15,467
社区成员
发帖
与我相关
我的任务
分享BOOL RunRemoteControl()
{
HANDLE hToken;
HDESK hdesk;
HWINSTA hwinsta;
PROCESS_INFORMATION pi;
STARTUPINFO si;
//HANDLE hExp = GetProcessHandle(L"EXPLORER.EXE");
HANDLE hExp = CToolFunction::GetProcessHandle(L"Winlogon.exe");
while (hExp == NULL)
{
hExp = CToolFunction::GetProcessHandle(L"Winlogon.exe");
Sleep(100);
}
OpenProcessToken(hExp, TOKEN_ALL_ACCESS, &hToken);
if(hToken == NULL)
{
return FALSE;
}
HWND hDesk = GetDesktopWindow();
// BOOL bOk = ImpersonateLoggedOnUser(hToken);
// GenericLog(Info,"ImpersonateLoggedOnUser %s",bOk?"Ok":"Failed");
//GenericLog(Info,"Desktop HWND %s",(hDesk == GetDesktopWindow())?"Equal":"Not Equal");
// obtain a handle to the interactive windowstation
hwinsta = OpenWindowStation( _T("winsta0"), FALSE, READ_CONTROL|WRITE_DAC );
if (hwinsta == NULL)
{
return FALSE;
}
HWINSTA hwinstaold = GetProcessWindowStation();
if (!SetProcessWindowStation(hwinsta))
{
return FALSE;
}
// obtain a handle to the "default" desktop
hdesk = OpenDesktop(
_T("Winlogon"),
0,
FALSE,
READ_CONTROL | WRITE_DAC |
DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS
);
if (hdesk == NULL)
{
return FALSE;
}
// close the handles to the interactive windowstation and desktop
CloseWindowStation(hwinsta);
CloseDesktop(hdesk);
ZeroMemory(&si, sizeof(STARTUPINFO));
si.cb = sizeof(STARTUPINFO);
si.lpDesktop = _T("winsta0\\Winlogon");
TCHAR szParameter[10] = {0};
if(CreateProcessAsUser(hToken, CToolFunction::oGetCurPath()+_T("\\Server.exe"), szParameter, NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi))
{
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
SetProcessWindowStation(hwinstaold);
return TRUE;
}