声明:未经允许不得转载,转载时请标注来源;禁止用作商业及其他衍生目的。
有误请指正,侵权请联系删除。有更好的方法也请联系我。
1.提权+蓝屏
Add-Type @"
using System;
using System.Runtime.InteropServices;
using System.Text;
public class YZX
{
[DllImport("ntdll.dll")]
public static extern uint NtRaiseHardError(
uint ErrorStatus,
uint NumberOfParameters,
uint UnicodeStringParameterMask,
IntPtr Parameters,
uint ValidResponseOption,
out uint Response);
[DllImport("ntdll.dll")]
public static extern void RtlAdjustPrivilege(int Privilege, int NewValue, int NewThread, out bool OldValue);
}
"@ -Language CSharp -ReferencedAssemblies System.Drawing,System.Data,System.Windows.Forms
[YZX]::RtlAdjustPrivilege(19, $true, $false, [ref]0); #提上关机权限
[YZX]::NtRaiseHardError(3221226528, 0, 0, 0, 6, [ref]0); #执行蓝屏
注:使用内核蓝屏,程序只需要关机权限
2.提权+关机
此处的关机指的是关闭内核,此时应提前保存好信息(不显示关机界面)
$type = @'
using System.Runtime.InteropServices;
public class YZX {
[DllImport("ntdll.dll")]
public static extern void RtlAdjustPrivilege(int Privilege, int NewValue, int NewThread, out bool OldValue);
[DllImport("ntdll.dll")]
public static extern void NtShutdownSystem(int Action);
}
'@
Add-Type -TypeDefinition $type
$t = "0"
[YZX]::RtlAdjustPrivilege(19, 1, 0, [ref]$t)
[YZX]::NtShutdownSystem(1) #也可为0 代表着重启和关机
注:a.NtShutdownSystem 继承自 NtSetSystemPowerState
b.也可用ZwShutdownSystem 继承自 ZwSetSystemPowerState