unbaiat / adduser

Programmatically create an administrative user under Windows

adduser

Programmatically creates a 'local admin' Windows user. Requires admin rights. The created user is hardcoded to the following:

Login: audit Password: Test123456789! (this should be good enough to fit most password policies)

This standalone piece code can run in many contexts:

• As a command-line EXE.
• As a DLL (the user will be created on DLL load). This is useful to exploit "DLL Preloading" issues.
• As a DLL, through rundll32.exe adduser.dll,CreateAdminUser@16. This is useful to bypass mandatory code signing applied to EXE files only.

Compiling

Using MinGW (tested on macOS, but Linux should work)

• Create a 32-bit EXE file: i686-w64-mingw32-gcc -oadduser32.exe adduser.c -lnetapi32
• Create a 32-bit DLL file: i686-w64-mingw32-gcc -shared -oadduser32.dll adduser.c -lnetapi32
• Create a 64-bit EXE file: x86_64-w64-mingw32-gcc -oadduser64.exe adduser.c -lnetapi32
• Create a 64-bit DLL file: x86_64-w64-mingw32-gcc -shared -oadduser64.dll adduser.c -lnetapi32

Using Visual Studio (tested with VS2013)

• Create an EXE file: cl.exe adduser.c /link /DEFAULTLIB:ADVAPI32 /DEFAULTLIB:NETAPI32
• Create a DLL file: cl.exe adduser.c /LD /link /DEFAULTLIB:ADVAPI32 /DEFAULTLIB:NETAPI32