利用服务创建SYSTEM权限的CMD

2005-4-4 08:17 804 1

摘要: 作者：dahubaobao[E.S.T] 邪恶八进制 //使用sc安装...然后sc start ServiceName "whoami" //就可以看到效果了...呵呵 //Code by...

关键词： nbsp ServiceStatus MsgError SERVICE return TCHAR GetLastError Command SetServiceStatus ServiceStatusHan

作者：dahubaobao[E.S.T] 邪恶八进制 //使用sc安装...然后sc start ServiceName "whoami" //就可以看到效果了...呵呵 //Code by dahubaobao#define DEBUGMSG #include <windows.h>#include <stdio.h> #pragma comment (lib,"advapi32.lib") #define erron GetLastError() #define Debug(x) OutputDebugString(x) TCHAR MsgError[50]={0}; SERVICE_STATUS ServiceStatus;SERVICE_STATUS_HANDLE ServiceStatusHandle; VOID WINAPI ServiceMain (DWORD dwArgc,TCHAR *lpArgv[]); VOID WINAPI ServiceHandle (DWORD dwFlags); BOOL ServiceTest (TCHAR *Command); int main (int argc,TCHAR *argv[]){ SERVICE_TABLE_ENTRY ServiceTableEntry[2]= { {TEXT("dahubaobao"),ServiceMain}, {NULL,NULL} }; StartServiceCtrlDispatcher(ServiceTableEntry); return 0;} VOID WINAPI ServiceMain (DWORD dwArgc,TCHAR *lpArgv[]){ TCHAR SysDir[MAX_PATH]={0}; TCHAR Command[MAX_PATH]={0}; ServiceStatus.dwServiceType=SERVICE_WIN32; ServiceStatus.dwCurrentState=SERVICE_START_PENDING; ServiceStatus.dwControlsAccepted=SERVICE_ACCEPT_STOP; ServiceStatus.dwServiceSpecificExitCode=0; ServiceStatus.dwWin32ExitCode=0; ServiceStatus.dwCheckPoint=0; ServiceStatus.dwWaitHint=0; if ((ServiceStatusHandle=RegisterServiceCtrlHandler(TEXT("dahubaobao"),ServiceHandle))==0) { #ifdef DEBUGMSG sprintf(MsgError,TEXT("RegisterServiceCtrlHandler() GetLastError reports %d\n"),erron); Debug(MsgError); #endif return ; } ServiceStatus.dwCurrentState=SERVICE_RUNNING; ServiceStatus.dwCheckPoint=0; ServiceStatus.dwWaitHint=0; if (SetServiceStatus(ServiceStatusHandle,&ServiceStatus)==0) { #ifdef DEBUGMSG sprintf(MsgError,TEXT("SetServiceStatus() GetLastError reports %d\n"),erron); Debug(MsgError); #endif return ; } GetSystemDirectory(SysDir,MAX_PATH-1); sprintf(Command,TEXT("%s\\cmd.exe /k %s%c"),SysDir,(char *)lpArgv[1],0); ServiceTest(Command); return ;} VOID WINAPI ServiceHandle (DWORD ControlCode){ switch (ControlCode) { case SERVICE_CONTROL_STOP: ServiceStatus.dwCurrentState=SERVICE_STOPPED; ServiceStatus.dwWin32ExitCode=0; ServiceStatus.dwCheckPoint=0; ServiceStatus.dwWaitHint=0; break; default: break; } if (SetServiceStatus(ServiceStatusHandle,&ServiceStatus)==0) { #ifdef DEBUGMSG sprintf(MsgError,TEXT("SetServiceStatus() GetLastError reports %d\n"),erron); Debug(MsgError); #endif return ; } return ;} BOOL ServiceTest (TCHAR *Command){ STARTUPINFO si={0}; PROCESS_INFORMATION pi; si.cb=sizeof (STARTUPINFO); si.lpDesktop=TEXT("WinSta0\\Default"); if (!(CreateProcess(NULL,Command,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi))) { #ifdef DEBUGMSG sprintf(MsgError,TEXT("CreateProcess() GetLastError reports %d\n"),erron); Debug(MsgError); #endif return FALSE; } return TRUE;}

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除