我正在尝试使用用户/pass编写一个PowerShell脚本,以实现自举。问题是,在启动进程中不能同时使用runas和-Credential。我尝试在powershell中运行powershell,但它不起作用。其想法是通过用户/pass绕过UAC。有人有什么建议吗?
编辑:不可能!
$username = "test"
$password = "123456"
$credentials = New-Object System.Management.Automation.PSCredential -ArgumentList @($username,(ConvertTo-SecureString -String $password -AsPlainText -Force))
# Self-elevate the script if required
if (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) {
if ([int](Get-CimInstance -Class Win32_OperatingSystem | Select-Object -ExpandProperty BuildNumber) -ge 6000) {
Write-Host -ForegroundColor 'Red' "Bypassing UAC..."
Start-Sleep -s 2
$CommandLine = "-File `"" + $MyInvocation.MyCommand.Path + "`" " + $MyInvocation.UnboundArguments
$CommandLine = "Start-Process -FilePath PowerShell.exe -verb runas -ArgumentList " + $CommandLine
Start-Process powershell.exe -Credential $credentials -ArgumentList $CommandLine
Write-Host -ForegroundColor 'Red' "Bypassing UAC..." $CommandLine
Start-Sleep -s 30
Exit
}
}
Write-Host -ForegroundColor 'Green' "Admin mode..."
Write-Host -ForegroundColor 'Gray' "Shell will exit in 15 seconds..."
Start-Sleep -s 15发布于 2020-11-02 23:14:04
UAC旨在在尝试提升到管理权限时提供确认提示。(当进程已被提升时,提示符不会出现。)如果UAC已启用(强烈建议将其保留为已启用),则始终会出现提升提示符。您不能绕过UAC提示符(或者,如果您更喜欢其他术语,“以编程方式接受”)。这是故意的。
https://stackoverflow.com/questions/64645211
复制相似问题