.NET (Core and Framework)

Richard Deeming wrote:

Convert.ToInt32 does not allow you to use a Hex prefix. Neither the VB prefix (&H) nor the C# prefix (0x) will work.

Convert.ToInt32("2A", 16)   ' Works
Convert.ToInt32("0x2A", 16) ' Works
Convert.ToInt32("&H2A", 16) ' FormatException: Could not find any recognizable digits
Convert.ToInt32("0x2A")     ' FormatException: Input string was not in a correct format
Convert.ToInt32("&H2A")     ' FormatException: Input string was not in a correct format

public class MyRunAs
    {
        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        internal static extern bool CreateProcessWithTokenW(
            IntPtr dupeTokenHandle,
            LogonFlags dwLogonFlags,  
            string applicationName,
            string commandLine,
            CreationFlags dwCreationFlags, 
            IntPtr environment,
            string currentDirectory,
            ref STARTUPINFO sui,
            out PROCESS_INFORMATION processInfo);

        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        internal static extern bool DuplicateTokenEx(IntPtr tokenHandle, int
        dwDesiredAccess,
        ref SECURITY_ATTRIBUTES lpTokenAttributes, int
        SECURITY_IMPERSONATION_LEVEL,
        int TOKEN_TYPE, ref IntPtr dupeTokenHandle);

        [DllImport("userenv.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        private static extern bool CreateEnvironmentBlock(
         ref IntPtr lpEnvironment,
         IntPtr hToken,
         bool bInherit);

        [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
        static extern bool CreateProcessAsUser(
             IntPtr Token,
             [MarshalAs(UnmanagedType.LPTStr)] string ApplicationName,
             [MarshalAs(UnmanagedType.LPTStr)] string CommandLine,
             ref SECURITY_ATTRIBUTES ProcessAttributes,
             ref SECURITY_ATTRIBUTES ThreadAttributes,
             bool InheritHandles,
             CreationFlags dwCreationFlags,
             IntPtr Environment,
             [MarshalAs(UnmanagedType.LPTStr)] string CurrentDirectory,
             ref STARTUPINFO StartupInfo,
             out PROCESS_INFORMATION ProcessInformation);


        [StructLayout(LayoutKind.Sequential)]
        internal struct SECURITY_ATTRIBUTES
        {
            internal int nLength;
            internal int lpSecurityDescriptor;
            internal bool bInheritHandle;

        }

        public enum CreationFlags
        {
            DefaultErrorMode = 0x04000000,
            NewConsole = 0x00000010,
            NewProcessGroup = 0x00000200,
            SeparateWOWVDM = 0x00000800,
            Suspended = 0x00000004,
            UnicodeEnvironment = 0x00000400,
            ExtendedStartupInfoPresent = 0x00080000
        }

        public enum LogonFlags
        {
            WithProfile = 1,
            NetCredentialsOnly
        }

        [StructLayout(LayoutKind.Sequential)]
        internal struct STARTUPINFO
        {
            internal int cb;
            [MarshalAs(UnmanagedType.LPTStr)]
            internal string lpReserved;
            [MarshalAs(UnmanagedType.LPTStr)]
            internal string lpDesktop;
            [MarshalAs(UnmanagedType.LPTStr)]
            internal string lpTitle;
            internal int dwX;
            internal int dwY;
            internal int dwXSize;
            internal int dwYSize;
            internal int dwXCountChars;
            internal int dwYCountChars;
            internal int dwFillAttribute;
            internal int dwFlags;
            internal short wShowWindow;
            internal short cbReserved2;
            internal IntPtr lpReserved2;
            internal IntPtr hStdInput;
            internal IntPtr hStdOutput;
            internal IntPtr hStdError;
        }

        [StructLayout(LayoutKind.Sequential)]
        internal struct PROCESS_INFORMATION
        {
            internal IntPtr hProcess;
            internal IntPtr hThread;
            internal int dwProcessId;
            internal int dwThreadId;
        }

