CreateProcessAsUser()的使用

63 阅读 0 评论 42 点赞

我是靠谱客的博主积极烤鸡，最近开发中收集的这篇文章主要介绍CreateProcessAsUser()的使用，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

        HANDLE hToken = NULL;
	TCHAR szUsername[MAX_PATH];
	TCHAR para[MAX_PATH] = {0};
	TCHAR szUsernamePath[MAX_PATH];
	DWORD dwUsernameLen = MAX_PATH;
	DWORD cursessionid;
	cursessionid = WTSGetActiveConsoleSessionId();
	log_error("WTSGetActiveConsoleSessionId() = %dn",cursessionid);
	if(!WTSQueryUserToken(cursessionid, &hToken))
	{
		log_error("%s WTSQueryUserToken is failedn", __FUNCTION__);
	}
	if(!ImpersonateLoggedOnUser(hToken))
	{
		log_error("%s ImpersonateLoggedOnUser is failedn", __FUNCTION__);
	}
	DWORD UsernamePathSize = ARRAYSIZE(szUsernamePath);
	//获取到当前用户路径
	if (!GetUserProfileDirectory(hToken,szUsernamePath,&UsernamePathSize))
	{
		log_error("%s GetUserProfileDirectory is failedn", __FUNCTION__);
	}
        BOOL bResult = FALSE;
	PROCESS_INFORMATION pi;
	PSID                psid;
	STARTUPINFO         si;
	ZeroMemory(&si, sizeof(STARTUPINFO));
	si.cb        = sizeof(STARTUPINFO);
	si.lpDesktop = L"winsta0\default";
	// 
	// start the process
	//
	LPVOID environment;
	BOOL blockRet = CreateEnvironmentBlock(&environment, hToken, FALSE);
	if (!blockRet)
	{
		log_error("could not create environment block (error: %i)",
			GetLastError());
	}
	else
	{
		//TCHAR Cmdline[MAX_PATH] = _T("/c "C:\Windows\System32\RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8"");
		TCHAR Cmdline[MAX_PATH] = _T("/c "C:\Windows\System32\cleanmgr" /sagerun:100");
		DWORD creationFlags = NORMAL_PRIORITY_CLASS | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT;

		bResult = CreateProcessAsUser(
			hToken,
			_T("C:\Windows\System32\CMD.exe"),
			Cmdline,//_T("InetCpl.cpl,ClearMyTracksByProcess 8"),//L""inetcpl.cpl,clearmytracksbyprocess 8"",
			//L"/c "C:\Windows\System32\cleanmgr" /sagerun:100",
			NULL,
			NULL,
			FALSE,
			creationFlags,
			environment,
			NULL,
			&si,
			&pi
			);
		log_error("CreateProcessAsUser0 = %d",GetLastError());

		// 
		// close the handles
		// 
		if (bResult && pi.hProcess != INVALID_HANDLE_VALUE) 
		{ 
			WaitForSingleObject(pi.hProcess, INFINITE); 
			CloseHandle(pi.hProcess); 
		} 
		else
		{
			log_error("CreateProcessAsUser1 = %d",GetLastError());
		}
		if (pi.hThread != INVALID_HANDLE_VALUE)
			CloseHandle(pi.hThread);
		 DestroyEnvironmentBlock(environment);
	}

	RevertToSelf();
	CloseHandle(hToken);