├── version3 ├── ListTokens.cpp ├── ListTokens.h ├── Execute.cpp ├── Helper.cpp ├── TokenUtil.h ├── Helper.h ├── StructureInfo.h ├── TokenInforUtil.h ├── TokenInforUtil.cpp ├── ProcessInforUtil.cpp ├── ProcessInforUtil.h ├── getopt.h ├── settings.h ├── .vscode │ └── c_cpp_properties.json ├── TokenUtil.vcxproj.user ├── getopt.cpp ├── Execute.h ├── TokenUtil.sln ├── TokenUtil.vcxproj.filters ├── TokenUtil.vcxproj └── TokenUtil.cpp ├── img ├── 0.jpg ├── 1.png ├── 2.png └── 3.png ├── version1 ├── TokenUtils.cpp ├── logonSession.cpp ├── tidtest.h ├── logonSession.h ├── getopt.h ├── test.vcxproj.user ├── TokenUtils.h ├── getopt.cpp ├── test.sln ├── test.vcxproj.filters ├── tidtest.cpp └── test.vcxproj ├── version2 ├── TokenUtils.cpp ├── TokenUtils.h ├── logonSession.cpp ├── logonSession.h ├── getopt.h ├── getopt.cpp ├── test.vcxproj.user ├── test.sln ├── test.vcxproj.filters └── test.vcxproj ├── .gitignore └── README.md /version3/ListTokens.cpp: -------------------------------------------------------------------------------- 1 | #include "ListTokens.h" 2 | -------------------------------------------------------------------------------- /img/0.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/img/0.jpg -------------------------------------------------------------------------------- /img/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/img/1.png -------------------------------------------------------------------------------- /img/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/img/2.png -------------------------------------------------------------------------------- /img/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/img/3.png -------------------------------------------------------------------------------- /version3/ListTokens.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | class ListTokens 3 | { 4 | }; 5 | 6 | -------------------------------------------------------------------------------- /version3/Execute.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/Execute.cpp -------------------------------------------------------------------------------- /version3/Helper.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/Helper.cpp -------------------------------------------------------------------------------- /version3/TokenUtil.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/TokenUtil.h -------------------------------------------------------------------------------- /version1/TokenUtils.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version1/TokenUtils.cpp -------------------------------------------------------------------------------- /version2/TokenUtils.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version2/TokenUtils.cpp -------------------------------------------------------------------------------- /version2/TokenUtils.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version2/TokenUtils.h -------------------------------------------------------------------------------- /version3/Helper.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | class Helper { 3 | public: 4 | static void print_usage(); 5 | }; -------------------------------------------------------------------------------- /version1/logonSession.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version1/logonSession.cpp -------------------------------------------------------------------------------- /version1/tidtest.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | 5 | int getPIDFromTid(DWORD dwThreadId); -------------------------------------------------------------------------------- /version2/logonSession.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version2/logonSession.cpp -------------------------------------------------------------------------------- /version3/StructureInfo.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/StructureInfo.h -------------------------------------------------------------------------------- /version3/TokenInforUtil.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/TokenInforUtil.h -------------------------------------------------------------------------------- /version3/TokenInforUtil.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/TokenInforUtil.cpp -------------------------------------------------------------------------------- /version3/ProcessInforUtil.