How to create and kill processes on remote PC

Common way is like this,

  1. VMI
  2. PSTool

WMI cannot run an application interacting with the desktop, never underestimate Microsoft’s concern about security, open an window akin login of course is an easy way to harvest password. Just used to start a process.

PSTool has much more power than WMI, but it need high-level access also, on remote PC you should change the user account control settings correspondingly. Otherwise you cannot even succeed to ping the target.

        private static void CreateAndKillProcess()
        {          

            /*create by PSTool*/
            Process.Start(@"C:\Users\wenaand\Downloads\PSTools\PsExec.exe", @"\\192.168.0.100 -d -u andrew -p 1234 -i d:\jot\npp.6.9");

            Console.ReadKey();
            /*create by WMI*/
            ConnectionOptions connOptions = new ConnectionOptions
            {
                Impersonation = ImpersonationLevel.Impersonate,
                EnablePrivileges = true,
                Username = "andrew",
                Password = "1234"
            };

            ManagementScope scope = new ManagementScope(@"\\192.168.0.100\root\cimv2", connOptions);
            scope.Connect();

            ManagementClass processclass = new ManagementClass(scope, new ManagementPath("Win32_Process"), new ObjectGetOptions());
            ManagementBaseObject inParamas = processclass.GetMethodParameters("Create");

            inParamas["CommandLine"] = @"d:\jot\npp.6.9";

            ManagementBaseObject outParams = processclass.InvokeMethod("Create", inParamas, null);

            Thread.Sleep(5000);
            /*Kill by PSTool*/
            Process.Start(@"C:\Users\wenaand\Downloads\PSTools\Pskill.exe", @"\\192.168.0.100 -u andrew -p 1234 npp.6.9.exe");

            Console.ReadKey();
            /*Kill by WMI*/
            string connectString = "SELECT * FROM Win32_Process";
            SelectQuery selectQuery = new SelectQuery(connectString);
            ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, selectQuery);
            /*
            foreach (ManagementObject mo in searcher.Get())
            {
                PropertyDataCollection searcherProperties = mo.Properties;
                foreach (PropertyData sp in searcherProperties)
                {
                    Console.WriteLine(sp.Name + "  " + sp.Value);
                }

            }
            */
            ManagementBaseObject Kill = processclass.GetMethodParameters("Terminate");
            foreach (ManagementObject service in searcher.Get())
            {
                Console.WriteLine(service["NAME"]);
                if (service["NAME"].Equals("npp.6.9.exe"))
                {
                    Console.WriteLine("catch it,wow");
                    //local host method
                    //service.InvokeMethod(new ManagementOperationObserver(), "Terminate", null);
                    service.InvokeMethod("Terminate", Kill, null);
                }
            }
            Console.ReadKey();

        }

你可能感兴趣的:(VMI,PSTool)