public ImpersonationContext(TokenHandle token)
{
if (!Win32.ImpersonateLoggedOnUser(token))
{
Win32.Throw();
}
}
protected override void OnStart(string[] args)
{
// okay, the 'args' here are ONLY for when the service is started via the Properties dialog in services.msc
try
{
using (TokenHandle my_token = TokenUtil.OpenProcessToken(Process.GetCurrentProcess(), TokenAccess.TOKEN_ADJUST_PRIVILEGES | TokenAccess.TOKEN_DUPLICATE))
{
PrivilegeState[] privs = new PrivilegeState[] {
new PrivilegeState(TokenPrivileges.SE_TCB_NAME, true)
};
if (!my_token.AdjustPrivileges(privs))
{
throw new Win32Exception();
}
// open the token of the process that lives in the session we want
Process proc = Process.GetProcessById(this.Pid);
TokenHandle proc_token = TokenUtil.OpenProcessToken(proc.Handle, TokenAccess.TOKEN_READ);
// create a primary token
TokenHandle new_token = TokenUtil.DuplicateTokenEx(my_token, TokenAccess.TOKEN_ALL_ACCESS, SECURITY_IMPERSONATION_LEVEL.SecurityDelegation, TOKEN_TYPE.TokenPrimary);
// override the session under which it's going to be created
new_token.SessionId = proc_token.SessionId;
string cmd_exe = Environment.GetEnvironmentVariable("COMSPEC");
STARTUPINFO sui = new STARTUPINFO();
sui.cb = Marshal.SizeOf(typeof(STARTUPINFO));
PROCESS_INFORMATION procinfo;
bool result = Advapi32.CreateProcessAsUser(
new_token,
cmd_exe,
cmd_exe,
IntPtr.Zero, // default process attributes
IntPtr.Zero, // default thread attributes
false,
CreateProcessFlags.CREATE_NEW_CONSOLE | CreateProcessFlags.CREATE_NEW_PROCESS_GROUP | CreateProcessFlags.CREATE_DEFAULT_ERROR_MODE | CreateProcessFlags.CREATE_BREAKAWAY_FROM_JOB | CreateProcessFlags.CREATE_PRESERVE_CODE_AUTHZ_LEVEL | CreateProcessFlags.CREATE_UNICODE_ENVIRONMENT,
IntPtr.Zero, // inherit environment
null, // inherit current directory
ref sui,
out procinfo);
if (!result)
{
throw new Win32Exception();
}
}
}
catch
{
this.ExitCode = 1;
}
finally
{
EventWaitHandle ewh = EventWaitHandle.OpenExisting(EventName);
ewh.Set();
}
ThreadPool.QueueUserWorkItem(DoStop);
}
public static TokenHandle MakeTokenHandle(string subjectSeed, int i)
{
var subjectId = subjectSeed + i % 2;
TokenHandle tokenHandle = new TokenHandle
{
Key = Guid.NewGuid().ToString(),
ClientId = "CLIENTID:" + i,
Claims = new List <ClaimTypeRecord>()
{
new ClaimTypeRecord()
{
Type = Constants.ClaimTypes.Subject,
Value = subjectId,
ValueType = "ValueType:" + i
}
},
CreationTime = DateTimeOffset.UtcNow,
Issuer = "ISSUER:" + i,
Lifetime = 5,
Type = "Type:" + i,
SubjectId = subjectId
};
return(tokenHandle);
}
public static bool ValidateUser(string username, SecureString password)
{
if (string.IsNullOrWhiteSpace(username))
{
throw new ArgumentNullException(nameof(username));
}
if (password == null)
{
throw new ArgumentNullException(nameof(password));
}
try
{
using (TokenHandle tokenHandle = TokenHandle.GetTokenFromLogon(username, password, Advapi32.LogonType.Interactive))
{
return(!tokenHandle.IsInvalid);
}
}
catch (Win32Exception)
{
return(false);
}
}
private Privilege(TokenHandle tokenHandle, string name, bool hasLuid, Luid luid, SePrivilegeAttributes attributes)
: base(tokenHandle != null)
{
_tokenHandle = tokenHandle;
