Prev: Coding help for loading custom icons into toolbar
Next: Interesting CreateEvent issue
From: Kerem Gümrükcü on 25 Feb 2010 01:09
Hi Joseph,

thank you very much for the example. Borrowing
the explorers token was not a good idea. Could
you pleace send me the examples of the three
things you found, that would be great. But i faced
another interessting thing: When i start a explorer.exe
with the code above and i want to run a executable
that has a manifest asking for UAC,...the UAC does
not come up and there ia also no shield overlay
on the icon of the executable. How can this be
explained or do you have an explanation for this,...

K.
From: Stefan Kuhr on 25 Feb 2010 05:46
Hi Corinna,

On 2/24/2010 6:39 PM, Corinna Vinschen wrote:
> Stefan Kuhr wrote:
>> Hi Kerem,
>>
>> On 2/24/2010 9:42 AM, Kerem Gümrükcü wrote:
>>> Does someone have a good idea, possibly not
>>> something with a second process runing non-elevated
>>> and expecting some signal or antother IPC data to
>>> spawn the non-elevated process, or like the example
>>> above duplicating the token from a process,...
>>
>> I think the answer is given in the article you mentioned: Since you want
>> the process to run under the same user account as the elevated process,
>> but just run it without the elevation, then "launch the new process with
>> that “dumbed down” token".
>>
>> Have you tried creating a restricted token from your elevated token and
>> then use CreateProcessAsUser? I have never tried this but I assume this
>> is the way to go.
>
> CreateRestrictedToken works fine, but there's a warning in MSDN that
> CreateRestrictedToken is still a bit of a security problem:
>
> "Warning Applications that use restricted tokens should run the
> restricted application on desktops other than the default desktop.
> This is necessary to prevent an attack by a restricted application,
> using SendMessage or PostMessage, to unrestricted applications on
> the default desktop. If necessary, switch between desktops for your
> application purposes."
>
> Other than that, I experimented a lot with GetTokenInformation info
> class TokenLinkedToken, and as far as I remember, if you're running in
> an elevated process, the linked token is the non-elevated token.
>

It definitely is worth a try for Kerem. My experience is that the linked
token can only be used for the AccessCheck API and nothing else.
However, since GetTokenInformation with TokenLinkedToken still seems to
be officially undocumented (my Server 08 PlatSDK doesn't document it and
on msdn online, TokenLinkedToken is also not mentioned as a valid
parameter for GetTokenInformation), I wouldn't be surprised if it works
accidentally but breaks with the next service pack.

--
S
From: Corinna Vinschen on 25 Feb 2010 09:38
Hey Stefan,

Stefan Kuhr wrote:
> Hi Corinna,
>
> On 2/24/2010 6:39 PM, Corinna Vinschen wrote:
>> Other than that, I experimented a lot with GetTokenInformation info
>> class TokenLinkedToken, and as far as I remember, if you're running in
>> an elevated process, the linked token is the non-elevated token.
>
> It definitely is worth a try for Kerem. My experience is that the linked
> token can only be used for the AccessCheck API and nothing else.

You are definitely right, if the process has no TCB privileges, and if
the process token is the restricted token, not the elevated token. In
this case the linked token is just an impersonation token and the call
to DuplicateTokenEx(PrimaryToken) fails with "access denied".

However, I know for a fact (since I'm using this capability in Cygwin)
that the linked, elevated token is a primary token suitable for calls
to CreateProcessAsUser, if the calling process has TCB privileges.
Which makes a lot of sense to me, even if that is nowhere documented.
And I seriously hope for Cygwin that this won't be changed in some
future version of Windows.

In Kerem's case I'm not sure. I never checked in the inverse case
- calling TokenLinkedToken on the elevated token - and without TCB
privileges, if the linked token is an impersonation token for which
DuplicateTokenEx(PrimaryToken) fails. I made the suggestion
nevertheless, because it can be very easily tested.

> However, since GetTokenInformation with TokenLinkedToken still seems to
> be officially undocumented (my Server 08 PlatSDK doesn't document it and
> on msdn online, TokenLinkedToken is also not mentioned as a valid
> parameter for GetTokenInformation), I wouldn't be surprised if it works
> accidentally but breaks with the next service pack.

It is documented as TOKEN_INFORMATION_CLASS member:
http://msdn.microsoft.com/en-us/library/aa379626%28VS.85%29.aspx

And the TOKEN_LINKED_TOKEN structure is documented as well:
http://msdn.microsoft.com/en-us/library/bb530719%28VS.85%29.aspx

It's only missing in the man pages for GetTokenInformation and
SetTokenInformation.

