CreateProcessAsUser和CreateProcessWithLogonW的简单案列

川长思鸟来 2022-04-23 12:26 319阅读 0赞

**介绍6种比较常用的运行（执行）程序的方法：  
包括WinExec、ShellExecute、CreateProcess、CreateProcessAsUser、CreateProcessWithLogonW、CreateProcessWithTokenW**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MjI3ODk2_size_16_color_FFFFFF_t_70][]

**一、 CreateProcessAsUser创建一个新进程及其主线程。**

**1、创建当前登录（活跃）用户下的进程**

**2、指定一个特定的用户创建一个进程（我这里最终是做成服务的形式了，所以有提升服务的一些权限设置）:**

#include "pch.h"
    
    #include <windows.h>
    #include <stdio.h>
    #include <userenv.h>
    #include <iostream>
    #include <Wtsapi32.h>
    #pragma comment(lib, "Wtsapi32.lib")
    #pragma comment(lib, "Userenv.lib")
    #include<tchar.h>
    #include <atlconv.h>
    #include <tlhelp32.h>
    
    #define G_LEN_CMD_LINE  1024    //< 命令行最大长度
    // 计算wchar_t 数组的size, 以wchar_t为单位
    #define SIZE_OF_WCHAR_ARRAY(x) (sizeof(x) / sizeof(wchar_t))
    
    /*
    注意：
    1、是“服务”进程！如果需要以用户身份运行，必须在前面执行LogonUser来获取用户令牌
    2、此种设置只能在服务中使用，如果用编译器来执行会报只CreateProcessAsUser: 客户端没有所需的特权
    3、如果做好后，启动服务，出现一个交互式的界面的话。需要：保留。不需要，查看下面的解决之法
    */
    
    //用CreateProcessAsUse函数实现的（可用，做成服务不可用）
    BOOL CreateProcessAsUse(wchar_t * pcLoginUsr,
    	wchar_t * pcLoginPwd,
    	wchar_t * pcPePathName,
    	DWORD &   dwSubPID,
    	DWORD &   dwSubTID)
    {
    	BOOL                    bRc = FALSE;
    	// 检查用户登录权
    	HANDLE hUserToken = NULL;
    	if (LogonUser(pcLoginUsr, L".", pcLoginPwd, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hUserToken))
    	{
    		PROCESS_INFORMATION pi;
    		STARTUPINFO si;
    		DWORD dwCreationFlags = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE;
    		ZeroMemory(&si, sizeof(STARTUPINFO));
    		si.cb = sizeof(STARTUPINFO);
    		//si.lpDesktop = L"winsta0\\default";
    		ZeroMemory(&pi, sizeof(pi));
    
    		TOKEN_PRIVILEGES tp;
    		LUID luid;
    		if (!LookupPrivilegeValue(NULL, SE_RESTORE_NAME, &luid))//查询进程的权限
    		{
    			std::cout << "LookupPrivilegeValue： " << GetLastError() << std::endl;
    			return false;
    		}
    		else
    		{
    			tp.PrivilegeCount = 1;
    			tp.Privileges[0].Luid = luid;
    			tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    			//判断(调整)令牌权限
    			if (!AdjustTokenPrivileges(hUserToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, NULL))
    			{
    				std::cout << "AdjustTokenPrivileges： " << GetLastError() << std::endl;
    				return false;
    			}
    			else
    			{
    				//创建环境
    				LPVOID pEnv = NULL;
    				if (CreateEnvironmentBlock(&pEnv, hUserToken, TRUE))
    				{
    					dwCreationFlags |= CREATE_UNICODE_ENVIRONMENT;
    					bRc = TRUE;
    					if (bRc == CreateProcessAsUser(hUserToken, // client's access token
    						NULL,        // file to execute
    						pcPePathName,   // command line
    						NULL,          // pointer to process SECURITY_ATTRIBUTES
    						NULL,          // pointer to thread SECURITY_ATTRIBUTES
    						FALSE,          // handles are not inheritable
    						dwCreationFlags,// creation flags
    						pEnv,          // pointer to new environment block
    						NULL,          // name of current directory
    						&si,            // pointer to STARTUPINFO structure
    						&pi            // receives information about new process
    					)) 
    					{
    						dwSubPID = pi.dwProcessId;
    						dwSubTID = pi.dwThreadId;
    
    						::CloseHandle(pi.hProcess);
    						::CloseHandle(pi.hThread);
    					}
    					else
    					{
    						std::cout << "CreateProcessAsUser： " << GetLastError() << std::endl;
    					}
    				}
    				else {
    					std::cout << "CreateEnvironmentBlock： " << GetLastError() << std::endl;
    					
    				}
    			}
    		}
    	}
    	else
    	{
    		std::cout << "LogonUser： " << GetLastError() << std::endl;
    		