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/chroblert/JCTokenUtil/HEAD/version3/ProcessInforUtil.cpp -------------------------------------------------------------------------------- /version1/logonSession.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | 5 | #include 6 | #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) 7 | 8 | int EnumLogonSessions(); -------------------------------------------------------------------------------- /version2/logonSession.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | 5 | //#include 6 | #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) 7 | 8 | int EnumLogonSessions(); -------------------------------------------------------------------------------- /version3/ProcessInforUtil.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include "settings.h" 7 | 8 | class ProcessInforUtil 9 | { 10 | public: 11 | static BOOL GetProcessNameFromPid(DWORD pid, TCHAR* tProcName); 12 | }; 13 | 14 | -------------------------------------------------------------------------------- /version1/getopt.h: -------------------------------------------------------------------------------- 1 | //#pragma once 2 | #include 3 | #ifndef GETOPT_H__ 4 | #define GETOPT_H__ 5 | 6 | #ifdef __cplusplus 7 | extern "C" { 8 | #endif 9 | 10 | extern TCHAR* optarg; 11 | extern int optind; 12 | 13 | int getopt(int argc, TCHAR* const argv[], const char* optstring); 14 | 15 | #ifdef __cplusplus 16 | } 17 | #endif 18 | 19 | #endif -------------------------------------------------------------------------------- /version2/getopt.h: -------------------------------------------------------------------------------- 1 | //#pragma once 2 | #include 3 | #ifndef GETOPT_H__ 4 | #define GETOPT_H__ 5 | 6 | #ifdef __cplusplus 7 | extern "C" { 8 | #endif 9 | 10 | extern TCHAR* optarg; 11 | extern int optind; 12 | 13 | int getopt(int argc, TCHAR* const argv[], const char* optstring); 14 | 15 | #ifdef __cplusplus 16 | } 17 | #endif 18 | 19 | #endif -------------------------------------------------------------------------------- /version3/getopt.h: -------------------------------------------------------------------------------- 1 | //#pragma once 2 | #include 3 | #ifndef GETOPT_H__ 4 | #define GETOPT_H__ 5 | 6 | #ifdef __cplusplus 7 | extern "C" { 8 | #endif 9 | 10 | extern TCHAR* optarg; 11 | extern int optind; 12 | 13 | int getopt(int argc, TCHAR* const argv[], const char* optstring); 14 | 15 | #ifdef __cplusplus 16 | } 17 | #endif 18 | 19 | #endif -------------------------------------------------------------------------------- /version1/test.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -p 1352 5 | WindowsLocalDebugger 6 | 7 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | # 此 .gitignore 文件已由 Microsoft(R) Visual Studio 自动创建。 3 | ################################################################################ 4 | 5 | /version1/.vs/ 6 | /version1/Release/ 7 | /version1/Debug/ 8 | /version1/x64/ 9 | /version2/.vs/ 10 | /version2/Release/ 11 | /version2/Debug/ 12 | /version2/x64/ 13 | /version3/.vs/ 14 | /version3/Release/ 15 | /version3/Debug/ 16 | /version3/x64/ -------------------------------------------------------------------------------- /version3/settings.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #define Token_List_Node_Count 1000 3 | #define BUFSIZE 4096 4 | #define BUF_SIZE 4096 5 | #define PROCNAME_CHAR_COUNT 260 6 | #define DOMAIN_CHAR_COUNT 100 7 | #define USERNAME_CHAR_COUNT 50 8 | #define TOKENLIST_NODE_COUNT 1000 9 | #define USER_LIST_COUNT 10 10 | 11 | #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) 12 | #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) 13 | #define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L) 14 | #define NT_SUCCESS(x) ((x)>=0) 15 | #define STATUS_NO_TOKEN 0xC000007C 16 | 17 | -------------------------------------------------------------------------------- /version1/TokenUtils.