Miten tuhoaisin prosessit Visual Basicillä (VB6) joita en pysty tuhoamaan tehtävienhallinnasta (ei tarvittavia oikeuksia)?
Exploittaamalla jotain turva-aukkoa.
Moikka JoonasK!
kokeile tätä...
Dim Prosessit, Prosessi 'Projektiin referenssi: 'Microsoft WMI Scripting V1.2 Library 'C:\WINDOWS\system32\wbem\wbemdisp.TLB) Set Prosessit = GetObject _ ("winmgmts:{impersonationLevel=impersonate}") _ .InstancesOf("Win32_Process") For Each Prosessi In Prosessit With Prosessi If LCase(.Name) = "joku.exe" Then .Kill() End If End With Next Set Prosessit = Nothing
.Kill()
Syntax error, lisäsin referenssin.
EDIT: Löysin ratkaisun.
Sub TuhoaProsessi(nimi As String) Dim Prosessi, Prosessit Set Prosessit = GetObject _ ("winmgmts:{impersonationLevel=impersonate}") _ .InstancesOf("Win32_Process") For Each Prosessi In Prosessit With Prosessi If LCase(.Name) = nimi Then On Error GoTo prosessia_ei_loydy Prosessi.Terminate End If End With Next MsgBox "Prosessi " & nimi & " sammutettu", vbOKOnly, "Prosessin tuhoaminen onnistui" Exit Sub prosessia_ei_loydy: MsgBox "Prosessia " & nimi & " ei löytynyt", vbOKOnly, "Prosessin tuhoaminen epäonnistui" Exit Sub End Sub
Toimii.
Pieni lisäys: Tämä toimii mutta ei sulje kaikkia prosesseja, tarkoitus olisi että voisi sulkea myös prosesseja joita ei pysty rajoitusten (ei järjestelmänvalvoja) takia.
No eihän se nyt tietenkään ole mahollista, ellei Windowsista sitten löydy tietoturva-aukkoa, joka moisen mahollistaa.
JoonasK kirjoitti:
Pieni lisäys: Tämä toimii mutta ei sulje kaikkia prosesseja, tarkoitus olisi että voisi sulkea myös prosesseja joita ei pysty rajoitusten (ei järjestelmänvalvoja) takia.
Pystyyks se sulkemaan niitä, jos käynnistät sen järjestelmänvalvojana?
Newb kirjoitti:
Pystyyks se sulkemaan niitä, jos käynnistät sen järjestelmänvalvojana?
Pystyy. Ja se on mahdollista ilman mitään tietoturva-aukkojakin. Siis pakottaa prosessi sammumaan.
JoonasK kirjoitti:
Ja se on mahdollista ilman mitään tietoturva-aukkojakin. Siis pakottaa prosessi sammumaan.
Ei ole, ellet ole prosessin omistaja tai järjestelmänvalvoja.
Eikös PostMessage:lla tai SendMessage:lla voi lähettää sille prosessille WM_QUIT,WM_CLOSE tai WM_DESTROY jonka pitäisi tuhota sen väkisin?
En tosin oo itse ihan varma miten se tehdään.
shell "taskkill /f /im ""softa.exe"""
Toimisko tollanen?
Jos ei niin toinen vaihtoehto on käyttää TerminateProcessia tai lähettää se WM_CLOSE suljettavalle prosessille SendMessagella.
Private Declare Function TerminateProcess Lib "kernel32" Alias "TerminateProcess" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Sub TuhoaProsessi(nimi As String, method as Integer) Dim Prosessi, Prosessit Set Prosessit = GetObject _ ("winmgmts:{impersonationLevel=impersonate}") _ .InstancesOf("Win32_Process") For Each Prosessi In Prosessit With Prosessi If LCase(.Name) = nimi Then If method = 1 Then 'PostMessage app_hwnd, WM_QUIT, 0, vbNullString TerminateProcess Prosessi, 0 ElseIf method = 2 Then Shell "taskkill /f /im " & nimi ElseIf method = 3 Then Prosessi.Terminate End If End If End With Next End Sub
Kokeilin TuhoaProsessi "notepad.exe", 1 (eli TerminateProcess):
Object doesn't support this property or method
EDIT: Tämä
Public Declare Function TerminateProcess Lib "kernel32" Alias "TerminateProcess" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
on moduulissa.
Kokeilin TuhoaProsessi "notepad.exe", 2 (eli shell "taskkill /f /im"):
File not found
Googlesta löytyi TerminateProcessille esimerkki...
