Using OpenProcessToke n

[Niclas]

Hi,

I am trying to get a usertoken from a particular process running on the
computer, from a Windows Service to do a Windows group membership of the
user running that process. I was planning to use a API call to
OpenProcessToke n and use the Tokenhandle retrieved to build a
WindowsIdentity object and do a access check on.

Has anyone done this before, and can advise if this would work, and if so
possible post a sample on how to do the API call and get the Token handle ?

Many thanks

Niclas

[Willy Denoyette [MVP]]

"Niclas" <li************ *@hotmail.com> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..
| Hi,
|
| I am trying to get a usertoken from a particular process running on the
| computer, from a Windows Service to do a Windows group membership of the
| user running that process. I was planning to use a API call to
| OpenProcessToke n and use the Tokenhandle retrieved to build a
| WindowsIdentity object and do a access check on.
|
| Has anyone done this before, and can advise if this would work, and if so
| possible post a sample on how to do the API call and get the Token handle
?
|
| Many thanks
|
| Niclas
|
|
Yes, it's possible provided you are running this with appropriate
privileges, that is as SYSTEM to begin with.
Herewith a small sample that shows how to do.

using System;
using System.Runtime. InteropServices ;
using System.Collecti ons.Generic;
using System.Diagnost ics;
using System.Security ;
using System.Security .Principal;
namespace TestSecurity
{
class Tester
{

[DllImport("adva pi32", SetLastError=tr ue),
SuppressUnmanag edCodeSecurityA ttribute]
static extern int OpenProcessToke n(
System.IntPtr ProcessHandle, // handle to process
int DesiredAccess, // desired access to process
ref IntPtr TokenHandle // handle to open access token
);

[DllImport("kern el32", SetLastError=tr ue),
SuppressUnmanag edCodeSecurityA ttribute]
static extern bool CloseHandle(Int Ptr handle);
[DllImport("adva pi32.dll", CharSet=CharSet .Auto, SetLastError=tr ue)]
public extern static bool DuplicateToken( IntPtr ExistingTokenHa ndle,
int SECURITY_IMPERS ONATION_LEVEL, ref IntPtr DuplicateTokenH andle);

public const int TOKEN_DUPLICATE = 2;
public const int TOKEN_QUERY = 0X00000008;
public const int TOKEN_IMPERSONA TE = 0X00000004;

static void Main()
{
IntPtr hToken = IntPtr.Zero;
IntPtr dupeTokenHandle = IntPtr.Zero;
// For simplicity I'm using the PID of System here
Process proc = Process.GetProc essById(4);
if (OpenProcessTok en(proc.Handle,
TOKEN_QUERY|TOK EN_IMPERSONATE| TOKEN_DUPLICATE ,
ref hToken) != 0)
{
WindowsIdentity newId = new WindowsIdentity (hToken);
Console.WriteLi ne(newId.Owner );
try
{
const int SecurityImperso nation = 2;
dupeTokenHandle = DupeToken(hToke n,
SecurityImperso nation);
if(IntPtr.Zero == dupeTokenHandle )
{
string s = String.Format(" Dup failed {0}, privilege not held",
Marshal.GetLast Win32Error());
throw new Exception(s);
}

WindowsImperson ationContext impersonatedUse r =
newId.Impersona te();
IntPtr accountToken = WindowsIdentity .GetCurrent().T oken;
Console.WriteLi ne( "Token number is: " + accountToken.To String());
Console.WriteLi ne( "Windows ID Name is: " +
WindowsIdentity .GetCurrent().N ame);
}
finally
{
CloseHandle(hTo ken);
}
}
else
{
string s = String.Format(" OpenProcess Failed {0}, privilege not
held", Marshal.GetLast Win32Error());
throw new Exception(s);
}
}
static IntPtr DupeToken(IntPt r token, int Level)
{
IntPtr dupeTokenHandle = IntPtr.Zero;
bool retVal = DuplicateToken( token, Level, ref dupeTokenHandle );
return dupeTokenHandle ;
}
}
}

Willy.

