现在的位置: 首页 > 综合 > 正文

提升权限并枚举系统进程

2017年08月31日 ⁄ 综合 ⁄ 共 1476字 ⁄ 字号 评论关闭
#include <stdio.h>
#include <windows.h>
#include "PSAPI.H"
#pragma comment( lib, "PSAPI.LIB" )

//自定义函数:赋予指定特权。这里用来提升程序权限。提升进程权限本身需要一定的权限
BOOL EnablePrivilege(HANDLE hToken,LPCWSTR szPrivName);

int main(void)
{

 DWORD processid[1024],needed,processcount,i;
 HANDLE hProcess;
 HMODULE hModule;
 char path[MAX_PATH] = "",temp[256];

 HANDLE hToken;

 printf("ShowProcessPath 2.0 with [Process Status API]\n\n");

 if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
 {
  if (EnablePrivilege(hToken,SE_DEBUG_NAME))
  {
   CloseHandle(hToken);
   EnumProcesses(processid, sizeof(processid), &needed);
   processcount=needed/sizeof(DWORD);

   for (i=0;i<processcount;i++)
   {
    if (processid[i] == 20072)
    {
     printf("");
    }
    hProcess=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,false,processid[i]);
    if (hProcess)
    {
     EnumProcessModules(hProcess, &hModule, sizeof(hModule), &needed);
     GetModuleFileNameExA(hProcess, hModule, path, sizeof(path));
     GetShortPathNameA(path,path,256);
     itoa(processid[i],temp,10);
     printf("%s --- %s\n",path,temp);
     CloseHandle(hProcess);
    }
    else
     printf("Failed!!!\n");
   }
  }
 }

 itoa(processcount,temp,10);
 printf("\nProcess Count:%s\n\n",temp);

 return 0;
}

//////////////////////////////////////////////////////////////////////

BOOL EnablePrivilege(HANDLE hToken,LPCWSTR szPrivName)
{

 TOKEN_PRIVILEGES tkp;

 LookupPrivilegeValue( NULL,szPrivName,&tkp.Privileges[0].Luid );//修改进程权限
 tkp.PrivilegeCount=1;
 tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
 AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL );//通知系统修改进程权限

 return( (GetLastError()==ERROR_SUCCESS) );

}

抱歉!评论已关闭.