//http://www.raysoftware.cn/?

p=292
unit LowIntergrityLevelProcess;
interface
uses
//WinApi.Windows;
Windows,variants;
const
SECURITY_MANDATORY_UNTRUSTED_RID = $00000000;
SECURITY_MANDATORY_LOW_RID = $00001000;
SECURITY_MANDATORY_MEDIUM_RID = $00002000;
SECURITY_MANDATORY_HIGH_RID = $00003000;
SECURITY_MANDATORY_SYSTEM_RID = $00004000;
SECURITY_MANDATORY_PROTECTED_PROCESS_RID = $00005000;
type
PTokenMandatoryLabel = ^TTokenMandatoryLabel;
TTokenMandatoryLabel = packed record
Label_ : TSidAndAttributes;
end;
type
//Extend existing enumeration in Windows.pas with new Vista constants
TTokenInformationClass = (TokenICPad, TokenUser, TokenGroups, TokenPrivileges, T
okenOwner, TokenPrimaryGroup, TokenDefaultDacl, TokenSource, TokenType, TokenImp
ersonationLevel, TokenStatistics, TokenRestrictedSids, TokenSessionId, TokenGrou
psAndPrivileges, TokenSessionReference, TokenSandBoxInert, TokenAuditPolicy, Tok
enOrigin, TokenElevationType, TokenLinkedToken, TokenElevation, TokenHasRestrict
ions, TokenAccessInformation, TokenVirtualizationAllowed, TokenVirtualizationEna
bled, TokenIntegrityLevel, TokenUIAccess, TokenMandatoryPolicy, TokenLogonSid);
function CreateLowIntegrityProcess(const ExeName: string;
const Params: string = ''; TimeOut: DWORD = 0): HResult;
function GetIntegrityLevel(): DWORD;
implementation
function GetIntegrityLevel() : DWORD;
var hProcess, hToken : THandle;
pTIL : PTokenMandatoryLabel;
dwReturnLength: DWORD;
dwTokenUserLength: DWORD;
psaCount : PUCHAR;
SubAuthority : DWORD;
begin
Result := 0;
dwReturnLength := 0;
dwTokenUserLength := 0;
pTIL := nil;
hProcess := GetCurrentProcess();
OpenProcessToken(hProcess, TOKEN_QUERY or TOKEN_QUERY_SOURCE, hToken);
if hToken = 0 then Exit;
if not GetTokenInformation(hToken, Windows.TTokenInformationClass(TokenIntegr
ityLevel),
pTIL, dwTokenUserLength, dwReturnLength) the
n
begin
if GetLastError = ERROR_INSUFFICIENT_BUFFER then
Begin
pTIL := Pointer(LocalAlloc(0, dwReturnLength));
if pTIL = nil then Exit;
dwTokenUserLength := dwReturnLength;
dwReturnLength := 0;
if GetTokenInformation(hToken, Windows.TTokenInformationClass(TokenInteg
rityLevel),
pTIL, dwTokenUserLength, dwReturnLength) and
IsValidSid( (pTIL.Label_).Sid ) then
begin
psaCount := GetSidSubAuthorityCount((pTIL.Label_).Sid );
SubAuthority := psaCount^;
SubAuthority := SubAuthority - 1;
Result := GetSidSubAuthority((pTIL.Label_).Sid, SubAuthority)^;
end;
LocalFree(Cardinal(pTIL));
End;
end;
CloseHandle(hToken);
end;
const
userenvlib = 'userenv.dll';
function CreateEnvironmentBlock(lpEnvironment: PPointer; hToken: THandle;
bInherit: BOOL): BOOL; stdcall; external userenvlib;
function DestroyEnvironmentBlock(lpEnvironment: Pointer): BOOL; stdcall;
external userenvlib;
function CreateLowIntegrityProcess(const ExeName, Params: string;
