管理员组获取系统权限的完美解决方案

  // Compute the size of the new ACL.
  dwNewAclSize = aclSizeInfo.AclBytesInUse + (2*sizeof(ACCESS_ALLOWED_ACE)) + (2*GetLengthSid(psid)) - (2*sizeof(DWORD));
  // Allocate memory for the new ACL.
  pNewAcl = (PACL)HeapAlloc(
  GetProcessHeap(),
  HEAP_ZERO_MEMORY,
  dwNewAclSize);
  if (pNewAcl == NULL)
  __leave;
  // Initialize the new DACL.
  if (!InitializeAcl(pNewAcl, dwNewAclSize, ACL_REVISION))
  __leave;
  // If DACL is present, copy it to a new DACL.
  if (bDaclPresent)
  {
  // Copy the ACEs to the new ACL.
  if (aclSizeInfo.AceCount)
  {
  for (i=0; i < aclSizeInfo.AceCount; i++)
  {
  // Get an ACE.
  if (!GetAce(pacl, i, &pTempAce))
  __leave;
  // Add the ACE to the new ACL.
  if (!AddAce(
  pNewAcl,
  ACL_REVISION,
  MAXDWORD,
  pTempAce,
  ((PACE_HEADER)pTempAce)->AceSize)
  )
  __leave;
  }
  }
  }
  // Add the first ACE to the window station.
  pace = (ACCESS_ALLOWED_ACE *)HeapAlloc(
  GetProcessHeap(),
  HEAP_ZERO_MEMORY,
  sizeof(ACCESS_ALLOWED_ACE) + GetLengthSid(psid) -
  sizeof(DWORD));
  if (pace == NULL)
  __leave;
  pace->Header.AceType  = ACCESS_ALLOWED_ACE_TYPE;
  pace->Header.AceFlags = CONTAINER_INHERIT_ACE |
  INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE;
  pace->Header.AceSize  = sizeof(ACCESS_ALLOWED_ACE) +
  GetLengthSid(psid) - sizeof(DWORD);
  pace->Mask            = GENERIC_ACCESS;
  if (!CopySid(GetLengthSid(psid), &pace->SidStart, psid))
  __leave;
  if (!AddAce(
  pNewAcl,
  ACL_REVISION,
  MAXDWORD,
  (LPVOID)pace,
  pace->Header.AceSize)
  )
  __leave;
  // Add the second ACE to the window station.
  pace->Header.AceFlags = NO_PROPAGATE_INHERIT_ACE;
  pace->Mask            = WINSTA_ALL;
  if (!AddAce(
  pNewAcl,
  ACL_REVISION,
  MAXDWORD,
  (LPVOID)pace,
  pace->Header.AceSize)
  )
  __leave;
  // Set a new DACL for the security descriptor.
  if (!SetSecurityDescriptorDacl(
  psdNew,
  TRUE,
  pNewAcl,
  FALSE)
  )
  __leave;
  // Set the new security descriptor for the window station.
  if (!SetUserObjectSecurity(hwinsta, &si, psdNew))
  __leave;
  // Indicate success.
  bSuccess = TRUE;
  }
  __finally
  {
  // Free the allocated buffers.
  if (pace != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)pace);
  if (pNewAcl != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)pNewAcl);
  if (psd != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)psd);
  if (psdNew != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)psdNew);
  }
  return bSuccess;
  }
  BOOL AddAceToDesktop(HDESK hdesk, PSID psid)
  {
  ACL_SIZE_INFORMATION aclSizeInfo;
  BOOL                 bDaclExist;
  BOOL                 bDaclPresent;
  BOOL                 bSuccess = FALSE;
  DWORD                dwNewAclSize;
  DWORD                dwSidSize = 0;
  DWORD                dwSdSizeNeeded;
  PACL                 pacl;
  PACL                 pNewAcl;
  PSECURITY_DESCRIPTOR psd = NULL;
  PSECURITY_DESCRIPTOR psdNew = NULL;
  PVOID                pTempAce;
  SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
  unsigned int         i;
  __try
  {
  // Obtain the security descriptor for the desktop object.
  if (!GetUserObjectSecurity(
  hdesk,
  &si,
