#include <Windows.h>#include <iostream>#include <Psapi.h>#include <Tlhelp32.h>#include <sddl.h>#include <Shlwapi.h> using namespace std;#pragma comment (lib,"advapi32.lib")#pragma comment (lib,"Shlwapi.lib") VOID InjectToWinLogon(){       PROCESSENTRY32 entry;    HANDLE snapshot = NULL, proc = NULL;    entry.dwSize = sizeof(PROCESSENTRY32);    snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);     INT pid = -1;    if (Process32First(snapshot, &entry))    {        while (Process32Next(snapshot, &entry))        {            if (wcscmp(entry.szExeFile, L"winlogon.exe") == 0)            {                               pid = entry.th32ProcessID;                break;            }        }    }    CloseHandle(snapshot);    if (pid < 0)    {        //puts("[-] Could not find winlogon.exe");        return;    }      proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);    if (proc == NULL)    {        DWORD error = GetLastError();        puts("[-] Failed to open process.");        printf("error %d\n", error);        return;    }    TCHAR buffDll[MAX_PATH] = { 0 };    GetModuleFileName(NULL, buffDll, _countof(buffDll));    PathRemoveFileSpec(buffDll);    _tcscat_s(buffDll, _countof(buffDll), L"\\DllHookExitWindowsEx.dll");       LPVOID buffer = VirtualAllocEx(proc, NULL, sizeof(buffDll), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);    if (buffer == NULL)    {        printf("[-] Failed to allocate remote memory");    }    if (!WriteProcessMemory(proc, buffer, buffDll, sizeof(buffDll), 0))    {        puts("[-] Failed to write to remote memory");        return;    }           LPTHREAD_START_ROUTINE start = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(L"Kernel32.dll"), "LoadLibraryW");    HANDLE hthread = CreateRemoteThread(proc, 0, 0, (LPTHREAD_START_ROUTINE)start, buffer, 0, 0);        DWORD error = GetLastError();    if (hthread == INVALID_HANDLE_VALUE)    {        puts("[-] Failed to create remote thread");        return;    }} void EnableSeDebugPrivilegePrivilege(){    LUID luid;    HANDLE currentProc = OpenProcess(PROCESS_ALL_ACCESS, false, GetCurrentProcessId());    if (currentProc)    {        HANDLE TokenHandle = NULL;        BOOL hProcessToken = OpenProcessToken(currentProc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &TokenHandle);        if (hProcessToken)        {            BOOL checkToken = LookupPrivilegeValue(NULL, L"SeDebugPrivilege", &luid);             if (!checkToken)            {                //std::cout << "[+] Current process token already includes SeDebugPrivilege\n" << std::endl;            }            else            {                TOKEN_PRIVILEGES tokenPrivs;                 tokenPrivs.PrivilegeCount = 1;                tokenPrivs.Privileges[0].Luid = luid;                tokenPrivs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;                 BOOL adjustToken = AdjustTokenPrivileges(TokenHandle, FALSE, &tokenPrivs, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL);                 if (adjustToken != 0)                {                    //std::cout << "[+] Added SeDebugPrivilege to the current process token" << std::endl;                }            }            CloseHandle(TokenHandle);        }    }    CloseHandle(currentProc);} int _tmain(int argc, _TCHAR* argv[]){                    //开启权限 使之可以注入到syetem进程    EnableSeDebugPrivilegePrivilege();    //注入dll    InjectToWinLogon();     getchar();    return 0;}

