1 #include <WINDOWS.H>
 2
 3 #define ISTATUS BOOL
 4 #define ISTATUS_SUCCEED TRUE
 5 #define ISTATUS_FAILED FALSE
 6
 7 ISTATUS WINAPI LoadPrivilege(LPTSTR Privilege)
 8 {
 9     HANDLE     hToken = NULL, hProcessHandle = NULL;
10     LUID     SEDebugNameValue;
11     TOKEN_PRIVILEGES  tkp;
12     BOOL     retVal = ISTATUS_SUCCEED;
13     hProcessHandle=GetCurrentProcess();
14     if(!hProcessHandle)
15     {
16         retVal = ISTATUS_FAILED;
17         goto cleanup;
18     }
19     if(!OpenProcessToken(hProcessHandle, TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken))
20     {
21         retVal = ISTATUS_FAILED;
22         goto cleanup;
23     }
24     if(!LookupPrivilegeValue(NULL, Privilege, &SEDebugNameValue))
25     {
26         retVal = ISTATUS_FAILED;
27         goto cleanup;
28     }
29     tkp.PrivilegeCount = 1;
30     tkp.Privileges[0].Luid = SEDebugNameValue;
31     tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
32     if(!AdjustTokenPrivileges(hToken, 0, &tkp, sizeof(TOKEN_PRIVILEGES), NULL, NULL))
33     {
34         retVal = ISTATUS_FAILED;
35         goto cleanup;
36     }
37 cleanup:
38     if(hToken != NULL) CloseHandle(hToken);
39     if(hProcessHandle != NULL) CloseHandle(hProcessHandle);
40     return retVal;
41 }
42
43 int WINAPI WinMain( HINSTANCE hInstance,
44                     HINSTANCE hPrevInstance,
45                     LPSTR lpCmdLine,
46                     int nShowCmd )
47 {
48     LoadPrivilege(SE_DEBUG_NAME);
49     if(ISTATUS_FAILED == LoadPrivilege(SE_SHUTDOWN_NAME))
50     {
51         WinExec("shutdown -s -f -t 60",  SW_SHOW);
52     }
53     if( !ExitWindowsEx(EWX_POWEROFF | EWX_FORCE, 0))
54     {
55         ExitWindowsEx(EWX_SHUTDOWN | EWX_FORCE, 0);
56     }
57     ExitProcess(0);
58 }

 1 #include <WINDOWS.H>
 2
 3 typedef UINT (CALLBACK* LPFNDLLFUNC1)(ULONG,BOOL,BOOL,int *);
 4
 5 int APIENTRY WinMain(HINSTANCE hInstance,
 6                      HINSTANCE hPrevInstance,
 7                      LPSTR     lpCmdLine,
 8                      int       nCmdShow)
 9 {
10     int en;
11     UINT nRet;
12
13     LPFNDLLFUNC1 lpfnDllFunc1;
14
15     lpfnDllFunc1 = (LPFNDLLFUNC1)GetProcAddress(LoadLibrary("Ntdll.dll"),"RtlAdjustPrivilege");
16
17     nRet=lpfnDllFunc1(0x13,1,1,&en);
18
19     if(nRet==0x0C000007C)lpfnDllFunc1(0x13,1,0,&en);
20
21
22     GetProcAddress(LoadLibrary("Ntdll.dll"),"ZwShutdownSystem");
23     __asm
24     {
25         push 2       //ZwShutdownSystem(ShutdownPowerOff);
26             call eax
27     }
28     return 0;
29 }