当前没有测试数据。

%1 mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c ""%~s0"" ::","","runas",1)(window.close)&&exit
chcp 65001
@echo off
mkdir C:\token
echo set-executionpolicy remotesigned > C:\input_token.in
echo A >> C:\input_token.in
echo Save-Module -Name NtObjectManager -Path c:\token >> C:\input_token.in
echo Y >> C:\input_token.in
echo Install-Module -Name NtObjectManager >> C:\input_token.in
echo A >> C:\input_token.in
echo Set-ExecutionPolicy Unrestricted >> C:\input_token.in
echo A >> C:\input_token.in
echo Import-Module NtObjectManager >> C:\input_token.in
echo sc.exe start TrustedInstaller >> C:\input_token.in
echo Set-NtTokenPrivilege SeDebugPrivilege >> C:\input_token.in
echo $p = Get-NtProcess -Name TrustedInstaller.exe >> C:\input_token.in
echo $proc = New-Win32Process cmd.exe -CreationFlags NewConsole -ParentProcess $p >> C:\input_token.in
type C:\input_token.in | powershell