Maxbad`Blog

进程提权

2022-06-22 · 1 min read

暂未验证,从别的代码抄袭的.


void adjustProcessPriviledges()
{
	// Set the necessary privileges for accessing token info for all system processes
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
	if (hProcess)
	{
		HANDLE hToken;
				
		if (OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES, &hToken))
		{
			TOKEN_PRIVILEGES tp;
			LUID luid;

			if ( !LookupPrivilegeValue( 
					NULL,            // lookup privilege on local system
					SE_DEBUG_NAME,   // privilege to lookup 
					&luid ) )        // receives LUID of privilege
			{
				CloseHandle(hToken);
				CloseHandle(hProcess);
				return; 
			}

			tp.PrivilegeCount = 1;
			tp.Privileges[0].Luid = luid;
			tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

			if ( !AdjustTokenPrivileges(
				   hToken, 
				   FALSE,  
				   &tp, 
				   sizeof(TOKEN_PRIVILEGES), 
				   (PTOKEN_PRIVILEGES) NULL, 
				   (PDWORD) NULL) )
			{ 
				  CloseHandle(hToken);
				  CloseHandle(hProcess);
				  return; 
			} 

			CloseHandle(hToken);
		}

		CloseHandle(hProcess);
	}
}