Private Type PROCESSENTRY32 dwSize As Long cntUsage As Long th32ProcessID As Long th32DefaultHeapID As Long th32ModuleID As Long cntThreads As Long th32ParentProcessID As Long pcPriClassBase As Long dwFlags As Long szExeFile As String * 260 End Type Private Type OSVERSIONINFO dwOSVersionInfoSize As Long dwMajorVersion As Long dwMinorVersion As Long dwBuildNumber As Long dwPlatformId As Long szCSDVersion As String * 128 End Type Private Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long Private Declare Function CloseHandle Lib "Kernel32.dll" (ByVal Handle As Long) As Long Private Declare Function OpenProcess Lib "Kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long Private Declare Function EnumProcesses Lib "psapi.dll" (ByRef lpidProcess As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long Private Declare Function GetModuleFileNameExA Lib "psapi.dll" (ByVal hProcess As Long, ByVal hModule As Long, ByVal ModuleName As String, ByVal nSize As Long) As Long Private Declare Function EnumProcessModules Lib "psapi.dll" (ByVal hProcess As Long, ByRef lphModule As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long Private Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" (lpVersionInformation As OSVERSIONINFO) As Long Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long Private Const PROCESS_TERMINATE = &H1 Private Const VER_PLATFORM_WIN32_WINDOWS = 1 Private Const PROCESS_QUERY_INFORMATION = 1024 Private Const PROCESS_VM_READ = 16 Private Const TH32CS_SNAPPROCESS = &H2 Private Function CheckVersion() As Long Dim tOS As OSVERSIONINFO tOS.dwOSVersionInfoSize = Len(tOS) Call GetVersionEx(tOS) CheckVersion = tOS.dwPlatformId End Function Public Function GetEXEProcessID(ByVal sEXE As String) As Long Dim aPID() As Long Dim lProcesses As Long Dim lProcess As Long Dim lModule As Long Dim sName As String Dim iIndex As Integer Dim bCopied As Long Dim lSnapShot As Long Dim tPE As PROCESSENTRY32 Dim bDone As Boolean If CheckVersion() = VER_PLATFORM_WIN32_WINDOWS Then 'Windows 9x 'Create a SnapShot of the Currently Running Processes lSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) If lSnapShot < 0 Then Exit Function tPE.dwSize = Len(tPE) 'Buffer the First Processes Info.. bCopied = Process32First(lSnapShot, tPE) Do While bCopied 'While there are Processes List them.. sName = Left$(tPE.szExeFile, InStr(tPE.szExeFile, Chr(0)) - 1) sName = Mid(sName, InStrRev(sName, "\") + 1) If InStr(sName, Chr(0)) Then sName = Left(sName, InStr(sName, Chr(0)) - 1) End If bCopied = Process32Next(lSnapShot, tPE) If StrComp(sEXE, sName, vbTextCompare) = 0 Then GetEXEProcessID = tPE.th32ProcessID Exit Do End If Loop Else 'Windows NT 'The EnumProcesses Function doesn't indicate how many Process there are, 'so you need to pass a large array and trim off the empty elements 'as cbNeeded will return the no. of Processes copied. ReDim aPID(255) Call EnumProcesses(aPID(0), 1024, lProcesses) lProcesses = lProcesses / 4 ReDim Preserve aPID(lProcesses) For iIndex = 0 To lProcesses - 1 'Get the Process Handle, by Opening the Process lProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, 0, aPID(iIndex)) If lProcess Then 'Just get the First Module, all we need is the Handle to get 'the Filename.. If EnumProcessModules(lProcess, lModule, 4, 0&) Then sName = Space(260) Call GetModuleFileNameExA(lProcess, lModule, sName, Len(sName)) If InStr(sName, "\") > 0 Then sName = Mid(sName, InStrRev(sName, "\") + 1) End If If InStr(sName, Chr(0)) Then sName = Left(sName, InStr(sName, Chr(0)) - 1) End If If StrComp(sEXE, sName, vbTextCompare) = 0 Then GetEXEProcessID = aPID(iIndex) bDone = True End If End If 'Close the Process Handle lRet = CloseHandle(lProcess) If bDone Then Exit For End If Next End If End Function Public Function TerminateEXE(ByVal sEXE As String) As Boolean Dim lPID As Long Dim lProcess As Long lPID = GetEXEProcessID(sEXE) If lPID = 0 Then Exit Function lProcess = OpenProcess(PROCESS_TERMINATE, 0, lPID) Call TerminateProcess(lProcess, 0&) Call CloseHandle(lProcess) TerminateEXE = True End Function
Yllä oleva koodi johonkin moduuliin.
Ja tota voi käyttää esim. näin:
Private sub command1_Click() TerminateExe "prosessi.exe" End sub
Edit. huom.
lainaus:
The terms terminate and kill should be used carefully; they usually imply unconditional and immediate removal from the system, as is done by TerminateProcess, which should be avoided. Many problems can be caused by TerminateProcess, including loss of data.
Any time someone says they want to terminate a process but they are not clear about the necessity to actually terminate a process, I ask for clarification.
The first solution that should be tried/suggested is to simply send a WM_CLOSE message to the application's main window. The WM_CLOSE message is essentially the equivalent to clicking the "X" at the top right of the window.
Use of TerminateProcess should be the last resort. It should never be used if there is another way to get the application to end.
Ei tuhoa kaikkia prosesseja, kokeilin tuhota NetControl 2-serveriä. :/
JoonasK kirjoitti:
Ei tuhoa kaikkia prosesseja, kokeilin tuhota NetControl 2-serveriä. :/
Jossei sitä noin voi tuhota, niin turha edes yrittää.
JoonasK kirjoitti:
Pystyy. Ja se on mahdollista ilman mitään tietoturva-aukkojakin. Siis pakottaa prosessi sammumaan.
Et voi sammuttaa prosessia johon sinulla ei ole oikeuksia PISTE.
Miten olisi.. poistaa/disabloida ohjelma jota et halua käynnistyvän?
Tuolla on 3 sivuinen opas Windowsin palveluihin ja optimointiin:
http://www.overclockersclub.com/guides/
Paljon lisää aiheesta googlella. "disable winxp services" mikäli tämä on ollenkaan mitä hait?
Minkä prosessin yleensä haluaisit tuhota?
Aihe on jo aika vanha, joten et voi enää vastata siihen.