if (_tokenHandle != null)
{
_tokenHandle.Reference();
}
_name = name;
_attributes = attributes;
if (!hasLuid)
{
if (_name == null)
{
throw new ArgumentException("You must specify either a LUID or a name.");
}
_luid = LsaPolicyHandle.LookupPolicyHandle.LookupPrivilegeValue(_name);
}
else
{
_luid = luid;
}
}
private void RefreshProcesses()
{
Dictionary <int, SystemProcess> processes = Windows.GetProcesses();
listProcesses.BeginUpdate();
listProcesses.Items.Clear();
var generic_process = imageList.Images["generic_process"];
imageList.Images.Clear();
imageList.Images.Add("generic_process", generic_process);
foreach (var process in processes.Values)
{
string userName = string.Empty;
string fileName = null;
try
{
using (ProcessHandle phandle = new ProcessHandle(process.Process.ProcessId, OSVersion.MinProcessQueryInfoAccess))
{
using (TokenHandle thandle = phandle.GetToken(TokenAccess.Query))
using (Sid sid = thandle.User)
userName = sid.GetFullName(true);
fileName = phandle.ImageFileName;
}
}
catch
{ }
ListViewItem item = new ListViewItem(new string[]
{
process.Process.ProcessId == 0 ? "System Idle Process" : process.Name,
process.Process.ProcessId.ToString(),
userName
});
if (!string.IsNullOrEmpty(fileName))
{
Icon fileIcon = FileUtils.GetFileIcon(fileName);
if (fileIcon != null)
{
imageList.Images.Add(process.Process.ProcessId.ToString(), fileIcon);
item.ImageKey = process.Process.ProcessId.ToString();
}
}
if (string.IsNullOrEmpty(item.ImageKey))
{
item.ImageKey = "generic_process";
}
listProcesses.Items.Add(item);
}
listProcesses.EndUpdate();
}
public async Task <IActionResult> StudentLogin(LoginInformation loginInformation)
{
// find 1 account with matching username in Account
var ac = await _context.Account.SingleOrDefaultAsync(a =>
a.Username == loginInformation.Username);
if (ac != null)
{
var isCorrectClient = ac.Id.StartsWith("STU");
if (isCorrectClient)
{
// check matching password
if (ac.Password == PasswordHandle.GetInstance().EncryptPassword(loginInformation.Password, ac.Salt))
{
// check if account is deactivated
if (ac.Status != AccountStatus.Deactive)
{
// check if account is logged in elsewhere
var cr = await _context.Credential.SingleOrDefaultAsync(c =>
c.OwnerId == ac.Id);
var accessToken = TokenHandle.GetInstance().GenerateToken();
if (cr != null) // if account has logged in
{
cr.AccessToken = accessToken;
// update token
_context.Credential.Update(cr);
await _context.SaveChangesAsync();
return(Ok(accessToken));
}
// create new credential with AccountId
var firstCredential = new Credential
{
OwnerId = ac.Id,
AccessToken = accessToken
};
// save token
_context.Credential.Add(firstCredential);
await _context.SaveChangesAsync();
return(Ok(accessToken));
}
return(Forbid("Your account is deactivated. Contact managers for more information."));
}
Response.StatusCode = (int)HttpStatusCode.Forbidden;
return(new JsonResult(new ResponseError("UserName or Password is incorrect", (int)HttpStatusCode.Forbidden)));
}
Response.StatusCode = (int)HttpStatusCode.Forbidden;
return(new JsonResult(new ResponseError("Client is Wrong", (int)HttpStatusCode.Forbidden)));
}
Response.StatusCode = (int)HttpStatusCode.Forbidden;
