windows 进程降权和提权代码示例

àì夳堔傛蜴生んèń 2023-02-13 05:52 2阅读 0赞

#include "windows.h"
    BOOL GetTokenByName(HANDLE &hToken,LPTSTR lpName)
    {
    	if(!lpName)
    	{
    		return FALSE;
    	}
    	HANDLE hProcessSnap = NULL; 
    	BOOL bRet = FALSE; 
    	PROCESSENTRY32 pe32 = {0}; 
     
    	hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 
    	if (hProcessSnap == INVALID_HANDLE_VALUE) 
    	{
    		return FALSE; 
    	}
     
    	pe32.dwSize = sizeof(PROCESSENTRY32); 
     
    	if (Process32First(hProcessSnap, &pe32)) 
    	{ 
    		do 
    		{
    			if(_wcsicmp(pe32.szExeFile,lpName) == 0)
    			{
    				HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION,
    					FALSE,pe32.th32ProcessID);
    				bRet = OpenProcessToken(hProcess,TOKEN_ALL_ACCESS,&hToken); 
    				CloseHandle (hProcessSnap); 
    				return (bRet);
    			}
    		} 
    		while (Process32Next(hProcessSnap, &pe32)); 
    		//bRet = TRUE; 
    	} 
    	else 
    		bRet = FALSE;
     
    	CloseHandle (hProcessSnap); 
    	return (bRet);
    }
     
     
     
    int _tmain(int argc, _TCHAR* argv[])
    {
    	HANDLE hToken = NULL;
    	//获取目标进程权限 此方法可以降权和提权 eg: explore.exe[mid]  winlogon.exe[system]
    	if(!GetTokenByName(hToken,TEXT("winlogon.exe")))
    	{
     
    		return FALSE;
    	}
    	if (hToken == NULL)
    	{
    		return FALSE;
    	}
     
    	STARTUPINFO startUpInfo;
    	::ZeroMemory(&startUpInfo, sizeof(startUpInfo));
    	startUpInfo.cb = sizeof(STARTUPINFO);
    	startUpInfo.dwFlags = STARTF_USESHOWWINDOW;
    	startUpInfo.wShowWindow = SW_SHOW;
     
    	BOOL bResult = CreateProcessAsUser(hToken,NULL,"需要提权.exe",NULL,NULL,
    		FALSE,NORMAL_PRIORITY_CLASS,NULL,NULL,&startUpInfo,&m_myProcInfo.procInfo);
     
    	CloseHandle(hToken);
     
    	return 0;
    }
    
    ————————————————
    版权声明：本文为CSDN博主「小青峰_jd」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
    原文链接：https://blog.csdn.net/jiangdong2007/article/details/106270384