如何确定进程的特权是否存在并启用/禁用？

Question

假想

我想确定指定的进程是否启用了特定的特权。

为了简化这个问题，示例目标进程将是当前进程，我将检查关闭本地系统的权限(以前使用AdjustTokenPrivileges函数启用)。

然后，我发现PrivilegeCheck函数似乎可以确定指定的一组特权是否在目标进程的访问令牌中启用。

更新

我认为我把注意力放在了错误的方向上，因为似乎PrivilegeCheck函数需要模拟，所以现在我面临着另一个永无休止的尝试GetTokenInformation函数的阶段，这似乎是实现这一任务的合适函数。

问题

我遇到的问题是，当我尝试使用PrivilegeCheck函数时，它总是返回False (错误)，而特权的引用数组没有预期的值(因为函数失败)。

更新

使用一个-2147467259) False值，GetTokenInformation函数也会失败，返回以下win32错误代码：122 (HRESULT：和消息：

传递给系统调用的数据区域太小。

发问

我应该做些什么来修复我在代码中遇到的错误，以便能够检查一个进程的特权是否存在，然后，特权是启用还是禁用？

使用PrivilegeCheck或GetTokenInformation函数，或者仅仅使用任何其他可以确定特权状态的该死函数。

源代码

这是一个完整的可复制示例(连同下面的p/调用)，我将演示如何测试PrivilegeCheck和GetTokenInformation方法，两者都失败了。

Dim pHandle As IntPtr = Process.GetCurrentProcess().Handle
Dim privilegeName As String = "SeShutdownPrivilege"
Dim tokenAccess As TokenAccess = (TokenAccess.AdjustPrivileges Or TokenAccess.Query Or TokenAccess.Duplicate)
Dim hToken As IntPtr
Dim hTokenDup As IntPtr

Try
    ' ****************************************************************************
    ' 1st Step: Enable the "SeShutdownPrivilege" privilege in the current process.
    ' ****************************************************************************

    Dim win32Err As Integer

    ' Get the process token.
    NativeMethods.OpenProcessToken(pHandle, tokenAccess, hToken)

    ' Set up a LuidAndAttributes structure containing the privilege to enable,
    ' getting the LUID that corresponds to the privilege.
    Dim luAttr As New LuidAndAttributes
    luAttr.Attributes = TokenPrivilegeAttributes.PrivilegeEnabled
    NativeMethods.LookupPrivilegeValue(Nothing, privilegeName, luAttr.Luid)

    ' Set up a TokenPrivileges structure containing only the source privilege.
    Dim newState As New TokenPrivileges
    newState.PrivilegeCount = 1
    newState.Privileges = New LuidAndAttributes() {luAttr}

    ' Set up a TokenPrivileges structure for the previous (modified) privileges.
    Dim prevState As New TokenPrivileges
    prevState = New TokenPrivileges
    ReDim prevState.Privileges(CInt(newState.PrivilegeCount))

    ' Apply the TokenPrivileges structure to the source process token.
    Dim bufferLength As Integer = Marshal.SizeOf(prevState)
    Dim returnLength As IntPtr
    If Not NativeMethods.AdjustTokenPrivileges(hToken, False, newState, bufferLength, prevState, returnLength) Then
        win32Err = Marshal.GetLastWin32Error
        MessageBox.Show("AdjustTokenPrivileges failed.")
        Throw New Win32Exception(win32Err)
    End If

    ' *********************************************************************
    ' Everything OK at this point, 
    ' as AdjustTokenPrivileges dididn't failed, I assume the privilege Is enabled in the process.
    '
    ' 2n Step: Check whether the privilege is enabled or not...
    ' *********************************************************************

    ' Set up a new one LuidAndAttributes structure containing the privilege to check,
    ' getting the LUID that corresponds to the privilege.
    luAttr = New LuidAndAttributes
    NativeMethods.LookupPrivilegeValue(Nothing, privilegeName, luAttr.Luid)

    ' *********************************************************************
    ' Trying PrivilegeCheck and Duplicatetoken methodology...
    ' *********************************************************************

    NativeMethods.DuplicateToken(hToken, SecurityImpersonationLevel.SecurityImpersonation, hTokenDup)
    win32Err = Marshal.GetLastWin32Error

    If (hTokenDup <> IntPtr.Zero) Then
        Dim result As Boolean
        Dim pSet As New PrivilegeSet
        pSet.Control = 0
        pSet.PrivilegeCount = 1
        pSet.Privileges = New LuidAndAttributes() {luAttr}

        If Not NativeMethods.PrivilegeCheck(hToken, pSet, result) Then
            win32Err = Marshal.GetLastWin32Error
            MessageBox.Show("PrivilegeCheck using original access-token failed.")
            ' Ignore exception, to continue with the GetTokenInformation methodology.
            ' Throw New Win32Exception(win32Err)

        Else
            MessageBox.Show(String.Format("{0} (original token) state is: {1}",
                                              privilegeName, pSet.Privileges(0).Attributes.ToString()))

            If Not NativeMethods.PrivilegeCheck(hTokenDup, pSet, result) Then
                win32Err = Marshal.GetLastWin32Error
                MessageBox.Show("PrivilegeCheck using impersonated access-token failed.")
                ' Ignore exception, to continue with the GetTokenInformation methodology.
                ' Throw New Win32Exception(win32Err)
            Else
                MessageBox.Show(String.Format("{0} (impersonated token) state is: {1}",
                                              privilegeName, pSet.Privileges(0).Attributes.ToString()))

            End If

        End If

    Else
        MessageBox.Show("DuplicateToken failed.")
        ' Ignore exception, to continue with the GetTokenInformation methodology.
        ' Throw New Win32Exception(win32Err)

    End If

    ' *********************************************************************
    ' Trying GetTokenInformation methodology...
    ' *********************************************************************

    Dim tkp As New TokenPrivileges
    Dim tkpHandle As IntPtr
    Dim tkInfoLength As Integer = 0

    tkpHandle = Marshal.AllocHGlobal(Marshal.SizeOf(tkpHandle))
    Marshal.StructureToPtr(tkp, tkpHandle, False)

    NativeMethods.GetTokenInformation(hToken, TokenInformationClass.TokenPrivileges, IntPtr.Zero, tkInfoLength, tkInfoLength)
    win32Err = Marshal.GetLastWin32Error
    ' If I understood, It is supposed to return 122,
    ' so I should ignore that error code?:
    If (win32Err <> 122) Then 
        MessageBox.Show("GetTokenInformation failed in the attempt to get the TokenPrivileges's size.")
        Throw New Win32Exception(win32Err)

    Else
        If Not NativeMethods.GetTokenInformation(hToken, TokenInformationClass.TokenPrivileges, tkpHandle, tkInfoLength, tkInfoLength) Then
            win32Err = Marshal.GetLastWin32Error
            MessageBox.Show("GetTokenInformation failed in the attempt to get the TokenPrivileges.")
            Throw New Win32Exception(win32Err)

        Else
            Dim privilegeAttr As TokenPrivilegeAttributes = tkp.Privileges(0).Attributes
            MessageBox.Show(String.Format("{0} state is: {1}", privilegeName, privilegeAttr.ToString()))

        End If

    End If

Catch ex As Win32Exception
    MessageBox.Show(ex.NativeErrorCode & " " & ex.Message)

Catch ex As Exception
    MessageBox.Show(ex.Message)

Finally
    If (hTokenDup <> IntPtr.Zero) Then
        NativeMethods.CloseHandle(hTokenDup)
    End If

    If (hToken <> IntPtr.Zero) Then
        NativeMethods.CloseHandle(hToken)
    End If

End Try

这些是相关的winapi定义(请注意注释的MSDN urls以表示兴趣)：

' http://msdn.microsoft.com/en-us/library/windows/desktop/aa379295%28v=vs.85%29.aspx
<DllImport("advapi32.dll", SetLastError:=True)>
Public Shared Function OpenProcessToken(ByVal processHandle As IntPtr,
                                        ByVal desiredAccess As TokenAccess,
                                        ByRef tokenHandle As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function

