admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

* don't show impersonation levels for primary tokens

Browse Source 
* better linked token support in PhCreateProcessAsUser

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3909 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2010-12-21 02:48:21 +00:00
parent 86e37c1ff9
commit ddd2e8626e
2 changed files with 45 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
2.x/trunk/ProcessHacker/tokprp.c
+20 -13
View File
@@ -972,20 +972,27 @@ INT_PTR CALLBACK PhpTokenAdvancedPageProc(
break;
}
switch (statistics.ImpersonationLevel)
if (statistics.TokenType == TokenImpersonation)
{
case SecurityAnonymous:
tokenImpersonationLevel = L"Anonymous";
break;
case SecurityIdentification:
tokenImpersonationLevel = L"Identification";
break;
case SecurityImpersonation:
tokenImpersonationLevel = L"Impersonation";
break;
case SecurityDelegation:
tokenImpersonationLevel = L"Delegation";
break;
switch (statistics.ImpersonationLevel)
{
case SecurityAnonymous:
tokenImpersonationLevel = L"Anonymous";
break;
case SecurityIdentification:
tokenImpersonationLevel = L"Identification";
break;
case SecurityImpersonation:
tokenImpersonationLevel = L"Impersonation";
break;
case SecurityDelegation:
tokenImpersonationLevel = L"Delegation";
break;
}
}
else
{
tokenImpersonationLevel = L"N/A";
}
PhPrintPointer(tokenLuid, (PVOID)statistics.TokenId.LowPart);
2.x/trunk/phlib/support.c
+25 -13
View File
@@ -2695,39 +2695,51 @@ NTSTATUS PhCreateProcessAsUser(
if (Flags & PH_CREATE_PROCESS_USE_LINKED_TOKEN)
{
HANDLE linkedTokenHandle;
TOKEN_TYPE tokenType;
ULONG returnLength;
// NtQueryInformationToken normally returns an impersonation token with SecurityIdentification,
// but if the process is running with SeTcbPrivilege, it returns a primary token. We can never
// duplicate a SecurityIdentification impersonation token to make it a primary token, so we just
// check if the token is primary before using it.
if (NT_SUCCESS(PhGetTokenLinkedToken(tokenHandle, &linkedTokenHandle)))
{
NtClose(tokenHandle);
tokenHandle = linkedTokenHandle;
needsDuplicate = TRUE; // returned linked token handle is an impersonation token; need to convert to primary
if (NT_SUCCESS(NtQueryInformationToken(
linkedTokenHandle,
TokenType,
&tokenType,
sizeof(TOKEN_TYPE),
&returnLength
)) && tokenType == TokenPrimary)
{
NtClose(tokenHandle);
tokenHandle = linkedTokenHandle;
}
else
{
NtClose(linkedTokenHandle);
}
}
}
if (needsDuplicate)
{
HANDLE newTokenHandle;
OBJECT_ATTRIBUTES oa;
SECURITY_QUALITY_OF_SERVICE securityQos;
securityQos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
securityQos.ImpersonationLevel = SecurityImpersonation;
securityQos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
securityQos.EffectiveOnly = FALSE;
OBJECT_ATTRIBUTES objectAttributes;
InitializeObjectAttributes(
&oa,
&objectAttributes,
NULL,
0,
NULL,
NULL
);
oa.SecurityQualityOfService = &securityQos;
status = NtDuplicateToken(
tokenHandle,
TOKEN_ALL_ACCESS,
&oa,
&objectAttributes,
FALSE,
TokenPrimary,
&newTokenHandle