Create non-elevated process from elevated process,...?
in [Win32 Kernel]
|
From: Kerem Gümrükcü on 24 Feb 2010 03:42 Hi, i am looking for some way to execute some application of my chioce from an elevated process. This is )for sure) no problem, but the problem is that i want to execute the newly spawned process as a non elevated process without the elevated token rights of the same user. I already tried this by using this, but it is not a realiable solution since it depends on a running shell/explorer process. http://blogs.msdn.com/aaron_margosis/archive/2009/06/06/faq-how-do-i-start-a-program-as-the-desktop-user-from-an-elevated-app.aspx Does someone have a good idea, possibly not something with a second process runing non-elevated and expecting some signal or antother IPC data to spawn the non-elevated process, or like the example above duplicating the token from a process,... Thanks on advance,... K. -- ----------------------- Beste Gr�sse / Best regards / Votre bien devoue Kerem G�mr�kc� -----------------------
From: Stefan Kuhr on 24 Feb 2010 04:07 Hi Kerem, On 2/24/2010 9:42 AM, Kerem G�mr�kc� wrote: > Hi, > > i am looking for some way to execute some application > of my chioce from an elevated process. This is )for > sure) no problem, but the problem is that i want to > execute the newly spawned process as a non elevated > process without the elevated token rights of the same user. > I already tried this by using this, but it is not a realiable solution > since it depends on a running shell/explorer process. > > http://blogs.msdn.com/aaron_margosis/archive/2009/06/06/faq-how-do-i-start-a-program-as-the-desktop-user-from-an-elevated-app.aspx > > > Does someone have a good idea, possibly not > something with a second process runing non-elevated > and expecting some signal or antother IPC data to > spawn the non-elevated process, or like the example > above duplicating the token from a process,... > > Thanks on advance,... > > K. > I think the answer is given in the article you mentioned: Since you want the process to run under the same user account as the elevated process, but just run it without the elevation, then "launch the new process with that �dumbed down� token". Have you tried creating a restricted token from your elevated token and then use CreateProcessAsUser? I have never tried this but I assume this is the way to go. -- S
From: Leo Davidson on 24 Feb 2010 07:13 On Feb 24, 8:42 am, Kerem Gümrükcü <kareem...(a)hotmail.com> wrote: > I already tried this by using this, but it is not a realiable solution > since it depends on a running shell/explorer process. As an aside for others, the comments in the article you linked to have what looks like a better method of doing this, if you don't mind the requirement that the shell/explorer is running: http://brandonlive.com/2008/04/27/getting-the-shell-to-run-an-application-for-you-part-2-how/ It gets an interface to Explorer.exe, which should be running in the user's normal context, and asks Explorer to execute a command in its behalf. This is done just using simple, documented COM interfaces and without having to mess around with process tokens or code/DLL injection. I'm guessing you need this to work in environments where the shell might not be running, though... To do it without any dependency on the shell/explorer, I think you have to either manipulate the token yourself (not easy) or split your process into elevated and non-elevated halves, where the elevated side can ask the non-elevated side to launch things on its behalf. (You can use various IPC methods for that conversation.) Of course, you then have to run your non-elevated side somehow, but often that is easy. (e.g. If your app is being run from an non- elevated context and currently requesting elevation at startup, have it instead start the non-elevated part at startup and have that run the elevated part itself via a UAC prompt.) It's quite a shame there still isn't a proper API for creating the medium or low integrity level token given a higher one. This question keeps coming up and it's been a glaring hole in the UAC API since day one.
From: Goran on 24 Feb 2010 08:11 On Feb 24, 9:42 am, Kerem Gümrükcü <kareem...(a)hotmail.com> wrote: > Hi, > > i am looking for some way to execute some application > of my chioce from an elevated process. This is )for > sure) no problem, but the problem is that i want to > execute the newly spawned process as a non elevated > process without the elevated token rights of the same user. Perhaps something on the lines of OpenProcess/ThreadToken, then CreateRestrictedToken, then CreateProcessAsUser could work? Goran.
From: Kerem Gümrükcü on 24 Feb 2010 08:17
Hi Stefan, Hi Leo, yes, i need to do this even without any explorer process running, thats the point, unless that, it is no big match to run the code from the Shell Token,... Regards Kerem ----------------------- "Leo Davidson" <leonudeldavidson(a)googlemail.com> schrieb im Newsbeitrag news:4c6568a1-e1ca-4638-9a6e-78235c592cd5(a)v25g2000yqk.googlegroups.com... > On Feb 24, 8:42 am, Kerem G�mr�kc� <kareem...(a)hotmail.com> wrote: >> I already tried this by using this, but it is not a realiable solution >> since it depends on a running shell/explorer process. > > As an aside for others, the comments in the article you linked to have > what looks like a better method of doing this, if you don't mind the > requirement that the shell/explorer is running: > > http://brandonlive.com/2008/04/27/getting-the-shell-to-run-an-application-for-you-part-2-how/ > > It gets an interface to Explorer.exe, which should be running in the > user's normal context, and asks Explorer to execute a command in its > behalf. This is done just using simple, documented COM interfaces and > without having to mess around with process tokens or code/DLL > injection. > > I'm guessing you need this to work in environments where the shell > might not be running, though... > > To do it without any dependency on the shell/explorer, I think you > have to either manipulate the token yourself (not easy) or split your > process into elevated and non-elevated halves, where the elevated side > can ask the non-elevated side to launch things on its behalf. (You can > use various IPC methods for that conversation.) > > Of course, you then have to run your non-elevated side somehow, but > often that is easy. (e.g. If your app is being run from an non- > elevated context and currently requesting elevation at startup, have > it instead start the non-elevated part at startup and have that run > the elevated part itself via a UAC prompt.) > > It's quite a shame there still isn't a proper API for creating the > medium or low integrity level token given a higher one. This question > keeps coming up and it's been a glaring hole in the UAC API since day > one. |