static uint createProcessInSession(uint dwSessionId, String commandLine, WinApi.Advapi32.CreationFlags dwCreationFlags = 0, WinApi.Advapi32.STARTUPINFO?startupInfo = null, bool bElevate = false)
        {
            IntPtr hUserToken    = IntPtr.Zero;
            IntPtr hUserTokenDup = IntPtr.Zero;
            IntPtr hPToken       = IntPtr.Zero;
            IntPtr hProcess      = IntPtr.Zero;

            try
            {
                // Log the client on to the local computer.
                //uint dwSessionId = WTSGetActiveConsoleSessionId();

                //// Find the winlogon process
                //var procEntry = new PROCESSENTRY32();

                //uint hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
                //if (hSnap == INVALID_HANDLE_VALUE)
                //    throw new Exception("CreateToolhelp32Snapshot == INVALID_HANDLE_VALUE. " + ErrorRoutines.GetLastError());

                //procEntry.dwSize = (uint)Marshal.SizeOf(procEntry); //sizeof(PROCESSENTRY32);
                //if (Process32First(hSnap, ref procEntry) == 0)
                //    throw new Exception("Process32First == 0. " + ErrorRoutines.GetLastError());

                //uint winlogonPid = 0;
                //String strCmp = "explorer.exe";
                //do
                //{
                //    if (strCmp.IndexOf(procEntry.szExeFile) == 0)
                //    {
                //        // We found a winlogon process...make sure it's running in the console session
                //        uint winlogonSessId = 0;
                //        if (ProcessIdToSessionId(procEntry.th32ProcessID, ref winlogonSessId) && winlogonSessId == dwSessionId)
                //        {
                //            winlogonPid = procEntry.th32ProcessID;
                //            break;
                //        }
                //    }
                //}
                //while (Process32Next(hSnap, ref procEntry) != 0);
                //if (winlogonPid == 0)
                //    throw new Exception("winlogonPid == 0");

                //Get the user token used by DuplicateTokenEx
                //WTSQueryUserToken(dwSessionId, ref hUserToken);
                //if (hUserToken == IntPtr.Zero)
                //    throw new Exception("WTSQueryUserToken == 0. " + ErrorRoutines.GetLastError());

                WinApi.Advapi32.STARTUPINFO si;
                if (startupInfo != null)
                {
                    si = (WinApi.Advapi32.STARTUPINFO)startupInfo;
                }
                else
                {
                    si = new WinApi.Advapi32.STARTUPINFO();
                }
                si.cb        = Marshal.SizeOf(si);
                si.lpDesktop = "winsta0\\default";
                //hProcess = OpenProcess(MAXIMUM_ALLOWED, false, winlogonPid);
                //if (hProcess == IntPtr.Zero)
                //    throw new Exception("OpenProcess == IntPtr.Zero. " + ErrorRoutines.GetLastError());

                if (!WinApi.Advapi32.OpenProcessToken(Process.GetCurrentProcess().Handle, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, out hPToken))
                {
                    //if (!OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_SESSIONID | TOKEN_READ | TOKEN_WRITE, ref hPToken))
                    throw new Exception("!OpenProcessToken. " + ErrorRoutines.GetLastError());
                }

                //var luid = new LUID();
                //if (!LookupPrivilegeValue(IntPtr.Zero, SE_DEBUG_NAME, ref luid))
                //    throw new Exception("!LookupPrivilegeValue. " + ErrorRoutines.GetLastError());

                var sa = new WinApi.Advapi32.SECURITY_ATTRIBUTES();
                sa.Length = Marshal.SizeOf(sa);
                if (!WinApi.Advapi32.DuplicateTokenEx(hPToken, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, ref sa, WinApi.Advapi32.SECURITY_IMPERSONATION_LEVEL.SecurityIdentification, WinApi.Advapi32.TOKEN_TYPE.TokenPrimary, ref hUserTokenDup))
                {
                    throw new Exception("!DuplicateTokenEx. " + ErrorRoutines.GetLastError());
                }

                //if (bElevate)
                //{
                //    var tp = new TOKEN_PRIVILEGES();
                //    //tp.Privileges[0].Luid = luid;
                //    //tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
                //    tp.PrivilegeCount = 1;
                //    tp.Privileges = new int[3];
                //    tp.Privileges[2] = SE_PRIVILEGE_ENABLED;
                //    tp.Privileges[1] = luid.HighPart;
                //    tp.Privileges[0] = luid.LowPart;

