CreateProcessAsUser()的使用

来源：互联网发布：算法导论要学吗编辑：程序博客网时间：2024/06/16 11:55
        HANDLE hToken = NULL;TCHAR szUsername[MAX_PATH];TCHAR para[MAX_PATH] = {0};TCHAR szUsernamePath[MAX_PATH];DWORD dwUsernameLen = MAX_PATH;DWORD cursessionid;cursessionid = WTSGetActiveConsoleSessionId();log_error("WTSGetActiveConsoleSessionId() = %d\n",cursessionid);if(!WTSQueryUserToken(cursessionid, &hToken)){log_error("%s WTSQueryUserToken is failed\n", __FUNCTION__);}if(!ImpersonateLoggedOnUser(hToken)){log_error("%s ImpersonateLoggedOnUser is failed\n", __FUNCTION__);}DWORD UsernamePathSize = ARRAYSIZE(szUsernamePath);//获取到当前用户路径if (!GetUserProfileDirectory(hToken,szUsernamePath,&UsernamePathSize)){log_error("%s GetUserProfileDirectory is failed\n", __FUNCTION__);}        BOOL bResult = FALSE;PROCESS_INFORMATION pi;PSID                psid;STARTUPINFO         si;ZeroMemory(&si, sizeof(STARTUPINFO));si.cb        = sizeof(STARTUPINFO);si.lpDesktop = L"winsta0\\default";// // start the process//LPVOID environment;BOOL blockRet = CreateEnvironmentBlock(&environment, hToken, FALSE);if (!blockRet){log_error("could not create environment block (error: %i)",GetLastError());}else{//TCHAR Cmdline[MAX_PATH] = _T("/c \"C:\\Windows\\System32\\RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8\"");TCHAR Cmdline[MAX_PATH] = _T("/c \"C:\\Windows\\System32\\cleanmgr\" /sagerun:100");DWORD creationFlags = NORMAL_PRIORITY_CLASS | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT;bResult = CreateProcessAsUser(hToken,_T("C:\\Windows\\System32\\CMD.exe"),Cmdline,//_T("InetCpl.cpl,ClearMyTracksByProcess 8"),//L"\"inetcpl.cpl,clearmytracksbyprocess 8\"",//L"/c \"C:\\Windows\\System32\\cleanmgr\" /sagerun:100",NULL,NULL,FALSE,creationFlags,environment,NULL,&si,&pi);log_error("CreateProcessAsUser0 = %d",GetLastError());// // close the handles// if (bResult && pi.hProcess != INVALID_HANDLE_VALUE) { WaitForSingleObject(pi.hProcess, INFINITE); CloseHandle(pi.hProcess); } else{log_error("CreateProcessAsUser1 = %d",GetLastError());}if (pi.hThread != INVALID_HANDLE_VALUE)CloseHandle(pi.hThread); DestroyEnvironmentBlock(environment);}RevertToSelf();CloseHandle(hToken);
0 0