C++ 开启,查看远程3389端口

版权声明:本文为博主原创文章,遵循 CC 4.0 by-sa 版权协议,转载请附上原文出处链接和本声明。
本文链接:https://blog.csdn.net/cssxn/article/details/80619758

最近写一个小demo测试我写的沙箱规则,目的是监控木马程序修改注册表3389的开关,以及修改远程桌面端口。
很长时间不使用注册表的API了,读取注册表的时候没有问题,后来想添加一个设置注册表的,也就是写注册表,发现添加了KEY_WRITE权限后,RegOpenKeyEx函数一直返回失败,经过调试,原来是没有管理员运行权限。

#include "stdafx.h"
#include <windows.h>
#include <winreg.h>
#include <winnt.h>

VOID OpenRDP(HKEY hKey)
{
    DWORD lpData = 0;
    LONG ret = RegSetValueExA(hKey, "fDenyTSConnections", 0, REG_DWORD, (LPBYTE)&lpData, sizeof(DWORD));
    if (ret == ERROR_SUCCESS)
    {
        printf("Try to open RDP Success\n");
    }
    else
    {
        printf("Try to oepn RDP Failed\n");
    }
}

int _tmain(int argc, _TCHAR* argv[])
{

    HKEY hKey = nullptr;
    TCHAR *lpSubKey = _T("SYSTEM\\CUrrentControlSet\\Control\\Terminal Server");
    LONG ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpSubKey, 0, KEY_READ|KEY_WRITE, &hKey);


    if (ret == ERROR_SUCCESS)
    {
        DWORD szLocation;
        DWORD dwType = REG_SZ;
        DWORD dwSize = sizeof(DWORD);
        ret = RegQueryValueEx(hKey, L"fDenyTSConnections", NULL, &dwType, (LPBYTE)&szLocation, &dwSize);
        wprintf(L"RegQueryValueEx returns %d, dwSize=%d\n", ret, dwSize);
        if (ret == ERROR_SUCCESS)
        {
            if (szLocation == 0)
            {
                printf("Terminal Server is opened!\n");
            }
            else
            {
                printf("Terminal Server is not open!\n");

                OpenRDP(hKey);
            }

            HKEY hKeyWds = NULL;
            ret = RegOpenKeyEx(hKey, L"Wds\\rdpwd\\Tds\\tcp", 0, KEY_READ, &hKeyWds);
            if (ret == ERROR_SUCCESS)
            {
                ret = RegQueryValueEx(hKeyWds, L"PortNumber", NULL, &dwType, (LPBYTE)&szLocation, &dwSize);
                printf("Terminal Server port under Wds is on %u\n", szLocation);
            }
            else
            {
                printf("Terminal Server port under Wds failed!\n");
            }

            // 第二个注册表
            HKEY hKeyWinstation = NULL;
            ret = RegOpenKeyEx(hKey, L"WinStations\\RDP-Tcp", 0, KEY_READ, &hKeyWinstation);
            if (ret == ERROR_SUCCESS)
            {
                ret = RegQueryValueEx(hKeyWinstation, L"PortNumber", NULL, &dwType, (LPBYTE)&szLocation, &dwSize);
                printf("Terminal Server port under Winstations is on %u\n", szLocation);
            }
            else
            {
                printf("Terminal Server under WinStaions read port failed!\n");
            }

        }

    }
    system("pause");

    return 0;
}

展开阅读全文

没有更多推荐了,返回首页