CreateProcessAsUser.docx

1、CreateProcessAsUsersystem服务程序中创建一个进程,当前登陆用户,用createProcessByUser()#define DESKTOP_ALL (DESKTOP_READOBJECTS | DESKTOP_CREATEWINDOW | DESKTOP_CREATEMENU | DESKTOP_HOOKCONTROL | DESKTOP_JOURNALRECORD | DESKTOP_JOURNALPLAYBACK | DESKTOP_ENUMERATE | DESKTOP_WRITEOBJECTS | DESKTOP_SWITCHDESKTOP | STANDARD

2、_RIGHTS_REQUIRED)#define WINSTA_ALL (WINSTA_ENUMDESKTOPS | WINSTA_READATTRIBUTES | WINSTA_ACCESSCLIPBOARD | WINSTA_CREATEDESKTOP | WINSTA_WRITEATTRIBUTES | WINSTA_ACCESSGLOBALATOMS | WINSTA_EXITWINDOWS | WINSTA_ENUMERATE | WINSTA_READSCREEN | STANDARD_RIGHTS_REQUIRED)#define GENERIC_ACCESS (GENERIC_

3、READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL)BOOL AddAceToWindowStation(HWINSTA hwinsta, PSID psid);BOOL AddAceToDesktop(HDESK hdesk, PSID psid);BOOL GetLogonSID (HANDLE hToken, PSID *ppsid);VOID FreeLogonSID (PSID *ppsid);BOOL StartInteractiveClientProcess ( LPTSTR lpszUsername, / client to

4、 log on LPTSTR lpszDomain, / domain of clients account LPTSTR lpszPassword, / clients password LPTSTR lpCommandLine / command line to execute) HANDLE hToken; HDESK hdesk = NULL; HWINSTA hwinsta = NULL, hwinstaSave = NULL; PROCESS_INFORMATION pi; PSID pSid = NULL; STARTUPINFO si; BOOL bResult = FALSE

5、;/ Log the client on to the local computer. if (!LogonUser( lpszUsername, lpszDomain, lpszPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken) ) goto Cleanup; / Save a handle to the callers current window station. if ( (hwinstaSave = GetProcessWindowStation() ) = NULL) goto Cleanu

6、p;/ Get a handle to the interactive window station. hwinsta = OpenWindowStation( Lwinsta0, / the interactive window station FALSE, / handle is not inheritable READ_CONTROL | WRITE_DAC); / rights to read/write the DACL if (hwinsta = NULL) goto Cleanup;/ To get the correct default desktop, set the cal

7、lers / window station to the interactive window station. if (!SetProcessWindowStation(hwinsta) goto Cleanup;/ Get a handle to the interactive desktop. hdesk = OpenDesktop( Ldefault, / the interactive window station 0, / no interaction with other desktop processes FALSE, / handle is not inheritable R

8、EAD_CONTROL | / request the rights to read and write the DACL WRITE_DAC | DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS);/ Restore the callers window station. if (!SetProcessWindowStation(hwinstaSave) goto Cleanup; if (hdesk = NULL) goto Cleanup;/ Get the SID for the clients logon session. if (!GetLogo

9、nSID(hToken, &pSid) goto Cleanup;/ Allow logon SID full access to interactive window station. if (! AddAceToWindowStation(hwinsta, pSid) ) goto Cleanup;/ Allow logon SID full access to interactive desktop. if (! AddAceToDesktop(hdesk, pSid) ) goto Cleanup;/ Impersonate client to ensure access to exe

10、cutable file. if (! ImpersonateLoggedOnUser(hToken) ) goto Cleanup;/ Initialize the STARTUPINFO structure./ Specify that the process runs in the interactive desktop. ZeroMemory(&si, sizeof(STARTUPINFO); si.cb= sizeof(STARTUPINFO); si.lpDesktop = TEXT(winsta0default);/ Launch the process in the clien

