0

I want to kill a process as Process Hacker does (it can kill NT Authority/SYSTEM processes and processes that requires an extra password to be killed).

I am not sure what kind of black magic it does, apparently it uses another kill function that neither "Task Manager" nor "Process Manager" uses, as they mention here: https://www.bleepingcomputer.com/forums/t/750256/process-hacker-2-vs-nt-authority/

I have tried to also use taskkill /IM <process.exe> /F from an Administrator cmd, https://superuser.com/questions/1457137/how-can-i-kill-a-process-like-process-hacker-does and also, from a NT Authority / SYSTEM cmd, with: PsExec64.exe -i -s cmd.exeand also launching a "Task Manager" with SYSTEM with PsExec64.exe -i -s taskmngr.exe

The only thing that works, is Terminating it with Process Hacker.

Now, the thing is, when I terminate it, the process restarts over and over, and I want to keep it dead.

How could I emulate that behavior ?

Regards!

aDoN
  • 1,877
  • 4
  • 39
  • 55

1 Answers1

1

In the Windows context it is essential to understand that just by simply being Administrator does not mean that you have all the privileges. Every different program launches ran as Administrator may run with slightly different variations on the privileges. These privileges can be easily spotted on Process Hacker in the tab Token. As an example , this are the differences between the Process Hacker.exe token and the Task Manager token: Process Hacker VS Task Manager Token

As it is clearly visible, although they were both run as Administrator, they hold different privileges. In particular, I would like to point out the SeLoadDriverPrivilege which has already been used in the wild as a privilege escalation method:

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/privileged-accounts-and-token-privileges

Basically, this privilege allows the user to load/unload drivers. Which translated to this context means that you will be able to run arbitrary code as NT/System which means that you will have full control over the system. As per the Process Hacker FAQ (https://wj32.org/processhacker/faq.php) this is how it is able to effectively kill those protected processes.

borcho
  • 137
  • 4
  • Ok I have used this tool: https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1 and I have now all the privileges (including SeLoadDriverPrivilege) enabled. Now, what is the internal Microsoft kernel function for process termination I should use and how to invoke it. Regards – aDoN Dec 01 '21 at 14:35