Re: Create non-elevated process from elevated process,...?

From:

Stefan Kuhr <kustt110@gmx.li>

Newsgroups:

microsoft.public.vc.mfc,microsoft.public.win32.programmer.kernel

Date:

Thu, 25 Feb 2010 16:58:57 +0100

Message-ID:

<eGg3gRjtKHA.4624@TK2MSFTNGP02.phx.gbl>

Hi Corinna,

On 2/25/2010 3:38 PM, Corinna Vinschen wrote:

<snip>
In Kerem's case I'm not sure. I never checked in the inverse case
- calling TokenLinkedToken on the elevated token - and without TCB
privileges, if the linked token is an impersonation token for which
DuplicateTokenEx(PrimaryToken) fails. I made the suggestion
nevertheless, because it can be very easily tested.

Were you thinking about something like the following code? When run
under an elevated token, CPAU fails with 1314 (Privilige not held) and
the linked token is an impersonation token, duplicating it to a primary
token fails with 1346 (bad impersonation level):

int _tmain(int argc, _TCHAR* argv[])
{
   TOKEN_LINKED_TOKEN tlt;

   HANDLE hProcessToken = NULL;

   if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY,
     &hProcessToken))
   {
     DWORD cbLength = 0L;
     if (GetTokenInformation(hProcessToken, TokenLinkedToken,
       &tlt,sizeof(tlt), &cbLength))
     {
       TCHAR szCmdLine[] = _T("notepad");

       STARTUPINFO si = {0};
       si.dwFlags = STARTF_USESHOWWINDOW;
       si.wShowWindow = SW_SHOW;
       PROCESS_INFORMATION pi;

       if(CreateProcessAsUser(tlt.LinkedToken,
         _T("c:\\windows\\notepad.exe"), szCmdLine, NULL,
         NULL, FALSE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi))
       {
         _tprintf(_T("It worked\n"));
         VERIFY(WAIT_OBJECT_0==WaitForSingleObject(pi.hProcess,
           INFINITE));
         VERIFY(CloseHandle(pi.hProcess));
         VERIFY(CloseHandle(pi.hThread));
       }
       else
       {
         DWORD dwLastError = GetLastError();
         _tprintf(_T("CPAU failed with %lu (0x%.8x)\n"), dwLastError,
           dwLastError);
       }

       TOKEN_TYPE tt;

       if (GetTokenInformation(tlt.LinkedToken, TokenType,
          &tt,sizeof(tt), &cbLength))
       {
         _tprintf(_T("Token is of type %lu\n"), (DWORD) tt);

         if(TokenImpersonation==tt)
         {
           HANDLE hPrimary = NULL;
           if(!DuplicateTokenEx(tlt.LinkedToken, 0L, NULL,
             SecurityImpersonation, TokenPrimary, &hPrimary))
           {
             DWORD dwLastError = GetLastError();
             _tprintf(_T("DuplicateTokenEx failed with %lu (0x%.8x)\n"),
              dwLastError, dwLastError);
           }
         }

       }

       VERIFY(CloseHandle(tlt.LinkedToken));
     }

     VERIFY(CloseHandle(hProcessToken));
   }

   return 0;
}

Cheers,

--
S