Skip to content

Commit

Permalink
提权操作进程意外退出，还可以重新连接
Browse files Browse the repository at this point in the history
  • Loading branch information
埃博拉酱 committed Jul 29, 2024
1 parent e8dd268 commit d4bd61a
Show file tree
Hide file tree
Showing 6 changed files with 35 additions and 23 deletions.
Binary file modified +MATLAB/+internal/private/WindowsCall.mexw64
View file
Binary file not shown.
Binary file modified +MATLAB/+internal/提权操作C.exe
View file
Binary file not shown.
Binary file modified +MATLAB/SnatchSerialport.mlx
View file
Binary file not shown.
29 changes: 22 additions & 7 deletions Windows平台/提权操作.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,13 +41,22 @@ static 懒加载 RootVersion参数头([]()noexcept
});
static void 特权调用(const std::string& 参数)
{
static RPC_WSTR Parameters;
static RPC_WSTR Parameters = []()
{
RPC_WSTR 返回值;
UUID Uuid;
UuidCreate(&Uuid);
UuidToStringW(&Uuid, &返回值);
自动析构(返回值, [](void* 指针)
{
RpcStringFreeW((RPC_WSTR*)&指针);
CoUninitialize();
});
return 返回值;
}();
static std::unique_ptr<wchar_t[]>Filename;
if (!特权服务器)
{
UUID Uuid;
UuidCreate(&Uuid);
UuidToStringW(&Uuid, &Parameters);
const std::filesystem::path Name = std::filesystem::path(L"\\\\.\\pipe") / (wchar_t*)Parameters;
DWORD BufferSize = 128;
特权服务器 = CreateNamedPipeW(Name.c_str(), PIPE_ACCESS_DUPLEX, 0, 1, BufferSize, BufferSize, 0, NULL);
Expand Down Expand Up @@ -77,16 +86,22 @@ static void 特权调用(const std::string& 参数)
{
if ((INT_PTR)ShellExecuteW(NULL, L"runas", (std::filesystem::path(Filename.get()).parent_path().parent_path() / L"提权操作C.exe").c_str(), (LPCWSTR)Parameters, NULL, 0) == SE_ERR_ACCESSDENIED)
EnumThrow(MATLAB::Exception::User_denied_access);
RpcStringFreeW(&Parameters);
CoUninitialize();
ConnectNamedPipe(特权服务器, NULL);
已连接 = true;
}
static DWORD NumberOfBytes;
WriteFile(特权服务器, 参数.data(), 参数.size(), &NumberOfBytes, NULL);
MATLAB::Exception 结果;
if (!ReadFile(特权服务器, &结果, sizeof(结果), &NumberOfBytes, NULL))
ThrowLastError(MATLAB::Exception::Failed_to_communicate_with_the_privilege_server);
{
const DWORD 错误码 = GetLastError();
if (错误码 == ERROR_BROKEN_PIPE)
{
DisconnectNamedPipe(特权服务器);//不先断连就不能连新的
已连接 = false;
}
EnumThrow(MATLAB::Exception::Failed_to_communicate_with_the_privilege_server, WindowsErrorMessage(错误码).get());
}
switch (结果)
{
case MATLAB::Exception::Successful:
Expand Down
Binary file modified doc/GettingStarted.mlx
View file
Binary file not shown.
29 changes: 13 additions & 16 deletions 提权操作C/提权操作C.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -547,8 +547,7 @@ API(Serialport_snatch)
{
static const HMODULE Ntdll = GetModuleHandleA("ntdll.dll");
static decltype(NtQuerySystemInformation)* const 查询系统信息 = (decltype(NtQuerySystemInformation)*)GetProcAddress(Ntdll, "NtQuerySystemInformation");
static ULONG SystemInformationLength = sizeof(SYSTEM_HANDLE_INFORMATION_EX);
static std::unique_ptr<char[]>SystemInformation = std::make_unique_for_overwrite<char[]>(SystemInformationLength);
static std::vector<char>SystemInformation(sizeof(SYSTEM_HANDLE_INFORMATION_EX));
ULONG ReturnLength;
static bool 未获取特权 = true;
if (未获取特权)
Expand All @@ -568,9 +567,9 @@ API(Serialport_snatch)
CloseHandle(TokenHandle);
未获取特权 = false;
}
while (查询系统信息(SystemExtendedHandleInformation, SystemInformation.get(), SystemInformationLength, &ReturnLength))
SystemInformation = std::make_unique_for_overwrite<char[]>(SystemInformationLength = ReturnLength);
const SYSTEM_HANDLE_INFORMATION_EX* const 系统句柄信息 = (SYSTEM_HANDLE_INFORMATION_EX*)SystemInformation.get();
while (查询系统信息(SystemExtendedHandleInformation, SystemInformation.data(), SystemInformation.size(), &ReturnLength))
SystemInformation.resize(ReturnLength);
const SYSTEM_HANDLE_INFORMATION_EX* const 系统句柄信息 = (SYSTEM_HANDLE_INFORMATION_EX*)SystemInformation.data();
const SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* 系统句柄表条目信息头 = 系统句柄信息->Handles;
const SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* const 系统句柄表条目信息尾 = 系统句柄表条目信息头 + 系统句柄信息->NumberOfHandles;
系统指针<HANDLE, decltype(CloseHandle)*>TargetHandle(CloseHandle);
Expand Down Expand Up @@ -607,15 +606,16 @@ API(Serialport_snatch)
#pragma pack(pop)
if (!TargetHandle)
for (; 系统句柄表条目信息头->ObjectTypeIndex != OB_TYPE_FILE || 句柄不可用(系统句柄表条目信息头, SourceProcessHandle, TargetHandle); 系统句柄表条目信息头++);
struct ProcExp_OutBuffer
{
ULONG ShareAccess;
wchar_t* 文件名()const noexcept { return (wchar_t*)(this + 1); }
};
static std::vector<char> OutBuffer(32);//初始大小不能太小，否则DeviceIoControl会报ERROR_MORE_DATA以外的错
for (;;)
{
InBuffer.Object = 系统句柄表条目信息头->Object;
InBuffer.DuplicatedHandle = TargetHandle;
struct ProcExp_OutBuffer
{
ULONG ShareAccess;
wchar_t* 文件名()const noexcept { return (wchar_t*)(this + 1); }
};
static const HANDLE ProExp152 = []()
{
HANDLE 返回值 = CreateFileW(L"\\\\.\\PROCEXP152", GENERIC_READ | GENERIC_WRITE, NULL, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
Expand All @@ -640,16 +640,14 @@ API(Serialport_snatch)
}
return 返回值;
}();
static DWORD OutBufferSize = 32;//初始大小不能太小，否则DeviceIoControl会报ERROR_MORE_DATA以外的错

