[2024-10-22 01:39:20 最后更新]
得到 windows 管理员权限的代码收集贴
今天弄了一整天,怎样用管理员权限云运行另外一个程序(当然是在自己就是管理员运行程序的情况下,并不是指黑客手段).
没想到网上的很多代码居然是错误的,当然也有可能因为现在都是 win10 了,以前的用不了了.
首先要说的是网上盛传的 runas 并不能用,似乎是要使用密码才行.
比如 https://blog.csdn.net/qq125096885/article/details/72626886
就行不通
--------------------------------------------------------------------
#include <stdio.h>
#include<windows.h>
#include<tchar.h>
int main(void)
{
SHELLEXECUTEINFO sei = { sizeof(SHELLEXECUTEINFO) };
sei.lpVerb = TEXT("runas");
sei.lpFile = TEXT("cmd.exe");//add application which you want to run as administrator here
sei.nShow = SW_SHOWNORMAL;//without this,the windows will be hiden
if (!ShellExecuteEx(&sei))
{
DWORD dwStatus = GetLastError();
if (dwStatus == ERROR_CANCELLED)
{
printf("提升权限被用户拒绝\n");
}
else if (dwStatus == ERROR_FILE_NOT_FOUND)
{
printf("所要执行的文件没有找到\n");
}
}
getchar();
getchar();
return 0;
}
--------------------------------------------------------------------
下面这份是用一个新的 api 运行的,很有点意思大家可以看看.
https://wedelphi.com/t/376196/
pApplicationName是可执行文件名字.lpCommandLine是命令行参数.
如果lpApplicationName是空的话,那么将会把第一个参数作为可执行文件执行.所有带参数执行的话有两种调用方式.
我给你两种调用方式的的例子,都是调用记事本打开C:/boot.ini文件的
const
LOGON_WITH_PROFILE = $00000001;
LOGON_NETCREDENTIALS_ONLY = $00000002;
function CreateProcessWithLogonW(lpUsername, lpDomain, lpPassword : LPCWSTR;
dwLogonFlags : DWORD; lpApplicationName : LPCWSTR; lpCommandLine : LPWSTR;
dwCreationFlags : DWORD; lpEnvironment : pointer; lpCurrentDirectory : LPCWSTR;
const lpStartupInfo : STARTUPINFOW; var lpProcessInformation : PROCESS_INFORMATION) : BOOL; stdcall;
external 'advapi32.dll';
procedure TForm1.Button1Click(Sender: TObject);
var
wUsername, wDomain, wPassword, wApplicationName, wCommandLine : WideString;
pwUsername, pwDomain, pwPassword, pwApplicationName, pwCommandLine : PWCHAR;
StartupInfo : STARTUPINFOW;
ProcessInfo : PROCESS_INFORMATION;
begin
wUsername := 'WANGRUI';
wDomain := '';
wPassword := 'wr';
wApplicationName := 'c:/windows/notepad.exe';
wCommandLine := ' c:/boot.ini';
pwUsername := PWCHAR(wUsername);
pwDomain := PWCHAR(wDomain);
pwPassword := PWCHAR(wPassword);
pwApplicationName := PWCHAR(wApplicationName);
pwCommandLine := PWCHAR(wCommandLine);
FillChar(StartupInfo, SizeOf(STARTUPINFOW), 0);
StartupInfo.cb := SizeOf(STARTUPINFOW);
if not CreateProcessWithLogonW(pwUsername,
pwDomain,
pwPassword,
LOGON_WITH_PROFILE,
pwApplicationName,
pwCommandLine,
CREATE_DEFAULT_ERROR_MODE,
nil,
nil,
StartupInfo,
ProcessInfo) then
RaiseLastOSError;
end;
procedure TForm1.Button2Click(Sender: TObject);
var
wUsername, wDomain, wPassword, wCommandLine : WideString;
pwUsername, pwDomain, pwPassword, pwCommandLine : PWCHAR;
StartupInfo : STARTUPINFOW;
ProcessInfo : PROCESS_INFORMATION;
begin
wUsername := 'WANGRUI';
wDomain := '';
wPassword := 'wr';
wCommandLine := 'c:/windows/notepad.exe c:/boot.ini';
pwUsername := PWCHAR(wUsername);
pwDomain := PWCHAR(wDomain);
pwPassword := PWCHAR(wPassword);
pwCommandLine := PWCHAR(wCommandLine);
FillChar(StartupInfo, SizeOf(STARTUPINFOW), 0);
StartupInfo.cb := SizeOf(STARTUPINFOW);
if not CreateProcessWithLogonW(pwUsername,
pwDomain,
pwPassword,
LOGON_WITH_PROFILE,
nil,
pwCommandLine,
CREATE_DEFAULT_ERROR_MODE,
nil,
nil,
StartupInfo,
ProcessInfo) then
RaiseLastOSError;
end;
--------------------------------------------------------------------