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #pragma comment(lib, "advapi32.lib") 5 | #pragma comment(lib,"user32.lib") 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include "psapi.h" 11 | #include 12 | #include 13 | #include 14 | #define BUF_SIZE 4096 15 | #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) 16 | 17 | #pragma comment(lib,"Secur32.lib") 18 | #include "getopt.h" 19 | #include "logonSession.h" 20 | 21 | 22 | VOID GetSessionData(PLUID); 23 | DWORD GetThreadListFromPid(DWORD dwOwnerPID, DWORD** pThreadList); 24 | BOOL GetInfoFromTid(DWORD tid); -------------------------------------------------------------------------------- /version3/.vscode/c_cpp_properties.json: -------------------------------------------------------------------------------- 1 | { 2 | "configurations": [ 3 | { 4 | "name": "Win32", 5 | "includePath": [ 6 | "${workspaceFolder}/**" 7 | ], 8 | "defines": [ 9 | "_DEBUG", 10 | "UNICODE", 11 | "_UNICODE" 12 | ], 13 | "windowsSdkVersion": "10.0.17763.0", 14 | "compilerPath": "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Tools/MSVC/14.16.27023/bin/Hostx64/x64/cl.exe", 15 | "cStandard": "c17", 16 | "cppStandard": "c++17", 17 | "intelliSenseMode": "windows-msvc-x64" 18 | } 19 | ], 20 | "version": 4 21 | } -------------------------------------------------------------------------------- /version3/TokenUtil.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | false 5 | 6 | 7 | ListTokens 8 | WindowsLocalDebugger 9 | 10 | 11 | Execute -e "whoami" 12 | WindowsLocalDebugger 13 | 14 | -------------------------------------------------------------------------------- /version1/getopt.cpp: -------------------------------------------------------------------------------- 1 | #include "getopt.h" 2 | #include 3 | #include 4 | #include 5 | 6 | TCHAR* optarg = NULL; 7 | int optind = 1; 8 | 9 | int getopt(int argc, TCHAR* const argv[], const char* optstring) 10 | { 11 | if ((optind >= argc) || (argv[optind][0] != '-') || (argv[optind][0] == 0)) 12 | { 13 | return -1; 14 | } 15 | 16 | int opt = argv[optind][1]; 17 | const char* p = strchr(optstring, opt); 18 | 19 | if (p == NULL) 20 | { 21 | return '?'; 22 | } 23 | //wcscpy_s(optarg,_countof(L"no"),L"no"); 24 | //_tcscpy(optarg, L"no"); 25 | if (p[1] == ':') 26 | { 27 | optind++; 28 | if (optind >= argc) 29 | { 30 | return '?'; 31 | } 32 | optarg = argv[optind]; 33 | } 34 | optind++; 35 | return opt; 36 | } -------------------------------------------------------------------------------- /version2/getopt.cpp: -------------------------------------------------------------------------------- 1 | #include "getopt.h" 2 | #include 3 | #include 4 | #include 5 | 6 | TCHAR* optarg = NULL; 7 | int optind = 1; 8 | 9 | int getopt(int argc, TCHAR* const argv[], const char* optstring) 10 | { 11 | if ((optind >= argc) || (argv[optind][0] != '-') || (argv[optind][0] == 0)) 12 | { 13 | return -1; 14 | } 15 | 16 | int opt = argv[optind][1]; 17 | const char* p = strchr(optstring, opt); 18 | 19 | if (p == NULL) 20 | { 21 | return '?'; 22 | } 23 | //wcscpy_s(optarg,_countof(L"no"),L"no"); 24 | //_tcscpy(optarg, L"no"); 25 | if (p[1] == ':') 26 | { 27 | optind++; 28 | if (optind >= argc) 29 | { 30 | return '?'; 31 | } 32 | optarg = argv[optind]; 33 | } 34 | optind++; 35 | return opt; 36 | } -------------------------------------------------------------------------------- /version3/getopt.cpp: -------------------------------------------------------------------------------- 1 | #include "getopt.h" 2 | #include 3 | #include 4 | #include 5 | 6 | TCHAR* optarg = NULL; 7 | int optind = 1; 8 | 9 | int getopt(int argc, TCHAR* const argv[], const char* optstring) 10 | { 11 | if ((optind >= argc) || (argv[optind][0] != '-') || (argv[optind][0] == 0)) 12 | { 13 | return -1; 14 | } 15 | 16 | int opt = argv[optind][1]; 17 | const char* p = strchr(optstring, opt); 18 | 19 | if (p == NULL) 20 | { 21 | return '?'; 22 | } 23 | //wcscpy_s(optarg,_countof(L"no"),L"no"); 24 | //_tcscpy(optarg, L"no"); 25 | if (p[1] == ':') 26 | { 27 | optind++; 28 | if (optind >= argc) 29 | { 30 | return '?'; 31 | } 32 | optarg = argv[optind]; 33 | } 34 | optind++; 35 | return opt; 36 | } -------------------------------------------------------------------------------- /version2/test.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -p 1352 5 | WindowsLocalDebugger 6 | 7 | 8 | -p ALL 9 | WindowsLocalDebugger 10 | 11 | 12 | -p 9484 13 | WindowsLocalDebugger 14 | 15 | -------------------------------------------------------------------------------- /version3/Execute.