2026-01-07 03:00:10 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文阐述WindowsSession0隔离机制下的注入突破技术。针对Vista后传统CreateRemoteThread失效的问题，文章详细分析了通过启用SeDebugPrivilege权限并调用未公开APIZwCreateThreadEx，将挂起标志设为0从而成功注入Session0进程的方法。该技术可用于获取SYSTEM权限、提升红队工具隐蔽性及绕过杀软监控。 综合评分： 85 文章分类： 红队,内网渗透,免杀,二进制安全

cover_image

Windows安全攻防-突破Session0注入

剑外思归客

2026年1月7日 00:00 江苏

session的概念

Windows 操作系统通过“会话”（Session）机制来管理用户登录和进程运行环境。一个会话包含了代表单个用户登录会话的所有进程和其他系统对象，其中包括窗口、桌面和窗口站。每当用户登录 Windows 系统时，系统都会为其创建一个独立的会话。每个用户在虚拟内存中拥有自己的会话空间，该空间分为会话结构、会话镜像空间（用于 Win32k.sys 数据和驱动程序）、会话视图空间（包括桌面堆）和会话分页池。桌面堆或会话视图空间的耗尽可能导致显示异常或整个会话的问题。在 Windows XP、Windows Server 2003 及更早版本的操作系统中，所有服务和第一个登录到控制台的用户都运行在同一个会话中，即 Session 0 。这种共享环境带来了显著的安全风险。由于服务通常以提升的权限运行，它们成为了恶意代理寻求提升自身权限的攻击目标为了应对这一安全挑战，微软在 Windows Vista 和 Windows Server 2008 中引入了 Session 0 隔离机制。通过这项设计，服务被隔离到 Session 0 中，并使其变为非交互式。这意味着在 Windows Vista 及更高版本中，只有系统进程和服务在 Session 0 中运行。第一个登录的用户则进入 Session 1，随后的用户（例如通过远程桌面服务）会登录到 Session 2、Session 3 等等。这种隔离是操作系统有意设计并强制执行的。通过命令tasklist /fi "SESSION eq 0"可以查看当前session中运行的进程

session 0中运行的程序

Windows 服务（Services）

系统服务：如 svchost.exe 托管的服务（网络、更新、安全等）、lsass.exe（本地安全认证）、wininit.exe（系统初始化）等。
第三方服务：如数据库服务（MySQL、SQL Server）、杀毒软件后台服务（如 MsMpEng.exe）等。
服务控制管理器（SCM）：通过 services.msc 管理的所有服务默认在 Session 0 运行。

驱动程序（Drivers）

内核模式驱动程序（如硬件驱动、文件系统驱动）不直接运行在 Session 0，但用户模式的驱动程序宿主进程（如 spoolsv.exe 打印服务）可能在此会话中运行。

系统关键进程

csrss.exe（客户端/服务器运行时子系统）：管理控制台窗口和线程。
winlogon.exe（仅早期版本）：在 Windows Vista 之前的部分版本中可能关联 Session 0。
smss.exe（会话管理器）：初始化系统会话（包括 Session 0）。

计划任务

配置为“无论用户是否登录均运行”的任务（通过 schtasks.exe 或任务计划程序创建）。

CreateRemoteThread与ZwCreateThreadEx的差异

传统远程线程注入技术主要依赖于CreateRemoteThread函数，该函数在Windows XP及更早版本中能够成功注入Session 0进程。但在Windows Vista及后续版本中，CreateRemoteThread无法突破Session 0隔离，这是因为其底层调用机制发生了变化。实际上CreateRemoteThread函数在底层中调用的是ZwCreateThreadEx这是一个未公开的windows APICreateRemoteThread

