这里使用了两个Demo进行测试。其中HijackPipe.exe是服务端，他接受客户端PipeClient发送来的数据，对该客户权限进行模拟，并使用在控制台打印出当前进程的用户名。我们使HijackPipe.exe运行在普通账户aaa下，并使用Runas命令让客户端PipeClient运行在管理员权限下，然后进行连接-If a server via named pipes to communicate with a client, the server can use the Windows API function

ImpersonateNamedPipeClient to tell the SRM, he wanted to imitate the other end of the pipe user. Server to be lost in the process of imitation

Some of the security certificate, in turn, the server will get some in imitation of the new security certificate, so as to achieve the purpose of the right to mention