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include "TokenInforUtil.h" 5 | #include "settings.h" 6 | #include 7 | 8 | static HANDLE hChildStdinRd, hChildStdinWr, hChildStdoutRd, hChildStdoutWr, hStdout; 9 | 10 | class Execute 11 | { 12 | public: 13 | static BOOL ExecuteWithToken(HANDLE hToken,TCHAR* tCommand,BOOL bConsoleMode); 14 | static BOOL ExecuteMain(TCHAR* tUsername, DWORD dwPid,TCHAR* tCommand, BOOL bConsoleMode); 15 | static void CreateProcessWithPipeComm(HANDLE token, TCHAR* command); 16 | static void CreateChildProcess(HANDLE token, TCHAR* command, PROCESS_INFORMATION* piProcInfo); 17 | static DWORD WINAPI ReadFromPipe(LPVOID p); 18 | static DWORD WINAPI WriteToPipe(LPVOID p); 19 | static BOOL output_counted_string(char* string, DWORD dwRead); 20 | static BOOL read_counted_input(char* string, int string_size, DWORD* dwRead); 21 | static void create_process(HANDLE token, TCHAR* command, BOOL console_mode, SECURITY_IMPERSONATION_LEVEL impersonation_level); 22 | }; 23 | -------------------------------------------------------------------------------- /version1/test.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30503.244 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AccessToken", "test.vcxproj", "{C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x64.ActiveCfg = Debug|x64 17 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x64.Build.0 = Debug|x64 18 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x86.ActiveCfg = Debug|Win32 19 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x86.Build.0 = Debug|Win32 20 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x64.ActiveCfg = Release|x64 21 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x64.Build.0 = Release|x64 22 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x86.ActiveCfg = Release|Win32 23 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {6BF62FA9-797E-467A-828E-B2A4200E4FA0} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /version2/test.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30503.244 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AccessToken", "test.vcxproj", "{C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x64.ActiveCfg = Debug|x64 17 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x64.Build.0 = Debug|x64 18 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x86.ActiveCfg = Debug|Win32 19 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Debug|x86.Build.0 = Debug|Win32 20 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x64.ActiveCfg = Release|x64 21 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x64.Build.0 = Release|x64 22 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x86.ActiveCfg = Release|Win32 23 | {C2D1147C-E86B-48FF-8EC7-D7FC4B2068CD}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {6BF62FA9-797E-467A-828E-B2A4200E4FA0} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /version3/TokenUtil.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30503.244 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TokenUtil", "TokenUtil.vcxproj", "{424BCF0A-2042-41F8-9D97-B59A2DEC5853}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Debug|x64.ActiveCfg = Debug|x64 17 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Debug|x64.Build.0 = Debug|x64 18 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Debug|x86.ActiveCfg = Debug|Win32 19 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Debug|x86.Build.0 = Debug|Win32 20 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Release|x64.ActiveCfg = Release|x64 21 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Release|x64.Build.0 = Release|x64 22 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Release|x86.ActiveCfg = Release|Win32 23 | {424BCF0A-2042-41F8-9D97-B59A2DEC5853}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {1353E5A2-5284-45DF-B71C-E32703B8488D} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /version2/test.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 源文件 20 | 21 | 22 | 源文件 23 | 24 | 25 | 源文件 26 | 27 | 28 | 29 | 30 | 头文件 31 | 32 | 33 | 头文件 34 | 35 | 36 | 头文件 37 | 38 | 39 | -------------------------------------------------------------------------------- /version1/test.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 源文件 20 | 21 | 22 | 源文件 23 | 24 | 25 | 源文件 26 | 27 | 28 | 源文件 29 | 30 | 31 | 32 | 33 | 头文件 34 | 35 | 36 | 头文件 37 | 38 | 39 | 头文件 40 | 41 | 42 | 头文件 43 | 44 | 45 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## 0x01 前言 2 | 详见[Zer0ne安全研究]公众号 3 | ## 0x02 介绍 4 | 本工具参考incognito的代码进行编写，完成了获取token和以某token执行命令两个功能。 5 | 6 | 在获取系统上所有token的时候，incognito工具使用NtQuerySystemInformation微软未公开API获取系统上所有的进程，然后再获取该进程上句柄表中的每一个句柄，判断是不是token句柄，若是则保存。 7 | JCTokenUtils工具同样使用NtQuerySystemInformation微软未公开API，不过是直接获取系统上所有的句柄，之后判断是不是token句柄，若是则保存。