當前位置:編程學習大全網 - 源碼下載 - Vc遠程註入源代碼

Vc遠程註入源代碼

事實上,這是所有系統權限都是相對的,但妳可以使用CreateService創建服務來實現它!

創建壹個名為CreateService的空控制臺項目,然後創建壹個CreateService.cpp文件,並將以下代碼粘貼到其中。。。

#包含“Windows.h”

#包含“Winsvc.h”

#包含“time.h”

#包含“stdio.h”

SERVICE _ STATUS m _ ServiceStatus

SERVICE _ STATUS _ HANDLE m _ SERVICE STATUS HANDLE;

BOOL bRunning = true

void WINAPI service main(DWORD argc,LPTSTR * argv);

void WINAPI servicectrl handler(DWORD操作碼);

BOOL install service();

BOOL DeleteService();

void DoTask()

{

//在這裏做點什麽;

}

void WINAPI service main(DWORD argc,LPTSTR *argv)

{

// DWORD狀態;

//DWORD specific error;

m _ SERVICE status . dw SERVICE type = SERVICE _ WIN32;

m _ SERVICE status . dwcurrentstate = SERVICE _ START _ PENDING;

m _ SERVICE status . dwcontrolsaccepted = SERVICE _ ACCEPT _ STOP;

m _ service status . dw win 32 exit code = 0;

m _ service status . dwservicespecificexitcode = 0;

m _ service status . dw check point = 0;

m _ service status . dwwaithint = 0;

//m _ SERVICE status . dw SERVICE type = SERVICE _ AUTO _ START;

m _ ServiceStatusHandle = RegisterServiceCtrlHandler(" service 2 ",ServiceCtrlHandler);

if(m _ ServiceStatusHandle = =(SERVICE _ STATUS _ HANDLE)0)

{

返回;

}

m _ SERVICE status . dwcurrentstate = SERVICE _ RUNNING;

m _ service status . dw check point = 0;

m _ service status . dwwaithint = 0;

如果(!SetServiceStatus(m _ ServiceStatusHandle,& ampm_ServiceStatus))

{

}

bRunning = true

while(布朗寧)

{

睡眠(3000);

//將您要處理的代碼放在這裏....

DoTask();

//睡眠(60 * 1000);

}

返回;

}

void WINAPI service ctrl handler(DWORD操作碼)

{

開關(操作碼)

{

案例服務_控制_暫停:

m _ SERVICE status . dwcurrentstate = SERVICE _ PAUSED;

打破;

案例服務_控制_繼續:

m _ SERVICE status . dwcurrentstate = SERVICE _ RUNNING;

打破;

案例服務_控制_停止:

m _ service status . dw win 32 exit code = 0;

m _ SERVICE status . dwcurrentstate = SERVICE _ STOPPED;

m _ service status . dw check point = 0;

m _ service status . dwwaithint = 0;

SetServiceStatus(m _ ServiceStatusHandle,& ampm _ service status);

bRunning = false

打破;

案例服務_控制_詢問:

打破;

}

返回;

}

BOOL InstallService()

{

char strDir[1024];

處理schSCManager,schService

GetCurrentDirectory(1024,strDir);

strcat(strDir," \ \ create service . exe ");

schsc MANAGER = opensc MANAGER(NULL,NULL,SC _ MANAGER _ ALL _ ACCESS);

if (schSCManager == NULL)

返回false

LPCTSTR lpszBinaryPathName = strDir;

schService = create Service((struct SC _ HANDLE _ _ *)schsc manager," Service2 "," MB Service ",//要顯示的服務名

SERVICE_ALL_ACCESS,//期望的訪問

SERVICE_WIN32_OWN_PROCESS,//服務類型

SERVICE_DEMAND_START,//啟動類型

SERVICE_ERROR_NORMAL,//錯誤控制類型

lpszBinaryPathName,//服務的二進制文件

NULL,//無加載順序組

NULL,//沒有標記標識符

空,//沒有依賴關系

NULL,// LocalSystem帳戶

NULL);//沒有密碼

if (schService == NULL)

返回false

CloseServiceHandle((struct SC _ HANDLE _ _ *)sch service);

返回true

}

布爾刪除服務()

{

處理schSCManager

SC _ HANDLE hService

schsc MANAGER = opensc MANAGER(NULL,NULL,SC _ MANAGER _ ALL _ ACCESS);

if (schSCManager == NULL)

返回false

h SERVICE = open SERVICE((struct SC _ HANDLE _ _ *)schsc manager," Service2 ",SERVICE _ ALL _ ACCESS);

if (hService == NULL)

返回false

if(DeleteService(hService)==0)

返回false

if(CloseServiceHandle(h service)= = 0)

返回false

其他

返回true

}

int main(int argc,char* argv[])

{

if(argc & gt;1)

{

if(strcmp(argv[1],-i")==0) {

if(InstallService())

printf("\nMB服務已成功安裝\ n ");

其他

printf("\nMB服務已安裝\ n ");

} else if(strcmp(argv[1],"-d")==0) {

if(DeleteService())

printf("\nMB服務卸載成功\ n ");

其他

printf(" \ n未找到安裝的Easin中心服務\ n ");

}否則{

printf(" \n未知開關用法\ n安裝時使用service test-I \ n卸載時使用service test-d \ n ");

}

}

其他

{

SERVICE _ TABLE _ ENTRY dispatch TABLE[]= { { " SERVICE 2 ",ServiceMain},{NULL,NULL } }

StartServiceCtrlDispatcher(dispatch table);

}

返回0;

}

編譯成功後,生成壹個CreateService.exe,使用cmd-CD CreateService.exe目錄,輸入CreateService.exe-I安裝服務。

CreateService.exe-d刪除服務

有點繁瑣,然後開始-運行-服務. msc找到MB服務,右鍵啟動。

現在轉到任務管理器,查看是否有CreateService.exe系統進程權限。

不懂再問我!祝妳好運

  • 上一篇:現在很多廠商新出的安卓智能手機都不能換電池了,為什麽呢?
  • 下一篇:電腦裏的文件怎麽識別
  • copyright 2024編程學習大全網