CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-07 23:14:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

test: measure fixed already-enabled debug privilege adjustment

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 11:59:26 +09:00
1 parent cd65133fc4
commit 7136dadeac
2 files changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/TokenRightProbeNative.cs
+2 -2
View File
@@ -66,10 +66,10 @@ namespace Wela.TokenRightProbe {
try {
PrimaryOnly();
if(!OpenProcessToken(GetCurrentProcess(),0x28,out token))throw new Win32Exception(Marshal.GetLastWin32Error());
if(!LookupPrivilegeValue(null,"SeChangeNotifyPrivilege",out target))throw new Win32Exception(Marshal.GetLastWin32Error());
if(!LookupPrivilegeValue(null,"SeDebugPrivilege",out target))throw new Win32Exception(Marshal.GetLastWin32Error());
result.Luid=Hex(target);result.Before=Read(token);Privilege found=null;
foreach(var item in result.Before)if(item.Luid==result.Luid)found=item;
if(found==null||(found.Attributes&2)==0||(found.Attributes&4)!=0)throw new InvalidOperationException("SeChangeNotifyPrivilege must already be present and enabled; no new privilege is granted.");
if(found==null||(found.Attributes&2)==0||(found.Attributes&4)!=0)throw new InvalidOperationException("SeDebugPrivilege must already be present and enabled; no new privilege is granted.");
result.OriginalAttributes=found.Attributes;
try {
result.DisableStartedFileTime=Now();result.AdjustmentAttempted=true;