CreateProcessAsUser()的使用

使用用户凭据创建进程并执行特定操作

最新推荐文章于 2024-08-26 08:34:44 发布

原创最新推荐文章于 2024-08-26 08:34:44 发布 · 5.6k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#windows #32位 #winapi #操作系统 #编程

windows 同时被 2 个专栏收录

6 篇文章

订阅专栏

c++

6 篇文章

订阅专栏

本文介绍了一种方法，通过使用当前用户的令牌，利用WTSGetActiveConsoleSessionId、ImpersonateLoggedOnUser和CreateProcessAsUser等API来启动进程，并执行特定任务如清理磁盘缓存。

        HANDLE hToken = NULL;
	TCHAR szUsername[MAX_PATH];
	TCHAR para[MAX_PATH] = {0};
	TCHAR szUsernamePath[MAX_PATH];
	DWORD dwUsernameLen = MAX_PATH;
	DWORD cursessionid;
	cursessionid = WTSGetActiveConsoleSessionId();
	log_error("WTSGetActiveConsoleSessionId() = %d\n",cursessionid);
	if(!WTSQueryUserToken(cursessionid, &hToken))
	{
		log_error("%s WTSQueryUserToken is failed\n", __FUNCTION__);
	}
	if(!ImpersonateLoggedOnUser(hToken))
	{
		log_error("%s ImpersonateLoggedOnUser is failed\n", __FUNCTION__);
	}
	DWORD UsernamePathSize = ARRAYSIZE(szUsernamePath);
	//获取到当前用户路径
	if (!GetUserProfileDirectory(hToken,szUsernamePath,&UsernamePathSize))
	{
		log_error("%s GetUserProfileDirectory is failed\n", __FUNCTION__);
	}
        BOOL bResult = FALSE;
	PROCESS_INFORMATION pi;
	PSID                psid;
	STARTUPINFO         si;
	ZeroMemory(&si, sizeof(STARTUPINFO));
	si.cb        = sizeof(STARTUPINFO);
	si.lpDesktop = L"winsta0\\default";
	// 
	// start the process
	//
	LPVOID environment;
	BOOL blockRet = CreateEnvironmentBlock(&environment, hToken, FALSE);
	if (!blockRet)
	{
		log_error("could not create environment block (error: %i)",
			GetLastError());
	}
	else
	{
		//TCHAR Cmdline[MAX_PATH] = _T("/c \"C:\\Windows\\System32\\RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8\"");
		TCHAR Cmdline[MAX_PATH] = _T("/c \"C:\\Windows\\System32\\cleanmgr\" /sagerun:100");
		DWORD creationFlags = NORMAL_PRIORITY_CLASS | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT;

		bResult = CreateProcessAsUser(
			hToken,
			_T("C:\\Windows\\System32\\CMD.exe"),
			Cmdline,//_T("InetCpl.cpl,ClearMyTracksByProcess 8"),//L"\"inetcpl.cpl,clearmytracksbyprocess 8\"",
			//L"/c \"C:\\Windows\\System32\\cleanmgr\" /sagerun:100",
			NULL,
			NULL,
			FALSE,
			creationFlags,
			environment,
			NULL,
			&si,
			&pi
			);
		log_error("CreateProcessAsUser0 = %d",GetLastError());

		// 
		// close the handles
		// 
		if (bResult && pi.hProcess != INVALID_HANDLE_VALUE) 
		{ 
			WaitForSingleObject(pi.hProcess, INFINITE); 
			CloseHandle(pi.hProcess); 
		} 
		else
		{
			log_error("CreateProcessAsUser1 = %d",GetLastError());
		}
		if (pi.hThread != INVALID_HANDLE_VALUE)
			CloseHandle(pi.hThread);
		 DestroyEnvironmentBlock(environment);
	}

	RevertToSelf();
	CloseHandle(hToken);