HANDLE&nbsp;CreateRemoteThread(
&nbsp; HANDLE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hProcess, &nbsp;&nbsp;//目标进程句柄
&nbsp; LPSECURITY_ATTRIBUTES &nbsp;lpThreadAttributes, &nbsp;&nbsp;//线程安全属性，通常NULL
&nbsp; SIZE_T &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dwStackSize, &nbsp;&nbsp;//初始堆栈大小，0表示默认
&nbsp; LPTHREAD_START_ROUTINE lpStartAddress, &nbsp;&nbsp;//线程起始地址
&nbsp; LPVOID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lpParameter, &nbsp;&nbsp;//传递给线程函数的参数
&nbsp; DWORD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;dwCreationFlags, &nbsp;&nbsp;//创建标志，0表示立即执行
&nbsp; LPDWORD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lpThreadId &nbsp; &nbsp;//接收线程ID的指针，可NULL
);

ZwCreateThreadEx(32位和64位有所不同)

NTSYSAPI NTSTATUS NTAPI&nbsp;ZwCreateThreadEx(
&nbsp; &nbsp; PHANDLE ThreadHandle, &nbsp;&nbsp;//用于返回创建的线程句柄的指针。
&nbsp; &nbsp; ACCESS_MASK DesiredAccess, &nbsp;//用于指定线程句柄的访问权限。
&nbsp; &nbsp; POBJECT_ATTRIBUTES ObjectAttributes, &nbsp;//一个指向 OBJECT_ATTRIBUTES 结构的指针，指定线程对象的对象名和安全性属性
&nbsp; &nbsp; HANDLE ProcessHandle, &nbsp;// 目标进程的句柄，即在哪个进程中创建新线程。
&nbsp; &nbsp; PVOID StartRoutine, &nbsp;//一个指向新线程的入口点的指针
&nbsp; &nbsp; PVOID Argument, &nbsp;// 第二个参数传递给新线程的指针
&nbsp; &nbsp; ULONG CreateFlags, &nbsp;// 指定创建线程的属性，如堆栈大小、创建标志、线程属性等
&nbsp; &nbsp; SIZE_T ZeroBits, &nbsp;//保留参数，应该传递0
&nbsp; &nbsp; SIZE_T StackSize, &nbsp;//线程堆栈大小
&nbsp; &nbsp; SIZE_T MaximumStackSize, &nbsp;// 线程堆栈的最大大小
&nbsp; &nbsp; PPS_ATTRIBUTE_LIST AttributeList);&nbsp;//该结构可以用于在线程创建时指定各种属性

关键差异在于CreateSuspended标志的设置。CreateRemoteThread在底层调用ZwCreateThreadEx时，将CreateSuspended参数设置为1（挂起线程），导致注入Session 0进程失败。而直接调用ZwCreateThreadEx并将该参数设为0（不挂起线程）可绕过隔离机制，成功创建远程线程，另外ZwCreateThreadEx可以用于创建一个在指定进程的上下文之外的线程，即可以创建一个与指定进程无关的线程。此外，CreateRemoteThread需要管理员权限才能成功注入Session 0进程，即使以管理员身份运行程序，使用CreateRemoteThread进行注入时，仍然可能出现”拒绝访问”错误（错误码可能是5或0XC005）。因此，攻击者通常需要先获取SeDebugPrivilege权限，然后才能利用ZwCreateThreadEx实现Session 0注入

SeDebugPrivilege

SeDebugPrivilege（调试权限）是一个内核级权限，可以让拥有它的进程“越权”访问或操作其他进程，包括系统服务（比如 SYSTEM 权限的进程）、Session 0 服务进程等，例如访问 SYSTEM 用户的进程、调试、注入、读取内存等。默认情况下，即使你是管理员账户，也不默认启用该权限。你需要显式调用系统 API 启用它。通过whoami /priv可以查看当前用户是否具有该权限quser命令可以查看当前系统的会话普通用户是没有该权限的

C:\Users\admin>whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Description &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;State
============================= ==================================== ========
SeShutdownPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Shut down the system &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeChangeNotifyPrivilege &nbsp; &nbsp; &nbsp; Bypass traverse checking &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Enabled
SeUndockPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set &nbsp; &nbsp; &nbsp; Disabled
SeTimeZonePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Change the time zone &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled

