在模拟时获取当前用户名

本文关键字：用户 获取 模拟 | 更新日期: 2023-09-27 18:10:13

我在代码中使用了下面的方法来模拟用户:

如何在。net中进行模拟?

在另一个类中，我需要找出当前用户(如"mydomain'moose")，但我不知道我当前是否在冒充另一个用户。

如果我冒充某人，我如何获得用户名?

System.Environment。UserName和system . security . principal . windowidentity . getcurrent()。名称都返回原始用户，而不是当前模拟的用户。

更多细节:

我这样做是为了能够访问网络共享中的一些文件，而用户通常无法访问这些文件。

如果我使用LOGON32_LOGON_INTERACTIVE的登录类型，我确实看到了新用户，但是我不能访问网络共享。如果使用LOGON32_LOGON_NEW_CREDENTIALS登录类型(值为9)，则可以访问网络共享，但在Environment.UserName.

在模拟时获取当前用户名

中看不到新用户。

首先，我想指出WindowsIdentity.GetCurrent().Name将返回的属性如果使用LOGON32_LOGON_NEW_CREDENTIALS或LOGON32_LOGON_INTERACTIVE作为LogonUser(在模拟类中)函数的登录类型:

  1. 使用LOGON32_LOGON_INTERACTIVE 

    // Assuming this code runs under USER_B
using (var imp = new Impersonation("treyresearch", "USER_A", "SecurePwd", LOGON32_LOGON_INTERACTIVE ))
{
  // Now, we run under USER_A
  Console.Out.WriteLine(WindowsIdentity.GetCurrent().Name); // Will return USER_A
}

  2. 使用LOGON32_LOGON_NEW_CREDENTIALS 

    // Assuming this codes runs under USER_B
using (var imp = new Impersonation("treyresearch", "USER_A", "SecurePwd", LOGON32_LOGON_NEW_CREDENTIALS ))
{
  Console.Out.WriteLine(WindowsIdentity.GetCurrent().Name); // Will return USER_B
}

这是您在问题中描述的行为，并且与MSDN上LogonUser函数的描述一致。对于LOGON32_LOGON_NEW_CREDENTIALS，创建的用户令牌只是当前用户令牌的克隆。这意味着创建的用户会话具有与调用线程相同的标识符。传递给LogonUser函数的凭据仅用于出站网络连接。

其次，让我指出LOGON32_LOGON_INTERACTIVE和LOGON32_LOGON_NEW_CREDENTIALS之间所描述的差异变得清晰的两种情况:

  • 两个域连接计算机:computer_A, computer_B
  • 两个用户:user_A(计算机a上的本地管理员)，user_B(计算机B上只有标准用户权限)
  • 在computer_B上有一个网络共享(mynetworkshare, user_B有访问共享的权限)。
  • 在computer_A上有一个本地文件夹(只有user_A有权限写这个文件夹)。

您在computer_A上运行程序(在user_A的帐户下)。您模拟user_B(使用LOGON32_LOGON_INTERACTIVE)。然后连接到computer_B上的网络共享，并尝试将一个文件复制到本地文件夹(只有user_A有向该文件夹写入的权限)。然后，您会得到一个访问被拒绝的错误消息，因为文件操作是在user_B的权限下完成的，而user_B对本地文件夹没有权限。

与上述情况相同。但是现在，我们使用LOGON32_LOGON_NEW_CREDENTIALS来模拟user_B。我们连接到网络驱动器，并从网络驱动器复制一个文件到本地文件夹。在本例中，操作成功，因为文件操作是在user_A的权限下完成的。

根据http://msdn.microsoft.com/en-us/library/chf6fbt4.aspx的示例，当前标识在模拟期间发生更改。您确定您的代码在模拟代码块内吗?

我写了一个助手类来做这件事:

public static class ImpersonationUtils
{
    private const int SW_SHOW = 5;
    private const int TOKEN_QUERY = 0x0008;
    private const int TOKEN_DUPLICATE = 0x0002;
    private const int TOKEN_ASSIGN_PRIMARY = 0x0001;
    private const int STARTF_USESHOWWINDOW = 0x00000001;
    private const int STARTF_FORCEONFEEDBACK = 0x00000040;
    private const int CREATE_UNICODE_ENVIRONMENT = 0x00000400;
    private const int TOKEN_IMPERSONATE = 0x0004;
    private const int TOKEN_QUERY_SOURCE = 0x0010;
    private const int TOKEN_ADJUST_PRIVILEGES = 0x0020;
    private const int TOKEN_ADJUST_GROUPS = 0x0040;
    private const int TOKEN_ADJUST_DEFAULT = 0x0080;
    private const int TOKEN_ADJUST_SESSIONID = 0x0100;
    private const int STANDARD_RIGHTS_REQUIRED = 0x000F0000;
    private const int TOKEN_ALL_ACCESS =
        STANDARD_RIGHTS_REQUIRED |
        TOKEN_ASSIGN_PRIMARY |
        TOKEN_DUPLICATE |
        TOKEN_IMPERSONATE |
        TOKEN_QUERY |
        TOKEN_QUERY_SOURCE |
        TOKEN_ADJUST_PRIVILEGES |
        TOKEN_ADJUST_GROUPS |
        TOKEN_ADJUST_DEFAULT |
        TOKEN_ADJUST_SESSIONID;
    [StructLayout(LayoutKind.Sequential)]
    private struct PROCESS_INFORMATION
    {
        public IntPtr hProcess;
        public IntPtr hThread;
        public int dwProcessId;
        public int dwThreadId;
    }
    [StructLayout(LayoutKind.Sequential)]
    private struct SECURITY_ATTRIBUTES
    {
        public int nLength;
        public IntPtr lpSecurityDescriptor;
        public bool bInheritHandle;
    }
    [StructLayout(LayoutKind.Sequential)]
    private struct STARTUPINFO
    {
        public int cb;
        public string lpReserved;
        public string lpDesktop;
        public string lpTitle;
        public int dwX;
        public int dwY;
        public int dwXSize;
        public int dwYSize;
        public int dwXCountChars;
        public int dwYCountChars;
        public int dwFillAttribute;
        public int dwFlags;
        public short wShowWindow;
        public short cbReserved2;
        public IntPtr lpReserved2;
        public IntPtr hStdInput;
        public IntPtr hStdOutput;
        public IntPtr hStdError;
    }
    private enum SECURITY_IMPERSONATION_LEVEL
    {
        SecurityAnonymous,
        SecurityIdentification,
        SecurityImpersonation,
        SecurityDelegation
    }
    private enum TOKEN_TYPE
    {
        TokenPrimary = 1,
        TokenImpersonation
    }
    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool CreateProcessAsUser(
        IntPtr hToken,
        string lpApplicationName,
        string lpCommandLine,
        ref SECURITY_ATTRIBUTES lpProcessAttributes,
        ref SECURITY_ATTRIBUTES lpThreadAttributes,
        bool bInheritHandles,
        int dwCreationFlags,
        IntPtr lpEnvironment,
        string lpCurrentDirectory,
        ref STARTUPINFO lpStartupInfo,
        out PROCESS_INFORMATION lpProcessInformation);
    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool DuplicateTokenEx(
        IntPtr hExistingToken,
        int dwDesiredAccess,
        ref SECURITY_ATTRIBUTES lpThreadAttributes,
        int ImpersonationLevel,
        int dwTokenType,
        ref IntPtr phNewToken);
    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool OpenProcessToken(
        IntPtr ProcessHandle,
        int DesiredAccess,
        ref IntPtr TokenHandle);
    [DllImport("userenv.dll", SetLastError = true)]
    private static extern bool CreateEnvironmentBlock(
            ref IntPtr lpEnvironment,
            IntPtr hToken,
            bool bInherit);
    [DllImport("userenv.dll", SetLastError = true)]
    private static extern bool DestroyEnvironmentBlock(
            IntPtr lpEnvironment);
    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool CloseHandle(
        IntPtr hObject);
    private static void LaunchProcessAsUser(string cmdLine, IntPtr token, IntPtr envBlock, int sessionId)
    {
        var pi = new PROCESS_INFORMATION();
        var saProcess = new SECURITY_ATTRIBUTES();
        var saThread = new SECURITY_ATTRIBUTES();
        saProcess.nLength = Marshal.SizeOf(saProcess);
        saThread.nLength = Marshal.SizeOf(saThread);
        var si = new STARTUPINFO();
        si.cb = Marshal.SizeOf(si);
        si.lpDesktop = @"WinSta0'Default";
        si.dwFlags = STARTF_USESHOWWINDOW | STARTF_FORCEONFEEDBACK;
        si.wShowWindow = SW_SHOW;
        if (!CreateProcessAsUser(
            token,
            null,
            cmdLine,
            ref saProcess,
            ref saThread,
            false,
            CREATE_UNICODE_ENVIRONMENT,
            envBlock,
            null,
            ref si,
            out pi))
        {
            throw new Win32Exception(Marshal.GetLastWin32Error(), "CreateProcessAsUser failed");
        }
    }
    private static IDisposable Impersonate(IntPtr token)
    {
        var identity = new WindowsIdentity(token);
        return identity.Impersonate();
    }
    private static IntPtr GetPrimaryToken(Process process)
    {
        var token = IntPtr.Zero;
        var primaryToken = IntPtr.Zero;
        if (OpenProcessToken(process.Handle, TOKEN_DUPLICATE, ref token))
        {
            var sa = new SECURITY_ATTRIBUTES();
            sa.nLength = Marshal.SizeOf(sa);
            if (!DuplicateTokenEx(
                token,
                TOKEN_ALL_ACCESS,
                ref sa,
                (int)SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation,
                (int)TOKEN_TYPE.TokenPrimary,
                ref primaryToken))
            {
                throw new Win32Exception(Marshal.GetLastWin32Error(), "DuplicateTokenEx failed");
            }
            CloseHandle(token);
        }
        else
        {
            throw new Win32Exception(Marshal.GetLastWin32Error(), "OpenProcessToken failed");
        }
        return primaryToken;
    }
    private static IntPtr GetEnvironmentBlock(IntPtr token)
    {
        var envBlock = IntPtr.Zero;
        if (!CreateEnvironmentBlock(ref envBlock, token, false))
        {
            throw new Win32Exception(Marshal.GetLastWin32Error(), "CreateEnvironmentBlock failed");
        }
        return envBlock;
    }
    public static void LaunchAsCurrentUser(string cmdLine)
    {
        var process = Process.GetProcessesByName("explorer").FirstOrDefault();
        if (process != null)
        {
            var token = GetPrimaryToken(process);
            if (token != IntPtr.Zero)
            {
                var envBlock = GetEnvironmentBlock(token);
                if (envBlock != IntPtr.Zero)
                {
                    LaunchProcessAsUser(cmdLine, token, envBlock, process.SessionId);
                    if (!DestroyEnvironmentBlock(envBlock))
                    {
                        throw new Win32Exception(Marshal.GetLastWin32Error(), "DestroyEnvironmentBlock failed");
                    }
                }
                CloseHandle(token);
            }
        }
    }
    public static IDisposable ImpersonateCurrentUser()
    {
        var process = Process.GetProcessesByName("explorer").FirstOrDefault();
        if (process != null)
        {
            var token = GetPrimaryToken(process);
            if (token != IntPtr.Zero)
            {
                return Impersonate(token);
            }
        }
        throw new Exception("Could not find explorer.exe");
    }
}

你可以这样使用:

ImpersonationUtils.LaunchAsCurrentUser("notepad");
using (ImpersonationUtils.ImpersonateCurrentUser())
{
}

更多的解释和例子可以在这里找到:

从SYSTEM中模拟CurrentUser

看看QueryCredentialsAttributes

相关文章：