RUN AS LOCALSYSTEM USER
NOTES:
IF YOU WANT TO CREATE A USER ACCOUNT AND ADD IT TO A SPECIFIC GROUP, DO THE FOLLOWING STEPS:
IF YOU WANT TO REMOVE A USER ACCOUNT FROM A SPECIFIC GROUP AND DELETE THE USER ACCOUNT, DO THE FOLLOWING STEPS:
This script has been scanned with virustotal.com and Xcitium verdict cloud.
PYTHON SCRIPT FILE SHA1 VALUE - 24a1b89e31cc90f6465c323f28b4968c9beabc2c
JSON FILE SHA1 VALUE - 649eca8c2e0042e145dcecfc5f7cd72f177ce147
CREATE_OR_DELETE = 0 # give 0 if you want to create or give 1 if you want to delete
username = "john" # give here the username to create or delete from the system. eg: james
password = "12345" #give here the password for the above user account to create. you don't have to give password if you want to Delete, just username and Group name is enough.
Group_To_AddOrRemove_User = "user" # give here the group name to add or remove the user account
import os
from subprocess import PIPE, Popen
import ctypes
class disable_file_system_redirection:
_disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
_revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
def __enter__(self):
self.old_value = ctypes.c_long()
self.success = self._disable(ctypes.byref(self.old_value))
def __exit__(self, type, value, traceback):
if self.success:
self._revert(self.old_value)
def ecmd(command):
from subprocess import Popen, PIPE
import ctypes
with disable_file_system_redirection():
obj = Popen(command, shell = True, stdout = PIPE, stderr = PIPE)
out, err = obj.communicate()
ret=obj.returncode
return ret,out,err
def AddOrRemove_Group(groupname,username,cmd,word):
ret,out,err = ecmd('net localgroup "%s" "%s" %s'%(groupname,username,cmd))
if ret==0:
if out:
print(out)
print('successfully %s the user account to the group'%(word))
else:
print(err)
def CreateOrDelete_UserAccount(username,password,cmd,word):
if cmd=="/delete":
ret,out,err = ecmd('net user "%s" %s'%(username,cmd))
else:
ret,out,err = ecmd('net user "%s" "%s" %s'%(username,password,cmd))
if ret==0:
if out:
print(out)
print('successfully %s the user account'%(word))
else:
print(err)
if CREATE_OR_DELETE==0:
cmd = "/add"
CreateOrDelete_UserAccount(username,password,cmd,"created")
AddOrRemove_Group(Group_To_AddOrRemove_User,username,cmd,"added")
elif CREATE_OR_DELETE==1:
cmd = "/delete"
AddOrRemove_Group(Group_To_AddOrRemove_User,username,cmd,"removed")
CreateOrDelete_UserAccount(username,password,cmd,"deleted")
Comments