在肆意的远程桌面的session中运行指定的程序[网络技术]

//在别的session中(如远程桌面的session)运行指定的程序,需求具有system权限,可以在肆意的桌面里运行指定程序#include <windows.h>#include <stdio.h>#include <process.h>#include <Tlhelp32.h>#include <tchar.h>#include <psapi.h>#include <stdio.h>#include <STDLIB.H>#include <tlhelp32.h> #include <WtsApi32.h>#pragma comment(lib, "WtsApi32.lib")#pragma  comment (lib,"psapi")// Get username from session idbool GetSessionUserName(DWORD dwSessionId, char username[256]){        LPTSTR pBuffer = NULL;        DWORD dwBufferLen;                BOOL bRes = WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE, dwSessionId, WTSUserName, &pBuffer, &dwBufferLen);                if (bRes == FALSE)                return false;                lstrcpy(username ,pBuffer);        WTSFreeMemory(pBuffer);                return true;}// Get domain name from session idbool GetSessionDomain(DWORD dwSessionId, char domain[256]){        LPTSTR pBuffer = NULL;        DWORD dwBufferLen;                BOOL bRes = WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE, dwSessionId, WTSDomainName, &pBuffer, &dwBufferLen);                if (bRes == FALSE)        {                printf("WTSQuerySessionInformation Fail!\n");                return false;        }                lstrcpy(domain,pBuffer);        WTSFreeMemory(pBuffer);                return true;}HANDLE GetProcessHandle(LPSTR szExeName)  //遍历进程PID{                  PROCESSENTRY32 Pc = { sizeof(PROCESSENTRY32) };                  HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);                  if(Process32First(hSnapshot, &Pc)){                                  do{                                                  if(!stricmp(Pc.szExeFile, szExeName)) {   //返回explorer.exe进程的PID                                printf("explorer's PID=%d\n",Pc.th32ProcessID);                                return OpenProcess(PROCESS_ALL_ACCESS, TRUE, Pc.th32ProcessID);                                              }                                          }while(Process32Next(hSnapshot, &Pc));                      }                                  return NULL;  } //输出帮忙的典型办法:void Usage (void){        fprintf(stderr,"===============================================================================\n"                "\t名称:在肆意的远程桌面的session中运行指定的程序

[1] [2] [3]  下一页