From bc22e2dd25072a1982ffc216615c7ba91d956317 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Sat, 3 Aug 2019 08:45:56 +0000 Subject: [PATCH] GetCurrentProcessToken() is Win8+, so open our own token Signed-off-by: Jason A. Donenfeld --- installer/rundll32.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/installer/rundll32.c b/installer/rundll32.c index 3a482f1..cc1a6d2 100644 --- a/installer/rundll32.c +++ b/installer/rundll32.c @@ -35,7 +35,7 @@ ConsoleLogger(_In_ LOGGER_LEVEL Level, _In_ const TCHAR *LogLine) static BOOL ElevateToSystem(VOID) { - HANDLE ThreadToken, ProcessSnapshot, WinlogonProcess, WinlogonToken, DuplicatedToken; + HANDLE CurrentProcessToken, ThreadToken, ProcessSnapshot, WinlogonProcess, WinlogonToken, DuplicatedToken; PROCESSENTRY32 ProcessEntry = { .dwSize = sizeof(PROCESSENTRY32) }; BOOL Ret; DWORD LastError = ERROR_SUCCESS; @@ -50,8 +50,13 @@ static BOOL ElevateToSystem(VOID) TOKEN_USER MaybeLocalSystem; CHAR LargeEnoughForLocalSystem[0x400]; } TokenUserBuffer; - if (!GetTokenInformation( - GetCurrentProcessToken(), TokenUser, &TokenUserBuffer, sizeof(TokenUserBuffer), &RequiredBytes)) + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &CurrentProcessToken)) + goto cleanup; + Ret = + GetTokenInformation(CurrentProcessToken, TokenUser, &TokenUserBuffer, sizeof(TokenUserBuffer), &RequiredBytes); + LastError = GetLastError(); + CloseHandle(CurrentProcessToken); + if (!Ret) goto cleanup; if (EqualSid(TokenUserBuffer.MaybeLocalSystem.User.Sid, LocalSystemSid)) return TRUE; @@ -116,7 +121,12 @@ RunAsAdministrator(HWND hwnd, TCHAR *Verb, int nCmdShow) { TOKEN_ELEVATION Elevation; DWORD Required; - if (!GetTokenInformation(GetCurrentProcessToken(), TokenElevation, &Elevation, sizeof(Elevation), &Required)) + HANDLE CurrentProcessToken; + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &CurrentProcessToken)) + return; + BOOL Ret = GetTokenInformation(CurrentProcessToken, TokenElevation, &Elevation, sizeof(Elevation), &Required); + CloseHandle(CurrentProcessToken); + if (!Ret) return; if (Elevation.TokenIsElevated) return; @@ -155,6 +165,6 @@ VOID __stdcall InstallWintun(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int VOID __stdcall UninstallWintun(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) { - RunAsAdministrator(hwnd, TEXT(__FUNCTION__) , nCmdShow); + RunAsAdministrator(hwnd, TEXT(__FUNCTION__), nCmdShow); Do(FALSE, !!nCmdShow); } \ No newline at end of file