Win7 under Super Admin create normal permissions task

Moved to a new blog Http://www.raysoftware click the Open link. cn/?p=49

The project uses a feature that Win7 under the Super administrator to create a normal permissions task.

Tried several ways, such as obtaining token from the Resource manager, and then creating a task with CREATEPROCESSWITHTOKENW with this token. It is possible to do so.

But what if you don't currently have a resource manager or other normal permission task? Createtoken can build a token himself, but those parameters look great.

Try it. Start Task Manager with a super user to run in the menu, it is the default to create a normal permissions task, there is a complex option to start the task with superuser privileges.

Tracked it with WinDbg. The Discovery Task Manager invokes the Wdcruntaskasinteractiveuser function. function bit field Wdc.dll.

The form of the function is analyzed as follows:

Delphi statement:

[Delphi]View Plaincopy

1. function Wdcruntaskasinteractiveuser (Pwszcmdline, Pwszpath:pwidechar;
2. Dwdummy:dword): HResult; stdcall;  External ' Wdc.dll ';

C + + declaration:

[CPP]View Plaincopy

1. HRESULT WINAPI wdcruntaskasinteractiveuser (lpcwstr Pwszcmdline,
2. lpcwstr Pwszpath,
3. DWORD dwdummy);

This is a function that Microsoft does not expose. Not available on MSDN or Google.

This function uses very few parameters and is very simple.

The last parameter to the Task Manager is 39. It should be identified by a bit. 39 should be 4 or 2 or 1 get.

I tried to give 0, open exe and so on is no problem, but open MP3 and so will fail.

Using Ida to Decompile Wdcruntaskasinteractiveuser discovers that his implementation is to create a low-privilege scheduled task, and then invoke the Run method of the scheduled task,

There is also an episode. I think Vista and Windows7 are similar, just judge Windows version >=6 with Wdcruntaskasinteractiveuser, otherwise call Shellexecuteexe.

It turns out that Vista is not working, there is no such function on Vista, and even the process manager without Wdc.dll.Vista can not create a normal process under superuser privileges, it simply calls the ShellExecuteEx.

Of course, Vista we can use the scheduled task to create the normal permissions process tasks, and then run the. That is, to realize the wdcruntaskasinteractiveuser.

I am more lazy, the project as long as GetProcAddress can not find Wdcruntaskasinteractiveuser, I use ShellExecuteEx.

Here is a code of execution that I encapsulated in my project.

[Delphi]View Plaincopy

2. function Runtaskasinteractiveuser (cmdline, Param, dir:string): Boolean;
4. Const
6. WDC = ' Wdc.dll ';
8. Type
10. Twdcruntaskasinteractiveuser = function (pwszcmdline, Pwszpath:pwidechar;
12. Dwdummy:dword): HResult; stdcall;
14. Var
16. Wdcruntaskasinteractiveuser:twdcruntaskasinteractiveuser;
18. FullName: string;
20. Sei:shellexecuteinfo;
22. E:integer;
24. hwdc:cardinal;
26. Begin
28. Result: = False;
30. SetLength (FullName, Length (cmdline));
32. CopyMemory (PChar (FullName), PChar (CmdLine), ByteLength (CmdLine));
34. //If Windows version >=6
36. if Win32majorversion >= 6 Then
38. begin
40. HWDC: = GetModuleHandle (WDC);
42. if HWDC = 0 Then
44. HWDC: = LoadLibrary (WDC);
46. @WdcRunTaskAsInteractiveUser: = GetProcAddress (HWDC, ' Wdcruntaskasinteractiveuser ');
50. //If you can find Wdcruntaskasinteractiveuser, then it should be Windows7 .
52. if Assigned (wdcruntaskasinteractiveuser) Then
54. begin
56. if Length (Param) > 0 Then
58. FullName: = Format (' "%s '%s ', [FullName, Param]);
60. //fullname + ' + Param;
62. ///The last parameter 39 is the reverse. I don't know what it means. Taskmgr gives a fixed
64. //If given 0, EXE etc can be started, but the folder, MP3, etc. cannot start
66. E: = Wdcruntaskasinteractiveuser (PChar (FullName), PChar (dir), 39);
68. Result: = e = S_OK;
70. end;
72. end;
74. //If not successful, usually there is no wdcruntaskasinteractiveuser, the system may be Vista or XP
76. if not Result Then
78. begin
80. //  
82. ZeroMemory (@sei, sizeof (SEI));
84. Sei. cbsize: = sizeof (SHELLEXECUTEINFO);
86. Sei. Fmask: = see_mask_nocloseprocess or see_mask_flag_no_ui;
88. Sei. Lpfile: = PChar (fullname);
90. Sei. Lpverb: = ' Open '; If this gives ' runas ' the ability to start with Super User privileges
92. Sei. Nshow: = Sw_show;
94. if Length (Param) > 0 Then
96. Sei. Lpparameters: = PChar (Param)
98. Else
100. Sei. Lpparameters: = nil;
102. Sei. Lpdirectory: = PChar (dir);
104. ShellExecuteEx (@sei);
106. if Sei. hprocess <> 0 Then
108. CloseHandle (seihprocess);
112. end;
114. End

http://blog.csdn.net/wr960204/article/details/6600581

Win7 under Super Admin create normal permissions task