CreateProecssAsUser 승격 된 권한?

Question

CreateProcessAsUser 함수에 오류가 발생했습니다. "요청 된 작업은 고도가 필요합니다."라고 나는 그것을 내가 할 수있는 가장 높은 권한을 부여했다고 생각했다. 누구 한테 도움이 되니?

  activeSessionId = WTSGetActiveConsoleSessionId();//get the currently logged on user's active session id 
      hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//take snapshot of all processes in The system 

      pe32.dwSize = sizeof(PROCESSENTRY32); 
      Process32First(hProcessSnap, &pe32) 

      do//iterate through all processes 
      { 
       if(_wcsicmp(pe32.szExeFile, L"winlogon.exe") == 0)//narrow down to process called "winlogon.exe" 
       { 
        if (ProcessIdToSessionId(pe32.th32ProcessID, &peSessionID) 
        && peSessionID == activeSessionId)//compare the sessionID of each winlog process to the active console session id 
        { 
         winlogonPID = pe32.th32ProcessID; 
         break; 
        } 
       } 
      }while(Process32Next(hProcessSnap, &pe32)); 

      dwCreationFlags = (NORMAL_PRIORITY_CLASS|CREATE_NEW_CONSOLE); 

      hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,winlogonPID);//return handle to winlogon process 

      OpenProcessToken(hProcess,TOKEN_ALL_ACCESS,&hPToken)//opens the access token 
      LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&luid)//get the locally unique identifier(luid) 


      //creates a new access token and duplicates winlogon token of the active user 
      DuplicateTokenEx(hPToken,MAXIMUM_ALLOWED,NULL,SecurityIdentification,TokenPrimary,&hUserTokenDup) 

      } 

      SetTokenInformation(hUserTokenDup,TokenSessionId,(void*)&activeSessionId,sizeof(DWORD))//sets info for duplicated token 

      //adjust the privileges of the duplicated token 
      tp.PrivilegeCount = 1; 
      tp.Privileges[0].Luid = luid; 
      tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 

      AdjustTokenPrivileges(hUserTokenDup, FALSE, &tp, sizeof(TOKEN_PRIVILEGES),(PTOKEN_PRIVILEGES)NULL,NULL) 


      pEnv = NULL; 
      if(CreateEnvironmentBlock(&pEnv,hUserTokenDup,TRUE))//retrieve environment variables for the user 
      { 
       dwCreationFlags|=CREATE_UNICODE_ENVIRONMENT; 
      } 
      else pEnv = NULL; 

      ZeroMemory(&si, sizeof(si));//set parameters to 0 
      si.cb = sizeof(si);//the size of si 
      si.lpDesktop = L"WinSta0\\Default";//window station and desktop of interactive user 
      ZeroMemory(&pi, sizeof(pi));//set parameters to 0 

      //launch the process in active logged in user's session 
      CreateProcessAsUser 
       (
       hUserTokenDup, 
       NULL, 
       Path, 
       NULL, 
       NULL, 
       FALSE, 
       dwCreationFlags, 
       pEnv, 
       NULL, 
       &si, 
       &pi 
       ) 
      ) 


       //Destroy the Environment block 
         (DestroyEnvironmentBlock(pEnv) 


       CloseHandle(hProcess) 
       CloseHandle(hUserToken) 
       CloseHandle(hUserTokenDup) 
       CloseHandle(hPToken) 

     } 

Answer 1

당신의 전화 코드가 실행되고 어떤 사용자 계정을 다음과 같이 감사

내 코드는? 해당 계정에 다른 사용자로 프로세스를 실행할 수있는 권한이 있습니까?

CreateProcessAsUser()을 사용하는 코드가 SYSTEM 계정의 서비스에서 실행됩니다. 다음 방법은 프로세스를 전혀 열거하지 않고도 제대로 작동합니다.

// error handling omitted for brevity... 

DWORD dwSessionId = WTSGetActiveConsoleSessionId(); 
HANDLE hProcessToken = NULL; 
HANDLE hUserToken = NULL; 

TOKEN_PRIVILEGES TokenPriv, OldTokenPriv; 
DWORD OldSize = 0; 
OpenProcess(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hProcessToken); 
LookupPrivilegeValue(NULL, SE_TCB_NAME, &TokenPriv.Privileges[0].Luid); 
TokenPriv.PrivilegeCount = 1; 
TokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
AdjustTokenPrivileges(hProcessToken, FALSE, &TokenPriv, sizeof(TokenPriv), &OldTokenPriv, &OldSize); 

HANDLE hToken = NULL; 
WTSQueryUserToken(dwSessionId, &hToken); 
DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityIdentification, TokenPrimary, &hUserToken); 
CloseHandle(hToken); 

LPVOID pEnv = NULL; 
CreateEnvironmentBlock(&pEnv, hUserToken, FALSE); 

STARTUPINFO si = {0}; 
si.cb = sizeof(si); 
si.lpDesktop = TEXT("WinSta0\\Default"); 
//... 

PROCESS_INFORMATION pi = {0}; 

//launch the process in active logged in user's session 
CreateProcessAsUser(
    hUserToken, 
    NULL, 
    Path, 
    NULL, 
    NULL, 
    FALSE, 
    NORMAL_PRIORITY_CLASS | CREATE_UNICODE_ENVIRONMENT | ..., 
    pEnv, 
    NULL, 
    &si, 
    &pi 
); 

CloseHandle(pi.hThread); 
CloseHandle(pi.hProcess); 
DestroyEnvironmentBlock(pEnv); 
CloseHandle(hUserToken); 

AdjustTokenPrivileges(hProcessToken, FALSE, &OldTokenPriv, sizeof(OldTokenPriv), NULL, NULL); 
CloseHandle(hProcessToken);