创建SYSTEM用户权限的进程

#include <stdio.h>

#include <windows.h>

#include <Tlhelp32.h>

#include <AccCtrl.h>

#include <Aclapi.h>

typedef NTSTATUS (WINAPI *pfRtlAdjustPrivilege)(

ULONG Privilege,

BOOLEAN Enable,

BOOLEAN CurrentThread,

PBOOLEAN Enabled);

void AdjustPrivilege()

{

pfRtlAdjustPrivilege RtlAdjustPrivilege = NULL;

RtlAdjustPrivilege = (pfRtlAdjustPrivilege)GetProcAddress(GetModuleHandle("NTDLL.DLL"), "RtlAdjustPrivilege");

if(RtlAdjustPrivilege)

{

BOOLEAN blPev;

RtlAdjustPrivilege(20, TRUE, FALSE, &blPev);

printf("提权成功: %d\n", blPev);

}

}

DWORD GetProcessID( LPSTR lpName)

{

if(!lpName)

{

return 0;

}

HANDLE hProcessSnap = NULL;

BOOL bRet = FALSE;

PROCESSENTRY32 pe32 = {0};

DWORD dwProcessId = 0;

hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (hProcessSnap == INVALID_HANDLE_VALUE)

return dwProcessId;

pe32.dwSize = sizeof(PROCESSENTRY32);

if (Process32First(hProcessSnap, &pe32))

{

do

{

if(stricmp(pe32.szExeFile, lpName) == 0)

{

dwProcessId = pe32.th32ProcessID;

CloseHandle (hProcessSnap);

return dwProcessId;

}

}

while (Process32Next(hProcessSnap, &pe32));

}

CloseHandle(hProcessSnap);

return dwProcessId;

}

BOOL CreateSystemProcess(LPTSTR szProcessName, LPTSTR szCmdLine)

{

HANDLE hProcess;

HANDLE hToken, hNewToken;

DWORD dwPid;

PACL pOldDAcl = NULL;

PACL pNewDAcl = NULL;

BOOL bDAcl;

BOOL bDefDAcl;

DWORD dwRet;

PACL pSacl = NULL;

PSID pSidOwner = NULL;

PSID pSidPrimary = NULL;

DWORD dwAclSize = 0;

DWORD dwSaclSize = 0;

DWORD dwSidOwnLen = 0;

DWORD dwSidPrimLen = 0;

DWORD dwSDLen;

EXPLICIT_ACCESS ea;

PSECURITY_DESCRIPTOR pOrigSd = NULL;

PSECURITY_DESCRIPTOR pNewSd = NULL;

STARTUPINFO si;

PROCESS_INFORMATION pi;

CHAR szFullCmdLine[512] = {0};

BOOL bError;

AdjustPrivilege();

dwPid = GetProcessID("winlogon.exe");

if(dwPid == 0)

{

bError = TRUE;

goto Cleanup;

}

hProcess = OpenProcess( PROCESS_QUERY_INFORMATION, FALSE, dwPid );

if ( hProcess == NULL )

{

printf( "OpenProcess() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

if ( !OpenProcessToken( hProcess, READ_CONTROL | WRITE_DAC, &hToken ) )

{

printf( "OpenProcessToken() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

// 设置 ACE 具有所有访问权限

ZeroMemory( &ea, sizeof( EXPLICIT_ACCESS ) );

BuildExplicitAccessWithName(

&ea,

"Everyone",

TOKEN_ALL_ACCESS,

GRANT_ACCESS,

0 );

if ( !GetKernelObjectSecurity(

hToken,

DACL_SECURITY_INFORMATION,

pOrigSd,

0,

&dwSDLen ))

{

// 第一次调用给出的参数肯定返回这个错误，这样做的目的是

// 为了得到原安全描述符 pOrigSd 的长度

if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER )

{

pOrigSd = ( PSECURITY_DESCRIPTOR ) HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, dwSDLen );

if ( pOrigSd == NULL )

{

printf( "Allocate pSd memory to failed!\n" );

bError = TRUE;

goto Cleanup;

}

// 再次调用才正确得到安全描述符 pOrigSd

if ( !GetKernelObjectSecurity(

hToken,

DACL_SECURITY_INFORMATION,

pOrigSd,

dwSDLen,

&dwSDLen ) )

{

printf( "GetKernelObjectSecurity() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

}

else

{

printf( "GetKernelObjectSecurity() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

}

// 得到原安全描述符的访问控制列表 ACL

if ( !GetSecurityDescriptorDacl( pOrigSd, &bDAcl, &pOldDAcl, &bDefDAcl ) )

{

printf( "GetSecurityDescriptorDacl() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

// 生成新 ACE 权限的访问控制列表 ACL

dwRet = SetEntriesInAcl( 1, &ea, pOldDAcl, &pNewDAcl );

if ( dwRet != ERROR_SUCCESS )

{

printf( "SetEntriesInAcl() = %d\n", GetLastError() );

pNewDAcl = NULL;

bError = TRUE;

goto Cleanup;

}

if ( !MakeAbsoluteSD( pOrigSd,

pNewSd,

&dwSDLen,

pOldDAcl,

&dwAclSize,

pSacl,

&dwSaclSize,

pSidOwner,

&dwSidOwnLen,

pSidPrimary,

&dwSidPrimLen ) )