                //    //Adjust Token privilege
                //    if (!SetTokenInformation(hUserTokenDup, TOKEN_INFORMATION_CLASS.TokenSessionId, ref dwSessionId, (uint)IntPtr.Size))
                //        throw new Exception("!SetTokenInformation. " + ErrorRoutines.GetLastError());
                //    if (!AdjustTokenPrivileges(hUserTokenDup, false, ref tp, Marshal.SizeOf(tp), /*(PTOKEN_PRIVILEGES)*/IntPtr.Zero, IntPtr.Zero))
                //        throw new Exception("!AdjustTokenPrivileges. " + ErrorRoutines.GetLastError());
                //}

                //dwCreationFlags |= dwCreationFlagValues.NORMAL_PRIORITY_CLASS| dwCreationFlagValues.CREATE_NEW_CONSOLE;
                //IntPtr pEnv = IntPtr.Zero;
                //if (CreateEnvironmentBlock(ref pEnv, hUserTokenDup, true))
                //    dwCreationFlags |= dwCreationFlagValues.CREATE_UNICODE_ENVIRONMENT;
                //else
                //    pEnv = IntPtr.Zero;

                // Launch the process in the client's logon session.
                WinApi.Advapi32.PROCESS_INFORMATION pi;
                if (!WinApi.Advapi32.CreateProcessAsUser(hUserTokenDup,   // client's access token
                                                         null,            // file to execute
                                                         commandLine,     // command line
                                                         ref sa,          // pointer to process SECURITY_ATTRIBUTES
                                                         ref sa,          // pointer to thread SECURITY_ATTRIBUTES
                                                         false,           // handles are not inheritable
                                                         dwCreationFlags, // creation flags
                                                         IntPtr.Zero,     //pEnv, // pointer to new environment block
                                                         null,            // name of current directory
                                                         ref si,          // pointer to STARTUPINFO structure
                                                         out pi           // receives information about new process
                                                         ))
                {
                    throw new Exception("!CreateProcessAsUser. " + ErrorRoutines.GetLastError());
                }
                return(pi.dwProcessId);
            }
            //catch(Exception e)
            //{

            //}
            finally
            {
                if (hProcess != IntPtr.Zero)
                {
                    WinApi.Kernel32.CloseHandle(hProcess);
                }
                if (hUserToken != IntPtr.Zero)
                {
                    WinApi.Kernel32.CloseHandle(hUserToken);
                }
                if (hUserTokenDup != IntPtr.Zero)
                {
                    WinApi.Kernel32.CloseHandle(hUserTokenDup);
                }
                if (hPToken != IntPtr.Zero)
                {
                    WinApi.Kernel32.CloseHandle(hPToken);
                }
                //if (pEnv != IntPtr.Zero)
                //    DestroyEnvironmentBlock(pEnv);
            }
        }
        static void beginMonitorServiceStartStop()
        {
            try
            {
                IntPtr hSCM = WinApi.Advapi32.OpenSCManager(null, null, WinApi.Advapi32.SCM_ACCESS.SC_MANAGER_CONNECT);//(WinApi.Advapi32.SCM_ACCESS)0xF003F);//
                if (hSCM == IntPtr.Zero)
                {
                    throw new Exception("OpenSCManager: " + ErrorRoutines.GetLastError());
                }
                IntPtr hService = WinApi.Advapi32.OpenService(hSCM, Cliver.CisteraScreenCaptureService.Program.SERVICE_NAME, WinApi.Advapi32.OpenServiceDesiredAccess.SERVICE_QUERY_STATUS);
                if (hService == IntPtr.Zero)
                {
                    throw new Exception("OpenService: " + ErrorRoutines.GetLastError());
                }
                ThreadRoutines.StartTry(() =>
                {
                    for (; ;)
                    {
                        serviceSatusChangedNotify                      = new WinApi.Advapi32.SERVICE_NOTIFY();
                        serviceSatusChangedNotify.dwVersion            = 2;
                        serviceSatusChangedNotify.pfnNotifyCallback    = Marshal.GetFunctionPointerForDelegate(serviceStatusChangedDelegate);
                        serviceSatusChangedNotify.pContext             = IntPtr.Zero;
                        serviceSatusChangedNotify.dwNotificationStatus = 0;
                        WinApi.Advapi32.SERVICE_STATUS_PROCESS process;
                        process.dwServiceType             = 0;
                        process.dwCurrentState            = 0;
                        process.dwControlsAccepted        = 0;
                        process.dwWin32ExitCode           = 0;
                        process.dwServiceSpecificExitCode = 0;
                        process.dwCheckPoint   = 0;
                        process.dwWaitHint     = 0;
                        process.dwProcessId    = 0;
                        process.dwServiceFlags = 0;
                        serviceSatusChangedNotify.ServiceStatus           = process;
                        serviceSatusChangedNotify.dwNotificationTriggered = 0;
                        serviceSatusChangedNotify.pszServiceNames         = Marshal.StringToHGlobalUni(Cliver.CisteraScreenCaptureService.Program.SERVICE_NAME);
                        notifyHandle             = GCHandle.Alloc(serviceSatusChangedNotify, GCHandleType.Pinned);
                        unmanagedNotifyStructure = notifyHandle.AddrOfPinnedObject();
                        if (0 != WinApi.Advapi32.NotifyServiceStatusChange(hService, WinApi.Advapi32.NotifyMask.SERVICE_NOTIFY_RUNNING | WinApi.Advapi32.NotifyMask.SERVICE_NOTIFY_STOPPED, unmanagedNotifyStructure))
                        {
                            LogMessage.Error("NotifyServiceStatusChange: " + ErrorRoutines.GetLastError());
                        }

