itm4n / usodllloader

Windows - Weaponizing privileged file writes with the Update Session Orchestrator service

itm4n

I'm an offensive security consultant with a leaning towards Windows security research. I document my work on my personal blog itm4n.github.io and publish my PoCs and tools here on GitHub.

usodllloader's Issues

release version please

hello @itm4n , can you please produce the release version which has been already compile ?
coz of I'm not able to compile it.

CLSID_UpdateSessionOrchestrator is same?

The CLSID_UpdateSessionOrchestrator is same in different system? For example win10 , server2008 and win7.

Wrong Parameter error

Hi,

at first -> good work for this! 👍

I just tried getting a system shell using your binary, but i always get the following error by executing the loader.exe:

[*] Using UpdateOrchestrator->StartScan()
    |__ Creating instance of 'UpdateSessionOrchestrator'... Done.
    |__ Creating a new Update Session... Done.

    |__ Something went wrong (80070057 - "Wrong Parameter.").

I checked that not one of the following conditions is met:

• One or several updates are waiting to be installed.

• Updates are being installed.

By manually searching for updates GUI like the DLL is called correctly and the listening Port is open.

Some idea for the cause here?