aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/token.h
diff options
context:
space:
mode:
authorEgor Tensin <Egor.Tensin@gmail.com>2016-09-16 01:08:49 +0300
committerEgor Tensin <Egor.Tensin@gmail.com>2016-09-16 01:08:49 +0300
commit42f1ad36ef93c98542f9899ada57bd55396a99f5 (patch)
treed0b10dd617764271db739b608a9d6bfaa63d516b /token.h
parentmake the 'Elevate' button smaller (diff)
downloadprivilege-check-42f1ad36ef93c98542f9899ada57bd55396a99f5.tar.gz
privilege-check-42f1ad36ef93c98542f9899ada57bd55396a99f5.zip
.hpp instead of .h for C++ headers
Diffstat (limited to 'token.h')
-rw-r--r--token.h175
1 files changed, 0 insertions, 175 deletions
diff --git a/token.h b/token.h
deleted file mode 100644
index 66dac28..0000000
--- a/token.h
+++ /dev/null
@@ -1,175 +0,0 @@
-#pragma once
-
-#include "error.h"
-#include "handle.h"
-#include "os.h"
-#include "sid.h"
-
-#include <Windows.h>
-
-#include <string>
-#include <unordered_map>
-#include <utility>
-#include <vector>
-
-namespace token
-{
- namespace permissions
- {
- constexpr DWORD query() { return TOKEN_QUERY; }
-
- constexpr DWORD duplicate() { return TOKEN_DUPLICATE; }
- }
-
- constexpr DWORD default_permissions = permissions::query();
-
- // Current thread's primary impersonation token.
- Handle dumb() { return Handle{NULL}; }
-
- Handle open_for_process(
- const Handle& process,
- DWORD permissions = default_permissions)
- {
- HANDLE raw;
-
- if (!OpenProcessToken(process, permissions, &raw))
- error::raise("OpenProcessToken");
-
- return Handle{raw};
- }
-
- Handle open_for_current_process(
- DWORD permissions = default_permissions)
- {
- return open_for_process(Handle{GetCurrentProcess()}, permissions);
- }
-
- Handle get_linked(Handle&& token)
- {
- if (!os::is_vista_or_later())
- return std::move(token);
-
- auto type = TokenElevationTypeDefault;
- DWORD cb = 0;
-
- if (!GetTokenInformation(token, TokenElevationType, &type, sizeof(type), &cb))
- error::raise("GetTokenInformation");
-
- if (type != TokenElevationTypeLimited)
- return std::move(token);
-
- HANDLE raw;
-
- if (!GetTokenInformation(token, TokenLinkedToken, &raw, sizeof(raw), &cb))
- error::raise("GetTokenInformation");
-
- return Handle{raw};
- }
-
- Handle impersonate(const Handle& token)
- {
- HANDLE raw;
-
- if (!DuplicateToken(token, SecurityIdentification, &raw))
- error::raise("DuplicateToken");
-
- return Handle{raw};
- }
-
- //
- // FUNCTION: query_integrity_level()
- //
- // RETURN VALUE: Returns the integrity level of the current process. It is
- // usually one of these values:
- //
- // SECURITY_MANDATORY_UNTRUSTED_RID (SID: S-1-16-0x0)
- // Means untrusted level. It is used by processes started by the
- // Anonymous group. Blocks most write access.
- //
- // SECURITY_MANDATORY_LOW_RID (SID: S-1-16-0x1000)
- // Means low integrity level. It is used by Protected Mode Internet
- // Explorer. Blocks write acess to most objects (such as files and
- // registry keys) on the system.
- //
- // SECURITY_MANDATORY_MEDIUM_RID (SID: S-1-16-0x2000)
- // Means medium integrity level. It is used by normal applications
- // being launched while UAC is enabled.
- //
- // SECURITY_MANDATORY_HIGH_RID (SID: S-1-16-0x3000)
- // Means high integrity level. It is used by administrative applications
- // launched through elevation when UAC is enabled, or normal
- // applications if UAC is disabled and the user is an administrator.
- //
- // SECURITY_MANDATORY_SYSTEM_RID (SID: S-1-16-0x4000)
- // Means system integrity level. It is used by services and other
- // system-level applications (such as Wininit, Winlogon, Smss, etc.)
- //
- DWORD query_integrity_level(const Handle& token)
- {
- DWORD cb = 0;
-
- if (!GetTokenInformation(token, TokenIntegrityLevel, NULL, 0, &cb))
- {
- switch (GetLastError())
- {
- case ERROR_INSUFFICIENT_BUFFER:
- break;
- default:
- error::raise("GetTokenInformation");
- }
- }
-
- std::vector<unsigned char> buf(cb);
- const auto token_level = reinterpret_cast<TOKEN_MANDATORY_LABEL*>(buf.data());
-
- if (!GetTokenInformation(token, TokenIntegrityLevel, token_level, cb, &cb))
- error::raise("GetTokenInformation");
-
- // Integrity Level SIDs are in the form of S-1-16-0xXXXX. (e.g.
- // S-1-16-0x1000 stands for low integrity level SID). There is one and
- // only one subauthority.
- return *GetSidSubAuthority(token_level->Label.Sid, 0);
- }
-
- std::wstring integrity_level_to_string(DWORD level)
- {
- static const std::unordered_map<DWORD, const wchar_t*> names =
- {
- {SECURITY_MANDATORY_UNTRUSTED_RID, L"Untrusted"},
- {SECURITY_MANDATORY_LOW_RID, L"Low"},
- {SECURITY_MANDATORY_MEDIUM_RID, L"Medium"},
- {SECURITY_MANDATORY_HIGH_RID, L"High"},
- {SECURITY_MANDATORY_SYSTEM_RID, L"System"},
- };
-
- static constexpr auto unknown_name = L"Unknown";
-
- const auto it = names.find(level);
-
- if (it == names.cend())
- return unknown_name;
-
- return it->second;
- }
-
- bool belongs(const Handle& token, const SidBuffer& sid)
- {
- BOOL b = FALSE;
-
- if (!CheckTokenMembership(token, const_cast<unsigned char*>(sid.data()), &b))
- error::raise("CheckTokenMembership");
-
- return b != FALSE;
- }
-
- bool is_elevated(const Handle& token)
- {
- TOKEN_ELEVATION elevation;
- DWORD cb = 0;
-
- if (!GetTokenInformation(token, TokenElevation, &elevation, sizeof(elevation), &cb))
- error::raise("GetTokenInformation");
-
- return elevation.TokenIsElevated != 0;
- }
-}