                        serviceStatusChangedManualResetEvent.Reset();
                        serviceStatusChangedManualResetEvent.WaitOne();
                        notifyHandle.Free();
                    }
                },
                                        null,
                                        () =>
                {
                    try
                    {
                        notifyHandle.Free();
                    }
                    catch { }
                }
                                        );
            }
            catch (Exception e)
            {
                LogMessage.Error(e);
            }
        }
Beispiel #3
0
        static uint createProcessInSession(uint dwSessionId, String commandLine, WinApi.Advapi32.CreationFlags dwCreationFlags = 0, WinApi.Advapi32.STARTUPINFO?startupInfo = null, bool bElevate = false)
        {
            Log.Main.Inform("Launching (in session " + dwSessionId + "):\r\n" + commandLine);

            IntPtr hNewProcessToken = IntPtr.Zero;
            IntPtr hProcessToken    = IntPtr.Zero;

            try
            {
                WinApi.Advapi32.STARTUPINFO si;
                if (startupInfo != null)
                {
                    si = (WinApi.Advapi32.STARTUPINFO)startupInfo;
                }
                else
                {
                    si = new WinApi.Advapi32.STARTUPINFO();
                }
                si.cb        = Marshal.SizeOf(si);
                si.lpDesktop = "winsta0\\default";

                if (!WinApi.Advapi32.OpenProcessToken(Process.GetCurrentProcess().Handle, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, out hProcessToken))
                {
                    throw new Exception("!OpenProcessToken. " + ErrorRoutines.GetLastError());
                }

                var sa = new WinApi.Advapi32.SECURITY_ATTRIBUTES();
                sa.Length = Marshal.SizeOf(sa);
                if (!WinApi.Advapi32.DuplicateTokenEx(hProcessToken, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, ref sa, WinApi.Advapi32.SECURITY_IMPERSONATION_LEVEL.SecurityIdentification, WinApi.Advapi32.TOKEN_TYPE.TokenPrimary, ref hNewProcessToken))
                {
                    throw new Exception("!DuplicateTokenEx. " + ErrorRoutines.GetLastError());
                }

                if (!WinApi.Advapi32.SetTokenInformation(hNewProcessToken, WinApi.Advapi32.TOKEN_INFORMATION_CLASS.TokenSessionId, ref dwSessionId, (uint)IntPtr.Size))
                {
                    throw new Exception("!SetTokenInformation. " + ErrorRoutines.GetLastError());
                }

                WinApi.Advapi32.PROCESS_INFORMATION pi;
                if (!WinApi.Advapi32.CreateProcessAsUser(hNewProcessToken, // client's access token
                                                         null,             // file to execute
                                                         commandLine,      // command line
                                                         ref sa,           // pointer to process SECURITY_ATTRIBUTES
                                                         ref sa,           // pointer to thread SECURITY_ATTRIBUTES
                                                         false,            // handles are not inheritable
                                                         dwCreationFlags,  // creation flags
                                                         IntPtr.Zero,      //pEnv, // pointer to new environment block
                                                         null,             // name of current directory
                                                         ref si,           // pointer to STARTUPINFO structure
                                                         out pi            // receives information about new process
                                                         ))
                {
                    throw new Exception("!CreateProcessAsUser. " + ErrorRoutines.GetLastError());
                }
                return(pi.dwProcessId);
            }
            //catch(Exception e)
            //{

            //}
            finally
            {
                if (hProcessToken != IntPtr.Zero)
                {
                    WinApi.Kernel32.CloseHandle(hProcessToken);
                }
                if (hNewProcessToken != IntPtr.Zero)
                {
                    WinApi.Kernel32.CloseHandle(hNewProcessToken);
                }
            }
        }