用其他身份执行程序

最新推荐文章于 2019-07-03 07:57:48 发布

lanyus

最新推荐文章于 2019-07-03 07:57:48 发布

阅读量1.1k

点赞数

分类专栏： DELPHI编程文章标签： forms interface button domain module windows

本文链接：https://blog.csdn.net/lanyus/article/details/460936

版权

DELPHI编程专栏收录该内容

71 篇文章 1 订阅

订阅专栏

转载，原作者：easykey

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;

const
  LOGON_WITH_PROFILE = 1;
  LOGON_NETCREDENTIALS_ONLY = 2;

function CreateProcessWithLogon(
                                 lpUsername: PWChar;
                                 lpDomain: PWChar;
                                 lpPassword: PWChar;
                                 dwLogonFlags: DWORD;
                                 lpApplicationName: PWChar;
                                 lpCommandLine: PWChar;
                                 dwCreationFlags: DWORD;
                                 lpEnvironment: Pointer;
                                 lpCurrentDirectory: PWChar;
                                 const lpStartupInfo: TStartupInfo;
                                 var lpProcessInfo: TProcessInformation
                               ): BOOL; stdcall;

type
  TForm1 = class(TForm)
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

function CreateProcessWithLogon; external advapi32 name 'CreateProcessWithLogonW';

procedure TForm1.Button1Click(Sender: TObject);
var
  wUsername, wDomain, wPassword, wApplicationName: WideString;
  pwUsername, pwDomain, pwPassword, pwApplicationName: PWideChar;
  StartupInfo: TStartupInfo;
  ProcessInfo: TProcessInformation;
begin
  wUsername := 'administrator';
  wDomain := '';
  wPassword := '123456';
  wApplicationName := 'cmd.exe';
  pwUsername := Addr(wUsername[1]);
  pwDomain := Addr(wDomain[1]);
  pwPassword := Addr(wPassword[1]);
  pwApplicationName := Addr(wApplicationName[1]);

  FillChar(StartupInfo, SizeOf(TStartupInfo), 0);
  StartupInfo.cb := SizeOf(TStartupInfo);
  if not CreateProcessWithLogon(pwUsername,pwDomain,pwPassword,LOGON_WITH_PROFILE,
                                pwApplicationName,nil,CREATE_DEFAULT_ERROR_MODE,
                                nil,nil,StartupInfo,ProcessInfo) then
    RaiseLastOSError;
end;

end.
可带入其它使用者的Profile，使用上比LogonUser、CreateProcessAsUser简单，省去设定SE_TCB_NAME privilege

此函数可用于暴力破解本地账号密码

CreateProcessWithLogonW函数
CreateProcessWithLogonW API的定义如下：
BOOL CreateProcessWithLogonW(
LPCWSTR , // 用户乙的账号(Account)
LPCWSTR , //用户乙的域(Domain)
LPCWSTR , // 用户乙的密码(Password)
DWORD , // logon option
LPCWSTR , // executable module name
LPWSTR , // command-line string
DWORD , // creation flags
LPVOID , // new environment block
LPCWSTR , // current directory name
LPSTARTUPINFOW , // startup information
LPPROCESS_INFORMATION // process information
);