Windows 7：利用自动提升来提升我自己的进程？
摘自 2009 年 7 月 Technet 文章，标题为Inside Windows 7 User Account Control, Mark Russinovish 描述了以标准用户身份运行的应用程序可以悄悄地提升并获得管理权限：
...第三方也可以 在 PA（受保护的管理员）帐户中运行的软件 利用标准用户权限 自动升高增益 行政权利。 例如， 该软件可以使用 WriteProcessMemory API 将代码注入Explorer和 CreateRemoteThread API 执行该代码，一种技术称为DLL 注射。 由于代码正在执行 在资源管理器中，这是一个 Windows 可执行文件，它可以利用COM 自动升降的物体，例如 复制/移动/重命名/删除/链接对象， 修改系统注册表项或 目录并提供软件 管理权限。
他接着提到恶意软件永远不会这样做，因为这太难了：
...这些步骤需要 刻意的意图，并非微不足道......
最后
...恶意软件可能会获得管理权限 使用相同技术的权利。
所以我很好奇看到实际的实现。
我本以为 PROCESS_VM_WRITE 会是未授予标准用户的权利。
注意：我自己实际上永远不会做任何坏事，就像世界上所有其他开发人员一样。
From a July 2009 Technet article entitled Inside Windows 7 User Account Control, Mark Russinovish describes that it's possible for an application running as standard user to silently elevate and gain administrative rights:
...it's possible for third-party
software running in a PA (Protected Administrator) account with
standard user rights to take advantage
of auto-elevation to gain
administrative rights. For example,
the software can use the
WriteProcessMemory API to inject code into Explorer and the
CreateRemoteThread API to execute that code, a technique called DLL
injection. Since the code is executing
in Explorer, which is a Windows
executable, it can leverage the COM
objects that auto-elevate, like the
Copy/Move/Rename/Delete/Link Object,
to modify system registry keys or
directories and give the software
administrative rights.
He goes on to mention that malware will never do this, because it's too hard:
...these steps require
deliberate intent, aren't trivial...
and finally
...malware could gain administrative
rights using the same techniques.
So i'm curious to see an actual implementation.
i would have thought PROCESS_VM_WRITE would be a right not given to standard users.
Note: i would never actually do anything bad myself, as is true for every other developer in the world.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Long Cheng，在 istartedsomething.com 上有一些关于自动提升应用程序的帖子。 他不是源代码的作者，但他链接到进行概念验证的人。
您可以阅读有关它的更多信息 此处。
Long Zheng, over at istartedsomething.com has a few posts about autoelevating an application. He's not the author of the source code, but he links to the person that made the proof-of-concept.
You can read more about it here.
你是在谈论使用进程注入吗？ 或者提升特权？
如果您想查看进程注入的代码示例，该线程有一些示例：
http://www.rohitab.com/discuss/ index.php?showtopic=23539&hl=绕过+防火墙
are you talking about using process injection? or elevating the privileges?'
If you want to see a code sample of a process injection this thread has some samples:
http://www.rohitab.com/discuss/index.php?showtopic=23539&hl=bypassing+firewall