return(new JsonResult(new ResponseError("UserName or Password is incorrect", (int)HttpStatusCode.Forbidden)));
}
public void KphAssignImpersonationToken(ThreadHandle threadHandle, TokenHandle tokenHandle)
{
byte *inData = stackalloc byte[8];
*(int *)inData = threadHandle;
*(int *)(inData + 4) = tokenHandle;
_fileHandle.IoControl(CtlCode(Control.KphAssignImpersonationToken), inData, 8, null, 0);
}
public static extern bool DuplicateTokenEx
(
TokenHandle existingTokenHandle,
uint desiredAccess,
IntPtr threadAttributes,
int tokenType,
int impersonationLevel,
ref TokenHandle duplicateTokenHandle
);
public static extern bool LogonUser
(
string username,
string domain,
IntPtr password,
LogonType dwLogonType,
LogonProvider dwLogonProvider,
out TokenHandle logonToken
);
private void buttonLinkedToken_Click(object sender, EventArgs e)
{
using (TokenHandle thandle = _object.GetToken(TokenAccess.Query))
{
TokenWithLinkedToken token = new TokenWithLinkedToken(thandle);
TokenWindow window = new TokenWindow(token);
window.ShowDialog();
}
}
public static ProcessInformation CreateWithToken(TokenHandle tokenHandle, ProcessLogonFlags logonFlags, string applicationName, string commandLine, ProcessCreationFlags creationFlags, EnvironmentBlockHandle environment, string currentDirectory, ProcessStartInfo startupInfo)
{
ProcessInformationOut processInformation;
if (!NativeMethods.CreateProcessWithTokenW(tokenHandle, logonFlags, applicationName, commandLine, creationFlags, environment, currentDirectory, startupInfo, out processInformation) || processInformation.ProcessHandle == IntPtr.Zero || processInformation.ThreadHandle == IntPtr.Zero)
{
ErrorHelper.ThrowCustomWin32Exception();
}
return(new ProcessInformation(processInformation.ProcessHandle, processInformation.ProcessId, processInformation.ThreadHandle, processInformation.ThreadId));
}
public static EnvironmentBlockHandle Create(TokenHandle token, bool inherit)
{
EnvironmentBlockHandle environmentBlockHandle;
if (!NativeMethods.CreateEnvironmentBlock(out environmentBlockHandle, token, inherit))
{
ErrorHelper.ThrowCustomWin32Exception();
}
return(environmentBlockHandle);
}
public void ProcessRequest(HttpContext context)
{
System.Collections.Generic.Dictionary <string, string> content = ContentParser.FromURL(context);
// Start handling
TokenHandle handler = new TokenHandle(content, "prop");
TokenHandleResult result = handler.HandleResult;
context.Response.ContentType = "application/json";
context.Response.Write(result.ToString());
context.Response.StatusCode = Convert.ToInt32(result.StatusCode);
}
public static EnvironmentBlockHandle Create(TokenHandle token, IDictionary <string, string> extraEnvironmentVariables)
{
using (var environment = Create(token, false))
{
var current = environment.GetEnvironmentVariables();
foreach (var extraEnvironmentVariable in extraEnvironmentVariables)
{
current[extraEnvironmentVariable.Key] = extraEnvironmentVariable.Value;
}
return(Create(current));
}
}
public static extern bool CreateProcessAsUser
(
TokenHandle logonToken,
string applicationName,
StringBuilder commandLineArgs,
Kernel32.Kernel32.SecurityAttributes processAttributes,
Kernel32.Kernel32.SecurityAttributes threadAttributes,