    	}
    
    	//执行所有Close句柄任务
    	if (NULL != hUserToken)
    	{
    		CloseHandle(hUserToken);
    	}
    
    	return bRc;
    }
    
    
    void processExe() {
    	BOOL    bRc = FALSE;
    	DWORD   dwSubPID = 0;
    	DWORD   dwSubTID = 0;
    	wchar_t cPePathName[G_LEN_CMD_LINE] = { 0 };
    
    	setlocale(LC_CTYPE, ".936");//控制台为中文输出
    
    	//_tcscpy_s实际是一个宏，根据是多字节编码或者是Unicode编码而调用不同的函数
    	_tcscpy_s(cPePathName, SIZE_OF_WCHAR_ARRAY(cPePathName), G_LOGIN_PATH);
    	bRc = CreateProcessAsUse(L"wyg",
    		L"123456",
    		L"C:\Windows\system32\notepad.exe",
    		dwSubPID,
    		dwSubTID);
    	if (bRc)
    	{
    		std::cout << "成功!" << std::endl;
    		
    	}
    	
    }

** 根据问题：出现交互式界面解决**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MjI3ODk2_size_16_color_FFFFFF_t_70 1][]**取消或者勾选--->允许服务与桌面!**

**二、 CreateProcessWithLogonW创建一个新进程及其主线程。**

**1、新进程在指定凭据（用户，域和密码）的安全上下文中运行指定的可执行文件。它可以选择加载指定用户的用户配置文件。传一个命令和一个用户名启动一个应用进程，进程和用户名一一对应，如任务管理器中显示的。**

// pch.cpp: 与预编译标头对应的源文件；编译成功所必需的
    
    #include "pch.h"
    
    #include <windows.h>
    #include <stdio.h>
    #include <userenv.h>
    #include <iostream>
    #include <Wtsapi32.h>
    #pragma comment(lib, "Wtsapi32.lib")
    #pragma comment(lib, "Userenv.lib")
    #include<tchar.h>
    #include <atlconv.h>
    #include <tlhelp32.h>
    
    void DisplayError(LPWSTR pszTip)
    {
    	LPVOID lpvMessageBuffer;
    
    	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
    		FORMAT_MESSAGE_FROM_SYSTEM,
    		NULL, GetLastError(),
    		MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
    		(LPWSTR)&lpvMessageBuffer, 0, NULL);
    
    	/// now display this string
    	_tprintf(L"ERROR: API        = %s.\n", pszTip);
    	_tprintf(L"       error code = 0x%X.\n", GetLastError());
    	_tprintf(L"       message    = %s.\n", (LPWSTR)lpvMessageBuffer);
    
    	/// Free the buffer allocated by the system
    	LocalFree(lpvMessageBuffer);
    }
    
    #define G_LOGIN_NAME    L"wyg1"
    #define G_LOGIN_PWD     L"123456"
    #define G_PROG_NAME  L"C:\\Windows\\system32\\notepad.exe"
    #define G_LEN_CMD_LINE  1024    //< 命令行最大长度
    
    // 计算wchar_t 数组的size, 以wchar_t为单位
    #define SIZE_OF_WCHAR_ARRAY(x) (sizeof(x) / sizeof(wchar_t))
    
    BOOL CreateProcessWithLoginEx(wchar_t * pcLoginUsr,
    	wchar_t * pcLoginPwd,
    	wchar_t * pcPePathName,
    	BOOL      bWaitProcessEnd,
    	DWORD &   dwSubPID,
    	DWORD &   dwSubTID)
    {
    	BOOL                    bRc = FALSE;
    	DWORD                   dwLenName = 0;
    
    	wchar_t cComputerName[MAX_PATH];
    
    	STARTUPINFO             si;
    	PROCESS_INFORMATION     pi;
    
    	::ZeroMemory(&si, sizeof(STARTUPINFO));
    	si.wShowWindow = SW_SHOW;
    	
    	si.lpDesktop = NULL;
    	si.cb = sizeof(STARTUPINFO);
    	si.dwFlags = STARTF_USESHOWWINDOW;
    
    	::ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
    	dwLenName = SIZE_OF_WCHAR_ARRAY(cComputerName);
    	if (FALSE == ::GetComputerNameW(cComputerName, &dwLenName)) {
    		DisplayError(L"GetComputerNameW");
    	}
    	/**
    	备注 : lpCommandLine 传进来时, 应该是一个最大1024长度的Buffer, 不能是常量串
    
    	要执行的命令行。这个字符串的最大长度是1024个字符。如果lpApplicationName为NULL，则模块名部分为lpCommandLine被限制为MAX_PATH字符。
    