11、ts logon session. bResult = CreateProcessAsUser( hToken, / clients access token NULL, / file to execute lpCommandLine, / command line NULL, / pointer to process SECURITY_ATTRIBUTES NULL, / pointer to thread SECURITY_ATTRIBUTES FALSE, / handles are not inheritable NORMAL_PRIORITY_CLASS | CREATE_NEW_C

12、ONSOLE, / creation flags NULL, / pointer to new environment block NULL, / name of current directory &si, / pointer to STARTUPINFO structure &pi / receives information about new process ); / End impersonation of client. RevertToSelf(); if (bResult & pi.hProcess != INVALID_HANDLE_VALUE) WaitForSingleO

13、bject(pi.hProcess, INFINITE); CloseHandle(pi.hProcess); if (pi.hThread != INVALID_HANDLE_VALUE) CloseHandle(pi.hThread); Cleanup: if (hwinstaSave != NULL) SetProcessWindowStation (hwinstaSave);/ Free the buffer for the logon SID. if (pSid) FreeLogonSID(&pSid);/ Close the handles to the interactive w

14、indow station and desktop. if (hwinsta) CloseWindowStation(hwinsta); if (hdesk) CloseDesktop(hdesk);/ Close the handle to the clients access token. if (hToken != INVALID_HANDLE_VALUE) CloseHandle(hToken); return bResult;BOOL AddAceToWindowStation(HWINSTA hwinsta, PSID psid) ACCESS_ALLOWED_ACE *pace;

15、 ACL_SIZE_INFORMATION aclSizeInfo; BOOL bDaclExist; BOOL bDaclPresent; BOOL bSuccess = FALSE; DWORD dwNewAclSize; DWORD dwSidSize = 0; DWORD dwSdSizeNeeded; PACL pacl; PACL pNewAcl; PSECURITY_DESCRIPTOR psd = NULL; PSECURITY_DESCRIPTOR psdNew = NULL; PVOID pTempAce; SECURITY_INFORMATION si = DACL_SE

16、CURITY_INFORMATION; unsigned int i; _try / Obtain the DACL for the window station. if (!GetUserObjectSecurity( hwinsta, &si, psd, dwSidSize, &dwSdSizeNeeded) ) if (GetLastError() = ERROR_INSUFFICIENT_BUFFER) psd = (PSECURITY_DESCRIPTOR)HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, dwSdSizeNeeded);

17、if (psd = NULL) _leave; psdNew = (PSECURITY_DESCRIPTOR)HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, dwSdSizeNeeded); if (psdNew = NULL) _leave; dwSidSize = dwSdSizeNeeded; if (!GetUserObjectSecurity( hwinsta, &si, psd, dwSidSize, &dwSdSizeNeeded) ) _leave; else _leave; / Create a new DACL. if (!In

18、itializeSecurityDescriptor( psdNew, SECURITY_DESCRIPTOR_REVISION) ) _leave; / Get the DACL from the security descriptor. if (!GetSecurityDescriptorDacl( psd, &bDaclPresent, &pacl, &bDaclExist) ) _leave; / Initialize the ACL. ZeroMemory(&aclSizeInfo, sizeof(ACL_SIZE_INFORMATION); aclSizeInfo.AclBytes

19、InUse = sizeof(ACL); / Call only if the DACL is not NULL. if (pacl != NULL) / get the file ACL size info if (!GetAclInformation( pacl, (LPVOID)&aclSizeInfo, sizeof(ACL_SIZE_INFORMATION), AclSizeInformation) ) _leave; / Compute the size of the new ACL. dwNewAclSize = aclSizeInfo.AclBytesInUse + (2*si

20、zeof(ACCESS_ALLOWED_ACE) + (2*GetLengthSid(psid) - (2*sizeof(DWORD); / Allocate memory for the new ACL. pNewAcl = (PACL)HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, dwNewAclSize); if (pNewAcl = NULL) _leave; / Initialize the new DACL. if (!InitializeAcl(pNewAcl, dwNewAclSize, ACL_REVISION) _leave;

