A_OSWindows权限与会话
,
Source
Edit
History

【权限与会话】提权

文章目录
  1. 1. 提权
  2. 2. 使用

这篇文章会给你带来？

  1. 直接 Copy 就可以使用的提权代码以及如何使用

提权

相关头文件

1
2
#include <windows.h>  
#include <tlhelp32.h>

代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
BOOL  EnablePrivilege(LPCTSTR lpszPrivilegeName, BOOL bEnable)
{
    int nResult = FALSE;
    int nRetCode = FALSE;
    HANDLE hToken = NULL;
    TOKEN_PRIVILEGES tkp = { 0 };

    do
    {
        nRetCode = ::OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
        if (!nRetCode)
            break;

        nRetCode = ::LookupPrivilegeValue(NULL, lpszPrivilegeName, &tkp.Privileges[0].Luid);
        if (!nRetCode)
            break;

        tkp.PrivilegeCount = 1;
        tkp.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;
        nRetCode = ::AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL);
        if (!nRetCode)
            break;

        nResult = TRUE;
    } while (FALSE);

    if (hToken != NULL)
    {
        CloseHandle(hToken);
    }

    return nResult;
}

HANDLE GetExplorerToken()
{
    EnablePrivilege(SE_DEBUG_NAME, TRUE);

    HANDLE hSnapshot = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE)
    {
        return NULL;
    }

    HANDLE hExplorerToken = NULL;
    PROCESSENTRY32 pe = { 0 };
    pe.dwSize = sizeof(pe);

    BOOL bMore = ::Process32First(hSnapshot, &pe);
    while (bMore)
    {
        if (_tcsicmp("explorer.exe", pe.szExeFile) == 0)
        {
            HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pe.th32ProcessID);
            if (hProcess == NULL)
            {
                continue;
            }
            if (OpenProcessToken(hProcess, TOKEN_QUERY, &hExplorerToken))
            {
                CloseHandle(hProcess);
                break;
            }

            CloseHandle(hProcess);
        }
        bMore = ::Process32Next(hSnapshot, &pe);
    }
    CloseHandle(hSnapshot);

    return hExplorerToken;
}

也可以使用下边这段代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
BOOL EnableDebugPrivilege() {
	HANDLE hToken;
	BOOL fOk = FALSE;
	if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) {
		TOKEN_PRIVILEGES tp;
		tp.PrivilegeCount = 1;
		LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);

		tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

		fOk = (GetLastError() == ERROR_SUCCESS);
		CloseHandle(hToken);
	}
	return fOk;
}

将权限设置为入参形式：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
BOOL EnableXXXPrivilege(LPCTSTR pszPrivilegeName)
{
	HANDLE hToken;
	LUID seXXXNameValue;
	TOKEN_PRIVILEGES tkp;
	
	// enable the SeXXXPrivilege
	if ( ! OpenProcessToken( GetCurrentProcess(),
		TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
	{
		MYTRACE(L"OpenProcessToken() failed, Error = %d  %s is not available.\n" , GetLastError(), pszPrivilegeName );
		return FALSE;
	}
	
	if ( !LookupPrivilegeValue( NULL, pszPrivilegeName, &seXXXNameValue))
	{
		MYTRACE(L"LookupPrivilegeValue() failed, Error = %d %s is not available.\n", GetLastError(), pszPrivilegeName);
		CloseHandle( hToken );
		return FALSE;
	}
	
	tkp.PrivilegeCount = 1;
	tkp.Privileges[0].Luid = seXXXNameValue;
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	
	if ( !AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ))
	{
		MYTRACE(L"AdjustTokenPrivileges() failed, Error = %d %s is not available.\n", GetLastError(),pszPrivilegeName);
		CloseHandle( hToken );
		return FALSE;
	}
	
	CloseHandle( hToken );

	return TRUE;
}

使用

1
2
3
4
5
6
7
8
9
10
11
HANDLE hExplorerToken = GetExplorerToken();
if (hExplorerToken == NULL)
    break;

char szUserProfilePath[MAX_PATH] = { 0 };
DWORD cchSize = MAX_PATH;
if (!GetUserProfileDirectoryA(hExplorerToken, szUserProfilePath, &cchSize))
{
    CloseHandle(hExplorerToken);
    break;
}