Windows RPC 计划任务(MS-TSCH协议)

参考链接

https://github.com/Rvn0xsy/SchtaskCreator

实现目标

上一篇文章实现了自己调用自己编写的rpc接口,达到了远程调用的效果。
本篇目标尝试调用windows系统自身的rpc接口,实现在本地机器和远程机器创建计划任务

环境和文件

开发环境
    windows10
    visual studio 2019

需要建立的文件
    SchRpc.idl文件(下载链接:https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/96c9b399-c373-4490-b7f5-78ec3849444e)

第一步 编译SchRpc.idl文件

第二步 创建一个工程,使用上一步生成的文件

#include <stdio.h>
#include <taskschd.h>
#include "SchRpc.h"

#pragma comment(lib, "rpcrt4.lib")

#define MAX_LOADSTRING 2048
WCHAR szDefaultTaskXML[MAX_LOADSTRING];


void __RPC_FAR* __RPC_USER midl_user_allocate(size_t cBytes)
{
    return((void __RPC_FAR*) malloc(cBytes));
}

void __RPC_USER midl_user_free(void __RPC_FAR* p)
{
    free(p);
}

BOOL RegisterNewTask(PWCHAR username, PWCHAR password, PWCHAR domain, PWCHAR task_xml, PWCHAR ip_address, BOOL is_local, BOOL just_run) {
    RPC_STATUS status;
    RPC_WSTR StringBinding = NULL;
    RPC_BINDING_HANDLE Binding = NULL;
    PWCHAR ConnectProtocol = NULL;
    WCHAR ConnectRemoteProtocol[] = L"ncacn_ip_tcp";
    WCHAR ConnectLocalProtocol[] = L"ncalrpc";
    RPC_WSTR Hostname = NULL;
    SEC_WINNT_AUTH_IDENTITY_W Auth;

    if (lstrlenW(domain) == 0) {
        Auth.Domain = NULL;
        Auth.DomainLength = 0;
    }
    else {
        Auth.Domain = (RPC_WSTR)domain;
        Auth.DomainLength = lstrlenW(domain);
    }

    //判断是不是本地执行,组装相应的参数
    if (is_local) {
        ConnectProtocol = ConnectLocalProtocol;
    }
    else {
        ConnectProtocol = ConnectRemoteProtocol;
        Auth.User = (RPC_WSTR)username; // username
        Auth.Password = (RPC_WSTR)password; // password
        Auth.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
        Auth.UserLength = lstrlenW(username);
        Auth.PasswordLength = lstrlenW(password);
        Hostname = (RPC_WSTR)ip_address;
    }

    //1.RpcStringBindingCompose 函数创建字符串绑定句柄
    status = RpcStringBindingCompose(
        NULL,                        // Interface's GUID, will be handled by NdrClientCall
        (RPC_WSTR)ConnectProtocol,   // Protocol sequence
        Hostname,                    // Network address
        NULL,                        // Endpoint
        NULL,                        // No options here
        &StringBinding               // Output string binding
    );

    if (status != RPC_S_OK) {
        // printf("RpcStringBindingCompose failed - %x\n", status);
        return FALSE;
    }

    //2.RpcBindingFromStringBinding 函数从绑定句柄的字符串表示形式返回绑定句柄
    //  记得绑定成功的话，最后要释放绑定的句柄
    status = RpcBindingFromStringBinding(
        StringBinding,              // Previously created string binding  指向绑定句柄的字符串表示形式的指针
        &Binding                    // Output binding handle  返回指向服务器绑定句柄的指针
    );

    if (status != RPC_S_OK) {
        // printf("RpcBindingFromStringBindingA failed - %x\n", status);
        return FALSE;
    }
    // 3.如果不是本地认证，则采用网络认证获取成功的认证信息，为后续远程调用打下基础
    if (!is_local) {
        RpcTryExcept{
            //RpcBindingSetAuthInfo 函数设置绑定句柄的身份验证和授权信息(认证成功的凭证应该在Binding中)
            status = RpcBindingSetAuthInfo(
                    Binding,
                    Hostname,
                    RPC_C_AUTHN_LEVEL_DEFAULT,
                    RPC_C_AUTHN_DEFAULT,
                    &Auth,
                    NULL
                );
            if (status != RPC_S_OK)
            {
                // printf("RpcBindingSetAuthInfo failed - %d\n", status);
                return FALSE;
            }
        }
        RpcExcept(EXCEPTION_EXECUTE_HANDLER);
        {
            return FALSE;
        }
        RpcEndExcept
    }
    status = RpcStringFree(&StringBinding);  //释放句柄


