////////////////////////////////////////////////////////////////////////////////
// Impersonates a SYSTEM token or creates a new process with the cloned token
////////////////////////////////////////////////////////////////////////////////
private static void _GetSystem(CommandLineParsing cLP, IntPtr hToken)
{
bool exists, enabled;
TokenInformation.CheckTokenPrivilege(hToken, "SeDebugPrivilege", out exists, out enabled);
if (exists)
{
using (TokenManipulation t = new TokenManipulation(hToken))
{
t.SetWorkingTokenToSelf();
if (!enabled)
{
t.SetTokenPrivilege(Winnt.SE_DEBUG_NAME, Winnt.TokenPrivileges.SE_PRIVILEGE_ENABLED);
}
if (string.IsNullOrEmpty(cLP.Command))
{
t.GetSystem();
}
else
{
t.GetSystem(cLP.CommandAndArgs);
}
}
}
else
{
if (string.IsNullOrEmpty(cLP.Command))
{
NamedPipes.GetSystem();
}
else
{
NamedPipes.GetSystem(cLP.Command, cLP.Arguments);
}
}
}