        // SECURITY_IMPERSONATION_LEVEL
        const int SecurityAnonymous = 0;
        const int SecurityIdentification = 1;
        const int SecurityImpersonation = 2;
        const int SecurityDelegation = 3;

        // TOKEN_TYPE
        const int TokenPrimary = 1;
        const int TokenImpersonation = 2;

        //dwLogonFlags Specifies the logon option
        const int LOGON_WITH_PROFILE = 1;
        const int LOGON_NETCREDENTIALS_ONLY = 2;

        // Access Token constants
        private const int TOKEN_QUERY = 0x0008;
        private const int TOKEN_DUPLICATE = 0x0002;
        private const int TOKEN_ASSIGN_PRIMARY = 0x0001;
        private const int STARTF_USESHOWWINDOW = 0x00000001;
        private const int STARTF_FORCEONFEEDBACK = 0x00000040;
        private const int CREATE_UNICODE_ENVIRONMENT = 0x00000400;
        private const int TOKEN_IMPERSONATE = 0x0004;
        private const int TOKEN_QUERY_SOURCE = 0x0010;
        private const int TOKEN_ADJUST_PRIVILEGES = 0x0020;
        private const int TOKEN_ADJUST_GROUPS = 0x0040;
        private const int TOKEN_ADJUST_DEFAULT = 0x0080;
        private const int TOKEN_ADJUST_SESSIONID = 0x0100;
        private const int STANDARD_RIGHTS_REQUIRED = 0x000F0000;
        private const int TOKEN_ALL_ACCESS =
            STANDARD_RIGHTS_REQUIRED |
            TOKEN_ASSIGN_PRIMARY |
            TOKEN_DUPLICATE |
            TOKEN_IMPERSONATE |
            TOKEN_QUERY |
            TOKEN_QUERY_SOURCE |
            TOKEN_ADJUST_PRIVILEGES |
            TOKEN_ADJUST_GROUPS |
            TOKEN_ADJUST_DEFAULT |
            TOKEN_ADJUST_SESSIONID;

        public static bool CreateTokenChild()
        {
                    
            try {
                
                
                STARTUPINFO startInfo = new STARTUPINFO();
                startInfo.cb = Marshal.SizeOf(startInfo);
                // not needed ?!
                // startInfo.lpDesktop = @"winsta0\default"; 

                // Create Process with token
                IntPtr dupeTokenHandle = IntPtr.Zero;
                // IntPtr tokenHandle = WindowsIdentity.GetCurrent().Token;

                // get impersonation token
                // we can do that since the owner of this thread 
                // has "act as part of operating system" priviledge
                // use UPN of target user
                WindowsIdentity id = new WindowsIdentity("user@domain");
                IntPtr tokenHandle = id.Token;
                
                // Setting security attributes
                SECURITY_ATTRIBUTES lpTokenAttributes = new SECURITY_ATTRIBUTES();
                lpTokenAttributes.nLength = Marshal.SizeOf(lpTokenAttributes);

                // SECURITY_ATTRIBUTES threadAttributes = new SECURITY_ATTRIBUTES();
                // threadAttributes.nLength = Marshal.SizeOf(lpTokenAttributes);

                // get primary token for user to be impersonated to
                bool retVal = DuplicateTokenEx(
                    tokenHandle,
                    TOKEN_ALL_ACCESS, 
                    ref lpTokenAttributes, 
                    SecurityImpersonation, 
                    TokenPrimary, 
                    ref dupeTokenHandle);

                if (!retVal)
                {
                    int winError = Marshal.GetLastWin32Error();
                    File.AppendAllText("C:\\tmp\\out.log", DateTime.Now.ToLongTimeString() + " " + winError + Environment.NewLine);

                    return false;
                }

                // app to be started
                string app = @"c:\Windows\System32\notepad.exe";
                // command line arguments
                string cmd = null;
                // startup path
                string spath = @"C:\";

