Question

所以我正在开发一个powershell脚本来管理专门控件的安全支持提供程序。目前我有脚本工作来添加SSP，但是当我尝试将脚本更改为删除ssp时，它会中断。

以下是代码：

$DynAssembly = New-Object System.Reflection.AssemblyName('SSPI2')
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('SSPI2', $False)

$TypeBuilder = $ModuleBuilder.DefineType('SSPI2.Secur32', 'Public, Class')
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod('DeleteSecurityPackage',
    'secur32.dll',
    'Public, Static',
    [Reflection.CallingConventions]::Standard,
    [Int32],
    [Type[]] @([String]),
    [Runtime.InteropServices.CallingConvention]::Winapi,
    [Runtime.InteropServices.CharSet]::Auto)

$Secur32 = $TypeBuilder.CreateType()
$RuntimeSuccess = $True
$Result = $Secur32::DeleteSecurityPackage($DllName)

每次我运行这个我得到：异常调用＆＃34; DeleteSecurityPackage＆＃34;用＆＃34; 1＆＃34;参数：＆＃34;不支持所请求的功能

然而，添加ssp的这段代码可以正常工作：

$DynAssembly = New-Object System.Reflection.AssemblyName('SSPI2')
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('SSPI2', $False)

$TypeBuilder = $ModuleBuilder.DefineType('SSPI2.Secur32', 'Public, Class')
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod('AddSecurityPackage',
    'secur32.dll',
    'Public, Static',
    [Reflection.CallingConventions]::Standard,
    [Int32],
    [Type[]] @([String], [IntPtr]),
    [Runtime.InteropServices.CallingConvention]::Winapi,
    [Runtime.InteropServices.CharSet]::Auto)

$Secur32 = $TypeBuilder.CreateType()

if ([IntPtr]::Size -eq 4) {
    $StructSize = 20
} else {
    $StructSize = 24
}

$StructPtr = [Runtime.InteropServices.Marshal]::AllocHGlobal($StructSize)
[Runtime.InteropServices.Marshal]::WriteInt32($StructPtr, $StructSize)

$RuntimeSuccess = $True
$Result = $Secur32::AddSecurityPackage($DllName, $StructPtr)

通过权利它应该更容易删除，因为我不需要担心结构，但它不高兴。

任何帮助将不胜感激

Answer 1

似乎没有完全实现/支持Microsoft。本文似乎支持这一点：http://cybernigma.blogspot.com/2014/03/using-sspap-lsass-proxy-to-mitigate.html相关信息约为3/4。

删除安全支持包

1 个答案: