我用LookupAccountSid(NULL,pTokenUser->User.Sid,szUserName,&dwNameSize,szDomain,&dwDomainSize,&SNU);
(就是进程管理器显示的User Name)
能获取本机管理员用户名字也能获取System用户名字,但是NETWORK SERVICE和LOCAL SERVICE却不能获取,检查得出访问权限不够
贴出我的提升权限函数:
BOOL CALLBACK EnablePrivilege(LPCTSTR lpszPrivilegeName,BOOL bEnable)
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;
if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES ¦
TOKEN_QUERY ¦ TOKEN_READ,&hToken))
return FALSE;
if(!LookupPrivilegeValue(NULL, lpszPrivilegeName, &luid))
return TRUE;
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = (bEnable) ? SE_PRIVILEGE_ENABLED : 0;
AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL);
CloseHandle(hToken);
return (GetLastError() == ERROR_SUCCESS);
}
获取进程用户函数:
LPCTSTR GetProcessUserName(DWORD dwID) // 进程ID
{
HANDLE hProcess=OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,dwID);
if( hProcess==NULL )
return NULL;
HANDLE hToken =NULL;
BOOL bResult =FALSE;
DWORD dwSize =0;
static TCHAR szUserName[256]={0};
TCHAR szDomain[256]={0};
DWORD dwDomainSize=256;
DWORD dwNameSize=256;
SID_NAME_USE SNU;
PTOKEN_USER pTokenUser=NULL;
__try
{
if( !OpenProcessToken(hProcess,TOKEN_QUERY,&hToken) )
{
bResult = FALSE;
__leave;
}
if( !GetTokenInformation(hToken,TokenUser,pTokenUser,dwSize,&dwSize) )
{
if( GetLastError() != ERROR_INSUFFICIENT_BUFFER )
{
bResult = FALSE ;
__leave;
}
}
pTokenUser = NULL;
pTokenUser = (PTOKEN_USER)malloc(dwSize);
if( pTokenUser == NULL )
{
bResult = FALSE;
__leave;
}
if( !GetTokenInformation(hToken,TokenUser,pTokenUser,dwSize,&dwSize) )
{
bResult = FALSE;
__leave;
}
if( LookupAccountSid(NULL,pTokenUser->User.Sid,szUserName,&dwNameSize,szDomain,&dwDomainSize,&SNU) != 0 )
{
return szUserName;
}
}
__finally
{
if( pTokenUser!=NULL )
free(pTokenUser);
}
return NULL;
}
怎么样提升权限才能获取到另外的用户名?
|