PROCEDURE declare DECLARE INTEGER GetLastError IN kernel32 DECLARE INTEGER CryptAcquireContext IN advapi32 ; STRING cProvider, INTEGER nProvType, INTEGER nFlags DECLARE INTEGER CryptReleaseContext IN advapi32 ; INTEGER hProvHandle, INTEGER nReserved DECLARE INTEGER CryptGenKey IN advapi32; INTEGER hProv, INTEGER Algid,; INTEGER dwFlags, INTEGER @phKey DECLARE INTEGER CryptExportKey IN advapi32 dwDataLen, INTEGER hPubKey,; INTEGER dwFlags, INTEGER @phKey DECLARE INTEGER CryptDestroyKey IN advapi32
IN advapi32; INTEGER hProv, INTEGER Algid, INTEGER hKey,; INTEGER dwFlags, INTEGER @phHash DECLARE INTEGER CryptAcquireContext IN advapi32; INTEGER @hProvHandle, STRING cContainer, ; STRING cProvider, INTEGER nProvType, INTEGER nFlags DECLARE INTEGER CryptReleaseContext IN advapi32 ; INTEGER hProvHandle, INTEGER nReserved DECLARE INTEGER CryptHashData IN advapi32; INTEGER hHash, STRING @pbData,; LONG dwDataLen, LONG dwFlags DECLARE INTEGER CryptDeriveKey IN advapi32
Public Declare Function OpenProcessToken Lib “advapi32” (ByVal ProcessHandle As Integer, ByVal DesiredAccess keyword=”vbup1050″” Public Declare Function LookupPrivilegeValue Lib “advapi32” Alias “LookupPrivilegeValueA keyword=”vbup1050″” Public Declare Function AdjustTokenPrivileges Lib “advapi32” (ByVal TokenHandle
}/include" INTERFACE_LINK_LIBRARIES "wldap32;winmm;ws2_32;OpenSSL::SSL;OpenSSL::Crypto;ZLIB::ZLIB;advapi32 ::libcurl的INTERFACE_LINK_LIBRARIES 属性为"wldap32;winmm;ws2_32;OpenSSL::SSL;OpenSSL::Crypto;ZLIB::ZLIB;advapi32
ASCII ':' +08 0x023a1bc8 | 0x00000000 +0c 0x023a1bcc | 0x023a1d3c (Heap) ptr to 0x77e46464 : ADVAPI32 [+] This mona.py actiontook 0:00:00.579000 很显然,对象中的某些值指向了字符串(ASCII and Unicode),其他的似乎指向了另外一个对象(ADVAPI32 ASCII ':' +08 0x023a1bc8 | 0x00000000 +0c 0x023a1bcc | 0x023a1d3c (Heap) ptr to 0x77e46464 : ADVAPI32 Address Contents Info ------ ------- -------- ----- +00 0x023a1d3c | 0x77e46464 ADVAPI32
" -Verbose).FullName # LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED $CallResult = [Advapi32 [+] Thread suspended" echo "[>] Wiping current impersonation token" $CallResult = [Advapi32 = [IntPtr]::Zero # 0x0006 --> TOKEN_DUPLICATE -bor TOKEN_IMPERSONATE $CallResult = [Advapi32 >] Duplicating SYSTEM token" $hDuplicateTokenHandle = [IntPtr]::Zero $CallResult = [Advapi32 " -Verbose).FullName # LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED $CallResult = [Advapi32
首先了解一下动态函数解析(DFR) 比如我们要获取当前用户名,在Win32API中就要调用GetUserNameA,我们使用DFR就是要变成如下格式 DECLSPEC_IMPORT DWORD WINAPI ADVAPI32 $GetUserNameA(LPSTR, LPDWORD); DECLSPEC_IMPORT:导入函数的关键字 WINAPI:函数调用约定,一般API函数都是这个 ADVAPI32:函数所在的模块名
StartServiceA( SC_HANDLE hService, DWORD dwNumServiceArgs, LPCSTR *lpServiceArgVectors ); 导入调用: [DllImport("advapi32
component:add("links", "freetype") component:add("syslinks", "opengl32", "gdi32", "user32", "advapi32 package:config("shared") then component:add("syslinks", "opengl32", "gdi32", "user32", "advapi32
deferred) 77d10000 77da0000 USER32 (deferred) 77da0000 77e49000 ADVAPI32
f3ba0000 00007ffb`f3d33000 USER32 (deferred) 13 00007ffb`f3d40000 00007ffb`f3de3000 advapi32 f3ba0000 00007ffb`f3d33000 USER32 (deferred) 14 00007ffb`f3d40000 00007ffb`f3de3000 advapi32
0xc0000004 #define NT_SUCCESS(x) ((x) >= 0) #pragma comment (lib, "crypt32.lib") #pragma comment (lib, "advapi32
以下是该文件的主要内容: 定义了用于链接的默认系统库: "advapi32", "ws2_32", "userenv", "mpr", "shell32"等。
Session Manager\KnownDLLs] "_Wow64"="Wow64.dll" "_Wow64cpu"="Wow64cpu.dll" "_Wow64win"="Wow64win.dll" "advapi32