1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
#pragma once
#include "error.hpp"
#include "handle.hpp"
#include "os.hpp"
#include "sid.hpp"
#include <Windows.h>
#include <string>
#include <unordered_map>
#include <utility>
#include <vector>
namespace token
{
namespace permissions
{
constexpr DWORD query() { return TOKEN_QUERY; }
constexpr DWORD duplicate() { return TOKEN_DUPLICATE; }
}
constexpr DWORD default_permissions = permissions::query();
// Current thread's primary impersonation token.
Handle dumb() { return Handle{NULL}; }
Handle open_for_process(
const Handle& process,
DWORD permissions = default_permissions)
{
HANDLE raw;
if (!OpenProcessToken(process, permissions, &raw))
error::raise("OpenProcessToken");
return Handle{raw};
}
Handle open_for_current_process(
DWORD permissions = default_permissions)
{
return open_for_process(Handle{GetCurrentProcess()}, permissions);
}
bool get_linked(Handle& token)
{
if (!os::is_vista_or_later())
return false;
auto type = TokenElevationTypeDefault;
DWORD cb = 0;
if (!GetTokenInformation(token, TokenElevationType, &type, sizeof(type), &cb))
error::raise("GetTokenInformation");
if (type != TokenElevationTypeLimited)
return false;
HANDLE raw;
if (!GetTokenInformation(token, TokenLinkedToken, &raw, sizeof(raw), &cb))
error::raise("GetTokenInformation");
token = Handle{raw};
return true;
}
Handle get_for_identification(const Handle& token)
{
HANDLE raw;
if (!DuplicateToken(token, SecurityIdentification, &raw))
error::raise("DuplicateToken");
return Handle{raw};
}
//
// FUNCTION: query_integrity_level()
//
// RETURN VALUE: Returns the integrity level of the current process. It is
// usually one of these values:
//
// SECURITY_MANDATORY_UNTRUSTED_RID (SID: S-1-16-0x0)
// Means untrusted level. It is used by processes started by the
// Anonymous group. Blocks most write access.
//
// SECURITY_MANDATORY_LOW_RID (SID: S-1-16-0x1000)
// Means low integrity level. It is used by Protected Mode Internet
// Explorer. Blocks write acess to most objects (such as files and
// registry keys) on the system.
//
// SECURITY_MANDATORY_MEDIUM_RID (SID: S-1-16-0x2000)
// Means medium integrity level. It is used by normal applications
// being launched while UAC is enabled.
//
// SECURITY_MANDATORY_HIGH_RID (SID: S-1-16-0x3000)
// Means high integrity level. It is used by administrative applications
// launched through elevation when UAC is enabled, or normal
// applications if UAC is disabled and the user is an administrator.
//
// SECURITY_MANDATORY_SYSTEM_RID (SID: S-1-16-0x4000)
// Means system integrity level. It is used by services and other
// system-level applications (such as Wininit, Winlogon, Smss, etc.)
//
DWORD query_integrity_level(const Handle& token)
{
DWORD cb = 0;
if (!GetTokenInformation(token, TokenIntegrityLevel, NULL, 0, &cb))
{
switch (GetLastError())
{
case ERROR_INSUFFICIENT_BUFFER:
break;
default:
error::raise("GetTokenInformation");
}
}
std::vector<unsigned char> buf(cb);
const auto token_level = reinterpret_cast<TOKEN_MANDATORY_LABEL*>(buf.data());
if (!GetTokenInformation(token, TokenIntegrityLevel, token_level, cb, &cb))
error::raise("GetTokenInformation");
// Integrity Level SIDs are in the form of S-1-16-0xXXXX. (e.g.
// S-1-16-0x1000 stands for low integrity level SID). There is one and
// only one subauthority.
return *GetSidSubAuthority(token_level->Label.Sid, 0);
}
std::wstring integrity_level_to_string(DWORD level)
{
static const std::unordered_map<DWORD, const wchar_t*> names =
{
{SECURITY_MANDATORY_UNTRUSTED_RID, L"Untrusted"},
{SECURITY_MANDATORY_LOW_RID, L"Low"},
{SECURITY_MANDATORY_MEDIUM_RID, L"Medium"},
{SECURITY_MANDATORY_HIGH_RID, L"High"},
{SECURITY_MANDATORY_SYSTEM_RID, L"System"},
};
static constexpr auto unknown_name = L"Unknown";
const auto it = names.find(level);
if (it == names.cend())
return unknown_name;
return it->second;
}
bool check_belongs(const Handle& token, const SidBuffer& sid)
{
BOOL b = FALSE;
if (!CheckTokenMembership(token, const_cast<unsigned char*>(sid.data()), &b))
error::raise("CheckTokenMembership");
return b != FALSE;
}
bool query_elevation(const Handle& token)
{
TOKEN_ELEVATION elevation;
DWORD cb = 0;
if (!GetTokenInformation(token, TokenElevation, &elevation, sizeof(elevation), &cb))
error::raise("GetTokenInformation");
return elevation.TokenIsElevated != 0;
}
}
|