TimeOut: DWORD): HResult;
type
_TOKEN_MANDATORY_LABEL = Record
Label_: SID_AND_ATTRIBUTES;
End;
TOKEN_MANDATORY_LABEL = _TOKEN_MANDATORY_LABEL;
PTOKEN_MANDATORY_LABEL = ^TOKEN_MANDATORY_LABEL;
const
SECURITY_MANDATORY_LABEL_AUTHORITY: TSidIdentifierAuthority =
(Value: (0, 0, 0, 0, 0, 16));
SE_GROUP_INTEGRITY = $00000020;
SE_GROUP_INTEGRITY_ENABLED = $00000040;
var
hToken, hNewToken: THandle;
MLAuthority: SID_IDENTIFIER_AUTHORITY;
pIntegritySid: PSID;
tml: TOKEN_MANDATORY_LABEL;
si: TStartupInfo;
pi: PROCESS_INFORMATION;
pszCommandLine: string;
dwCreationFlag: DWORD;
pEnvironment: LPVOID;
begin
Result := ERROR_SUCCESS;
pszCommandLine := ExeName + Params;
hToken := 0;
hNewToken := 0;
MLAuthority := SECURITY_MANDATORY_LABEL_AUTHORITY;
pIntegritySid := nil;
FillChar(tml, sizeof(tml), 0);
FillChar(si, sizeof(si), 0);
FillChar(pi, sizeof(pi), 0);
si.cb := sizeof(si);
si.lpDesktop := 'Winsta0\Default';
dwCreationFlag := NORMAL_PRIORITY_CLASS or CREATE_NEW_CONSOLE;
pEnvironment := nil;
try
// ?????????
if (not OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE or
TOKEN_QUERY or TOKEN_ADJUST_DEFAULT or TOKEN_ASSIGN_PRIMARY, hToken)) then
begin
Result := GetLastError();
Exit;
end;
// ????
if (not DuplicateTokenEx(hToken, 0, nil, SecurityImpersonation,
TokenPrimary, hNewToken)) then
begin
Result := GetLastError();
Exit;
end;
// ????????SID
if (not AllocateAndInitializeSid(MLAuthority, 1, SECURITY_MANDATORY_LOW_RID,
0, 0, 0, 0, 0, 0, 0, pIntegritySid)) then
begin
Result := GetLastError();
Exit;
end;
tml.Label_.Attributes := SE_GROUP_INTEGRITY;
tml.Label_.Sid := pIntegritySid;
// ???????SID???
if (not SetTokenInformation(hNewToken, TokenIntegrityLevel, @tml,
(sizeof(tml) + GetLengthSid(pIntegritySid)))) then
begin
Result := GetLastError();
Exit;
end;
// ????????
if (CreateEnvironmentBlock(@pEnvironment, hToken, FALSE)) then
dwCreationFlag := dwCreationFlag or CREATE_UNICODE_ENVIRONMENT
else
pEnvironment := nil;
// ??????????
if (not CreateProcessAsUser(hNewToken, nil, PChar(pszCommandLine), nil, nil,
FALSE, dwCreationFlag, pEnvironment, nil, si, pi)) then
begin
Result := GetLastError();
Exit;
end;
WaitForSingleObject(pi.hProcess, TimeOut);
finally
// ????
if pEnvironment <> nil then
begin
DestroyEnvironmentBlock(pEnvironment);
pEnvironment := nil;
end;
if (hToken <> 0) then
begin
CloseHandle(hToken);
hToken := 0;
end;
if (hNewToken <> 0) then
begin
CloseHandle(hNewToken);
hNewToken := 0;
end;
if (pIntegritySid <> nil) then
begin
FreeSid(pIntegritySid);
pIntegritySid := nil;
end;
if (pi.hProcess <> 0) then
begin
CloseHandle(pi.hProcess);
pi.hProcess := 0;
end;
if (pi.hThread <> 0) then
begin
CloseHandle(pi.hThread);
pi.hThread := 0;
end;
if (ERROR_SUCCESS <> Result) then
begin
SetLastError(Result);
end
else
begin
Result := ERROR_SUCCESS;
end;
end;
end;
end.