Запуск из службы

#define _WIN32_WINNT 0x0501
 
#include <Windows.h>
#include <Userenv.h>
#include <AccCtrl.h>
#include <Aclapi.h>
#include <stdio.h>
#include <Sddl.h>
 
#define DESKTOP_ALL           (DESKTOP_READOBJECTS | DESKTOP_CREATEWINDOW | DESKTOP_CREATEMENU | DESKTOP_HOOKCONTROL | \
                            DESKTOP_JOURNALRECORD | DESKTOP_JOURNALPLAYBACK | DESKTOP_ENUMERATE | DESKTOP_WRITEOBJECTS | \
                            DESKTOP_SWITCHDESKTOP | STANDARD_RIGHTS_REQUIRED)
 
BOOL CreateMyDACL(SECURITY_ATTRIBUTES *);
 
wchar_t command[] = L"c:\\windows\\system32\\notepad.exe";
 
int main(int argc, char **argv)
{
    HANDLE usertoken;
    STARTUPINFO sinfo;
    PROCESS_INFORMATION pinfo;
    HDESK desktop;
    EXPLICIT_ACCESS explicit_access;
 
    BYTE buffer_token_user[SECURITY_MAX_SID_SIZE];
    PTOKEN_USER token_user = (PTOKEN_USER)buffer_token_user;
    PSECURITY_DESCRIPTOR existing_sd;
    SECURITY_DESCRIPTOR new_sd;
    PACL existing_dacl, new_dacl;
    BOOL dacl_present, dacl_defaulted;
    SECURITY_INFORMATION sec_info_dacl = DACL_SECURITY_INFORMATION;
    DWORD dw, size, dwSize;
    HWINSTA window_station;
    
    LPVOID lpEnv;
    WCHAR szUserProfile[256] = L"";
    PROFILEINFO prInfo;
 
    if (!LogonUser(L"Admin", L"", L"Pass", LOGON32_LOGON_BATCH, LOGON32_PROVIDER_DEFAULT, &usertoken))
    {
        printf("LogonUser: %u\n", GetLastError());
        return 1;
    }
 
    ZeroMemory(&prInfo, sizeof(PROFILEINFO));
    prInfo.dwSize = sizeof(PROFILEINFO);
    prInfo.lpUserName = L"Admin";
    prInfo.dwFlags = PI_NOUI;
 
    if (!LoadUserProfile(usertoken, &prInfo))
    {
        printf("LoadUserProfile: %u\n", GetLastError());
        return 1;
    }
    
    if (!GetTokenInformation(usertoken, TokenUser, buffer_token_user, sizeof(buffer_token_user), &dw))
    {
        printf("GetTokenInformation(TokenUser): %u\n", GetLastError());
        return 1;
    }
 
    window_station = GetProcessWindowStation();
    if (window_station == NULL)
    {
        printf("GetProcessWindowStation: %u\n", GetLastError());
        return 1;
    }
 
    if (!GetUserObjectSecurity(window_station, &sec_info_dacl, &dw, sizeof(dw), &size) && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
    {
        printf("GetUserObjectSecurity(window_station) call 1: %u\n", GetLastError());
        return 1;
    }
 
    existing_sd = malloc(size);
    if (existing_sd == NULL)
    {
        printf("malloc failed\n");
        return 1;
    }
 
    if (!GetUserObjectSecurity(window_station, &sec_info_dacl, existing_sd, size, &dw))
    {
        printf("GetUserObjectSecurity(window_station) call 2: %u\n", GetLastError());
        return 1;
    }
 
    if (!GetSecurityDescriptorDacl(existing_sd, &dacl_present, &existing_dacl, &dacl_defaulted))
    {
        printf("GetSecurityDescriptorDacl(window_station): %u\n", GetLastError());
        return 1;
    }
 
    if (!dacl_present)
    {
        printf("no DACL present on window station\n");
        return 1;
    }
 
    explicit_access.grfAccessMode = SET_ACCESS;
    explicit_access.grfAccessPermissions = WINSTA_ALL_ACCESS | READ_CONTROL;
    explicit_access.grfInheritance = NO_INHERITANCE;
    explicit_access.Trustee.pMultipleTrustee = NULL;
    explicit_access.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    explicit_access.Trustee.TrusteeForm = TRUSTEE_IS_SID;
    explicit_access.Trustee.TrusteeType = TRUSTEE_IS_USER;
    explicit_access.Trustee.ptstrName = (LPTSTR)token_user->User.Sid;
 