#include <Windows.h>#include <Psapi.h>#include <Tlhelp32.h> #include "warningUser.h" #include <Shlwapi.h>#include <stdlib.h>#include <tchar.h> #pragma comment (lib,"Shlwapi.lib") LPVOID _copyNtShutdownSystem = NULL;LPVOID _ExitWindowsExAddTwoByte = NULL;HMODULE _gloDllModule = NULL;  #pragma warning(disable:4996) /*__declspec(naked)*/ void MyExitWindowsEx(){    /*__asm    {        call testMsgBox;        jmp _ExitWindowsExAddTwoByte    }*/} typedef BOOL(WINAPI* FuncExitWindowsEx)(_In_ UINT uFlags, _In_ DWORD dwReason);FuncExitWindowsEx _OldExitWindowsEx = NULL;  HANDLE gloCreateProcessHandle = NULL; BOOL WINAPI IATHookExitWindowsEx(_In_ UINT uFlags, _In_ DWORD dwReason){       BOOL bRet = FALSE;    static BOOL bNeedWarning = FALSE;    //__asm int 3    //DebugBreak();     /*if (uFlags & 0x200000)//win7 x86可以通过这句来判断是否是第二次调用 通过调试获得的   需要测试    {           }*/    if (bNeedWarning)    {        TCHAR wszProcessName[MAX_PATH] = { 0 };        GetModuleFileName(_gloDllModule, wszProcessName, _countof(wszProcessName));        PathRemoveFileSpec(wszProcessName);        _tcscat_s(wszProcessName, _countof(wszProcessName), L"\\LogOffWillRun.exe");        useTokenCreateProcess(gloCreateProcessHandle, wszProcessName);    }     bRet = _OldExitWindowsEx(uFlags, dwReason);    if (bRet)    {               bNeedWarning = TRUE;           }       return bRet;   } //这是 win7 x86上的 Iniline Hookvoid hook_ExitWindowsEx(){       HMODULE hUser32 = GetModuleHandle(L"user32.dll");    char* pOldExitWindowsEx = (char*)GetProcAddress(hUser32, "ExitWindowsEx");    char* pOldAddr = pOldExitWindowsEx;        //00540000 8bff            mov     edi, edi       int iLengthCopy = 7;    if (NULL != pOldAddr)    {        _copyNtShutdownSystem = VirtualAlloc(0, 1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE);        char* pNewAddr = (char*)_copyNtShutdownSystem;         char* pnop = pOldAddr - 5; //有5个字节的NOP        char aa = *pOldAddr;        char bb = *(pOldAddr+1);        if ((char)0x8b == *pOldAddr && (char)0xff == *(pOldAddr+1))        {            DWORD oldshutdownProtect = 0;            if (VirtualProtect(pOldAddr-5, iLengthCopy, PAGE_EXECUTE_READWRITE, &oldshutdownProtect))            {                //*pOldNtShutdownSyetem = (char)0xe9;//jmp                *pOldExitWindowsEx = (char)0xeB;//jmp 短跳转                *(UCHAR*)(pOldExitWindowsEx + 1) = (USHORT)(-0x7); //addr                 *pnop = (char)0xe9;//jmp                *(int*)(pnop + 1) = (int)MyExitWindowsEx-(int)(pnop + 5); //addr                _ExitWindowsExAddTwoByte = pOldExitWindowsEx + 2;                VirtualProtect(pOldAddr-5, iLengthCopy, oldshutdownProtect, NULL);            }        }           }    return;} BYTE* getNtHdrs(BYTE* pe_buffer){    if (pe_buffer == NULL) return NULL;     IMAGE_DOS_HEADER* idh = (IMAGE_DOS_HEADER*)pe_buffer;    if (idh->e_magic != IMAGE_DOS_SIGNATURE) {        return NULL;    }    const LONG kMaxOffset = 1024;    LONG pe_offset = idh->e_lfanew;    if (pe_offset > kMaxOffset) return NULL;    IMAGE_NT_HEADERS32* inh = (IMAGE_NT_HEADERS32*)((BYTE*)pe_buffer + pe_offset);    if (inh->Signature != IMAGE_NT_SIGNATURE) return NULL;    return (BYTE*)inh;} IMAGE_DATA_DIRECTORY* getPeDir(PVOID pe_buffer, size_t dir_id){    if (dir_id >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES) return NULL;     BYTE* nt_headers = getNtHdrs((BYTE*)pe_buffer);    if (nt_headers == NULL) return NULL;     IMAGE_DATA_DIRECTORY* peDir = NULL;     IMAGE_NT_HEADERS* nt_header = (IMAGE_NT_HEADERS*)nt_headers;    peDir = &(nt_header->OptionalHeader.DataDirectory[dir_id]);     if (peDir->VirtualAddress == NULL) {        return NULL;    }    return peDir; } bool FixDelayIATHook(PVOID modulePtr){       IMAGE_DATA_DIRECTORY* importsDir = getPeDir(modulePtr, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);    if (importsDir == NULL) return false;     size_t maxSize = importsDir->Size;    size_t impAddr = importsDir->VirtualAddress;     IMAGE_DELAYLOAD_DESCRIPTOR* lib_desc = NULL;    size_t parsedSize = 0;    bool bFound = TRUE;     size_t addrExitWindowsEx = (size_t)GetProcAddress(GetModuleHandle(L"User32"), "ExitWindowsEx");        for (; parsedSize < maxSize; parsedSize += sizeof(IMAGE_DELAYLOAD_DESCRIPTOR)) {         lib_desc = (IMAGE_DELAYLOAD_DESCRIPTOR*)(impAddr + parsedSize + (ULONG_PTR)modulePtr);         if (lib_desc->ImportAddressTableRVA == NULL && lib_desc->ImportNameTableRVA == NULL) break;         LPSTR lib_name = (LPSTR)((ULONGLONG)modulePtr + lib_desc->DllNameRVA);                size_t call_via = lib_desc->ImportAddressTableRVA;        size_t thunk_addr = lib_desc->ImportNameTableRVA;        if (thunk_addr == NULL) thunk_addr = lib_desc->ImportAddressTableRVA;         size_t offsetField = 0;        size_t offsetThunk = 0;               for (;; offsetField += sizeof(IMAGE_THUNK_DATA), offsetThunk += sizeof(IMAGE_THUNK_DATA))        {            IMAGE_THUNK_DATA* fieldThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetField + call_via);            IMAGE_THUNK_DATA* orginThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetThunk + thunk_addr);             if (0 == fieldThunk->u1.Function && 0 == orginThunk->u1.Function)            {                break;            }                       PIMAGE_IMPORT_BY_NAME by_name = NULL;            LPSTR func_name = NULL;            size_t addrOld = NULL;            if (orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32 || orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG64) // check if using ordinal (both x86 && x64)            {                addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), (char*)(orginThunk->u1.Ordinal & 0xFFFF));//通过序号也可以获取到  获取低两个字节 也可以获取到函数地址                //printf("        [V] API %x at %x\n", orginThunk->u1.Ordinal, addr);                //fieldThunk->u1.Function = addr;                               continue;            }            else            {                by_name = (PIMAGE_IMPORT_BY_NAME)(size_t(modulePtr) + orginThunk->u1.AddressOfData);                func_name = (LPSTR)by_name->Name;                addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), func_name);            }                                   //printf("        [V] API %s at %x\n", func_name, addr);            OutputDebugStringA("\r\n");            OutputDebugStringA(func_name);            //HOOK                       if (strcmpi(func_name, "ExitWindowsEx") == 0)            {                               //DebugBreak();                DWORD dOldProtect = 0;                size_t* pFuncAddr = (size_t*)&fieldThunk->u1.Function;                if (VirtualProtect(pFuncAddr, sizeof(size_t), PAGE_EXECUTE_READWRITE, &dOldProtect))                {                    fieldThunk->u1.Function = (size_t)IATHookExitWindowsEx;                    VirtualProtect(pFuncAddr, sizeof(size_t), dOldProtect, &dOldProtect);                    _OldExitWindowsEx = (FuncExitWindowsEx)addrExitWindowsEx;                    bFound = true;                    return bFound;                }                               break;            }         }     }       return true;} bool FixIATHook(PVOID modulePtr){    IMAGE_DATA_DIRECTORY* importsDir = getPeDir(modulePtr, IMAGE_DIRECTORY_ENTRY_IMPORT);    if (importsDir == NULL) return false;     size_t maxSize = importsDir->Size;    size_t impAddr = importsDir->VirtualAddress;     IMAGE_IMPORT_DESCRIPTOR* lib_desc = NULL;    size_t parsedSize = 0;    bool bFound = TRUE;       size_t addrExitWindowsEx = (size_t)GetProcAddress(GetModuleHandle(L"User32"), "ExitWindowsEx");     for (; parsedSize < maxSize; parsedSize += sizeof(IMAGE_IMPORT_DESCRIPTOR)) {        lib_desc = (IMAGE_IMPORT_DESCRIPTOR*)(impAddr + parsedSize + (ULONG_PTR)modulePtr);        if (lib_desc->OriginalFirstThunk == NULL && lib_desc->FirstThunk == NULL)            break;         LPSTR lib_name = (LPSTR)((size_t)modulePtr + lib_desc->Name);         size_t call_via = lib_desc->FirstThunk;        size_t thunk_addr = lib_desc->OriginalFirstThunk;        if (thunk_addr == NULL)            thunk_addr = lib_desc->FirstThunk;         size_t offsetField = 0;        size_t offsetThunk = 0;         for (;; offsetField += sizeof(IMAGE_THUNK_DATA), offsetThunk += sizeof(IMAGE_THUNK_DATA))        {            IMAGE_THUNK_DATA* fieldThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetField + call_via);            IMAGE_THUNK_DATA* orginThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetThunk + thunk_addr);             if (0 == fieldThunk->u1.Function && 0 == orginThunk->u1.Function)            {                break;            }             PIMAGE_IMPORT_BY_NAME by_name = NULL;            LPSTR func_name = NULL;            size_t addrOld = NULL;            if (orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32 || orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG64) // check if using ordinal (both x86 && x64)            {                addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), (char*)(orginThunk->u1.Ordinal & 0xFFFF));//通过序号?                //printf("        [V] API %x at %x\n", orginThunk->u1.Ordinal, addr);                //fieldThunk->u1.Function = addr;                   //DebugBreak();                continue;            }            else            {                by_name = (PIMAGE_IMPORT_BY_NAME)(size_t(modulePtr) + orginThunk->u1.AddressOfData);                func_name = (LPSTR)by_name->Name;                addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), func_name);            }            //printf("        [V] API %s at %x\n", func_name, addr);            OutputDebugStringA("\r\n");            OutputDebugStringA(func_name);            //HOOK                       if (strcmpi(func_name, "ExitWindowsEx") == 0)            {                               //DebugBreak();                                                               DWORD dOldProtect = 0;                size_t* pFuncAddr = (size_t*)&fieldThunk->u1.Function;                if (VirtualProtect(pFuncAddr, sizeof(size_t), PAGE_EXECUTE_READWRITE, &dOldProtect))                {                    fieldThunk->u1.Function = (size_t)IATHookExitWindowsEx;                    VirtualProtect(pFuncAddr, sizeof(size_t), dOldProtect, &dOldProtect);                    _OldExitWindowsEx = (FuncExitWindowsEx)addrExitWindowsEx;                    bFound = true;                    return bFound;                }                           }        }                   }    return true;   } BOOL APIENTRY DllMain( HMODULE hModule,                       DWORD  ul_reason_for_call,                       LPVOID lpReserved                     ){     switch (ul_reason_for_call)    {    case DLL_PROCESS_ATTACH:    {               //DebugBreak();        _gloDllModule = hModule;        gloCreateProcessHandle = getMediumProcessToken();              HMODULE exeModule = GetModuleHandle(NULL);               FixIATHook(exeModule);        FixDelayIATHook(exeModule);                       break;    }           case DLL_THREAD_ATTACH:    case DLL_THREAD_DETACH:    case DLL_PROCESS_DETACH:    {        if (gloCreateProcessHandle != NULL)        {            CloseHandle(gloCreateProcessHandle);            gloCreateProcessHandle = NULL;        }    }        break;    }    return TRUE;}