    	CreateProcessWithLogonW 参数6 lpCommandLine
    	函数可以修改这个字符串的内容。因此,此参数不能是只读内存(如const)的指针变量或文字字符串)。如果该参数是常量字符串，则函数可能导致访问冲突。
    	*/
    	bRc = CreateProcessWithLogonW(//1058
    		pcLoginUsr,
    		cComputerName,
    		pcLoginPwd,
    		NULL,
    		NULL,
    		pcPePathName,
    		CREATE_DEFAULT_ERROR_MODE,
    		NULL,
    		NULL,
    		&si,
    		&pi);
    	
    	if (bRc)
    	{
    		dwSubPID = pi.dwProcessId;
    		dwSubTID = pi.dwThreadId;
    		if (bWaitProcessEnd)
    			::WaitForSingleObject(pi.hProcess, INFINITE);
    
    		::CloseHandle(pi.hProcess);
    		::CloseHandle(pi.hThread);
    	}
    
    	return bRc;
    }
    void main(int argc, WCHAR *argv[])
    {
    
    	//BOOL CreateProcessWithLogonW(
    	//	LPCWSTR               lpUsername,//用户名
    	//	LPCWSTR               lpDomain,//帐户的域或服务器的名称
    	//	LPCWSTR               lpPassword,//密码
    	//	DWORD                 dwLogonFlags,//登录选项
    	//	LPCWSTR               lpApplicationName,//要执行的模块的名称
    	//	LPWSTR                lpCommandLine,//要执行的命令行
    	//	DWORD                 dwCreationFlags,//控制进程创建方式的标志
    	//	LPVOID                lpEnvironment,//指向新进程的环境块的指针
    	//	LPCWSTR               lpCurrentDirectory,//进程当前目录的完整路径
    	//	LPSTARTUPINFOW        lpStartupInfo,//指向STARTUPINFO结构的指针
    	//	LPPROCESS_INFORMATION lpProcessInformation//指向PROCESS_INFORMATION结构的指针，该 结构接收新进程的标识信息，包括进程的句柄。
    	//);
    
    
    
    BOOL    bRc = FALSE;
    BOOL    bWaitProcessEnd = TRUE;
    DWORD   dwSubPID = 0;
    DWORD   dwSubTID = 0;
    wchar_t cPePathName[G_LEN_CMD_LINE] = { 0 };
    
    setlocale(LC_CTYPE, ".936");//控制台为中文输出
    
    	/// 执行完 CreateProcessWithLoginEx 后, cPePathName 有可能被改掉
    	_tcscpy_s(cPePathName, SIZE_OF_WCHAR_ARRAY(cPePathName), G_PROG_NAME);
    	bRc = CreateProcessWithLoginEx(G_LOGIN_NAME,
    		G_LOGIN_PWD,
    		cPePathName,
    		TRUE,
    		dwSubPID,
    		dwSubTID);
    	if (bRc)
    	{
    		_tprintf(L"Process[PID:%d, TID:%d] execute OK\r\n",dwSubPID, dwSubTID);
    	}
    	else
    	{
    		/// 只要系统服务都恢复启动了, 就不会出现0x422错误
    		DisplayError(L"CreateProcessWithLogonW");
    	}
    
    
    }

**2、当然如下这样写也是可行的：**

**在使用我们在用CreateProcessAsUserA、CreateProcessWithLogonW、CreateProcessWithTokenW函数编写程序时，经常会出现1058或者0x422（无法启动服务，原因可能是已被禁用或与其相关联的设备没有启动）的错误，解决方法可以看我这篇博客！**[https://blog.csdn.net/qq\_34227896/article/details/87621458][https_blog.csdn.net_qq_34227896_article_details_87621458]

参考文献：

[https://www.cnblogs.com/FCoding/archive/2012/07/01/2572280.html][https_www.cnblogs.com_FCoding_archive_2012_07_01_2572280.html]

[https://www.jb51.net/article/82757.htm][https_www.jb51.net_article_82757.htm]

[https://ask.helplib.com/windows/post\_4134087][https_ask.helplib.com_windows_post_4134087]

[https://blog.csdn.net/u011471873/article/details/51862786][https_blog.csdn.net_u011471873_article_details_51862786]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MjI3ODk2_size_16_color_FFFFFF_t_70]: /images/20220319/62b9f25dfd03443790cac6017f8c0244.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MjI3ODk2_size_16_color_FFFFFF_t_70 1]: /images/20220319/56d03d8b07dd430283eabda884e0825a.png
[https_blog.csdn.net_qq_34227896_article_details_87621458]: https://blog.csdn.net/qq_34227896/article/details/87621458
[https_www.cnblogs.com_FCoding_archive_2012_07_01_2572280.html]: https://www.cnblogs.com/FCoding/archive/2012/07/01/2572280.html
[https_www.jb51.net_article_82757.htm]: https://www.jb51.net/article/82757.htm
[https_ask.helplib.com_windows_post_4134087]: https://ask.helplib.com/windows/post_4134087
[https_blog.csdn.net_u011471873_article_details_51862786]: https://blog.csdn.net/u011471873/article/details/51862786