    dw = SetEntriesInAcl(1, &explicit_access, existing_dacl, &new_dacl);
    if (dw != ERROR_SUCCESS) {
        printf("SetEntriesInAcl(window_station): %u\n", dw);
        return 1;
    }
 
    if (!InitializeSecurityDescriptor(&new_sd, SECURITY_DESCRIPTOR_REVISION))
    {
        printf("InitializeSecurityDescriptor(window_station): %u\n", GetLastError());
        return 1;
    }
 
    if (!SetSecurityDescriptorDacl(&new_sd, TRUE, new_dacl, FALSE))
    {
        printf("SetSecurityDescriptorDacl(window_station): %u\n", GetLastError());
        return 1;
    }
 
    if (!SetUserObjectSecurity(window_station, &sec_info_dacl, &new_sd))
    {
        printf("SetUserObjectSecurity(window_station): %u\n", GetLastError());
        return 1;
    }
 
    free(existing_sd);
    LocalFree(new_dacl);
 
    desktop = GetThreadDesktop(GetCurrentThreadId());
    if (desktop == NULL)
    {
        printf("GetThreadDesktop: %u\n", GetLastError());
        return 1;
    }
 
    if (!GetUserObjectSecurity(desktop, &sec_info_dacl, &dw, sizeof(dw), &size) && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
    {
        printf("GetUserObjectSecurity(desktop) call 1: %u\n", GetLastError());
        return 1;
    }
 
    existing_sd = malloc(size);
    if (existing_sd == NULL)
    {
        printf("malloc failed\n");
        return 1;
    }
 
    if (!GetUserObjectSecurity(desktop, &sec_info_dacl, existing_sd, size, &dw))
    {
        printf("GetUserObjectSecurity(desktop) call 2: %u\n", GetLastError());
        return 1;
    }
 
    if (!GetUserObjectSecurity(desktop, &sec_info_dacl, existing_sd, 4096, &dw))
    {
        printf("GetUserObjectSecurity: %u\n", GetLastError());
        return 1;
    }
 
    if (!GetSecurityDescriptorDacl(existing_sd, &dacl_present, &existing_dacl, &dacl_defaulted))
    {
        printf("GetSecurityDescriptorDacl: %u\n", GetLastError());
        return 1;
    }
 
    if (!dacl_present)
    {
        printf("no DACL present\n");
        return 1;
    }
 
    explicit_access.grfAccessMode = SET_ACCESS;
    explicit_access.grfAccessPermissions = GENERIC_ALL | DESKTOP_ALL;
    explicit_access.grfInheritance = NO_INHERITANCE;
    explicit_access.Trustee.pMultipleTrustee = NULL;
    explicit_access.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    explicit_access.Trustee.TrusteeForm = TRUSTEE_IS_SID;
    explicit_access.Trustee.TrusteeType = TRUSTEE_IS_USER;
    explicit_access.Trustee.ptstrName = (LPTSTR)token_user->User.Sid;
 
    dw = SetEntriesInAcl(1, &explicit_access, existing_dacl, &new_dacl);
    if (dw != ERROR_SUCCESS) {
        printf("SetEntriesInAcl: %u\n", dw);
        return 1;
    }
 
    if (!InitializeSecurityDescriptor(&new_sd, SECURITY_DESCRIPTOR_REVISION))
    {
        printf("InitializeSecurityDescriptor: %u\n", GetLastError());
        return 1;
    }
 
    if (!SetSecurityDescriptorDacl(&new_sd, TRUE, new_dacl, FALSE))
    {
        printf("SetSecurityDescriptorDacl: %u\n", GetLastError());
        return 1;
    }
 
    if (!SetUserObjectSecurity(desktop, &sec_info_dacl, &new_sd))
    {
        printf("SetUserObjectSecurity(window_station): %u\n", GetLastError());
        return 1;
    }
 
    free(existing_sd);
    LocalFree(new_dacl);
 
    
    dwSize = sizeof(szUserProfile) / sizeof(WCHAR);
    if (!GetUserProfileDirectory(usertoken, szUserProfile, &dwSize))
    {
        printf("GetUserProfileDirectory: %u\n", GetLastError());
        return 1;
    }
    
    if (!CreateEnvironmentBlock(&lpEnv, usertoken, FALSE))
    {
        printf("CreateEnvironmentBlock: %u\n", GetLastError());
        return 1;
    }
    //Здесь идет попытка передать SECURITY_ATTRIBUTES CreateProcessAsUserW
    SECURITY_ATTRIBUTES  sa;
 
