A simple launch of an external application with user privileges (dynamically adding users using the NetUserAdd function and the user_info_1 struct, and then starting the program with CREATEPROCESSWITHLOGONW)

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

[CPP]View PlainCopy

2. BOOL Executeasuser (lpcwstr lpszUserName, lpcwstr Lpszpassword, lpcwstr lpszapplication, LPCWSTR lpszCmdLine)
4. {
6. if (NULL = = lpszUserName)
8. {
10. return FALSE;
12. }
14. if (NULL = = lpszapplication)
16. {
18. return FALSE;
20. }
24. BOOL bRet = FALSE;
26. wchar* pusername = NULL;
28. wchar* ppassword = NULL;
30. Startupinfo si = {sizeof (SI)};
32. process_information pi = {0};
34. WCHAR Szapp[max_path * 2] = {0};
38. //Check User Name
40. size_t Nlen = wcslen (lpszusername) + 1;
42. Pusername = new Wchar[nlen];
44. STRINGCCHPRINTFW (Pusername, Nlen, L"%s", lpszUserName);
48. //Check Password
50. Nlen = (NULL! = Lpszpassword)? (Wcslen (Lpszpassword) + 1): 2;
52. Ppassword = new Wchar[nlen];
54. STRINGCCHPRINTFW (Ppassword, Nlen, L"%s", (NULL! = Lpszpassword)? lpszpassword:l"");
58. User_info_1 UI;
60. DWORD dwerror = 0;
62. DWORD dwlevel = 1;
64. Ui.usri1_name = Pusername;
66. Ui.usri1_password = Ppassword;
68. Ui.usri1_priv = User_priv_user;
70. Ui.usri1_home_dir = NULL;
72. Ui.usri1_comment = NULL;
74. Ui.usri1_flags = Uf_script;
76. Ui.usri1_script_path = NULL;
78. //ADD User
80. if (nerr_success! = NetUserAdd (NULL, Dwlevel, (lpbyte) &ui, &dwerror))
82. {
84. Goto _end_;
86. }
90. if ((NULL! = lpszcmdline) && wcslen (lpszcmdline))
92. STRINGCCHPRINTFW (Szapp, _countof (Szapp), L"%s%s", lpszapplication, lpszCmdLine);
94. Else
96. STRINGCCHPRINTFW (Szapp, _countof (Szapp), L"%s", lpszapplication);
100. if (createprocesswithlogonw (lpszUserName, NULL, Lpszpassword, logon_with_profile, NULL, Szapp, 0, NULL, NULL, & Si, &pi))
102. {
104. BRet = TRUE;
106. CloseHandle (Pi.hthread);
108. CloseHandle (pi.hprocess);
110. }
112. Else
114. {
116. dwerror = GetLastError ();
118. Goto _cleanup_;
120. }
122. BRet = TRUE;
126. _cleanup_:
128. //Delete User
130. Netuserdel (NULL, lpszUserName);
132. _end_:
134. if (NULL! = Ppassword)
136. {
138. delete[] Ppassword;
140. Ppassword = NULL;
142. }
144. if (NULL! = pusername)
146. {
148. delete[] Pusername;
150. Pusername = NULL;
152. }
154. return bRet;
156. }
160. Test code
162. #include "stdafx.h"
166. #include <Windows.h>
168. #include <lm.h>
170. #include <strsafe.h>
172. #pragma comment (lib, "Netapi32.lib")
176. int _tmain (int argc, _tchar* argv[])
178. {
180. Executeasuser (l "ABC", l "Hello", l"F:\\11.exe", NULL);
182. return 0;
184. }

http://blog.csdn.net/visualeleven/article/details/7640475

This creates a new account that can be used to openprocesstoken+createrestrictedtoken the privileges of the current process's token for CreateProcessAsUser

A simple launch of an external application with user privileges (dynamically adding users using the NetUserAdd function and the user_info_1 struct, and then starting the program with CREATEPROCESSWITHLOGONW)