How to call a function posing as another user instead of SYSTEM

Question

The Win32 API was launched in my DLL, which will be loaded by the SYSTEM user, and this API returns different results depending on the current user, so I can’t get the results corresponding to the current user, how can I call this API in the current user login context when a dll works in a SYSTEM context?

Answer 1

I did some research and did it (I'm not an expert on the Win32 API, but I'm really interested in this):

You can use ImpersonateLoggedOnUser , which requests a primary or impersonation token descriptor (with at least TOKEN_QUERY in both, TOKEN_DUPLICATE on the primary token, or TOKEN_IMPERSONATE on the impersonation token).

It would be very easy if you had the current login token and the correct privileges, you would just use ImpersonateLoggedOnUser , call the API function you want, and then call RevertToSelf to return to its original owner token.

But it is not so easy to get the user's current token. You must either use LogonUser username and password (which seems incorrect), or own a Windows service with sufficient privileges so that you can call WTSQueryUserToken , which may differ from what type of project you are developing.

Or, if you really want to do this using the normal process, you can also explore Authentication Features , where you can take advantage of the new UAC for Windows and security contexts that can be a little complicated to work with.

There is also this method, which I'm not sure if it works: Impersonate yourself as a standard user (getting a token using OpenProcessToken in explorer.exe ).

Some links that I found useful:

• MSDN - Impersonation Client (Windows)
• MSDN - Access Tokens (Windows)
• MSDN - LsaLogonUser Function (Windows)
• A simple example of an avatar program
• CodeProject - User Impersonation
• CodeProject - Vista UAC: The Ultimate Guide

I suggest: make sure that you really need to impersonate the user when calling the API function that you talked about before continuing. See if there is another way to accomplish what you want.

You can also specify which API function you are trying to use, which may redirect you to another simpler question.