[Niclas]

Willy,

Code works excellent. Many thanks for your help !

Niclas

"Willy Denoyette [MVP]" <wi************ *@telenet.be> wrote in message
news:eZ******** *****@TK2MSFTNG P15.phx.gbl...

"Niclas" <li************ *@hotmail.com> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..
| Hi,
|
| I am trying to get a usertoken from a particular process running on the
| computer, from a Windows Service to do a Windows group membership of the
| user running that process. I was planning to use a API call to
| OpenProcessToke n and use the Tokenhandle retrieved to build a
| WindowsIdentity object and do a access check on.
|
| Has anyone done this before, and can advise if this would work, and if
so
| possible post a sample on how to do the API call and get the Token
handle
?
|
| Many thanks
|
| Niclas
|
|
Yes, it's possible provided you are running this with appropriate
privileges, that is as SYSTEM to begin with.
Herewith a small sample that shows how to do.

using System;
using System.Runtime. InteropServices ;
using System.Collecti ons.Generic;
using System.Diagnost ics;
using System.Security ;
using System.Security .Principal;
namespace TestSecurity
{
class Tester
{

[DllImport("adva pi32", SetLastError=tr ue),
SuppressUnmanag edCodeSecurityA ttribute]
static extern int OpenProcessToke n(
System.IntPtr ProcessHandle, // handle to process
int DesiredAccess, // desired access to process
ref IntPtr TokenHandle // handle to open access token
);

[DllImport("kern el32", SetLastError=tr ue),
SuppressUnmanag edCodeSecurityA ttribute]
static extern bool CloseHandle(Int Ptr handle);
[DllImport("adva pi32.dll", CharSet=CharSet .Auto, SetLastError=tr ue)]
public extern static bool DuplicateToken( IntPtr ExistingTokenHa ndle,
int SECURITY_IMPERS ONATION_LEVEL, ref IntPtr DuplicateTokenH andle);

public const int TOKEN_DUPLICATE = 2;
public const int TOKEN_QUERY = 0X00000008;
public const int TOKEN_IMPERSONA TE = 0X00000004;

static void Main()
{
IntPtr hToken = IntPtr.Zero;
IntPtr dupeTokenHandle = IntPtr.Zero;
// For simplicity I'm using the PID of System here
Process proc = Process.GetProc essById(4);
if (OpenProcessTok en(proc.Handle,
TOKEN_QUERY|TOK EN_IMPERSONATE| TOKEN_DUPLICATE ,
ref hToken) != 0)
{
WindowsIdentity newId = new WindowsIdentity (hToken);
Console.WriteLi ne(newId.Owner );
try
{
const int SecurityImperso nation = 2;
dupeTokenHandle = DupeToken(hToke n,
SecurityImperso nation);
if(IntPtr.Zero == dupeTokenHandle )
{
string s = String.Format(" Dup failed {0}, privilege not held",
Marshal.GetLast Win32Error());
throw new Exception(s);
}

WindowsImperson ationContext impersonatedUse r =
newId.Impersona te();
IntPtr accountToken = WindowsIdentity .GetCurrent().T oken;
Console.WriteLi ne( "Token number is: " +
accountToken.To String());
Console.WriteLi ne( "Windows ID Name is: " +
WindowsIdentity .GetCurrent().N ame);
}
finally
{
CloseHandle(hTo ken);
}
}
else
{
string s = String.Format(" OpenProcess Failed {0}, privilege not
held", Marshal.GetLast Win32Error());
throw new Exception(s);
}
}
static IntPtr DupeToken(IntPt r token, int Level)
{
IntPtr dupeTokenHandle = IntPtr.Zero;
bool retVal = DuplicateToken( token, Level, ref dupeTokenHandle );
return dupeTokenHandle ;
}
}
}

Willy.