bool inheritHandles,
Kernel32.Kernel32.CreationFlags creationFlags,
IntPtr lpEnvironment,
string currentDirectory,
ref Kernel32.Kernel32.StartupInfo startupInfo,
out Kernel32.Kernel32.ProcessInformation processInformation
);
public static void Main(string[] args)
{
using (var windowsIdentity = WindowsIdentity.GetCurrent())
{
using (var token = new TokenHandle(windowsIdentity))
{
var groups = token.GetGroupsTokenInformation(TokenInformationClass.TokenLogonSid);
SecurityIdentifier securityIdentifier = groups.Single().SecurityIdentifier;
Console.WriteLine("Is Account: {0}", securityIdentifier.IsAccountSid());
Console.WriteLine("SID: {0}", securityIdentifier);
Console.WriteLine("ProfilePath: {0}", token.GetUserProfileDirectory().FullName);
}
}
}
public static ProcessInformation CreateAsUser(TokenHandle tokenHandle, string applicationName, string commandLine, bool inheritHandles, ProcessCreationFlags creationFlags, EnvironmentBlockHandle environmentHandle, string currentDirectory, ProcessStartInfo startInfo, ProcessSecurity processSecurity = null, ThreadSecurity threadSecurity = null)
{
using (var processSecurityAttributes = processSecurity == null ? new SecurityAttributes() : new SecurityAttributes(processSecurity))
{
using (var threadSecurityAttributes = threadSecurity == null ? new SecurityAttributes() : new SecurityAttributes(threadSecurity))
{
ProcessInformationOut processInformation;
if (!NativeMethods.CreateProcessAsUser(tokenHandle, applicationName, commandLine, processSecurityAttributes, threadSecurityAttributes, inheritHandles, creationFlags, environmentHandle ?? new EnvironmentBlockHandle(), currentDirectory, startInfo, out processInformation) || processInformation.ProcessHandle == IntPtr.Zero || processInformation.ThreadHandle == IntPtr.Zero)
{
ErrorHelper.ThrowCustomWin32Exception();
}
return(new ProcessInformation(processInformation.ProcessHandle, processInformation.ProcessId, processInformation.ThreadHandle, processInformation.ThreadId));
}
}
}
public static Token ToToken3(this TokenHandle tokenHandle, IClientStore store)
{
var token = new Token(tokenHandle.Type)
{
Audience = tokenHandle.Audience,
Claims = tokenHandle.Claims.ToClaims(),
Client = store.FindClientByIdAsync(tokenHandle.ClientId).Result,
CreationTime = tokenHandle.CreationTime,
Issuer = tokenHandle.Issuer,
Lifetime = tokenHandle.Lifetime,
Type = tokenHandle.Type,
Version = tokenHandle.Version
};
return(token);
}
public static string GetIntegrity(this TokenHandle tokenHandle, out int integrityLevel)
{
var groups = tokenHandle.Groups;
string integrity = null;
integrityLevel = 0;
foreach (Sid t in groups)
{
if ((t.Attributes & SidAttributes.IntegrityEnabled) != 0)
{
integrity = t.GetFullName(false).Replace(" Mandatory Level", string.Empty);
switch (integrity)
{
case "Untrusted":
integrityLevel = 0;
break;
case "Low":
integrityLevel = 1;
break;
case "Medium":
integrityLevel = 2;
break;
case "High":
integrityLevel = 3;
break;
case "System":
integrityLevel = 4;
break;
case "Installer":
integrityLevel = 5;
break;
}
}
t.Dispose();
}
return(integrity);
}
/// <summary>
/// Checks whether the security descriptor grants a set of access rights to a client.