' http://msdn.microsoft.com/en-us/library/windows/desktop/aa379180%28v=vs.85%29.aspx
<DllImport("Advapi32.dll", SetLastError:=True, CharSet:=CharSet.Auto, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Public Shared Function LookupPrivilegeValue(ByVal lpSystemName As String,
                                            ByVal lpName As String,
                                            ByRef lpLuid As Luid
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function

' http://msdn.microsoft.com/es-es/library/windows/desktop/aa375202%28v=vs.85%29.aspx
<DllImport("Advapi32.dll", SetLastError:=True)>
Public Shared Function AdjustTokenPrivileges(ByVal tokenHandle As IntPtr,
                                             ByVal disableAllPrivileges As Boolean,
                                             ByRef newState As TokenPrivileges,
                                             ByVal bufferLength As Integer,
                                             ByRef refPreviousState As TokenPrivileges,
                                             ByRef refReturnLength As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa379304%28v=vs.85%29.aspx
<DllImport("Advapi32.dll", SetLastError:=True)>
Public Shared Function PrivilegeCheck(ByVal token As IntPtr,
                          <[In], Out> ByRef privileges As PrivilegeSet,
                                      ByRef refResult As Boolean
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa446616%28v=vs.85%29.aspx
<DllImport("advapi32.dll", SetLastError:=True)>
Public Shared Function DuplicateToken(ByVal tokenHandle As IntPtr,
                                      ByVal impersonationLevel As SecurityImpersonationLevel,
                                      ByRef duplicateTokenHandle As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa446671%28v=vs.85%29.aspx
<DllImport("Advapi32.dll", SetLastError:=True)>
Public Shared Function GetTokenInformation(ByVal tokenHandle As IntPtr,
                                           ByVal tokenInformationClass As TokenInformationClass,
                                           ByVal tokenInformation As IntPtr,
                                           ByVal tokenInformationLength As Integer,
                                           ByRef refReturnLength As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function

' http://msdn.microsoft.com/en-us/library/windows/desktop/aa374905%28v=vs.85%29.aspx
<Flags>
Public Enum TokenAccess As UInteger
    ' THIS ENUMERATION IS PARTIALLY DEFINED.
    ' **************************************
    TokenAdjustPrivileges = &H20UI
    TokenQuery = &H8UI
End Enum

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa379630%28v=vs.85%29.aspx
<Flags>
Public Enum TokenPrivilegeAttributes As UInteger
    PrivilegeDisabled = &H0UI
    PrivilegeEnabledByDefault = &H1UI
    PrivilegeEnabled = &H2UI
    PrivilegeRemoved = &H4UI
    PrivilegeUsedForAccess = &H80000000UI
End Enum

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa379572(v=vs.85).aspx
Public Enum SecurityImpersonationLevel As Integer
    SecurityAnonymous = 0
    SecurityIdentification = 1
    SecurityImpersonation = 2
    SecurityDelegation = 3
End Enum

' http://msdn.microsoft.com/en-us/library/windows/desktop/aa379261%28v=vs.85%29.aspx
<StructLayout(LayoutKind.Sequential)>
Public Structure Luid
    Public LowPart As UInteger
    Public HighPart As Integer
End Structure

' http://msdn.microsoft.com/en-us/library/windows/desktop/aa379263%28v=vs.85%29.aspx
<StructLayout(LayoutKind.Sequential)>
Public Structure LuidAndAttributes
    Public Luid As Luid
    Public Attributes As TokenPrivilegeAttributes
End Structure

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa379630%28v=vs.85%29.aspx
<StructLayout(LayoutKind.Sequential)>
Public Structure TokenPrivileges
    Public PrivilegeCount As UInteger

    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)>
    Public Privileges As LuidAndAttributes()
End Structure

' https://msdn.microsoft.com/en-us/library/windows/desktop/aa379307%28v=vs.85%29.aspx
<StructLayout(LayoutKind.Sequential)>
Public Structure PrivilegeSet
    Public PrivilegeCount As UInteger
    Public Control As UInteger

    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)>
    Public Privileges As LuidAndAttributes()
End Structure

Answer 1

我现在上传了我用来测试答案的全部代码，以防其他人需要一个有用的例子。尤其是样板不完美(也不是故意的)，请不要对我进行评判。见此粘贴：http://pastebin.com/gdxwWHRb