  psd,
  dwSidSize,
  &dwSdSizeNeeded))
  {
  if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
  {
  psd = (PSECURITY_DESCRIPTOR)HeapAlloc(
  GetProcessHeap(),
  HEAP_ZERO_MEMORY,
  dwSdSizeNeeded );
  if (psd == NULL)
  __leave;
  psdNew = (PSECURITY_DESCRIPTOR)HeapAlloc(
  GetProcessHeap(),
  HEAP_ZERO_MEMORY,
  dwSdSizeNeeded);
  if (psdNew == NULL)
  __leave;
  dwSidSize = dwSdSizeNeeded;
  if (!GetUserObjectSecurity(
  hdesk,
  &si,
  psd,
  dwSidSize,
  &dwSdSizeNeeded)
  )
  __leave;
  }
  else
  __leave;
  }
  // Create a new security descriptor.
  if (!InitializeSecurityDescriptor(
  psdNew,
  SECURITY_DESCRIPTOR_REVISION)
  )
  __leave;
  // Obtain the DACL from the security descriptor.
  if (!GetSecurityDescriptorDacl(
  psd,
  &bDaclPresent,
  &pacl,
  &bDaclExist)
  )
  __leave;
  // Initialize.
  ZeroMemory(&aclSizeInfo, sizeof(ACL_SIZE_INFORMATION));
  aclSizeInfo.AclBytesInUse = sizeof(ACL);
  // Call only if NULL DACL.
  if (pacl != NULL)
  {
  // Determine the size of the ACL information.
  if (!GetAclInformation(
  pacl,
  (LPVOID)&aclSizeInfo,
  sizeof(ACL_SIZE_INFORMATION),
  AclSizeInformation)
  )
  __leave;
  }
  // Compute the size of the new ACL.
  dwNewAclSize = aclSizeInfo.AclBytesInUse +
  sizeof(ACCESS_ALLOWED_ACE) +
  GetLengthSid(psid) - sizeof(DWORD);
  // Allocate buffer for the new ACL.
  pNewAcl = (PACL)HeapAlloc(
  GetProcessHeap(),
  HEAP_ZERO_MEMORY,
  dwNewAclSize);
  if (pNewAcl == NULL)
  __leave;
  // Initialize the new ACL.
  if (!InitializeAcl(pNewAcl, dwNewAclSize, ACL_REVISION))
  __leave;
  // If DACL is present, copy it to a new DACL.
  if (bDaclPresent)
  {
  // Copy the ACEs to the new ACL.
  if (aclSizeInfo.AceCount)
  {
  for (i=0; i < aclSizeInfo.AceCount; i++)
  {
  // Get an ACE.
  if (!GetAce(pacl, i, &pTempAce))
  __leave;
  // Add the ACE to the new ACL.
  if (!AddAce(
  pNewAcl,
  ACL_REVISION,
  MAXDWORD,
  pTempAce,
  ((PACE_HEADER)pTempAce)->AceSize)
  )
  __leave;
  }
  }
  }
  // Add ACE to the DACL.
  if (!AddAccessAllowedAce(
  pNewAcl,
  ACL_REVISION,
  DESKTOP_ALL,
  psid)
  )
  __leave;
  // Set new DACL to the new security descriptor.
  if (!SetSecurityDescriptorDacl(
  psdNew,
  TRUE,
  pNewAcl,
  FALSE)
  )
  __leave;
  // Set the new security descriptor for the desktop object.
  if (!SetUserObjectSecurity(hdesk, &si, psdNew))
  __leave;
  // Indicate success.
  bSuccess = TRUE;
  }
  __finally
  {
  // Free buffers.
  if (pNewAcl != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)pNewAcl);
  if (psd != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)psd);
  if (psdNew != NULL)
  HeapFree(GetProcessHeap(), 0, (LPVOID)psdNew);
  }
  return bSuccess;
  }
  int main(int argc, char **argv)
  {
  HANDLE hToken = NULL;
  EnablePrivilege(SE_DEBUG_NAME);
  hToken = GetLSAToken();
  StartInteractiveClientProcess(NULL, NULL, NULL, argc==2?argv[1]:"regedit", hToken);
  return 0;
  }
  上面这两种要领都能很好的完全功能,但是建议用第二种,固然代码看上去有点长,但是很稳定.
  代码又长又乱,其中肯定有错误之处,还请大家告之.谢过先... ;-)
 

文章作者: 福州军威计算机技术有限公司
军威网络是福州最专业的电脑维修公司,专业承接福州电脑维修、上门维修、IT外包、企业电脑包年维护、局域网网络布线、网吧承包等相关维修服务。
版权声明：原创作品，允许转载，转载时请务必以超链接形式标明文章原始出处 、作者信息和声明。否则将追究法律责任。

TAG:

评论加载中... 内容： 评论者： 验证码：