当以管理员权限运行cmd之后，可以看到SeDebugPrivilege权限，但并未启用Disabled

C:\Windows\System32>whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Description &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;State
========================================= ================================================================== ========
SeIncreaseQuotaPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Adjust memory quotas for a process &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeSecurityPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Manage auditing and security log &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeTakeOwnershipPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Take ownership of files or other objects &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeLoadDriverPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Load and unload device drivers &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeSystemProfilePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Profile system performance &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeSystemtimePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Change the system time &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeProfileSingleProcessPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Profile single process &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeIncreaseBasePriorityPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Increase scheduling priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeCreatePagefilePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Create a pagefile &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Disabled
SeBackupPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Back up files and directories &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Disabled
SeRestorePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Restore files and directories &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Disabled
SeShutdownPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Shut down the system &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeDebugPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Debug programs &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeSystemEnvironmentPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Modify firmware environment values &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeChangeNotifyPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Bypass traverse checking &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Enabled
SeRemoteShutdownPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Force shutdown from a remote system &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Disabled
SeUndockPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Remove computer from docking station &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeManageVolumePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Perform volume maintenance tasks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeImpersonatePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Impersonate a client after authentication &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Enabled
SeCreateGlobalPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Create global objects &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Enabled
SeIncreaseWorkingSetPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Increase a process working set &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeTimeZonePrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Change the time zone &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Disabled
SeCreateSymbolicLinkPrivilege &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Create symbolic links &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Disabled

在做以下事情时，你需要启用 SeDebugPrivilege：

| 用途 | 是否需要 SeDebugPrivilege | | — | — | | 注入 SYSTEM 进程（如 lsass.exe） | 需要 | | 读取其他用户会话中的进程内存 | 需要 | | OpenProcess() 调用失败，错误代码 5（拒绝访问） | 需要 | | 使用调试器附加其他权限进程 | 需要 | | 获取 Windows 服务进程句柄 | 需要 | | 普通用户进程间注入（低权限） | 不需要 | | | |

Session0注入的流程

首先获取管理员权限—>获取SeDebugPrivilege权限—>获取目标进程的句柄—>在目标进程内创建虚拟地址空间—>将shellcode或者dll文件路径写入到虚拟地址空间内—>调用ZwCreateThreadEx进行创建线程并执行

session 0注入应用场景

获取高权限的会话

攻击者通过向SYSTEM权限的服务进程（如services.exe、winlogon.exe）注入DLL，直接执行高权限代码，实现权限提升。例如，将Cobalt Strike生成的DLL注入到Session 0进程，获取系统级控制权。这种技术使得恶意程序能够绕过用户会话隔离，执行需要高权限的操作，如修改系统配置、创建管理员账户、安装持久后门等。

红队工具隐蔽性增强

在渗透测试中，Session 0注入技术被用于提高攻击工具的隐蔽性。例如，将恶意代码注入到winlogon.exe进程中，实现截屏功能或建立监听端口，获取SYSTEM权限的shell。这种技术不会创建新的进程，难以被常规安全监控发现，常用于模拟高级持续性威胁（APT）攻击。

绕过杀毒软件强制结束进程

在 Session 0 中运行的大多数进程是以 SYSTEM 权限运行的，而普通用户级别的权限（即使是管理员权限）并不能轻易影响或监控 SYSTEM 权限下的进程。杀软一般不会在系统服务中直接进行杀毒操作，或者对 SYSTEM 权限进程进行强制结束，因为这样做有可能导致系统不稳定或崩溃。因此，如果恶意代码能够成功注入到 Session 0，它可以依托 SYSTEM 权限来规避杀软的检测和干预。

参考

https://0xcc12138.github.io/session0%E6%B3%A8%E5%85%A5/ https://www.lyshark.com/post/102cca99.html

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：剑外思归客《Windows安全攻防-突破Session0注入》