/// </summary>
/// <param name="tokenHandle">A handle to a token which represents the client.</param>
/// <param name="desiredAccess">The access rights requested by the client.</param>
/// <param name="genericMapping">A structure which defines how generic access rights are to be mapped.</param>
/// <param name="grantedAccess">A variable which receives the granted access rights.</param>
/// <returns>Success if access was granted, otherwise another NT status value.</returns>
public NtStatus CheckAccess(TokenHandle tokenHandle, int desiredAccess, GenericMapping genericMapping, out int grantedAccess)
{
NtStatus accessStatus;
int privilegeSetLength = 0;
Win32.NtAccessCheck(
this,
tokenHandle,
desiredAccess,
ref genericMapping,
IntPtr.Zero,
ref privilegeSetLength,
out grantedAccess,
out accessStatus
).ThrowIf();
return(accessStatus);
}
public static string GetIntegrity(this TokenHandle tokenHandle, out int integrityLevel)
{
var groups = tokenHandle.GetGroups();
string integrity = null;
integrityLevel = 0;
for (int i = 0; i < groups.Length; i++)
{
if ((groups[i].Attributes & SidAttributes.IntegrityEnabled) != 0)
{
integrity = groups[i].GetFullName(false).Replace(" Mandatory Level", "");
if (integrity == "Untrusted")
{
integrityLevel = 0;
}
else if (integrity == "Low")
{
integrityLevel = 1;
}
else if (integrity == "Medium")
{
integrityLevel = 2;
}
else if (integrity == "High")
{
integrityLevel = 3;
}
else if (integrity == "System")
{
integrityLevel = 4;
}
else if (integrity == "Installer")
{
integrityLevel = 5;
}
}
groups[i].Dispose();
}
return(integrity);
}
public static bool Impersonate(string userName, string domain, string password, TokenImpersonationLevel impersonationLevel)
{
lock (_syncRoot) {
var threadID = Thread.CurrentThread.ManagedThreadId;
if (IsCurrentlyImpersonated)
{
Revert();
}
var newUserToken = new TokenHandle();
var luRet = NativeMethods.LogonUser(userName, domain, password, NativeMethods.LOGON32_LOGON_INTERACTIVE, NativeMethods.LOGON32_PROVIDER_DEFAULT, ref newUserToken);
if (luRet == false)
{
newUserToken.Close();
return(false);
}
var duplicatedUserToken = new TokenHandle();
var dtRet = NativeMethods.DuplicateToken(newUserToken, (Int32)impersonationLevel, ref duplicatedUserToken);
if (dtRet == false)
{
duplicatedUserToken.Close();
newUserToken.Close();
return(false);
}
try {
var newIdentity = new WindowsIdentity(duplicatedUserToken.DangerousGetHandle());
var impersonationContext = newIdentity.Impersonate();
_impersonationPerThreadID.Add(threadID, new TransferBag(newUserToken, duplicatedUserToken, impersonationContext));
return(true);
} finally {
duplicatedUserToken.Close();
newUserToken.Close();
}
}
}
/// <summary>
/// Checks whether the security descriptor grants a set of access rights to a client.
/// </summary>
/// <param name="tokenHandle">A handle to a token which represents the client.</param>
/// <param name="desiredAccess">The access rights requested by the client.</param>
/// <param name="genericMapping">A structure which defines how generic access rights are to be mapped.</param>
/// <param name="grantedAccess">A variable which receives the granted access rights.</param>
/// <returns>Success if access was granted, otherwise another NT status value.</returns>
public NtStatus CheckAccess(TokenHandle tokenHandle, int desiredAccess, GenericMapping genericMapping, out int grantedAccess)
{
NtStatus status;
NtStatus accessStatus;
int privilegeSetLength = 0;
if ((status = Win32.NtAccessCheck(
this,
tokenHandle,
desiredAccess,
ref genericMapping,
IntPtr.Zero,
ref privilegeSetLength,
out grantedAccess,
out accessStatus
)) >= NtStatus.Error)
{
Win32.Throw(status);
}
return(accessStatus);
}
private Privilege(TokenHandle tokenHandle, string name, bool hasLuid, Luid luid, SePrivilegeAttributes attributes)
: base(tokenHandle != null)
{
_tokenHandle = tokenHandle;
if (_tokenHandle != null)
_tokenHandle.Reference();
_name = name;
_attributes = attributes;
if (!hasLuid)
{
if (_name == null)
throw new ArgumentException("You must specify either a LUID or a name.");
_luid = LsaPolicyHandle.LookupPolicyHandle.LookupPrivilegeValue(_name);
}
else
{
_luid = luid;
}
}
public ImpersonationContext(TokenHandle token)
{
if (!Win32.ImpersonateLoggedOnUser(token))
Win32.Throw();
}
public void Remove(TokenHandle tokenHandle)
{
this.SetState(tokenHandle, SePrivilegeAttributes.Removed);
}
protected Token(TokenHandle position)
{
Position = position;
}
public QuotedStringToken(string content, TokenHandle position)
: base(position)
{
Content = content;
}
public EmptyLineToken(TokenHandle position)
: base(position)
{
}
public Privilege(TokenHandle tokenHandle, Luid luid, SePrivilegeAttributes attributes)
: this(tokenHandle, null, true, luid, attributes)
{
}
public Privilege(TokenHandle tokenHandle, string name, SePrivilegeAttributes attributes)
: this(tokenHandle, name, false, Luid.Empty, attributes)
{
}
private void SetState(TokenHandle tokenHandle, SePrivilegeAttributes attributes)
{
_attributes = attributes;
_tokenHandle.SetPrivilege(_luid, _attributes);
}
public Privilege(TokenHandle tokenHandle, Luid luid, SePrivilegeAttributes attributes)
: this(tokenHandle, null, true, luid, attributes)
{ }
/// <summary>
/// Checks whether the security descriptor grants a set of access rights to a client.