    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
    sa.bInheritHandle = FALSE;
 
    if (!CreateMyDACL(&sa))
    {
        // Error encountered; generate message and exit.
        printf("Failed CreateMyDACL\n");
        exit(1);
    }
 
    ///Здесь попытка подмены DefaultDacl в токене пользователя
        PSECURITY_DESCRIPTOR psd;
    ULONG cbsd = 0;
    TCHAR * szS = TEXT("D:")       // Discretionary ACL
        TEXT("(A;OICI;GA;;;BG)")     // Deny access to 
                                     // built-in guests
        TEXT("(A;OICI;GA;;;AN)")     // Deny access to 
                                     // anonymous logon
        TEXT("(A;OICI;GRGWGX;;;AU)") // Allow 
                                     // read/write/execute 
                                     // to authenticated 
                                     // users
        TEXT("(A;OICI;GA;;;BA)");    // Allow full control 
                                     // to administrators
    
    
    ConvertStringSecurityDescriptorToSecurityDescriptor(szS, SDDL_REVISION, &psd, &cbsd);
    
    BOOL fDaclPresent = FALSE, fDaclDef = FALSE;
    TOKEN_DEFAULT_DACL dacl;
    GetSecurityDescriptorDacl(psd, &fDaclPresent, &dacl.DefaultDacl, &fDaclDef);
    
    SetTokenInformation(usertoken, TokenDefaultDacl, &dacl, sizeof(dacl));
 
    ZeroMemory(&sinfo, sizeof(sinfo));
    sinfo.cb = sizeof(sinfo);
    sinfo.lpDesktop = L"winsta0\\default";
    ZeroMemory(&pinfo, sizeof(pinfo));
 
    /*if (!CreateProcessWithTokenW(usertoken, LOGON_WITH_PROFILE, command, command, CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT, lpEnv, szUserProfile, &sinfo, &pinfo))
    {
        printf("CreateProcess: %u\n", GetLastError());
        return 1;
    }*/
    if (!CreateProcessAsUserW(usertoken, command, command, &sa, &sa, NULL, CREATE_DEFAULT_ERROR_MODE | CREATE_UNICODE_ENVIRONMENT, lpEnv, szUserProfile, &sinfo, &pinfo))
    {
        printf("CreateProcess: %u\n", GetLastError());
        return 1;
    }
    DestroyEnvironmentBlock(lpEnv);
    if (!UnloadUserProfile(usertoken, prInfo.hProfile))
    {
        printf("UnloadUserProfile: %u\n", GetLastError());
        return 1;
    }
    //RevertToSelf;
    CloseHandle(usertoken);
    CloseHandle(pinfo.hProcess);
    CloseHandle(pinfo.hThread);
    
    if (NULL != LocalFree(sa.lpSecurityDescriptor))
    {
        // Error encountered; generate message and exit.
        printf("Failed LocalFree\n");
        exit(1);
    }
 
    return 0;
}
 
BOOL CreateMyDACL(SECURITY_ATTRIBUTES * pSA)
{
    // Define the SDDL for the DACL. This example sets 
    // the following access:
    //     Built-in guests are denied all access.
    //     Anonymous logon is denied all access.
    //     Authenticated users are allowed 
    //     read/write/execute access.
    //     Administrators are allowed full control.
    // Modify these values as needed to generate the proper
    // DACL for your application. 
    TCHAR * szSD = TEXT("D:")       // Discretionary ACL
        TEXT("(A;OICI;GA;;;BG)")     // Deny access to 
                                     // built-in guests
        TEXT("(A;OICI;GA;;;AN)")     // Deny access to 
                                     // anonymous logon
        TEXT("(A;OICI;GRGWGX;;;AU)") // Allow 
                                     // read/write/execute 
                                     // to authenticated 
                                     // users
        TEXT("(A;OICI;GA;;;BA)");    // Allow full control 
                                     // to administrators
 
    if (NULL == pSA)
        return FALSE;
 
    return ConvertStringSecurityDescriptorToSecurityDescriptor(
        szSD,
        SDDL_REVISION_1,
        &(pSA->lpSecurityDescriptor),
        NULL);
}