VC 一句代碼提升進程許可權

RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE,1,0,NULL);

這個函數封裝在NtDll.dll中（在所有DLL載入之前載入），被微軟嚴格保密，就是說你在MSDN上查不到關於他的任何資訊。

.常量 SE_BACKUP_PRIVILEGE, "17", 公開
.常量 SE_RESTORE_PRIVILEGE, "18", 公開
.常量 SE_SHUTDOWN_PRIVILEGE, "19", 公開
.常量 SE_DEBUG_PRIVILEGE, "20", 公開

先來看看這個函數的定義

NTSTATUS RtlAdjustPrivilege(ULONG    Privilege,BOOLEAN Enable,BOOLEAN CurrentThread,PBOOLEAN Enabled)

參數的含義：

Privilege [In] Privilege index to change.                         // 所需要的許可權名稱，可以到MSDN尋找關於Process Token & Privilege內容可以查到Enable [In] If TRUE, then enable the privilege otherwise disable. // 如果為True 就是開啟相應許可權，如果為False 則是關閉相應許可權CurrentThread [In] If TRUE, then enable in calling thread, otherwise process. // 如果為True 則僅提升當前線程許可權，否則提升整個進程的許可權Enabled [Out] Whether privilege was previously enabled or disabled.// 輸出原來相應許可權的狀態（開啟 | 關閉）

 很多人大概沒有聽說過他的大名，但是相信有很多人見過進程提權的過程
拷一段我寫的提權上來吧

BOOL EnableDebugPrivilege(){    HANDLE token;    //提升許可權    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&token))    {        MessageBox(NULL,"開啟進程令牌失敗...","錯誤",MB_ICONSTOP);        return FALSE;    }    TOKEN_PRIVILEGES tkp;    tkp.PrivilegeCount = 1;    ::LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid);    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;    if(!AdjustTokenPrivileges(token,FALSE,&tkp,sizeof(tkp),NULL,NULL))    {        MessageBox(NULL,"調整令牌許可權失敗...","錯誤",MB_ICONSTOP);        return FALSE;    }    CloseHandle(token);    return TRUE;}

 

bool EnableDebugPrivilege()   {       HANDLE hToken;       LUID sedebugnameValue;       TOKEN_PRIVILEGES tkp;       if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))    {           return   FALSE;       }       if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))      {           CloseHandle(hToken);           return false;       }       tkp.PrivilegeCount = 1;       tkp.Privileges[0].Luid = sedebugnameValue;       tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;       if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))     {           CloseHandle(hToken);           return false;       }       return true;   }

 

例子：強制關機

// ExitWindow.cpp : Defines the entry point for the console application.//#include "stdafx.h"#include <Windows.h>#include <stdio.h>//定義函數原型typedef int (__stdcall *Func_RtlAdjustPrivilege)(ULONG, BOOLEAN, BOOLEAN, PBOOLEAN);int main(int argc, char* argv[]){//裝載DLLHMODULE hModule = ::LoadLibrary("NTDLL.DLL");if(hModule == NULL) {printf("LoadLibrary error\n");return 0;}//得到匯出函數的地址Func_RtlAdjustPrivilege RtlAdjustPrivilege = (Func_RtlAdjustPrivilege)GetProcAddress(hModule, "Func_RtlAdjustPrivilege");if(RtlAdjustPrivilege == NULL) {printf("GetProcAddress error \n");return 0;}//HANDLE hToken;//TOKEN_PRIVILEGES tkp;//取得系統版本OSVERSIONINFO osvi;osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);if(GetVersionEx(&osvi) == 0) {return false;}if(osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) {/*.常量 SE_BACKUP_PRIVILEGE, "17", 公開.常量 SE_RESTORE_PRIVILEGE, "18", 公開.常量 SE_SHUTDOWN_PRIVILEGE, "19", 公開.常量 SE_DEBUG_PRIVILEGE, "20", 公開*/RtlAdjustPrivilege(19, 1, 0, NULL);}//強制關機， 不向進程發送WM_QUERYENDSESSION訊息ExitWindowsEx(EWX_FORCE, 0);return 0;}

 

附註：

#define SE_CREATE_TOKEN_NAME              TEXT("SeCreateTokenPrivilege")#define SE_ASSIGNPRIMARYTOKEN_NAME        TEXT("SeAssignPrimaryTokenPrivilege")#define SE_LOCK_MEMORY_NAME               TEXT("SeLockMemoryPrivilege")#define SE_INCREASE_QUOTA_NAME            TEXT("SeIncreaseQuotaPrivilege")#define SE_UNSOLICITED_INPUT_NAME         TEXT("SeUnsolicitedInputPrivilege")#define SE_MACHINE_ACCOUNT_NAME           TEXT("SeMachineAccountPrivilege")#define SE_TCB_NAME                       TEXT("SeTcbPrivilege")#define SE_SECURITY_NAME                  TEXT("SeSecurityPrivilege")#define SE_TAKE_OWNERSHIP_NAME            TEXT("SeTakeOwnershipPrivilege")#define SE_LOAD_DRIVER_NAME               TEXT("SeLoadDriverPrivilege")#define SE_SYSTEM_PROFILE_NAME            TEXT("SeSystemProfilePrivilege")#define SE_SYSTEMTIME_NAME                TEXT("SeSystemtimePrivilege")#define SE_PROF_SINGLE_PROCESS_NAME       TEXT("SeProfileSingleProcessPrivilege")#define SE_INC_BASE_PRIORITY_NAME         TEXT("SeIncreaseBasePriorityPrivilege")#define SE_CREATE_PAGEFILE_NAME           TEXT("SeCreatePagefilePrivilege")#define SE_CREATE_PERMANENT_NAME          TEXT("SeCreatePermanentPrivilege")#define SE_BACKUP_NAME                    TEXT("SeBackupPrivilege")#define SE_RESTORE_NAME                   TEXT("SeRestorePrivilege")#define SE_SHUTDOWN_NAME                  TEXT("SeShutdownPrivilege")#define SE_DEBUG_NAME                     TEXT("SeDebugPrivilege")#define SE_AUDIT_NAME                     TEXT("SeAuditPrivilege")#define SE_SYSTEM_ENVIRONMENT_NAME        TEXT("SeSystemEnvironmentPrivilege")#define SE_CHANGE_NOTIFY_NAME             TEXT("SeChangeNotifyPrivilege")#define SE_REMOTE_SHUTDOWN_NAME           TEXT("SeRemoteShutdownPrivilege")#define SE_UNDOCK_NAME                    TEXT("SeUndockPrivilege")#define SE_SYNC_AGENT_NAME                TEXT("SeSyncAgentPrivilege")#define SE_ENABLE_DELEGATION_NAME         TEXT("SeEnableDelegationPrivilege")#define SE_MANAGE_VOLUME_NAME             TEXT("SeManageVolumePrivilege")

註： 完整列表請參考

http://msdn.microsoft.com/en-us/library/bb530716(v=vs.85).aspx

 

註：本文轉載自：http://bbs.pediy.com/showthread.php?t=104323

                               

http://pengranxiang.iteye.com/blog/771038