Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create Process With WMI
The following code demonstrates how to create a process using WMI. The function also allows for running the payload as the current user (if running as System). If running with privileges it also uses the MoveFileEx Self Delete.
Find Snippet on Stash: Creating a Process Using Windows
typedef struct _EXECUTE_ACTION //action type = 1
{
LPBYTE lpbPayload;
DWORD dwPayloadLen;
WCHAR *wcTargetPath;
BOOL bDeleteOnReboot;
INT iRunPayloadAs;
} EXECUTE_ACTION, *PEXECUTE_ACTION;