调整非特权帐户令牌（C，Windows中） [英] Adjust tokens on non-privileged accounts (C, Windows)

问题描述

我用下面的code（这是从MSDN样本略有修改）来检查我是否有一个过程调试权限。如果我不去我尝试设置它们。

I'm using the following code (which is a sample from the MSDN slightly modified) to check whether i have debug privileges on a process. If I don't I try to set them.

int SetDebugPriv()
{
    HANDLE TokenHandle;
    LUID lpLuid;
    TOKEN_PRIVILEGES NewState;

    if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &TokenHandle))
    {
    	//failed
    	return 0;
    }

    if(!LookupPrivilegeValue(NULL, "SeDebugPrivilege" , &lpLuid))
    {
    	//failed
    	CloseHandle(TokenHandle);
    	return 0;
    }

    NewState.PrivilegeCount = 1;
    NewState.Privileges[0].Luid = lpLuid;
    NewState.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    if(!AdjustTokenPrivileges(TokenHandle, FALSE, &NewState, sizeof(NewState), NULL, NULL))
    {
    	//failed
    	CloseHandle(TokenHandle);
    	return 0;
    }

    CloseHandle(TokenHandle);
    return 1;
}

现在，某些帐户在Windows XP和2003下，我尝试设置令牌时得到一个拒绝访问错误。我的猜测是，我不能设置特定的标记，因为我无权这样做。
我将如何设置调试令牌上具有低特权的非管理员帐户或帐户？

Now, under certain account on Windows XP and 2003 I am getting an access denied error when trying to set the token. My guess is that I cannot set that specific token because I have no permission to do that. How would I set the debug token on non admin accounts or account that have low privileges?

code是AP preciated。

code is appreciated.

感谢

推荐答案

您不能。如果你能，这将会是一个巨大的安全漏洞（SeDebugPrivilege比管理员更魔力）。

You can't. If you could, it'd be a massive security hole (SeDebugPrivilege has more mojo than Administrator).

AdjustTokenPrivileges接通该令牌具有特权，但没有启用。例如，SeShutdownPrivilege是其中之一。

AdjustTokenPrivileges turns on a privilege that the token has, but that isn't enabled. For example, SeShutdownPrivilege is one of these.

您必须将权限添加到用户帐户，然后用户必须注销并重新（获得的特权一个新的令牌）。

You have to add the privilege to the user account, and then the user has to log out and back in again (to get a new token with the privilege).

要特权编程方式添加到用户账户，开始与这个： http://support.microsoft.com/kb/132958

To add the privileges to the user account programmatically, start with this: http://support.microsoft.com/kb/132958

这篇关于调整非特权帐户令牌（C，Windows中）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！