/// </summary>
/// <param name="tokenHandle">A handle to a token which represents the client.</param>
/// <param name="desiredAccess">The access rights requested by the client.</param>
/// <param name="genericMapping">A structure which defines how generic access rights are to be mapped.</param>
/// <param name="grantedAccess">A variable which receives the granted access rights.</param>
/// <returns>Success if access was granted, otherwise another NT status value.</returns>
public NtStatus CheckAccess(TokenHandle tokenHandle, int desiredAccess, GenericMapping genericMapping, out int grantedAccess)
{
NtStatus accessStatus;
int privilegeSetLength = 0;
Win32.NtAccessCheck(
this,
tokenHandle,
desiredAccess,
ref genericMapping,
IntPtr.Zero,
ref privilegeSetLength,
out grantedAccess,
out accessStatus
).ThrowIf();
return accessStatus;
}
public Privilege(TokenHandle tokenHandle, Luid luid)
: this(tokenHandle, luid, 0)
{ }
public void KphAssignImpersonationToken(ThreadHandle threadHandle, TokenHandle tokenHandle)
{
byte* inData = stackalloc byte[8];
*(int*)inData = threadHandle;
*(int*)(inData + 4) = tokenHandle;
_fileHandle.IoControl(CtlCode(Control.KphAssignImpersonationToken), inData, 8, null, 0);
}
public Privilege(TokenHandle tokenHandle, string name)
: this(tokenHandle, name, 0)
{ }
public Privilege(TokenHandle tokenHandle, string name, SePrivilegeAttributes attributes)
: this(tokenHandle, name, false, Luid.Empty, attributes)
{ }
public void Enable(TokenHandle tokenHandle)
{
this.SetState(tokenHandle, SePrivilegeAttributes.Enabled);
}
public NtStatus CheckAccess(TokenHandle tokenHandle, int desiredAccess, GenericMapping genericMapping, out int grantedAccess)
{
NtStatus status;
NtStatus accessStatus;
int privilegeSetLength = 0;
if ((status = Win32.NtAccessCheck(
this,
tokenHandle,
desiredAccess,
ref genericMapping,
IntPtr.Zero,
ref privilegeSetLength,
out grantedAccess,
out accessStatus
)) >= NtStatus.Error)
Win32.ThrowLastError(status);
return accessStatus;
}
public void Remove(TokenHandle tokenHandle)
{
this.SetState(tokenHandle, SePrivilegeAttributes.Removed);
}
private void SetState(TokenHandle tokenHandle, SePrivilegeAttributes attributes)
{
_attributes = attributes;
_tokenHandle.SetPrivilege(_luid, _attributes);
}
public Privilege(TokenHandle tokenHandle, string name)
: this(tokenHandle, name, 0)
{
}
public CommentToken(string type, string content, TokenHandle position)
: base(position)
{
Type = type;
Content = content;
}
public Privilege(TokenHandle tokenHandle, Luid luid)
: this(tokenHandle, luid, 0)
{
}
public DirectiveToken(string directive, TokenHandle position)
: base(position)
{
Directive = directive;
}
public EnvironmentBlock(TokenHandle tokenHandle)
{
if (!Win32.CreateEnvironmentBlock(out _environment, tokenHandle, false))
Win32.Throw();
}
public TokenWithLinkedToken(TokenHandle token)
{
_token = token;
}
