGE_ENABLED;
  62. }
  63. retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
  64. retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
  65. return retVal;
  66. }
  67. }
  68. '@
  69.  
  70. $processHandle = (Get-Process -id $ProcessId).Handle
  71. $type = Add-Type $definition -PassThru
  72. $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
  73. }
  74.  
  75. Enable-Privilege SeTakeOwnershipPrivilege
  76.  
  77. $regKeyPath = "SYSTEM\CurrentControlSet\Services\<x>"
  78. $serviceName = "<x>"
  79. $admin = "Administrators"
  80.  
  81. $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($regKeyPath,[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::TakeOwnership)
  82. $regACL = $regKey.GetAccessControl()
  83. $regACL.SetOwner([System.Security.Principal.NTAccount]$admin)
  84. $regKey.SetAccessControl($regACL)
  85.  
  86. $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($regKeyPath,[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
  87. $regACL = $regKey.GetAccessControl()
  88. $regRule = New-Object System.Security.AccessControl.RegistryAccessRule ($admin,"FullControl","ContainerInherit","None","Allow")
  89. $regACL.SetAccessRule($regRule)
  90. $regKey.SetAccessControl($regACL)
  91.  
  92. Set-Service -Name $serviceName -Status running -StartupType automatic
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement