///说明：VC6编译通过//文件名：UAC.h//调用：UAC(进程名，可执行文件路径);

#pragma once
#include <windows.h>
#include <Aclapi.h>
#include <TLHelp32.h>typedef DWORD (WINAPI *WTSGetActiveConsoleSessionIdFunc)();
typedef    BOOL (WINAPI *ProcessIdToSessionIdFunc)(DWORD dwProcessId,DWORD* pSessionId);
typedef BOOL (WINAPI *WTSQueryUserTokenFunc)(ULONG SessionId,PHANDLE phToken);
typedef BOOL (WINAPI *CreateEnvironmentBlockFunc)(LPVOID *lpEnvironment,HANDLE hToken,BOOL bInherit);WTSGetActiveConsoleSessionIdFunc    WTSGetActiveConsoleSessionId=NULL;
ProcessIdToSessionIdFunc    ProcessIdToSessionId=NULL;
WTSQueryUserTokenFunc        WTSQueryUserToken=NULL;
CreateEnvironmentBlockFunc    CreateEnvironmentBlock=NULL;//获取所需函数地址
void GetFunc()
{HMODULE hKernel32=LoadLibrary("Kernel32.dll");HMODULE hWtsapi32=LoadLibrary("Wtsapi32.dll");HMODULE hUserenv=LoadLibrary("userenv.dll");if (hKernel32 && hWtsapi32 && hUserenv){WTSGetActiveConsoleSessionId = (WTSGetActiveConsoleSessionIdFunc)GetProcAddress(hKernel32,"WTSGetActiveConsoleSessionId");ProcessIdToSessionId = (ProcessIdToSessionIdFunc)GetProcAddress(hKernel32,"ProcessIdToSessionId");WTSQueryUserToken = (WTSQueryUserTokenFunc)GetProcAddress(hWtsapi32,"WTSQueryUserToken");CreateEnvironmentBlock=(CreateEnvironmentBlockFunc)GetProcAddress(hUserenv,"CreateEnvironmentBlock");}
}//开启本线程的SeDeDebug权限
bool EnableDebugPrivilege()
{HANDLE hToken;TOKEN_PRIVILEGES tp;if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))return false;if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid))return false;tp.PrivilegeCount=1;tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;if (!AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL))return false;return true;
}//主函数
BOOL UAC(char *ProcessName,char *ExecuteFilePath)
{DWORD    dwSessionId=0,TmpSessionId=0,PID=0,dwCreateFlags,dwSdLen,dwRet,dwAclSize=0,dwSaclSize=0,dwSidOwnLen=0,dwSidPrimLen=0;HANDLE    hSnap=NULL,hUserToken=NULL,hNewUserToken=NULL,hToken=NULL,hProcess;PROCESSENTRY32    pe={0x00};BOOL    Flag=false,bRet=false,bDAcl,bDefDAcl;TOKEN_PRIVILEGES    tp;LPVOID                lpEnv;STARTUPINFO            si;PROCESS_INFORMATION    pi;EXPLICIT_ACCESS        ea;PSECURITY_DESCRIPTOR    pOrigSd=NULL,pNewSd=NULL;PACL    pOldDAcl=NULL,pNewDAcl=NULL,pSacl=NULL;PSID    pSidOwner=NULL,pSidPrimary=NULL;//获取所需函数
    GetFunc();//开启本线程权限
    EnableDebugPrivilege();//Baby,come on!dwSessionId=WTSGetActiveConsoleSessionId();//查找进程，获取PIDhSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);pe.dwSize=sizeof(pe);Flag=Process32First(hSnap,&pe);while (Flag){if (strcmp(strlwr(pe.szExeFile),strlwr(ProcessName))==0){ProcessIdToSessionId(pe.th32ProcessID,&TmpSessionId);if (TmpSessionId==dwSessionId){PID=pe.th32ProcessID;break;}}Flag=Process32Next(hSnap,&pe);}//获取用户令牌WTSQueryUserToken(dwSessionId,&hUserToken);hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,PID);if (!hProcess)return FALSE;if (!OpenProcessToken(hProcess,READ_CONTROL|WRITE_DAC,&hToken))return FALSE;//设置ACE具有所有访问权限ZeroMemory(&ea,sizeof(EXPLICIT_ACCESS));BuildExplicitAccessWithName(&ea,"Everyone",TOKEN_ALL_ACCESS,GRANT_ACCESS,0);//第一次调用肯定返回这个错误，这是为了得到原安全描述符 pOrigSd 的长度if (!GetKernelObjectSecurity(hToken,DACL_SECURITY_INFORMATION,pOrigSd,0,&dwSdLen)){if (GetLastError()==ERROR_INSUFFICIENT_BUFFER){pOrigSd = (PSECURITY_DESCRIPTOR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwSdLen);if (pOrigSd==NULL)return FALSE;}}//第二次调用得到安全描述符 pOrigSdif (!GetKernelObjectSecurity(hToken,DACL_SECURITY_INFORMATION,pOrigSd,dwSdLen,&dwSdLen))return FALSE;//得到原安全描述符的访问控制列表 ACLif (!GetSecurityDescriptorDacl(pOrigSd,&bDAcl,&pOldDAcl,&bDefDAcl))return FALSE;// 生成新 ACE 权限的访问控制列表 ACLdwRet=SetEntriesInAcl(1,&ea,pOldDAcl,&pNewDAcl);if (dwRet!=ERROR_SUCCESS)return FALSE;//第一次调用肯定返回错误，为了创建新的安全描述符 pNewSd 而得到各项的长度if (!MakeAbsoluteSD(pOrigSd,pNewSd,&dwSdLen,pOldDAcl,&dwAclSize,pSacl,&dwSaclSize,pSidOwner,&dwSidOwnLen,pSidPrimary,&dwSidPrimLen)){if (GetLastError() == ERROR_INSUFFICIENT_BUFFER){pOldDAcl = (PACL)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwAclSize);pSacl = (PACL)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwSaclSize);pSidOwner = (PSID)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwSidOwnLen);pSidPrimary=(PSID)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwSidPrimLen);pNewSd = (PSECURITY_DESCRIPTOR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwSdLen);if (pOldDAcl==NULL || pSacl==NULL || pSidOwner==NULL || pSidPrimary==NULL || pNewSd==NULL)return FALSE;}}//再次调用才可以成功创建新的安全描述符 pNewSdif (!MakeAbsoluteSD(pOrigSd,pNewSd,&dwSdLen,pOldDAcl,&dwAclSize,pSacl,&dwSaclSize,pSidOwner,&dwSidOwnLen,pSidPrimary,&dwSidPrimLen))return FALSE;//将具有所有访问权限的访问控制列表 pNewDAcl 加入到新的 安全描述符 pNewSd 中if (!SetSecurityDescriptorDacl(pNewSd,bDAcl,pNewDAcl,bDefDAcl))return FALSE;//将新的安全描述符加到 TOKEN 中if (!SetKernelObjectSecurity(hToken, DACL_SECURITY_INFORMATION, pNewSd))return FALSE;//再次打开进程的 TOKEN，这时已经具有所有访问权限if (!OpenProcessToken( hProcess, TOKEN_ALL_ACCESS, &hToken))return FALSE;//复制令牌if (!DuplicateTokenEx(hToken,MAXIMUM_ALLOWED,NULL,SecurityIdentification,TokenPrimary,&hNewUserToken))return FALSE;//结束进程，危险，虚拟机测试//TerminateProcess(hProcess,0);//不虚拟登陆用户的话，创建新进程会提示
     ImpersonateLoggedOnUser(hNewUserToken);//创建环境if (CreateEnvironmentBlock(&lpEnv,hNewUserToken,TRUE))dwCreateFlags=NORMAL_PRIORITY_CLASS|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT;elselpEnv=NULL;ZeroMemory(&si,sizeof(si));ZeroMemory(&pi,sizeof(pi));si.cb=sizeof(si);si.lpDesktop="winsta0\default";bRet=CreateProcessAsUser(hNewUserToken,ExecuteFilePath,NULL,NULL,NULL,FALSE,dwCreateFlags,lpEnv,NULL,&si,&pi);//byeHeapFree(GetProcessHeap(),0,pOrigSd);HeapFree(GetProcessHeap(),0,pNewSd);HeapFree(GetProcessHeap(),0,pSidOwner);HeapFree(GetProcessHeap(),0,pSidPrimary);HeapFree(GetProcessHeap(),0,pSacl);HeapFree(GetProcessHeap(),0,pOldDAcl);CloseHandle(hSnap);CloseHandle(hProcess);CloseHandle(hToken);CloseHandle(hUserToken);CloseHandle(hNewUserToken);
}