    // 4.开始调用 计划任务
    RpcTryExcept
    {
        /*
         SchRpcCreateFolder  创建一个新文件夹
         HRESULT SchRpcCreateFolder(
           [in, string] const wchar_t* path,
           [in, string, unique] const wchar_t* sddl,
           [in] DWORD flags
         );
        */
        static const WCHAR Folder[] = L"\\Hello";
        SchRpcCreateFolder(Binding, Folder, NULL, 0);

        /*
        SchRpcRegisterTask 方法必须向服务器注册任务
         HRESULT SchRpcRegisterTask(
           [in, string, unique] const wchar_t* path,   句柄
           [in, string] const wchar_t* xml,   xml文件的计划任务
           [in] DWORD flags,
           [in, string, unique] const wchar_t* sddl,
           [in] DWORD logonType,
           [in] DWORD cCreds,
           [in, size_is(cCreds), unique] const TASK_USER_CRED* pCreds,
           [out, string] wchar_t** pActualPath,
           [out] PTASK_XML_ERROR_INFO* pErrorInfo
         );
        */
        static const WCHAR TaskPath[] = L"\\Hello\\TaskName";
        WCHAR* path = NULL;
        TASK_XML_ERROR_INFO* info = NULL;
        status = SchRpcRegisterTask(
            Binding,   //rpc调用多一个参数，手册中没有这个参数
            TaskPath,
            task_xml,
            TASK_CREATE | TASK_UPDATE,
            NULL,
            TASK_LOGON_NONE,
            0,
            NULL,
            &path,
            &info);

        if (status == RPC_S_OK && just_run) {
            GUID  pGuid;
            //立即运行
            status = SchRpcRun(Binding, TaskPath, NULL, NULL, TASK_RUN_IGNORE_CONSTRAINTS, NULL, NULL, &pGuid);
        }
    }
    RpcExcept(EXCEPTION_EXECUTE_HANDLER);
    {
        return FALSE;
    }
    RpcEndExcept
    {
    }

    if (status != RPC_S_OK) {
        return FALSE;
    }

    //释放绑定的句柄
    status = RpcBindingFree(&Binding);
    return TRUE;
}

int main()
{
    WCHAR szUsername[100] = L"administrator";
    WCHAR szPassword[100] = L"123456";
    WCHAR szIPAddress[100] = L"192.168.139.122";
    WCHAR szTaskXML[MAX_LOADSTRING] = L"<Task xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\"><RegistrationInfo><Date>2005-10-11T13:21:17-08:00</Date><Author>AuthorName</Author><Version>1.0.0</Version><Description>Notepad starts every day.</Description></RegistrationInfo><Triggers><CalendarTrigger><StartBoundary>2005-10-11T13:21:17-08:00</StartBoundary><EndBoundary>2006-01-01T00:00:00-08:00</EndBoundary><Repetition><Interval>PT1M</Interval><Duration>PT4M</Duration></Repetition><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger></Triggers><Principals><Principal id=\"LocalSystem\"><UserId>S-1-5-18</UserId><RunLevel>HighestAvailable</RunLevel></Principal></Principals><Settings><Enabled>true</Enabled><AllowStartOnDemand>true</AllowStartOnDemand><AllowHardTerminate>true</AllowHardTerminate></Settings><Actions><Exec><Command>notepad.exe</Command></Exec></Actions></Task>";
    WCHAR szDomain[100] = { 0 };
    
    // 开始本地执行(需要管理员权限)
#if 0
    if (RegisterNewTask(NULL, NULL, NULL, szTaskXML, NULL, TRUE, TRUE)) {
        printf("[*] 本地执行计划任务  ==>  立即执行成功");
    }
#endif // 0


#if 1
    //远程执行
    if (RegisterNewTask(szUsername, szPassword, szDomain, szTaskXML, szIPAddress, FALSE, TRUE)) {
        printf("[*] 远程执行计划任务  ==>  立即执行成功");
    }
#endif // 0

    return 0;
}

本地和远程执行效果