static ProcExp_OutBuffer* OutBuffer = (ProcExp_OutBuffer*)std::malloc(OutBufferSize);
for (;;)
{
if (DeviceIoControl(ProExp152, 0x83350048, &InBuffer, sizeof(InBuffer), OutBuffer, OutBufferSize, nullptr, nullptr))
if (DeviceIoControl(ProExp152, 0x83350048, &InBuffer, sizeof(InBuffer), OutBuffer.data(), OutBuffer.size(), nullptr, nullptr))
{
if (系统句柄表条目信息头->UniqueProcessId == 调用进程ID)
int a = 1;
if (!wcscmp(ValueName.get(), OutBuffer->文件名()))
if (!wcscmp(ValueName.get(), ((ProcExp_OutBuffer*)OutBuffer.data())->文件名()))
{
if (系统句柄表条目信息头->UniqueProcessId == 调用进程ID)
throw MATLAB::Exception::Attempt_to_snatch_the_serialport_occupied_by_yourself;
Expand All @@ -661,9 +659,8 @@ API(Serialport_snatch)
}
else if (GetLastError() != ERROR_MORE_DATA)
break;
OutBuffer = (ProcExp_OutBuffer*)std::realloc(OutBuffer, OutBufferSize *= 2);
OutBuffer.resize(OutBuffer.size() * 2);
}
std::free(OutBuffer);
do
if (++系统句柄表条目信息头 >= 系统句柄表条目信息尾)
{
Expand Down

0 comments on commit d4bd61a

Please sign in to comment.