您正在错误地使用非托管内存块tkpHandle和结构tkp。另外，您只是检查GetTokenInformation (tkp.Privileges(0))返回的第一个特权的属性--相反，您必须检查所有属性并找到正确的特权。

如果我这样修改您的代码，它会对我有效：

' *********************************************************************
' Trying GetTokenInformation methodology...
' *********************************************************************

Dim tkp As New TokenPrivileges
Dim tkpHandle As IntPtr = IntPtr.Zero ' <<< will be set later
Dim tkInfoLength As Integer = 0

' Here we call GetTokenInformation the first time to receive the length of the data it would like to store.
NativeMethods.GetTokenInformation(hToken, TokenInformationClass.TokenPrivileges, IntPtr.Zero, tkInfoLength, tkInfoLength)
win32Err = Marshal.GetLastWin32Error

' Since the "current" length we pass is 0, we'll always get "error" 122, which is fine. We also get the required length returned.
If (win32Err <> 122) Then
    MessageBox.Show("GetTokenInformation failed in the attempt to get the TokenPrivileges's size.")
    Throw New Win32Exception(win32Err)
Else
    Try
        ' Here we allocate memory for receiving the actual data. By now, tkInfoLength contains the size of the memory block we need to allocate.
        tkpHandle = Marshal.AllocHGlobal(tkInfoLength)

        ' This time, we shouldn't get an error 122, because this time we already have set the correct buffer size. GetTokenInformation should now write the data into the memory block we just allocated.
        If Not NativeMethods.GetTokenInformation(hToken, TokenInformationClass.TokenPrivileges, tkpHandle, tkInfoLength, tkInfoLength) Then
            win32Err = Marshal.GetLastWin32Error
            MessageBox.Show("GetTokenInformation failed in the attempt to get the TokenPrivileges.")
            Throw New Win32Exception(win32Err)

        Else
            ' We will now ask PtrToStructure to read the raw data out of the memory block and convert it to a managed structure of type TokenPrivileges which we can use in our code. That's it!
            tkp = Marshal.PtrToStructure(tkpHandle, GetType(TokenPrivileges))

            ' We have to iterate over all privileges listed in the TokenPrivileges structure to find the one we are looking for
            Dim found As Boolean = False
            For i As Integer = 0 To tkp.PrivilegeCount - 1
                ' There is a problem: Marshal.PtrToStructure can't marshal variable-length structures, but the array TokenPrivileges::Privileges has
                ' a variable length determined by the value of TokenPrivileges::PrivilegeCount! Since we don't know the size at compile time, the
                ' size of the array was hardcoded to 1, which means that we would only be able to access the first element of the array.
                ' To work around this, we calculate the raw memory offset pointing to the array element we need and load it separately into a
                ' LuidAndAttributes variable.
                ' The way this works is: The contents of the TokenPrivilege structure or stored in memory one after another, like this:
                '   PrivilegeCount (type: UInteger)
                '   Privileges(0) (type: LuidAndAttributes)
                '   Privileges(1) (type: LuidAndAttributes) << these and all further we normally can't access
                '   Privileges(2) (type: LuidAndAttributes)
                ' ...and so on.
                ' We are now calculating the offset into the structure for a specific array element. Let's use Privileges(2) as example:
                ' To get to it, we need to take the pointer to the beginning of the structure and add the sizes of all previous elements,
                ' which would be once the size of PrivilegeCount and then 2 times the size of a LuidAndAttributes structure.
                Dim directPointer As New IntPtr(tkpHandle.ToInt64() + Len(tkp.PrivilegeCount) + i * Marshal.SizeOf(GetType(LuidAndAttributes)))
                Dim luidAndAttributes As LuidAndAttributes = Marshal.PtrToStructure(directPointer, GetType(LuidAndAttributes))