The fact that the TOKEN_LINKED_TOKEN man page refers to
SetTokenInformation is interesting. I assume that you need TCB
privileges as well to link a token to another token, but I never
tried that.


Corinna

--
Corinna Vinschen
Cygwin Project Co-Leader
Red Hat
From: Stefan Kuhr on 25 Feb 2010 10:58
Hi Corinna,

On 2/25/2010 3:38 PM, Corinna Vinschen wrote:
> <snip>
> In Kerem's case I'm not sure. I never checked in the inverse case
> - calling TokenLinkedToken on the elevated token - and without TCB
> privileges, if the linked token is an impersonation token for which
> DuplicateTokenEx(PrimaryToken) fails. I made the suggestion
> nevertheless, because it can be very easily tested.
>


Were you thinking about something like the following code? When run
under an elevated token, CPAU fails with 1314 (Privilige not held) and
the linked token is an impersonation token, duplicating it to a primary
token fails with 1346 (bad impersonation level):


int _tmain(int argc, _TCHAR* argv[])
{
TOKEN_LINKED_TOKEN tlt;


HANDLE hProcessToken = NULL;

if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY,
&hProcessToken))
{
DWORD cbLength = 0L;
if (GetTokenInformation(hProcessToken, TokenLinkedToken,
&tlt,sizeof(tlt), &cbLength))
{
TCHAR szCmdLine[] = _T("notepad");

STARTUPINFO si = {0};
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_SHOW;
PROCESS_INFORMATION pi;

if(CreateProcessAsUser(tlt.LinkedToken,
_T("c:\\windows\\notepad.exe"), szCmdLine, NULL,
NULL, FALSE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi))
{
_tprintf(_T("It worked\n"));
VERIFY(WAIT_OBJECT_0==WaitForSingleObject(pi.hProcess,
INFINITE));
VERIFY(CloseHandle(pi.hProcess));
VERIFY(CloseHandle(pi.hThread));
}
else
{
DWORD dwLastError = GetLastError();
_tprintf(_T("CPAU failed with %lu (0x%.8x)\n"), dwLastError,
dwLastError);
}

TOKEN_TYPE tt;

if (GetTokenInformation(tlt.LinkedToken, TokenType,
&tt,sizeof(tt), &cbLength))
{
_tprintf(_T("Token is of type %lu\n"), (DWORD) tt);

if(TokenImpersonation==tt)
{
HANDLE hPrimary = NULL;
if(!DuplicateTokenEx(tlt.LinkedToken, 0L, NULL,
SecurityImpersonation, TokenPrimary, &hPrimary))
{
DWORD dwLastError = GetLastError();
_tprintf(_T("DuplicateTokenEx failed with %lu (0x%.8x)\n"),
dwLastError, dwLastError);
}
}

}

VERIFY(CloseHandle(tlt.LinkedToken));
}

VERIFY(CloseHandle(hProcessToken));
}


return 0;
}



Cheers,

--
S
From: Joseph M. Newcomer on 25 Feb 2010 12:19
I found them a couple years ago using google. None of them was quite the best style of
programming, so I rewrote them using the best examples from each plus avoiding sprintf. I
have long since forgotten where I found them; one was a Microsoft blog site, but I don't
remember the other two.

The code I showed was the ultimately best-programming-style example.

I have no idea how UAC and Explorer work together (or don't, as seems to be your case). My
goal was to launch a non-elevated app from an elevated app, which was your original
question.

I have found that the further I stay away from the explorer, the happier I am. Having
once tried to write an explorer extension, the most polite thing I can say is the whole
thing is a confused mess.
joe

On Thu, 25 Feb 2010 07:09:01 +0100, Kerem G�mr�kc� <kareem114(a)hotmail.com> wrote:

>Hi Joseph,
>
>thank you very much for the example. Borrowing
>the explorers token was not a good idea. Could
>you pleace send me the examples of the three
>things you found, that would be great. But i faced
>another interessting thing: When i start a explorer.exe
>with the code above and i want to run a executable
>that has a manifest asking for UAC,...the UAC does
>not come up and there ia also no shield overlay
>on the icon of the executable. How can this be
>explained or do you have an explanation for this,...
>
>K.
Joseph M. Newcomer [MVP]
email: newcomer(a)flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm
First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4
Prev: Coding help for loading custom icons into toolbar
Next: Interesting CreateEvent issue