如何在 windows xp 上将当前进程模拟为 SYSTEM？

Question

Process originaly runs as user (with admin privileges). In some point I want to rename file owned by user SYSTEM. So I need to impersonate my process as SYSTEM.

I have code that works correct on any windows later XP (and 2003):

[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
private static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool OpenProcessToken(IntPtr processHandle, uint desiredAccess, out IntPtr tokenHandle);

...

var systemProcessId = Process.GetProcessesByName("wininit").First().Id;
var handle = OpenProcess(ProcessAllAccess, false, systemProcessId);
private IntPtr _token;
OpenProcessToken(handle, (uint) TokenAccessLevels.MaximumAllowed, out _token)
WindowsIdentity.Impersonate(_token);

It doesn't work on Windows XP (and 2003). How can I get same result on XP and 2003?

Answer 1

I suppose you can try to do something like this:

var handle = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, false,
                        **smss.exe**);
if (handle.IsInvalid)
    throw new Exception("Can't open system process for access.");

if (!AdvApi32.OpenProcessToken(handle.DangerousGetHandle(),
        WRITE_DAC, out var token))
    throw new Exception($"OpenProcessToken failed, error code: {GetLastError()}");

if (!ConvertStringSecurityDescriptorToSecurityDescriptor("O:BAG:BAD:P(A;CIOI;GA;;;BA)", 1, out var pSd, out _))
    throw new Exception(
        $"ConvertStringSecurityDescriptorToSecurityDescriptor failed, error code: [{GetLastError()}]");

if (!SetKernelObjectSecurity(token.DangerousGetHandle(),
        DACL_SECURITY_INFORMATION, pSd))
    throw new Exception($"SetKernelObjectSecurity failed, error code: {GetLastError()}");
if (!token.IsInvalid && !token.IsClosed)
    token.Close();

if (!AdvApi32.OpenProcessToken(handle.DangerousGetHandle(),
        TOKEN_DUPLICATE,
        out token))
    throw new Exception($"OpenProcessToken failed, error code: {GetLastError()}");

if (!AdvApi32.DuplicateTokenEx(token,
        TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY,
        null,
        SecurityImpersonation,
        TokenPrimary,
        out var newToken))
    throw new Exception($"DuplicateTokenEx failed, error code: {GetLastError()}");
if (!token.IsInvalid && !token.IsClosed)
    token.Close();

WindowsIdentity.Impersonate(newToken.DangerousGetHandle());

I really, really think it's working code on Windows XP.