21、 / If DACL is present, copy it to a new DACL. if (bDaclPresent) / Copy the ACEs to the new ACL. if (aclSizeInfo.AceCount) for (i=0; i AceSize) ) _leave; / Add the first ACE to the window station. pace = (ACCESS_ALLOWED_ACE *)HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(ACCESS_ALLOWED_ACE) +

22、 GetLengthSid(psid) - sizeof(DWORD); if (pace = NULL) _leave; pace-Header.AceType = ACCESS_ALLOWED_ACE_TYPE; pace-Header.AceFlags = CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE; pace-Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + GetLengthSid(psid) - sizeof(DWORD); pace-Mask = GENERI

23、C_ACCESS; if (!CopySid(GetLengthSid(psid), &pace-SidStart, psid) _leave; if (!AddAce( pNewAcl, ACL_REVISION, MAXDWORD, (LPVOID)pace, pace-Header.AceSize) ) _leave; / Add the second ACE to the window station. pace-Header.AceFlags = NO_PROPAGATE_INHERIT_ACE; pace-Mask = WINSTA_ALL; if (!AddAce( pNewAc

24、l, ACL_REVISION, MAXDWORD, (LPVOID)pace, pace-Header.AceSize) ) _leave; / Set a new DACL for the security descriptor. if (!SetSecurityDescriptorDacl( psdNew, TRUE, pNewAcl, FALSE) ) _leave; / Set the new security descriptor for the window station. if (!SetUserObjectSecurity(hwinsta, &si, psdNew) _le

25、ave; / Indicate success. bSuccess = TRUE; _finally / Free the allocated buffers. if (pace != NULL) HeapFree(GetProcessHeap(), 0, (LPVOID)pace); if (pNewAcl != NULL) HeapFree(GetProcessHeap(), 0, (LPVOID)pNewAcl); if (psd != NULL) HeapFree(GetProcessHeap(), 0, (LPVOID)psd); if (psdNew != NULL) HeapFr

26、ee(GetProcessHeap(), 0, (LPVOID)psdNew); return bSuccess;BOOL AddAceToDesktop(HDESK hdesk, PSID psid) ACL_SIZE_INFORMATION aclSizeInfo; BOOL bDaclExist; BOOL bDaclPresent; BOOL bSuccess = FALSE; DWORD dwNewAclSize; DWORD dwSidSize = 0; DWORD dwSdSizeNeeded; PACL pacl; PACL pNewAcl; PSECURITY_DESCRIP

27、TOR psd = NULL; PSECURITY_DESCRIPTOR psdNew = NULL; PVOID pTempAce; SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION; unsigned int i; _try / Obtain the security descriptor for the desktop object. if (!GetUserObjectSecurity( hdesk, &si, psd, dwSidSize, &dwSdSizeNeeded) if (GetLastError() = ERROR_I

28、NSUFFICIENT_BUFFER) psd = (PSECURITY_DESCRIPTOR)HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, dwSdSizeNeeded ); if (psd = NULL) _leave; psdNew = (PSECURITY_DESCRIPTOR)HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, dwSdSizeNeeded); if (psdNew = NULL) _leave; dwSidSize = dwSdSizeNeeded; if (!GetUserO

29、bjectSecurity( hdesk, &si, psd, dwSidSize, &dwSdSizeNeeded) ) _leave; else _leave; / Create a new security descriptor. if (!InitializeSecurityDescriptor( psdNew, SECURITY_DESCRIPTOR_REVISION) ) _leave; / Obtain the DACL from the security descriptor. if (!GetSecurityDescriptorDacl( psd, &bDaclPresent, &pacl, &bDaclExist) ) _leave; / Initialize. ZeroMemory(&aclSizeInfo, sizeof(ACL_SIZE_INFORMATION); aclSizeInfo.AclBytesInUse = size