                // create environment for user to be impersonated to
                IntPtr env = GetEnvironmentBlock(dupeTokenHandle);

                // the process to be created
                PROCESS_INFORMATION processInfo;

                bool ret = CreateProcessWithTokenW(
                    dupeTokenHandle,
                    LogonFlags.WithProfile,
                    app,
                    cmd,
                    CreationFlags.UnicodeEnvironment,
                    env,
                    spath,
                    ref startInfo, 
                    out processInfo);
                
                /*bool ret = CreateProcessAsUser(dupeTokenHandle, spot, cmd, ref lpTokenAttributes, ref threadAttributes, true,
                    CreationFlags.UnicodeEnvironment, env, "C:\\", ref startInfo, out processInfo);
                    */

                if (!ret)
                {
                    int winError = Marshal.GetLastWin32Error();
                    File.AppendAllText("C:\\tmp\\out.log", DateTime.Now.ToLongTimeString() + " error: " + winError + Environment.NewLine);

                    return false;
                }                
                else
                {
                    File.AppendAllText("C:\\tmp\\out.log", DateTime.Now.ToLongTimeString() + " success " + Environment.NewLine);
                }               

            }

            catch (Exception e)
            {
                return false ;
            }
            finally
            {
                // TODO
                // close handles
            }
            return true;
                        
        }

        private static IntPtr GetEnvironmentBlock(IntPtr token)
        {
            var envBlock = IntPtr.Zero;
            if (!CreateEnvironmentBlock(ref envBlock, token, false))
            {
                throw new Win32Exception(Marshal.GetLastWin32Error(), "CreateEnvironmentBlock failed");
            }
            return envBlock;
        }

    }

gobbo-dd wrote:

I compared two processes with process explorer and the only thing that I realized was that "normal" processes have security attribute "NT AUTHORITY\INTERACTIVE" which the process I am starting has not ...

Bastard Programmer from Hell
If you can't read my code, try converting it here[^]

Quote:

If the lpDesktop member is NULL or an empty string, the new process inherits the desktop and window station of its parent process. The function adds permission for the specified user account to the inherited window station and desktop. Otherwise, if this member specifies a desktop, it is the responsibility of the application to add permission for the specified user account to the specified window station and desktop, even for WinSta0\Default.

gobbo-dd wrote:

And secondly, the documentation says that it should work ...

gobbo-dd wrote:

Anyone has an idea why it doesn't?

Bastard Programmer from Hell
If you can't read my code, try converting it here[^]

Quote:

If the lpDesktop member is NULL or an empty string, the new process inherits the desktop and window station of its parent process. The function adds permission for the specified user account to the inherited window station and desktop.

Quote:

..because (AFAIK) you can only interact with windows-objects that belong to your desktop-object; that is user-specific, as it is created after logon. You could create a new desktop-object and show it there.

gobbo-dd wrote:

which indicates imho that the process is allowed to create "something" on the desktop....

Bastard Programmer from Hell
If you can't read my code, try converting it here[^]

//The following security adjustments are necessary to give the new 
//process sufficient permission to run in the service's window station
//and desktop. This uses classes from the AsproLock library also from 
//Asprosys.
IntPtr hWinSta = GetProcessWindowStation();
WindowStationSecurity ws = new WindowStationSecurity(hWinSta, AccessControlSections.Access);
ws.AddAccessRule(new WindowStationAccessRule("user@domain", WindowStationRights.AllAccess, AccessControlType.Allow));
ws.AcceptChanges();

IntPtr hDesk = GetThreadDesktop(GetCurrentThreadId());
DesktopSecurity ds = new DesktopSecurity(hDesk, AccessControlSections.Access);
ds.AddAccessRule(new DesktopAccessRule("user@domain", DesktopRights.AllAccess, AccessControlType.Allow));
ds.AcceptChanges();