在SYSTEM权限下以当前用户权限运行程序

http://download.csdn.net/download/lai444132348/9730266

using System;
using System.Runtime.InteropServices; namespace murrayju.ProcessExtensions
{
public static class ProcessExtensions
{
#region Win32 Constants private const int CREATE_UNICODE_ENVIRONMENT = 0x00000400;
private const int CREATE_NO_WINDOW = 0x08000000; private const int CREATE_NEW_CONSOLE = 0x00000010; private const uint INVALID_SESSION_ID = 0xFFFFFFFF;
private static readonly IntPtr WTS_CURRENT_SERVER_HANDLE = IntPtr.Zero; #endregion #region DllImports [DllImport("advapi32.dll", EntryPoint = "CreateProcessAsUser", SetLastError = true, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
private static extern bool CreateProcessAsUser(
IntPtr hToken,
String lpApplicationName,
String lpCommandLine,
IntPtr lpProcessAttributes,
IntPtr lpThreadAttributes,
bool bInheritHandle,
uint dwCreationFlags,
IntPtr lpEnvironment,
String lpCurrentDirectory,
ref STARTUPINFO lpStartupInfo,
out PROCESS_INFORMATION lpProcessInformation); [DllImport("advapi32.dll", EntryPoint = "DuplicateTokenEx")]
private static extern bool DuplicateTokenEx(
IntPtr ExistingTokenHandle,
uint dwDesiredAccess,
IntPtr lpThreadAttributes,
int TokenType,
int ImpersonationLevel,
ref IntPtr DuplicateTokenHandle); [DllImport("userenv.dll", SetLastError = true)]
private static extern bool CreateEnvironmentBlock(ref IntPtr lpEnvironment, IntPtr hToken, bool bInherit); [DllImport("userenv.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool DestroyEnvironmentBlock(IntPtr lpEnvironment); [DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hSnapshot); [DllImport("kernel32.dll")]
private static extern uint WTSGetActiveConsoleSessionId(); [DllImport("Wtsapi32.dll")]
private static extern uint WTSQueryUserToken(uint SessionId, ref IntPtr phToken); [DllImport("wtsapi32.dll", SetLastError = true)]
private static extern int WTSEnumerateSessions(
IntPtr hServer,
int Reserved,
int Version,
ref IntPtr ppSessionInfo,
ref int pCount); #endregion #region Win32 Structs private enum SW
{
SW_HIDE = ,
SW_SHOWNORMAL = ,
SW_NORMAL = ,
SW_SHOWMINIMIZED = ,
SW_SHOWMAXIMIZED = ,
SW_MAXIMIZE = ,
SW_SHOWNOACTIVATE = ,
SW_SHOW = ,
SW_MINIMIZE = ,
SW_SHOWMINNOACTIVE = ,
SW_SHOWNA = ,
SW_RESTORE = ,
SW_SHOWDEFAULT = ,
SW_MAX =
} private enum WTS_CONNECTSTATE_CLASS
{
WTSActive,
WTSConnected,
WTSConnectQuery,
WTSShadow,
WTSDisconnected,
WTSIdle,
WTSListen,
WTSReset,
WTSDown,
WTSInit
} [StructLayout(LayoutKind.Sequential)]
private struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public uint dwProcessId;
public uint dwThreadId;
} private enum SECURITY_IMPERSONATION_LEVEL
{
SecurityAnonymous = ,
SecurityIdentification = ,
SecurityImpersonation = ,
SecurityDelegation = ,
} [StructLayout(LayoutKind.Sequential)]
private struct STARTUPINFO
{
public int cb;
public String lpReserved;
public String lpDesktop;
public String lpTitle;
public uint dwX;
public uint dwY;
public uint dwXSize;
public uint dwYSize;
public uint dwXCountChars;
public uint dwYCountChars;
public uint dwFillAttribute;
public uint dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
} private enum TOKEN_TYPE
{
TokenPrimary = ,
TokenImpersonation =
} [StructLayout(LayoutKind.Sequential)]
private struct WTS_SESSION_INFO
