#define LOGON_WITH_PROFILE 0x1 #define LOGON_NETCREDENTIALS_ONLY 0x2 #define CREATE_DEFAULT_ERROR_MODE 0x4000000 #define CREATE_NEW_CONSOLE 0x10 #define CREATE_NEW_PROCESS_GROUP 0x200 #define CREATE_SEPARATE_WOW_VDM 0x800 #define CREATE_SUSPENDED 0x4 #define CREATE_UNICODE_ENVIRONMENT 0x400 #define ABOVE_NORMAL_PRIORITY_CLASS 0x8000 #define BELOW_NORMAL_PRIORITY_CLASS 0x4000 #define HIGH_PRIORITY_CLASS 0x80 #define IDLE_PRIORITY_CLASS 0x40 #define NORMAL_PRIORITY_CLASS 0x20 #define REALTIME_PRIORITY_CLASS 0x100 oNet = CreateObject("WScript.Network") cHost = oNet.ComputerName ? chost Local lpStartupInfo as String , lpProcessInfo as String Declare Long CreateProcessWithLogonW in advapi32.dll ; String lpUsername , ; String lpDomain , ; String lpPassword , ; Long dwLogonFlags , ; String lpApplicationName , ; String lpCommandLine , ; Long dwCreationFlags , ; Long lpEnvironment , ; String lpCurrentDirectory , ; String @lpStartupInfo , ; String @lpProcessInfo Declare Long CloseHande in kernel32.dll ; hObject as Long cUser = Strconv("aaa",12) cDomain = Strconv(cHost,12) cPass = Strconv("aaa",12) cAppName = "C:\winnt\system32\cmd.exe /k dir c: > c:\aaa.txt" + Chr(0) cCommandLine = Chr(0) cDir = Strconv("c:\",12) pStart = long2str(68) + REPLICATE(CHR(0), 64) pProc = REPLICATE(CHR(0), 16) CreateProcessWithLogonW( ; cUser , ; cDomain , ; cPass , ; LOGON_WITH_PROFILE , ; cAppName , ; cCommandLine , ; CREATE_NEW_PROCESS_GROUP , ; 0 , ; cDir , ; @pStart , ; @pProc ; ) FUNCTION long2str PARAMETERS m.longval PRIVATE i, m.retstr m.retstr = "" FOR i = 24 TO 0 STEP -8 m.retstr = CHR(INT(m.longval/(2^i))) + m.retstr m.longval = MOD(m.longval, (2^i)) NEXT RETURN m.retstr ENDFUNC