dzf.rar_broughtqu5_filliqq_通讯编程

/********************************************************************* * 该注册表权限 在注册表有写DACL的权限下 * writen by uty@uaty *********************************************************************/ #include <stdio.h> #include <windows.h> #include <winnt.h> #include <aclapi.h> #include <accctrl.h> //#define SPECIFIC_RIGHTS_ALL 0x0000FFFF //#define STANDARD_RIGHTS_REQUIRED 0x000F0000 //#define STANDARD_RIGHTS_ALL 0x001F0000 int getprivilege(LPCTSTR privilege); int main(int Argc,char* Argv[]) { long ret=0; PSECURITY_DESCRIPTOR pSecurityDescriptor; PACL pAcl; PACL pNewAcl; //TRUSTEE trustee; //ACCESS_MASK AccessmAsk; EXPLICIT_ACCESS eA; char* user_groupnAme; char* keypAth; char sid[64]; DWORD receivedAce; DWORD sidlen; DWORD sidtype; char siddomAin[128]; DWORD siddomAinlen; int Aceindex = 0; //char usernAme[128];///debug //DWORD usernAmelen = 128; if (Argc != 5){ printf("usAge: %s registrypAth USER|GROUP usernAme|groupnAme deny|Allow|reAdonly\n\n",Argv[0]); printf("it's A simple work \n" "registerpAth like this MACHINE\\SECURITY....\n" "predefined registry keys:\"CLASSES_ROOT\", \"CURRENT_USER\", \"MACHINE\", and \"USERS\"\n\n"); return 0; }; keypAth = Argv[1]; user_groupnAme = Argv[3]; getprivilege(SE_SECURITY_NAME);//i don't whether it reAlly work,but result is ok getprivilege(SE_RESTORE_NAME); getprivilege(SE_BACKUP_NAME); getprivilege(SE_TAKE_OWNERSHIP_NAME); getprivilege(SE_DEBUG_NAME); ret = GetNamedSecurityInfo(keypAth,SE_REGISTRY_KEY,DACL_SECURITY_INFORMATION, NULL,NULL,&pAcl,NULL,&pSecurityDescriptor); if (ret != ERROR_SUCCESS){ printf("GetNAmedSecurityInfo fAiled: %d\n ret %d\n",GetLastError(),ret); LocalFree(pSecurityDescriptor); return -1; } ///this pArt just show the former ACE AccessmAsk /*trustee.pMultipleTrustee = NULL; trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; trustee.TrusteeForm = TRUSTEE_IS_NAME; trustee.TrusteeType = TRUSTEE_IS_USER;//// trustee.ptstrName = user_groupnAme;//// ret = GetEffectiveRightsFromAcl(pAcl,&trustee,&AccessmAsk); if (ret != ERROR_SUCCESS){ printf("GetEffectiveRightsFromAcl fAiled\n"); LocalFree(pSecurityDescriptor); return -1; }*/ ///get the sid sidlen = 64; siddomAinlen = 128; if(stricmp(Argv[2],"GROUP") == 0){ sidtype = SidTypeGroup; }else if(stricmp(Argv[2],"USER") == 0){ sidtype = SidTypeUser; }else{ printf(" ?? ,USER or GROUP\n"); exit(1); } ret = LookupAccountName(NULL,user_groupnAme,&sid,&sidlen,siddomAin,&siddomAinlen, &sidtype); if(ret == 0){ printf("LookupAccountNAme fAiled: %d\n sid size if %d\nsidlen requres %d\n\n",GetLastError(),sizeof(SID),sidlen); LocalFree(pSecurityDescriptor); return -1; } /* Sleep(200); //why cAn not lookup the sid 's usernAme? still don't know ret = LookupAccountSid(NULL,(PSID)(sid),usernAme,&usernAmelen, siddomAin,&siddomAinlen,&sidtype); printf("debug: ret = %d, GetLAstError = %d\n",ret,GetLastError()); printf("%s\n",usernAme); return 0;/////////////// */ ////删除同用户或同组的以前的ACE while(GetAce(pAcl,Aceindex,(PVOID)&receivedAce)){ if(EqualSid((PSID)sid,(PSID)(receivedAce+sizeof(ACE_HEADER)+sizeof(ACCESS_MASK)))){//if equAl,return nonzero DeleteAce(pAcl,Aceindex); continue; }else{ Aceindex++; } } /* while(ret = DeleteAce(pAcl,0)){ printf("debug: ret = %d\n",ret); printf("%d \n",GetLastError()); } //printf("lAst DeleteAce errorcode %d\n",GetLastError()); */ memset(&eA,0,sizeof(EXPLICIT_ACCESS)); if (stricmp(Argv[4],"ALLOW") == 0){ eA.grfAccessMode = GRANT_ACCESS; eA.grfAccessPermissions = SPECIFIC_RIGHTS_ALL; }else if(stricmp(Argv[4],"DENY") == 0){ eA.grfAccessMode = DENY_ACCESS; eA.grfAccessPermissions = SPECIFIC_RIGHTS_ALL; } else if(stricmp(Argv[4],"READONLY") == 0){ eA.grfAccessMode = DENY_ACCESS; eA.grfAccessPermissions = 0xFF06; //yun, the first 6 bits Are the 查询数值 设置数值 创建子项 枚举子项 通知 创建连接 // 0 1 2 3 4 5 }else{ printf(" ?? , ALLOW or DENY or READONLY\n"); exit(1); } eA.grfInheritance = CONTAINER_INHERIT_ACE; eA.Trustee .MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; eA.Trustee .pMultipleTrustee = NULL; eA.Trustee .TrusteeForm = TRUSTEE_IS_NAME; if(stricmp(Argv[2],"GROUP") == 0){ eA.Trustee .TrusteeType = TRUSTEE_IS_GROUP;//// }else if(stricmp(Argv[2],"USER") == 0){ eA.Trustee .TrusteeType = TRUSTEE_IS_USER;//// }else{ printf(" ?? ,USER or GROUP\n"); exit(1); } eA.Trustee .ptstrName = user_groupnAme;//// ret = SetEntriesInAcl(1,&eA,pAcl,&pNewAcl); if(ret != ERROR_SUCCESS){ printf("SetEntriesInAcl fAiled: %d\n ",GetLastError()); LocalFree(pSecurityDescriptor); return -1; } ret = SetNamedSecurityInfo(keypAth,SE_REGISTRY_KEY,DACL_SECURITY_INFORMATION,NULL,NULL,pNewAcl,NULL); if(ret != ERROR_SUCCESS){ printf("SetNAmedSecurityInfo fAiled: %d\n ",GetLastError()); LocalFree(pSecurityDescriptor); return -1; } return 0; } //-------------------------------------------------------------------- int getprivilege(LPCTSTR privilege) { //////////////////////// HANDLE hProcessToken=NULL; TOKEN_PRIVILEGES tp; LUID luid; //打开token if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hProcessToken)){ printf("\nOpen Current Process Token fAiled:%d",GetLastError()); return -1; } //查找所需权限的luid if(!LookupPrivilegeValue(NULL,privilege,&luid)) { printf("\nLookupPrivilegeVAlue error:%d",GetLastError()); return -1; } tp.PrivilegeCount =1;/////////表示只有一个// one privilege to set tp.Privileges [0].Luid = luid; tp.Privileges [0].Attributes = SE_PRIVILEGE_ENABLED; //给token加权限 AdjustTokenPrivileges(hProcessToken,FALSE,&tp,sizeof(TOKEN_PRIVILEGES) ,(PTOKEN_PRIVILEGES)NULL,(PDWORD)NULL); if (GetLastError()!=ERROR_SUCCESS){ printf("AdjustTokenPrivileges fAiled:%d\n",GetLastError()); return -1; } /////////////////////////////////// return 0; } //--------------------------------------------------------------------