HANDLE getMediumProcessToken();void useTokenCreateProcess(HANDLE hToken, TCHAR* szProcessName);

#include "warningUser.h"#include <Windows.h>#include <sddl.h>#include <tchar.h>#include <Shlwapi.h>#include <stdlib.h> #pragma comment(lib, "Advapi32.lib")#pragma comment (lib,"Shlwapi.lib") HANDLE getMediumProcessToken(){    WCHAR* wszIntegritySid = L"S-1-16-8192";    //CreateIntegritySidProcess(L"S-1-16-4096");//low权限进程    //CreateIntegritySidProcess(L"S-1-16-8192");//medium权限进程    //CreateIntegritySidProcess(L"S-1-16-12288");//high权限进程    //CreateIntegritySidProcess(L"S-1-16-16384");//system权限进程    HANDLE mediumToken = NULL;       HANDLE hToken = NULL;    HANDLE hNewToken = NULL;     PSID pIntegritySid = NULL;    TOKEN_MANDATORY_LABEL TIL = { 0 };       __try    {        if (FALSE == OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &hToken))        {            __leave;        }        if (FALSE == DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL,            SecurityImpersonation, TokenPrimary, &hNewToken))        {            __leave;        }        if (FALSE == ConvertStringSidToSid(wszIntegritySid, &pIntegritySid))        {            __leave;        }        TIL.Label.Attributes = SE_GROUP_INTEGRITY;        TIL.Label.Sid = pIntegritySid;         // Set the process integrity level        if (FALSE == SetTokenInformation(hNewToken, TokenIntegrityLevel, &TIL,            sizeof(TOKEN_MANDATORY_LABEL)+GetLengthSid(pIntegritySid)))        {            __leave;        }        mediumToken = hNewToken;    }    __finally    {        if (NULL != pIntegritySid)        {            LocalFree(pIntegritySid);            pIntegritySid = NULL;        }        if (NULL != hToken)        {            CloseHandle(hToken);            hToken = NULL;        }     }    return mediumToken;} void useTokenCreateProcess(HANDLE hToken, TCHAR* szProcessName){    //LogOffWillRun     //WCHAR wszProcessName[MAX_PATH] = L"C:\\Windows\\System32\\CMD.exe";    PROCESS_INFORMATION ProcInfo = { 0 };    STARTUPINFO StartupInfo = { 0 };    StartupInfo.cb = sizeof(STARTUPINFO);    //si.dwXSize = 120;    //StartupInfo.lpDesktop = L"WinSta0\\Default";    StartupInfo.lpDesktop = L"WinSta0\\winlogon";    StartupInfo.dwFlags = STARTF_USESHOWWINDOW;    StartupInfo.wShowWindow = SW_SHOWNORMAL;    BOOL bRet = CreateProcessAsUser(hToken, NULL,        szProcessName, NULL, NULL, FALSE,        0, NULL, NULL, &StartupInfo, &ProcInfo);    if (bRet)    {        WaitForSingleObject(ProcInfo.hProcess, INFINITE);    }    if (ProcInfo.hProcess)    {        CloseHandle(ProcInfo.hProcess);        ProcInfo.hProcess = NULL;    }    if (ProcInfo.hThread)    {        CloseHandle(ProcInfo.hThread);        ProcInfo.hThread = NULL;    }}

#include <Windows.h> #pragma comment(lib, "User32.lib")int _tmain(int argc, _TCHAR* argv[]){    MessageBox(GetConsoleWindow(), _TEXT("调用了ExitWindowsEx进行关机或者注销"), _TEXT("提示"), MB_OK);    return 0;}

if (bNeedWarning){    MessageBox(NULL, _TEXT("弹框提示"), _TEXT("提示"), MB_OK);}

# 往期推荐

1.CVE-2022-21882提权漏洞学习笔记

2.wibu证书 - 初探

3.win10 1909逆向之APIC中断和实验

4.EMET下EAF机制分析以及模拟实现

5.sql注入学习分享

6.V8 Array.prototype.concat函数出现过的issues和他们的POC们