由于句柄表中没有保存进程自身的主令牌，因而会使用OpenProcessTokenAPI获取并保存进程的主令牌。 8 | 以某个令牌执行命令，本工具基本参照incognito工具编写，没有区别。 9 | ## 0x03 使用 10 | ### 0x0301 命令介绍 11 | ```shell 12 | Usage: TokenUtil.exe [OPTION] 13 | 14 | [MODULE] 15 | ListTokens 16 | [OPTION] 17 | -p : 列出某个进程中的令牌 18 | -P : 列出某个进程的令牌 19 | -u : 列出某个用户的令牌 20 | -v : 详细模式 // 不加-v，每个用户只输出一次 21 | 22 | example: 23 | TokenUtils.exe ListTokens -u "NT AUTHORITY\SYSTEM" 24 | TokenUtils.exe ListTokens -P "cmd" 25 | TokenUtils.exe ListTokens -P "cmd" -u "NT AUTHORITY\SYSTEM" 26 | 27 | [MODULE] 28 | Execute 29 | [OPTION] 30 | -p : 以指定pid的token执行命令 31 | -u : 以某个用户执行命令，与-e 结合使用 32 | -e : 执行命令 33 | -c: 是否在当前终端下执行 34 | -v : 详细模式 35 | 36 | example: 37 | TokenUtils.exe Execute -p -e whoami -c 38 | TokenUtils.exe Execute -u "NT AUTHORITY\SYSTEM" -e whoami -c 39 | TokenUtils.exe Execute -p -u "NT AUTHORITY\SYSTEM" -e whoami -c 40 | ``` 41 | ### 0x0302 使用说明 42 | 43 | ◊ -P -u参数值大小写敏感 44 | ◊ 同时使用-P -u参数表示同时满足两个条件 45 | ◊ 获取token时同一个用户只输出一次，使用-v参数，则输出所有用户 46 | ### 0x0303 使用效果 47 | `TokenUtil.exe ListTokens -u jerrybird` 48 | ![](img/1.png) 49 | `TokenUtils.exe ListTokens -u jerrybird -v` 50 | ![](img/2.png) 51 | `TokenUtil.exe Execute -u "DESKTOP-UIK8D53\test" -e cmd -c` 52 | ![](img/3.png) 53 | 54 | -------------------------------------------------------------------------------- /version3/TokenUtil.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 源文件 20 | 21 | 22 | 源文件 23 | 24 | 25 | 源文件 26 | 27 | 28 | 源文件 29 | 30 | 31 | 源文件 32 | 33 | 34 | 源文件 35 | 36 | 37 | 源文件 38 | 39 | 40 | 41 | 42 | 头文件 43 | 44 | 45 | 头文件 46 | 47 | 48 | 头文件 49 | 50 | 51 | 头文件 52 | 53 | 54 | 头文件 55 | 56 | 57 | 头文件 58 | 59 | 60 | 头文件 61 | 62 | 63 | 头文件 64 | 65 | 66 | 头文件 67 | 68 | 69 | -------------------------------------------------------------------------------- /version1/tidtest.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #pragma comment(lib,"psapi.lib") 8 | 9 | 10 | typedef enum _THREADINFOCLASS { 11 | ThreadBasicInformation, 12 | ThreadTimes, 13 | ThreadPriority, 14 | ThreadBasePriority, 15 | ThreadAffinityMask, 16 | ThreadImpersonationToken, 17 | ThreadDescriptorTableEntry, 18 | ThreadEnableAlignmentFaultFixup, 19 | ThreadEventPair_Reusable, 20 | ThreadQuerySetWin32StartAddress, 21 | ThreadZeroTlsCell, 22 | ThreadPerformanceCount, 23 | ThreadAmILastThread, 24 | ThreadIdealProcessor, 25 | ThreadPriorityBoost, 26 | ThreadSetTlsArrayAddress, 27 | ThreadIsIoPending, 28 | ThreadHideFromDebugger, 29 | ThreadBreakOnTermination, 30 | MaxThreadInfoClass 31 | } THREADINFOCLASS; 32 | typedef struct _CLIENT_ID { 33 | HANDLE UniqueProcess; 34 | HANDLE UniqueThread; 35 | } CLIENT_ID; 36 | typedef CLIENT_ID* PCLIENT_ID; 37 | typedef struct _THREAD_BASIC_INFORMATION { // Information Class 0 38 | LONG ExitStatus; 39 | PVOID TebBaseAddress; 40 | CLIENT_ID ClientId; 41 | LONG AffinityMask; 42 | LONG Priority; 43 | LONG BasePriority; 44 | } THREAD_BASIC_INFORMATION, * PTHREAD_BASIC_INFORMATION; 45 | extern "C" LONG(__stdcall * ZwQueryInformationThread) ( 46 | IN HANDLE ThreadHandle, 47 | IN THREADINFOCLASS ThreadInformationClass, 48 | OUT PVOID ThreadInformation, 49 | IN ULONG ThreadInformationLength, 50 | OUT PULONG ReturnLength OPTIONAL 51 | ) = NULL; 52 | 53 | int getPIDFromTid(DWORD dwThreadId) { 54 | setlocale(LC_ALL, ".ACP"); 55 | HINSTANCE hNTDLL = ::GetModuleHandle(TEXT("ntdll")); 56 | (FARPROC&)ZwQueryInformationThread = ::GetProcAddress(hNTDLL, "ZwQueryInformationThread"); 57 | THREAD_BASIC_INFORMATION tbi; 58 | PVOID startaddr; 59 | LONG status; 60 | HANDLE thread, process; 61 | // DWORD dwThreadId = 3840; 62 | //thread = ::OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadId); 63 | thread = ::OpenThread(THREAD_QUERY_INFORMATION, FALSE, dwThreadId); 64 | 65 | DWORD error; 66 | if (NULL == thread) { 67 | thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, TRUE, dwThreadId); 68 | if (thread == NULL) { 69 | error = ::GetLastError(); 70 | SetLastError(error); 71 | std::cout << "\t打开线程失败，ERROR:" << error << std::endl; 72 | return FALSE; 73 | } 74 | } 75 | //error = GetLastError(); 76 | //if (thread == NULL) 77 | //{ 78 | // printf("\tcannot open thread handle\n"); 79 | // std::cout << "\tError: " << error << std::endl; 80 | // return FALSE; 81 | //} 82 | status = ZwQueryInformationThread(thread, ThreadQuerySetWin32StartAddress, &startaddr, sizeof(startaddr), NULL); 83 | error = ::GetLastError(); 84 | 85 | if (status < 0) 