{

// 第一次调用给出的参数肯定返回这个错误，这样做的目的是

// 为了创建新的安全描述符 pNewSd 而得到各项的长度

if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER )

{

pOldDAcl = ( PACL ) HeapAlloc( GetProcessHeap(),

HEAP_ZERO_MEMORY,

dwAclSize );

pSacl = ( PACL ) HeapAlloc( GetProcessHeap(),

HEAP_ZERO_MEMORY,

dwSaclSize );

pSidOwner = ( PSID ) HeapAlloc( GetProcessHeap(),

HEAP_ZERO_MEMORY,

dwSidOwnLen );

pSidPrimary = ( PSID ) HeapAlloc( GetProcessHeap(),

HEAP_ZERO_MEMORY,

dwSidPrimLen );

pNewSd = ( PSECURITY_DESCRIPTOR ) HeapAlloc( GetProcessHeap(),

HEAP_ZERO_MEMORY,

dwSDLen );

if ( pOldDAcl == NULL ||

pSacl == NULL ||

pSidOwner == NULL ||

pSidPrimary == NULL ||

pNewSd == NULL )

{

printf( "Allocate SID or ACL to failed!\n" );

bError = TRUE;

goto Cleanup;

}

// 再次调用才可以成功创建新的安全描述符 pNewSd

// 但新的安全描述符仍然是原访问控制列表 ACL

if ( !MakeAbsoluteSD( pOrigSd,

pNewSd,

&dwSDLen,

pOldDAcl,

&dwAclSize,

pSacl,

&dwSaclSize,

pSidOwner,

&dwSidOwnLen,

pSidPrimary,

&dwSidPrimLen ) )

{

printf( "MakeAbsoluteSD() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

}

else

{

printf( "MakeAbsoluteSD() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

}

// 将具有所有访问权限的访问控制列表 pNewDAcl 加入到新的

// 安全描述符 pNewSd 中

if ( !SetSecurityDescriptorDacl( pNewSd, bDAcl, pNewDAcl, bDefDAcl ) )

{

printf( "SetSecurityDescriptorDacl() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

// 将新的安全描述符加到 TOKEN 中

if ( !SetKernelObjectSecurity( hToken, DACL_SECURITY_INFORMATION, pNewSd ) )

{

printf( "SetKernelObjectSecurity() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

// 再次打开 WINLOGON 进程的 TOKEN，这时已经具有所有访问权限

if ( !OpenProcessToken( hProcess, TOKEN_ALL_ACCESS, &hToken ) )

{

printf( "OpenProcessToken() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

// 复制一份具有相同访问权限的 TOKEN

if ( !DuplicateTokenEx( hToken,

TOKEN_ALL_ACCESS,

NULL,

SecurityImpersonation,

TokenPrimary,

&hNewToken ) )

{

printf( "DuplicateTokenEx() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

ZeroMemory( &si, sizeof( STARTUPINFO ) );

si.cb = sizeof( STARTUPINFO );

// 不虚拟登陆用户的话，创建新进程会提示

// 1314 客户没有所需的特权错误

ImpersonateLoggedOnUser( hNewToken );

// 我们仅仅是需要建立高权限进程，不用切换用户

// 所以也无需设置相关桌面，有了新 TOKEN 足够

sprintf(szFullCmdLine, "\"%s\" %s", szProcessName, szCmdLine);

printf("%s\n", szFullCmdLine);

// 利用具有所有权限的 TOKEN，创建高权限进程

if ( !CreateProcessAsUser( hNewToken,

NULL,

szFullCmdLine,

NULL,

NULL,

FALSE,

NULL, //NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE,

NULL,

NULL,

&si,

&pi ) )

{

printf( "CreateProcessAsUser() = %d\n", GetLastError() );

bError = TRUE;

goto Cleanup;

}

bError = FALSE;

Cleanup:

if ( pOrigSd )

{

HeapFree( GetProcessHeap(), 0, pOrigSd );

}

if ( pNewSd )

{

HeapFree( GetProcessHeap(), 0, pNewSd );

}

if ( pSidPrimary )

{

HeapFree( GetProcessHeap(), 0, pSidPrimary );

}

if ( pSidOwner )

{

HeapFree( GetProcessHeap(), 0, pSidOwner );

}

if ( pSacl )

{

HeapFree( GetProcessHeap(), 0, pSacl );

}

if ( pOldDAcl )

{

HeapFree( GetProcessHeap(), 0, pOldDAcl );

}

CloseHandle( pi.hProcess );

CloseHandle( pi.hThread );

CloseHandle( hToken );

CloseHandle( hNewToken );

CloseHandle( hProcess );

if ( bError )

{

return FALSE;

}

return TRUE;

}

int _tmain(int argc, _TCHAR* argv[])

{

if(argc > 0)

{

char szCmdline[512] = {0};

for(int i=2; i<argc; i++)

{

strcat(szCmdline, " ");

strcat(szCmdline, argv[i]);

}

printf("%s\n", szCmdline);

CreateSystemProcess(argv[1], szCmdline);

}

//getchar();

return 0;