ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-09-03 12:23:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Implement CreateProcessAsUser[A/W] and LogonUserW with a fake token.

Browse Source 
svn path=/trunk/; revision=7793
This commit is contained in:
Eric Kohl
2004-01-20 23:16:42 +00:00
parent 930507af17
commit efb3dc1194
1 changed files with 182 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/lib/advapi32/misc/logon.c
+182 -27
View File
@@ -1,4 +1,4 @@
/* $Id: logon.c,v 1.1 2004/01/20 01:40:18 ekohl Exp $
/* $Id: logon.c,v 1.2 2004/01/20 23:16:42 ekohl Exp $
*
* COPYRIGHT: See COPYING in the top level directory
* PROJECT: ReactOS system libraries
@@ -12,10 +12,12 @@
#define NTOS_MODE_USER
#include <ntos.h>
#include <string.h>
/* FUNCTIONS ***************************************************************/
/*
* @unimplemented
* @implemented
*/
BOOL STDCALL
CreateProcessAsUserA (HANDLE hToken,
@@ -30,22 +32,46 @@ CreateProcessAsUserA (HANDLE hToken,
LPSTARTUPINFOA lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
{
/* redirect call to CreateProcess() as long as we don't support user logins */
return CreateProcessA (lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
lpProcessInformation);
NTSTATUS Status;
/* Create the process with a suspended main thread */
if (!CreateProcessA (lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags | CREATE_SUSPENDED,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
lpProcessInformation))
{
return FALSE;
}
/* Set the new process token */
Status = NtSetInformationProcess (lpProcessInformation->hProcess,
ProcessAccessToken,
(PVOID)&hToken,
sizeof (HANDLE));
if (!NT_SUCCESS (Status))
{
SetLastError (RtlNtStatusToDosError (Status));
return FALSE;
}
/* Resume the main thread */
if (!(dwCreationFlags & CREATE_SUSPENDED))
{
ResumeThread (lpProcessInformation->hThread);
}
return TRUE;
}
/*
* @unimplemented
* @implemented
*/
BOOL STDCALL
CreateProcessAsUserW (HANDLE hToken,
@@ -60,17 +86,41 @@ CreateProcessAsUserW (HANDLE hToken,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
{
/* redirect call to CreateProcess() as long as we don't support user logins */
return CreateProcessW (lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
lpProcessInformation);
NTSTATUS Status;
/* Create the process with a suspended main thread */
if (!CreateProcessW (lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags | CREATE_SUSPENDED,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
lpProcessInformation))
{
return FALSE;
}
/* Set the new process token */
Status = NtSetInformationProcess (lpProcessInformation->hProcess,
ProcessAccessToken,
(PVOID)&hToken,
sizeof (HANDLE));
if (!NT_SUCCESS (Status))
{
SetLastError (RtlNtStatusToDosError (Status));
return FALSE;
}
/* Resume the main thread */
if (!(dwCreationFlags & CREATE_SUSPENDED))
{
ResumeThread (lpProcessInformation->hThread);
}
return TRUE;
}
@@ -90,7 +140,7 @@ CreateProcessWithLogonW (LPCWSTR lpUsername,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
{
return(FALSE);
return FALSE;
}
@@ -120,7 +170,112 @@ LogonUserW (LPCWSTR lpszUsername,
DWORD dwLogonProvider,
PHANDLE phToken)
{
return FALSE;
OBJECT_ATTRIBUTES ObjectAttributes;
SECURITY_QUALITY_OF_SERVICE Qos;
TOKEN_USER TokenUser;
TOKEN_OWNER TokenOwner;
TOKEN_PRIMARY_GROUP TokenPrimaryGroup;
TOKEN_GROUPS TokenGroups;
// PTOKEN_GROUPS TokenGroups;
TOKEN_PRIVILEGES TokenPrivileges;
// PTOKEN_PRIVILEGES TokenPrivileges;
TOKEN_DEFAULT_DACL TokenDefaultDacl;
LARGE_INTEGER ExpirationTime;
LUID AuthenticationId;
TOKEN_SOURCE TokenSource;
PSID UserSid;
ACL Dacl;
NTSTATUS Status;
SID_IDENTIFIER_AUTHORITY SystemAuthority = {SECURITY_NT_AUTHORITY};
Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
Qos.ImpersonationLevel = SecurityAnonymous;
Qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
Qos.EffectiveOnly = FALSE;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
ObjectAttributes.RootDirectory = NULL;
ObjectAttributes.ObjectName = NULL;
ObjectAttributes.Attributes = 0;
ObjectAttributes.SecurityDescriptor = NULL;
ObjectAttributes.SecurityQualityOfService = &Qos;
// AuthenticationId = SYSTEM_LUID;
AuthenticationId.LowPart = 1000;
AuthenticationId.HighPart = 0;
ExpirationTime.QuadPart = -1;
/* FIXME: Get the user SID from the registry */
RtlAllocateAndInitializeSid (&SystemAuthority,
5,
SECURITY_NT_NON_UNIQUE_RID,
0x12345678,
0x12345678,
0x12345678,
DOMAIN_USER_RID_ADMIN,
SECURITY_NULL_RID,
SECURITY_NULL_RID,
SECURITY_NULL_RID,
&UserSid);
TokenUser.User.Sid = UserSid;
TokenUser.User.Attributes = 0;
// TokenGroups = NULL;
TokenGroups.GroupCount = 1;
TokenGroups.Groups[0].Sid = UserSid; /* FIXME */
TokenGroups.Groups[0].Attributes = SE_GROUP_ENABLED;
// TokenPrivileges = NULL;
TokenPrivileges.PrivilegeCount = 0;
TokenOwner.Owner = UserSid;
TokenPrimaryGroup.PrimaryGroup = UserSid;
Status = RtlCreateAcl (&Dacl, sizeof(ACL), ACL_REVISION);
if (!NT_SUCCESS(Status))
{
return FALSE;
}
TokenDefaultDacl.DefaultDacl = &Dacl;
memcpy (TokenSource.SourceName,
"**ANON**",
8);
Status = NtAllocateLocallyUniqueId (&TokenSource.SourceIdentifier);
if (!NT_SUCCESS(Status))
{
RtlFreeSid (UserSid);
return FALSE;
}
Status = NtCreateToken (phToken,
TOKEN_ALL_ACCESS,
&ObjectAttributes,
TokenPrimary,
&AuthenticationId,
&ExpirationTime,
&TokenUser,
// TokenGroups,
&TokenGroups,
// TokenPrivileges,
&TokenPrivileges,
&TokenOwner,
&TokenPrimaryGroup,
&TokenDefaultDacl,
&TokenSource);
if (!NT_SUCCESS(Status))
{
RtlFreeSid (UserSid);
return FALSE;
}
RtlFreeSid (UserSid);
return TRUE;
}