There are several ways to implement:
1.createprocesswithlogonw () // Need a password
2.logonuser (), createProcessAsUser () // also required password
3.ntcreateToken (), createprocessasuser () // No password
There are many tools outside 1, 2. 3 Bingle's WSU -F can be implemented.
However, Bingle's WSU just made SID processing. After he switches to GUEST, it is still written to the System32 directory in this environment. After switching to system, you can't open it.
According to the Bingle's WSU prototype, rewrote SU, you can truly switch, even if the account is disabled
The disadvantage is that it can only be to the Admin group and the System account under the terminal. I can't switch to ordinary users. I gave up this problem. If anyone can welcome it.
[root @ Dumplogin C: / Winnt / System32] #REG Query HKEY_LOCAL_MACHINE / SECURITY
Error:
[root @ Dumplogin C: / Winnt / System32] #
[[root @ dumplogin e: / mytestc / su] # su4-u system
Su.exe Like Unix Su Tool, Version 4.1
By bkbll (bkbll # cnhonker.net)
http://www.cnhonker.com
[ ] Enable sedebugprivilege ..
[ ] Get Lsass.exe PID .... 292
[ ] Grantprivilege from lsass ....
[ ] Calling NTCReateTokenasuser ...
[ ] CreateProcess by That token ...
Microsoft Windows 2000 [Version 5.00.2195]
(C) All rights reserved 1985-2000 Microsoft Corp.
[root @ Dumplogin E: / mytestc / su] #reg query hkey_local_machine / security
REG.EXE VERSION 2.0
HKEY_LOCAL_MACHINE / SECURITY
HKEY_LOCAL_MACHINE / SECURITY / Policy
HKEY_LOCAL_MACHINE / SECURITY / RXACT
HKEY_LOCAL_MACHINE / Security / SAM
[root @ dumplogin e: / mytestc / su] #
I am exhausted by this thing. Bitter. Post my code, I hope to help everyone in the future, and take less detours.
Harassing Bingle and TK N times during this period, thank you.
This Dongdong is currently only tested on Win2K SP4 CN,
/ * Suǐ ?? ӄ ??
* 2004/12/28 1.0, ?? πBINGLE? ĶSU ʇ? ك ?? ņ, ȩϟ ?? ûӑ զսɨփ.
* 2004/12/29 2.0, զսʵ ģģӄ ģģӄ ??? ņ? Ķ? .
* 2004/12/29 3.0, ?? 'պ? Ž ?? ɒԅ? Ģӄ ??
* 2004/12/30 4.0,? Ɒԅ? Ģsystem ӄ ??, ȩϟ24 ???? ĭȏ ??? ō
* 2004/12/30 4.1 ֕? ˵ ǂ? Ӄ ??? ɒ ի
