1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80
| static bool CreateProcessFromParent(char* lpPath) { char str[][20] = { "winlogon.exe","lsass.exe" }; DWORD pid = 0; int index = 0; do { pid = GetProcessIDByName(str[index++]); if (pid == 0) break; } while (index < sizeof(str) / 20); if (pid == 0 ) return false;
if (!EnableDebugPriv()) { cout << "EnableDebugPriv Failed !" << endl; return false; }
STARTUPINFOEXA si;
ZeroMemory(&si, sizeof(si));
si.StartupInfo.cb = sizeof(si);
HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
SIZE_T lpSize = 0; InitializeProcThreadAttributeList(NULL, 1, 0, &lpSize);
char * pTemp = new char[(int)lpSize]; LPPROC_THREAD_ATTRIBUTE_LIST AttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)pTemp;
InitializeProcThreadAttributeList(AttributeList, 1, 0, &lpSize);
if (!UpdateProcThreadAttribute( AttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &handle, sizeof(HANDLE), NULL, NULL)) { cout << "Fail to update attributes" << endl; return false; }
si.lpAttributeList = AttributeList;
PROCESS_INFORMATION pi; ZeroMemory(&pi, sizeof(pi));
if (CreateProcessAsUser(NULL, lpPath, 0, 0, 0, 0, EXTENDED_STARTUPINFO_PRESENT, 0, 0, (LPSTARTUPINFOA)&si, &pi)) { CloseHandle(pi.hProcess); CloseHandle(pi.hThread);
DeleteProcThreadAttributeList(AttributeList); delete []pTemp;
cout << "CreateProcessAsUserA Succeed ! ProcessId: " << pi.dwProcessId << endl; return true; } else { cout << "CreateProcessAsUserA Failed ! Error:" << GetLastError() << endl; } DeleteProcThreadAttributeList(AttributeList); delete []pTemp;
return false; }
|