我已经创建了一个模板类，它将创建一个带有登录用户 token 的线程并运行任何方法。我在 std::function 的帮助下将它传递给模板类，并在用户级上下文中运行它。

我目前的使用情况:

1.该类用于windows服务进程(以SYSTEM级别运行)。

2. 线程在挂起状态下创建，SetThreadToken() 用于应用从“explorer.exe”创建的模拟 token 。 (我知道在多个登录用户的情况下这不是一种可行的方法，但暂时我需要这个东西来解决问题)。

3.在这些之后，我将恢复线程以在用户级上下文中执行传递的 util 方法。

引用的线程模拟来自:Create thread with specific privilege c++

面临的问题:

成功模拟登录用户并且创建的线程也在用户级上下文中运行(使用 GetUserName() API 验证)但是从我传递给的方法执行任何 API模板类不符合预期。 (示例:我尝试读取模拟用户的 HKCU 条目，但总是失败并出现错误:ERROR_FILE_NOT_FOUND.2 (0x2) )。 P.S:交叉检查了注册表树，相应的键在那里。

注意:上面的例子(REG read)是我试图传递给 Userimpersonator 类并试图在用户上下文中运行的 util 方法之一服务，但在运行时，我会将其与任何 util 方法一起使用。

UserImpersonator.h

class UserImpersonator
{

public:

    UserImpersonator();

    UserImpersonator(ImpersonationType typeVal,bool b_ImpersonateAndRunAsThreadNeeded = false);

   ~UserImpersonator();

    T1 ImpersonateAndRun(T2 callback_function);

    T1 ImpersonateAndRunAsThread(T2 callback_function);

private:

    ImpersonationType ImpersonationTypeVal;
    CString m_processname;
    HANDLE hToken;

    HANDLE impToken;

    bool m_ImpersonateAndRunAsThreadNeeded;

    T1 return_value;
    T2 callable_function_object;

    HANDLE hThread;

    BOOL InitializeImpersonation();
    BOOL RevertImpersonation();

    static DWORD WINAPI SpawnImpersonatedThread ( LPVOID lpParam );

};

Method definitions:

template<typename T1,typename T2>
UserImpersonator<T1,T2>::UserImpersonator()
{
    ImpersonationTypeVal = ImpersonationType::IMPERSONATION_USING_WINLOGON;
    m_processname = _T("winlogon.exe");
    hToken = NULL;
    m_ImpersonateAndRunAsThreadNeeded = false;
    hThread = NULL;
    impToken = NULL;

    InitializeImpersonation();
}

template<typename T1,typename T2>
UserImpersonator<T1,T2>::UserImpersonator(ImpersonationType typeVal,bool b_ImpersonateAndRunAsThreadNeeded)
{
    ImpersonationTypeVal = typeVal;
    m_processname = (typeVal == ImpersonationType::IMPERSONATION_USING_WINLOGON) ? _T("winlogon.exe") : _T("explorer.exe");
    hToken = NULL;
    m_ImpersonateAndRunAsThreadNeeded = b_ImpersonateAndRunAsThreadNeeded;
    hThread = NULL;
    impToken = NULL;

    InitializeImpersonation();
}

template<typename T1,typename T2>
DWORD WINAPI UserImpersonator<T1,T2> :: SpawnImpersonatedThread ( LPVOID lpParam )
{
    TRY
    {
        UserImpersonator* ImpersonatorObject = (UserImpersonator*) lpParam;

        TCHAR   UserName[200] =  _T("");
    DWORD size = 200 ; //sizeof ( UserName ) ;
    GetUserName ( UserName  , &size  ) ;

    CString name = CString(UserName);

        ImpersonatorObject->return_value = ImpersonatorObject->ImpersonateAndRun(ImpersonatorObject->callable_function_object);
    }
    CATCH_ALL( e )
    {
        LogDebug ( _T("Exception occurs:%s"),__FUNCTIONW__ ) ;
        return FALSE ;
    }
    END_CATCH_ALL

return 0;
}

template<typename T1,typename T2>
BOOL UserImpersonator<T1,T2>::InitializeImpersonation()
{
    BOOL res = TRUE;

    try
    {
        TCHAR   UserName[200] =  _T("");
    DWORD size = 200 ; //sizeof ( UserName ) ;
    GetUserName ( UserName  , &size  ) ;

    CString name = CString(UserName);