86 | { 87 | CloseHandle(thread); 88 | SetLastError(error); 89 | std::cout << "\tZwQueryInformationThread失败,ERROR:" << error << std::endl; 90 | //printf("\tcannot get status1\n"); 91 | return FALSE; 92 | }; 93 | //printf("线程 %08x 的起始地址为 %p\n", dwThreadId, startaddr); 94 | status = ZwQueryInformationThread(thread, 95 | ThreadBasicInformation, 96 | &tbi, 97 | sizeof(tbi), 98 | NULL); 99 | if (status < 0) 100 | { 101 | CloseHandle(thread); 102 | printf("cannot get status2\n"); 103 | return FALSE; 104 | }; 105 | // printf("线程 %08d 所在进程ID为 %08d\n", dwThreadId, (DWORD)tbi.ClientId.UniqueProcess); 106 | process = ::OpenProcess(PROCESS_ALL_ACCESS, 107 | FALSE, 108 | (DWORD)tbi.ClientId.UniqueProcess); 109 | if (process == NULL) 110 | { 111 | DWORD error = ::GetLastError(); 112 | CloseHandle(thread); 113 | SetLastError(error); 114 | return FALSE; 115 | }; 116 | TCHAR modname[0x100]; 117 | ::GetModuleFileNameEx(process, NULL, modname, 0x100); 118 | //printf("线程 %08x 所在进程映象为 %S\n", dwThreadId, modname); 119 | GetMappedFileName(process, 120 | startaddr, 121 | modname, 122 | 0x100); 123 | /*std::string stName(pName); 124 | std::string stModName(modname); 125 | if (stModName.find(stName) != std::string::npos) 126 | { 127 | printf("线程 %08x 可执行代码所在模块为 %s\n", dwThreadId, modname); 128 | ret = TRUE; 129 | }*/ 130 | CloseHandle(process); 131 | CloseHandle(thread); 132 | 133 | return (DWORD)tbi.ClientId.UniqueProcess; 134 | 135 | } -------------------------------------------------------------------------------- /version1/test.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {c2d1147c-e86b-48ff-8ec7-d7fc4b2068cd} 25 | test 26 | 10.0 27 | 28 | 29 | AccessToken 30 | 31 | 32 | 33 | Application 34 | true 35 | v142 36 | Unicode 37 | 38 | 39 | Application 40 | false 41 | v142 42 | true 43 | Unicode 44 | false 45 | 46 | 47 | Application 48 | true 49 | v142 50 | Unicode 51 | 52 | 53 | Application 54 | false 55 | v142 56 | true 57 | Unicode 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | true 79 | 80 | 81 | false 82 | false 83 | 84 | 85 | true 86 | 87 | 88 | false 89 | 90 | 91 | 92 | Level3 93 | true 94 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 95 | true 96 | 97 | 98 | Console 99 | true 100 | 101 | 102 | 103 | 104 | Level3 105 | true 106 | true 107 | false 108 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 109 | true 110 | MultiThreadedDebug 111 | 112 | 113 | Console 114 | true 115 | true 116 | true 117 | RequireAdministrator 118 | false 119 | 120 | 121 | 122 | 123 | Level3 124 | false 125 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 126 | true 127 | MultiThreadedDebug 128 | 129 | 130 | Console 131 | true 132 | 133 | 134 | 135 | 136 | Level3 137 | true 138 | true 139 | true 140 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 141 | true 142 | 143 | 144 | Console 145 | true 146 | true 147 | true 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | -------------------------------------------------------------------------------- /version2/test.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {c2d1147c-e86b-48ff-8ec7-d7fc4b2068cd} 25 | test 26 | 10.0 27 | 28 | 29 | AccessToken 30 | 31 | 32 | 33 | Application 34 | true 35 | v142 36 | Unicode 37 | 38 | 39 | Application 40 | false 41 | v142 42 | true 43 | Unicode 44 | false 45 | 46 | 47 | Application 48 | true 49 | v142 50 | Unicode 51 | 52 | 53 | Application 54 | false 55 | v142 56 | true 57 | Unicode 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | true 79 | 80 | 81 | false 82 | false 83 | 84 | 85 | true 86 | 87 | 88 | false 89 | 90 | 91 | 92 | Level3 93 | false 94 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 95 | true 96 | MultiThreadedDebug 97 | 98 | 99 | Console 100 | true 101 | 102 | 103 | 104 | 105 | Level3 106 | true 107 | true 108 | false 109 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 110 | true 111 | MultiThreadedDebug 112 | 113 | 114 | Console 115 | true 116 | true 117 | true 118 | RequireAdministrator 119 | false 120 | 121 | 122 | 123 | 124 | Level3 125 | false 126 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 127 | true 128 | MultiThreadedDebug 129 | 130 | 131 | Console 132 | true 133 | 134 | 135 | 136 | 137 | Level3 138 | true 139 | true 140 | false 141 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 142 | true 143 | MultiThreadedDebug 144 | 145 | 146 | Console 147 | true 148 | true 149 | true 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | -------------------------------------------------------------------------------- /version3/TokenUtil.