                ' Get the privilege name. We first call LookupPrivilegeName with a zero size to get the real size we need, then reserve space, then get the actual data
                ' NOTE: The part below isn't actually necessary as commented Mark Hurd pointed out, because you already have the right privilege's LUID in luAttr.Luid.
                ' But I'll leave it here anyway in case somebody uses this piece of code without the part which sets the privilege.
                ' Another solution in this case would also be to run LookupPrivilegeValue to get the LUID to compare to (which is what led to luAttr.Luid as well).
                Dim privNameLen As Integer = 0
                Dim sb As New System.Text.StringBuilder()
                NativeMethods.LookupPrivilegeName(Nothing, luidAndAttributes.Luid, sb, privNameLen)
                sb.EnsureCapacity(privNameLen + 1)
                If Not NativeMethods.LookupPrivilegeName(Nothing, luidAndAttributes.Luid, sb, privNameLen) Then
                    win32Err = Marshal.GetLastWin32Error
                    MessageBox.Show("LookupPrivilegeName failed.")
                    Throw New Win32Exception(win32Err)
                End If

                ' Now that we have the name, we can check if it's the one we are looking for.
                ' NOTE: Refering to me comments above, this could be just: If luidAndAttributes.Luid = luAttr.Luid
                If sb.ToString() = privilegeName Then
                    ' Found! So we can finally get the status of the privilege!
                    found = True
                    MessageBox.Show(String.Format("{0} state is: {1}", privilegeName, luidAndAttributes.Attributes.ToString()))
                    Exit For
                End If
            Next

            If Not found Then MessageBox.Show(String.Format("{0} not found in list of privileges!", privilegeName))
        End If
    Finally
        ' Make sure the memory block is freed again (even when an error occured)
        If tkpHandle Then Marshal.FreeHGlobal(tkpHandle)
    End Try

End If

请看我在代码中的评论。基本上，流程是：

• 使用空指针和零大小调用GetTokenInformation，以接收实际需要的缓冲区大小(因此这里的错误122是正常的)。
• 根据我们收到的缓冲区大小分配内存。
• 再次调用GetTokenInformation，使用指向内存块的真实指针和实际大小来接收实际数据。
• 使用.NET (而不是Marshal.PtrToStructure )将原始数据转换为Marshal.StructureToPtr结构。
• 找到正确的特权并检查其状态。这有点棘手，见下面我的解释。
• 释放内存块。(我添加了一个Try/Finally块，以确保内存不会泄漏。)

这里还有另一个棘手的部分，就是如何找到正确的特权来签入GetTokenInformation返回的特权列表

• Marshal.PtrToStructure不能像在TokenInformation结构中那样封送可变长度数组。为了能够在代码中的第一个元素之后访问元素，我们必须玩一些技巧，做指针算法来计算这些数组元素的内存偏移量，然后对每个数组元素分别使用Marshal.PtrToStructure。有关详细信息，请参阅代码中的我的评论。
• 为了知道哪种特权是哪种特权，我们需要使用LookupPrivilegeName，它基本上与LookupPrivilegeValue相反。请再次注意，我们首先用零长度调用它以获得实际长度，然后保留空间，然后再调用它。-注意事项：正如我在自己的EDIT2中所写的，如果您正在寻找特定的特权，这实际上并不是必要的。您只需要使用LookupPrivilegeValue获得正确的LUID，然后将LUID与已知的LUID进行比较。在前面的代码中已经这样做了(在luAttr.Luid中)。请阅读我在代码中的其他评论！

我像这样导入了LookupPrivilegeName：

<DllImport("Advapi32.dll", SetLastError:=True, CharSet:=CharSet.Auto, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Public Shared Function LookupPrivilegeName(lpSystemName As String, ByRef lpLuid As Luid, lpName As System.Text.StringBuilder, ByRef cchName As Integer) As <MarshalAs(UnmanagedType.Bool)> Boolean

现在，代码成功地为我运行，并显示了一个消息框：

SeShutdownPrivilege状态是: PrivilegeEnabled

编辑：我忽略了一个问题，即tkp.Privileges(0).Attributes是硬编码的，而不是循环所有特权以找到正确的特权。我在回答中加入了正确的解决方案。

EDIT2：正确地说，作为评论马克赫德指出，实际上不需要每次调用LookupPrivilegeName。在这个问题的原始代码中，特权的LUID已经被知道了，因为它是在前面使用LookupPrivilegeValue查找的。但无论如何，我将在代码中保留名称查找，以防有人需要枚举其他启用的特权--我只是添加了有关它的注释。