        HANDLE process_handle = GetProcessHandleByName(m_processname);

        if ( OpenProcessToken(process_handle, TOKEN_ALL_ACCESS, &hToken) == 0 )
        {
            res = FALSE;
            CloseHandle(process_handle);
            LogCritical(_T("%s : OpenProcessToken Failed with error-%d"), __FUNCTIONW__, GetLastError());
        }
    }
    catch(...)
    {
        LogDebug(_T("%s::Exception occurred"),__FUNCTIONW__);
    }

return res;
}

template<typename T1,typename T2>
T1 UserImpersonator<T1,T2>::ImpersonateAndRunAsThread(T2 callback_function)
{

    try
    {

        callable_function_object = callback_function;   

        hThread = ::CreateThread(0,0,SpawnImpersonatedThread,this,CREATE_SUSPENDED,0); //without using sb

        BOOL b = DuplicateTokenEx(hToken,MAXIMUM_ALLOWED,NULL,SecurityImpersonation,TokenImpersonation,&impToken);

        if( hThread )
        {
            if(SetThreadToken(&hThread,impToken))
            {
                DWORD thread_suspended_count = ResumeThread(hThread);

                if( thread_suspended_count == (DWORD) 0 || thread_suspended_count == (DWORD) 1 )
                {

                    DWORD thread_return_status = WaitForSingleObject(hThread,INFINITE);

                    if( thread_return_status == WAIT_OBJECT_0 )
                    {
                        LogDebug(_T("%s::SpawnImpersonatedThread successfully executed the callback function"),__FUNCTIONW__);
                    }
                    else
                        LogDebug(_T("%s::WaitForSingleObject failed with error=%d"),__FUNCTIONW__,GetLastError());
                }
            }
            else
                LogDebug(_T("%s::SetThreadToken failed with error=%d"),__FUNCTIONW__,GetLastError());
        }
        else
            LogDebug(_T("%s::CreateThread failed with error=%d"),__FUNCTIONW__,GetLastError());

    }
    catch(...)
    {
        LogDebug(_T("%s::Exception occurred"),__FUNCTIONW__);
    }

return return_value;
}

template<typename T1,typename T2>
T1 UserImpersonator<T1,T2>:: ImpersonateAndRun(T2 callback_function)
{
    try
    {
        return_value = callback_function();
    }
    catch(...)
    {
        LogDebug(_T("%s::Exception occurred"),__FUNCTIONW__);
    }

return return_value;
}

template<typename T1,typename T2>
BOOL UserImpersonator<T1,T2>::RevertImpersonation()
{
    if(hToken)
        CloseHandle(hToken) ;
    if(impToken)
        CloseHandle(impToken) ;

return RevertToSelf();
}

template<typename T1,typename T2>
UserImpersonator<T1,T2>::~UserImpersonator()
{
    RevertImpersonation();
}

Example for Usage:

    UserImpersonator< bool,std::function<bool()> > ImpersonatedObj(ImpersonationType::IMPERSONATION_USING_EXPLORER,true);

    auto f = std::bind(&IsRegKeyExists);

    BOOL res = ImpersonatedObj.ImpersonateAndRunAsThread(f);

Util Method:

bool IsRegKeyExists()
{
    HKEY phKey = NULL;
    bool res = false;

    is64bit = Is64BitConfiguration();

    CString subkey = _T("Volatile Environment\\USERPROFILE");

    if(is64bit)
    {
        lRes = RegOpenKeyEx( HKEY_CURRENT_USER, subkey.GetBuffer(), 0, KEY_ALL_ACCESS | KEY_WOW64_64KEY, &phKey );
    }
    else
    {
        lRes = RegOpenKeyEx( HKEY_CURRENT_USER, subkey.GetBuffer(), 0, KEY_ALL_ACCESS, &phKey );
    }

    if(lRes == ERROR_SUCCESS)
    {
        res = true;
    }
    else
    {
       LogDebug ( _T("Key open failure! %d"), GetLastError() );
    } 
return res;
}

最佳答案

HKEY_CURRENT_USER 这是 Predefined Key - 此句柄已缓存:

The HKEY_CURRENT_USER key maps to the root of the current user's branch in the HKEY_USERS key. It is cached for all threads in a process. Therefore, this value does not change when another user's profile is loaded. RegOpenCurrentUser uses the thread's token to access the appropriate key, or the default if the profile is not loaded.

所以你需要先通过RegOpenCurrentUser打开用户根 key 并改用此句柄 HKEY_CURRENT_USER。也可以使用 RegDisablePredefinedCache和 RegDisablePredefinedCacheEx如果您间接访问用户注册表配置单元

关于c++ - 使用来自系统级进程(Windows 服务)的登录用户上下文模拟和运行任何方法 :，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/54865257/