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {424bcf0a-2042-41f8-9d97-b59a2dec5853} 25 | TokenUtil 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | false 89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 90 | true 91 | MultiThreadedDebug 92 | 93 | 94 | Console 95 | true 96 | 97 | 98 | 99 | 100 | Level3 101 | true 102 | true 103 | true 104 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 105 | true 106 | 107 | 108 | Console 109 | true 110 | true 111 | true 112 | 113 | 114 | 115 | 116 | Level3 117 | false 118 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 119 | true 120 | MultiThreadedDebug 121 | 122 | 123 | Console 124 | true 125 | 10 126 | 127 | 128 | 129 | 130 | Level3 131 | true 132 | true 133 | false 134 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 135 | true 136 | MultiThreadedDebug 137 | 138 | 139 | Console 140 | true 141 | true 142 | true 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | -------------------------------------------------------------------------------- /version3/TokenUtil.cpp: -------------------------------------------------------------------------------- 1 | // TokenUtil.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。 2 | // 3 | 4 | #include 5 | #include 6 | #include "TokenUtil.h" 7 | //#define TOKENLIST_NODE_COUNT 1000 8 | 9 | /*ListTokens*/ 10 | BOOL ListTokens(_TCHAR* tUserName,BOOL bVerbose,DWORD dwPid,TCHAR* tProcName,BOOL bIsVerbose) { 11 | // 声明并开辟空间 12 | TokenList* pTokenList = (TokenList*)calloc(1,sizeof(TokenList)); 13 | pTokenList->pTokenListNode = (PTokenListNode)calloc(Token_List_Node_Count, sizeof(TokenListNode)); 14 | // token的数量初始为0 15 | pTokenList->dwLength = 0; 16 | TokenInforUtil::GetTokens(pTokenList); 17 | TokenList tokenList = *pTokenList; 18 | 19 | TCHAR** userList = NULL; 20 | userList = (TCHAR**)calloc(USER_LIST_COUNT, sizeof(TCHAR*)); 21 | DWORD userListCount = 0; 22 | BOOL userIsInUserList = FALSE; 23 | for (DWORD i = 0; i < tokenList.dwLength; i++) { 24 | if (!bIsVerbose) { // 不详细输出 25 | // 判断用户是否已经输出过一次，若输出过，则跳过进入下一次循环 26 | for (DWORD idx = 0; idx < userListCount; idx++) { 27 | if (_tcscmp(userList[idx], tokenList.pTokenListNode[i].tUserName) == 0) { 28 | userIsInUserList = TRUE; 29 | break; 30 | } 31 | } 32 | if (userIsInUserList) { 33 | userIsInUserList = FALSE; 34 | continue; 35 | } 36 | // 记录已经输出过一次的用户 37 | if (tokenList.pTokenListNode[i].tUserName != nullptr) { 38 | userList[userListCount] = (TCHAR*)calloc(_tcslen(tokenList.pTokenListNode[i].tUserName) + 1, sizeof(TCHAR)); 39 | _tcscpy(userList[userListCount], tokenList.pTokenListNode[i].tUserName); 40 | userListCount++; 41 | 42 | if ((userListCount % USER_LIST_COUNT) == 0) { 43 | userList = (TCHAR**)realloc(userList, (userListCount / USER_LIST_COUNT + 1) * USER_LIST_COUNT * sizeof(TCHAR*)); 44 | memset(userList + userListCount, 0, USER_LIST_COUNT * sizeof(TCHAR*)); 45 | } 46 | } 47 | } 48 | 49 | // 若传入了用户名，则判断是否为该令牌的用户名；若不是则跳过，继续循环 50 | //if (tUserName != NULL && tokenList.pTokenListNode[i].tUserName != nullptr && _tcscmp(tokenList.pTokenListNode[i].tUserName, tUserName) != 0) { 51 | if (tUserName != NULL && tokenList.pTokenListNode[i].tUserName != nullptr && _tcsstr(tokenList.pTokenListNode[i].tUserName, tUserName) == NULL) { 52 | continue; 53 | } 54 | // 若传入了进程名字符串，则判断是该令牌的进程名是否包含该字符串；若不包含则跳过，继续循环 55 | if (tProcName != NULL && tokenList.pTokenListNode[i].tProcName != nullptr && _tcsstr(tokenList.pTokenListNode[i].tProcName, tProcName) == NULL) { 56 | continue; 57 | } 58 | // 若传入了进程ID，则判断是否为该令牌的进程ID；若不是则跳过，继续循环 59 | if (dwPid != -1 && tokenList.pTokenListNode[i].dwPID != dwPid) { 60 | continue; 61 | } 62 | printf("PID: %d\n", tokenList.pTokenListNode[i].dwPID); 63 | printf("HandleOffset: 0x%x\n", tokenList.pTokenListNode[i].dwHandleOffset); 64 | printf("LogonID: %08x-%08x\n", tokenList.pTokenListNode[i].luLogonID.HighPart, tokenList.pTokenListNode[i].luLogonID.LowPart); 65 | printf("IL: %d\n", tokenList.pTokenListNode[i].dwIL); 66 | //printf("TokenType: %d\n", tokenList.pTokenListNode[i].dwTokenType); 67 | switch (tokenList.pTokenListNode[i].dwTokenType) { 68 | case 1: 69 | printf("TokenType\t: Primary Token\n"); 70 | break; 71 | case 2: 72 | printf("TokenType\t: Impersonation Token\n"); 73 | break; 74 | default: 75 | printf("TokenType\t: N/A\n"); 76 | } 77 | printf("CanBeImpersonated: %d\n", tokenList.pTokenListNode[i].bCanBeImpersonate); 78 | if (tokenList.pTokenListNode[i].tProcName != nullptr) { 79 | printf("ProcessName: %S\n", tokenList.pTokenListNode[i].tProcName); 80 | } 81 | else { 82 | printf("ProcessName: None\n"); 83 | } 84 | if (tokenList.pTokenListNode[i].tUserName != nullptr) { 85 | printf("TokenUser: %S\n", tokenList.pTokenListNode[i].tUserName); 86 | } 87 | else { 88 | printf("TokenUser: None\n"); 89 | } 90 | printf("\n"); 91 | } 92 | // 释放令牌List 93 | if (pTokenList) { 94 | TokenInforUtil::ReleaseTokenList(pTokenList); 95 | free(pTokenList); 96 | pTokenList = NULL; 97 | } 98 | // 释放userList 99 | if (userList) { 100 | for(DWORD idx = 0;idx %S\n", opt, optarg); 136 | tUserName = (TCHAR*)calloc(_tcslen(optarg)+1, sizeof(TCHAR)); 137 | _tcscpy(tUserName, optarg); 138 | break; 139 | case 'p': //列出指定pid或所有进程中的令牌 140 | printf("\t%c -> %S\n", opt, optarg); 141 | dwPid = _ttoi(optarg); 142 | break; 143 | case 'P': 144 | printf("\t%c -> %S\n", opt, optarg); 145 | tProcName = (TCHAR*)calloc(_tcslen(optarg)+1, sizeof(TCHAR)); 146 | _tcscpy(tProcName, optarg); 147 | break; 148 | case 'c': //列出当前进程的令牌信息 149 | printf("\t%c -> %S\n", opt, optarg); 150 | break; 151 | case 'v': // 详细输出 152 | printf("\t%c -> %S\n", opt, optarg); 153 | bIsVerbose = TRUE; 154 | break; 155 | default: //输出帮助文档 156 | Helper::print_usage(); 157 | goto EXIT; 158 | } 159 | } 160 | // ListTokens 161 | ListTokens(tUserName, TRUE,dwPid,tProcName,bIsVerbose); 162 | } 163 | else if (!_tcscmp(tModuleArg, L"ListLogonSession")) { 164 | 165 | } 166 | else if (!_tcscmp(tModuleArg, L"Execute")) { 167 | if (argc <= 2) { 168 | Helper::print_usage(); 169 | goto EXIT; 170 | } 171 | bIsVerbose = FALSE; 172 | bConsoleMode = FALSE; 173 | // 从命令行获取参数 174 | while ((opt = getopt(argc - 1, tArgv, "u:p:e:c")) != -1) { 175 | switch (opt) { 176 | case 'u': //用户名 177 | printf("\t%c -> %S\n", opt, optarg); 178 | tUserName = (TCHAR*)calloc(_tcslen(optarg)+1,sizeof(TCHAR)); 179 | _tcscpy(tUserName, optarg); 180 | break; 181 | case 'p': 182 | printf("\t%c -> %S\n", opt, optarg); 183 | dwPid = _ttoi(optarg); 184 | break; 185 | case 'e': //列出当前进程的令牌信息 186 | printf("\t%c -> %S\n", opt, optarg); 187 | tCommand = (TCHAR*)calloc(_tcslen(optarg)+1,sizeof(TCHAR)); 188 | _tcscpy(tCommand, optarg); 189 | break; 190 | case 'c': 191 | printf("\t%c -> 1\n", opt); 192 | bConsoleMode = TRUE; 193 | break; 194 | default: //输出帮助文档 195 | Helper::print_usage(); 196 | goto EXIT; 197 | } 198 | } 199 | // 执行命令 200 | Execute::ExecuteMain(tUserName,dwPid,tCommand, bConsoleMode); 201 | } 202 | else { 203 | Helper::print_usage(); 204 | } 205 | EXIT: 206 | //释放创建的TCHAR指针 207 | if (tUserName != NULL) 208 | { 209 | free(tUserName); 210 | tUserName = NULL; 211 | } 212 | if (tProcName != NULL) { 213 | free(tProcName); 214 | tProcName = NULL; 215 | } 216 | if (tCommand != NULL) { 217 | free(tCommand); 218 | tCommand = NULL; 219 | } 220 | if (tArgv != NULL) { 221 | free(tArgv); 222 | tArgv = NULL; 223 | } 224 | 225 | } 226 | int _tmain(DWORD argc, _TCHAR* argv[]) 227 | { 228 | DWORD dwError = 0; 229 | if (!TokenInforUtil::TrySwitchTokenPriv(NULL,SE_DEBUG_NAME, TRUE,&dwError)) { 230 | printf("TryEnableDebugPriv,Error: %d\n", dwError); 231 | } 232 | if (!TokenInforUtil::TrySwitchTokenPriv(NULL, SE_ASSIGNPRIMARYTOKEN_NAME, TRUE, &dwError)) { 233 | printf("TryEnableAssignPrimaryPriv,Error: %d\n", dwError); 234 | } 235 | if (!TokenInforUtil::TrySwitchTokenPriv(NULL, SE_INCREASE_QUOTA_NAME, TRUE, &dwError)) { 236 | printf("TryEnableIncreaseQuotaPriv,Error: %d\n", dwError); 237 | } 238 | if (argc < 2) { 239 | Helper::print_usage(); 240 | return FALSE; 241 | } 242 | TCHAR* tModule = NULL; // 模块 243 | for (DWORD i = 0; i < sizeof(ModuleList) / sizeof(TCHAR*); i++) { 244 | if (!_tcscmp(argv[1], ModuleList[i])) { 245 | printf("ChooseModule:%ws\n", argv[1]); 246 | tModule = (TCHAR*)calloc(_tcslen(ModuleList[i])+1,sizeof(TCHAR)); 247 | _tcscpy(tModule, ModuleList[i]); 248 | break; 249 | } 250 | } 251 | if (tModule != NULL) { 252 | HandleArgument(tModule, argc, argv); 253 | } 254 | else { 255 | Helper::print_usage(); 256 | } 257 | // 释放TCHAR指针 258 | if (tModule != NULL) { 259 | free(tModule); 260 | tModule = NULL; 261 | } 262 | return FALSE; 263 | 264 | 265 | } --------------------------------------------------------------------------------