{
public readonly UInt32 SessionID; [MarshalAs(UnmanagedType.LPStr)]
public readonly String pWinStationName; public readonly WTS_CONNECTSTATE_CLASS State;
} #endregion // Gets the user token from the currently active session
private static bool GetSessionUserToken(ref IntPtr phUserToken)
{
var bResult = false;
var hImpersonationToken = IntPtr.Zero;
var activeSessionId = INVALID_SESSION_ID;
var pSessionInfo = IntPtr.Zero;
var sessionCount = ; // Get a handle to the user access token for the current active session.
if (WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, , , ref pSessionInfo, ref sessionCount) != )
{
var arrayElementSize = Marshal.SizeOf(typeof(WTS_SESSION_INFO));
var current = pSessionInfo; for (var i = ; i < sessionCount; i++)
{
var si = (WTS_SESSION_INFO)Marshal.PtrToStructure((IntPtr)current, typeof(WTS_SESSION_INFO));
current += arrayElementSize; if (si.State == WTS_CONNECTSTATE_CLASS.WTSActive)
{
activeSessionId = si.SessionID;
}
}
} // If enumerating did not work, fall back to the old method
if (activeSessionId == INVALID_SESSION_ID)
{
activeSessionId = WTSGetActiveConsoleSessionId();
} //If the function succeeds, the return value is a nonzero value, and the phToken parameter points to the primary token of the user. //To call this function successfully, the calling application must be running within the context of the LocalSystem account and have the SE_TCB_NAME privilege. if (WTSQueryUserToken(activeSessionId, ref hImpersonationToken) != )
{
// Convert the impersonation token to a primary token
bResult = DuplicateTokenEx( hImpersonationToken, //hExistingToken
,
IntPtr.Zero, (int)SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, //ImpersonationLevel (int)TOKEN_TYPE.TokenPrimary, //TokenType ref phUserToken); //phNewToken [out] CloseHandle(hImpersonationToken);
} return bResult;
} public static bool StartProcessAsCurrentUser(string appPath, string cmdLine = null, string workDir = null, bool visible = true)
{ var hUserToken = IntPtr.Zero;
var startInfo = new STARTUPINFO();
var procInfo = new PROCESS_INFORMATION();
var pEnv = IntPtr.Zero;
int iResultOfCreateProcessAsUser; startInfo.cb = Marshal.SizeOf(typeof(STARTUPINFO)); try
{
if (!GetSessionUserToken(ref hUserToken))
{ int errCode = Marshal.GetLastWin32Error(); throw new Exception("GetSessionUserToken failed. ERROR Code:" + errCode.ToString());
} uint dwCreationFlags = CREATE_UNICODE_ENVIRONMENT | (uint)(visible ? CREATE_NEW_CONSOLE : CREATE_NO_WINDOW);
startInfo.wShowWindow = (short)(visible ? SW.SW_SHOW : SW.SW_HIDE);
startInfo.lpDesktop = "winsta0\\default"; if (!CreateEnvironmentBlock(ref pEnv, hUserToken, false))
{
throw new Exception("CreateEnvironmentBlock failed.");
} if (!CreateProcessAsUser(
hUserToken,
appPath,
cmdLine,
IntPtr.Zero,
IntPtr.Zero,
false,
dwCreationFlags,
pEnv,
workDir,
ref startInfo,
out procInfo))
{ //iResultOfCreateProcessAsUser = Marshal.GetLastWin32Error(); throw new Exception("CreateProcessAsUser failed.");
} }
finally
{
CloseHandle(hUserToken);
if (pEnv != IntPtr.Zero)
{
DestroyEnvironmentBlock(pEnv);
}
CloseHandle(procInfo.hThread);
CloseHandle(procInfo.hProcess);
} return true;
} }
}
上一篇:Windows服务调试状态下用Console启动


下一篇:Windows服务器SYSTEM权限Webshell无法添加3389账户情况突破总结