70,020
社区成员




#include<iostream>
#include"windows.h"
#include"tlhelp32.h"
using namespace std;
BOOL Prompt()
{
HANDLE hToken;
if(!OpenProcessToken(::GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))
{
cout<<"OpenProcessToken error the code is :"<<GetLastError()<<endl;
return FALSE;
}
TOKEN_PRIVILEGES tkp;
tkp.PrivilegeCount =1;
if(!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges [0].Luid ))
{
cout<<"LookPrivilegeValue error the code is :"<<GetLastError()<<endl;
return FALSE;
}
if(!AdjustTokenPrivileges(hToken,false,&tkp,sizeof(tkp),NULL,0))
{
cout<<"AdjustPrivileges error the code is:"<<GetLastError()<<endl;
return FALSE;
}
return true;
}
int main()
{
//获得系统当前运行的程序,获得目标程序ID
DWORD ProcessId=0;
HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(hSnap==NULL)
{
cout<<"CreateToolhelp32Snapshot error the code is :"<<GetLastError()<<endl;
return 0;
}
BOOL mark=false;
PROCESSENTRY32 pro_info;
pro_info.dwSize =sizeof(pro_info);
mark=Process32First(hSnap,&pro_info);
while(mark)
{
if(pro_info.szExeFile [0]=='c'&&pro_info.szExeFile [1]=='a'&&pro_info.szExeFile [2]=='l'&&pro_info.szExeFile [3]=='c')
{
MessageBoxA(NULL,"find it!","warning ",0);
ProcessId=pro_info.th32ProcessID ;
break;
}
mark=Process32Next(hSnap,&pro_info);
}
if(Prompt())
{
cout<<"提升权限成功。。。"<<endl;
}
else
return 0;
if(ProcessId==0)
{
MessageBoxA(NULL,"没有找到计算器进程",NULL,0);
return -1;
}
//打开目标程序
HANDLE hPro;
hPro=OpenProcess(PROCESS_ALL_ACCESS,FALSE,ProcessId);
if(hPro==NULL)
{
int num=GetLastError();
char warn[100];
sprintf(warn,"%s,%d","OpenProcess",num);
MessageBoxA(NULL,warn,"warning ",0);
return -1;
}
PVOID addr;
addr=VirtualAllocEx(hPro,NULL,1024*4,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(addr==NULL)
{
int num=GetLastError();
char warn[100];
sprintf(warn,"%s,%d","VirtualAlloc 出错",num);
MessageBoxA(NULL,warn,"warning ",0);
return -1;
}
// 获得函数地址
PVOID Func_addr;
Func_addr=GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");
if(Func_addr==NULL)
{
int num=GetLastError();
char warn[100];
sprintf(warn,"%s,%d","GetProcAddress出错",num);
MessageBoxA(NULL,warn,"warning ",0);
return -1;
}
char DllName[]="en.dll";
if(!WriteProcessMemory(hPro,addr,DllName,strlen(DllName),0))
{
int num=GetLastError();
char warn[100];
sprintf(warn,"%s,%d","WriteProcessMemory出错",num);
MessageBoxA(NULL,warn,"warning ",0);
return -1;
}
//创建远程线程
DWORD ID;
HANDLE hThr;
hThr=CreateRemoteThread(hPro,NULL,0,(PTHREAD_START_ROUTINE)Func_addr,addr,0,&ID);
if(hThr==NULL)
{
int num=GetLastError();
char warn[100];
sprintf(warn,"%s,%d","远程进程创建失败",num);
MessageBoxA(NULL,warn,"warning ",0);
return 0;
}
else
{
MessageBoxA(NULL,"远程进程创建成功!","warning ",0);
int a;
cin>>a;
}
}