用于网络模拟的 LogonUser 替代方案 (C++)
除了 LogonUser 之外，还有其他方法可以模拟给定帐户来访问网络资源吗？ 我正在寻找一种模拟方法，它可以让我连接到外部域中的计算机（或者相同情况下的工作组计算机）。
对于初始数据，我有：机器名称、用户名（或域\用户名）、明文密码。
我知道有一种方法可以使用 WNetAddConnection 与 \\machinename\ipc$ 建立连接，然后大多数网络功能将在该帐户的上下文中运行，但是 win2008 添加了另一个转折，某些功能仍然使用该帐户，该线程在该帐户下运行。
我还知道，有一些方法可以使用 SSPI 获取模拟令牌。 有人尝试过这些令牌吗？它们是否适合访问共享、SCM、远程注册表等？ WNetAddConnection 正在使用什么？
编辑：澄清一下，我无法使用 LogonUser 的原因是因为我需要模拟不受信任的域或工作组中的用户
编辑2：另一个澄清：我正在使用的项目尝试实现类似于psexec，例如：
- 程序不应修改主机或活动目录配置（例如：创建临时本地用户等）。 此外，不能假设它是否在 DC 上运行，不能
- 假设远程主机上预安装了哪些软件，唯一给出的条件是在目标上启用了 Windows 文件共享
- 已知帐户/密码是在目标上工作，但目标机器可能位于本地域、外部域，甚至根本不在域中。
EDIT3：我真的很想了解更多有关 SSPI InitializeSecurityContext / AcquireCredentialsHandle 选项的信息。 有人广泛使用过这个 API 吗？ 是否可以使用模拟返回的令牌，以便线程可以访问网络共享和复制文件等？ 有人可以发布工作代码片段吗？
EDIT4：感谢 Marsh Ray，问题得到了解决。 如果有人想查看概念验证代码，就在这里
Are there any alternatives to LogonUser and for impersonating given account in order to access network resources? I'm looking for the method of impersonation which would let me connect to machine in foreign domains (or, workgroup machines for the same matter).
For initial data I have: machine name, username (or domain\username), cleartext password.
I know there's a way to establish connection using WNetAddConnection to a \\machinename\ipc$, then most network functions will run in a context of that account, however win2008 added another twist and some functions still use the account, that thread is running under.
I'm also aware, that there's some way to get an impersonation token using SSPI. Have anyone experimented with those tokens, are they good for accessing shares, SCM, remote registry and stuff? Is is what WNetAddConnection is using?
EDIT: To clarify, the reason I cannot use LogonUser is because I need to impersonate user in a non-trusted domain or workgroup
EDIT2: Another clarification: the item I'm trying to implement is similar to psexec, e.g.:
- program should not modify host or active directory configuration (e.g.: create temporary local users, etc). Moreover assumption cannot be made that it is running on DC or not
- there can be no assumptions made about which software is pre-installed on the remote host, only condition given is that windows file sharing is enabled on target
- Account/password is known to be working on target, but target machine may be in local domain, foreign domain, not in domain at all.
EDIT3: I would really love to hear more about SSPI InitializeSecurityContext / AcquireCredentialsHandle option. Is there anybody who has been working with this API extensively? Is it possible to use the tokens returned with impersonation, so that a thread can access network shares and copy files, etc? Can someone post a working code snippet?
EDIT4: Thanks to Marsh Ray, problem got resolved. If anyone is looking to see the proof-of-concept code, it is here
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可以打开命令行，使用明文用户名和密码映射驱动器。 然后断开驱动器连接：
http://technet.microsoft。 com/en-us/library/cc756153(WS.10).aspx
You could open a command line, map the drive using the plaintext username and password. Then disconnect the drive:
http://technet.microsoft.com/en-us/library/cc756153(WS.10).aspx
通过 Windows API 直接可靠地完成此操作似乎几乎是不可能的，而且 Windows 在幕后做了很多工作才能使网络访问“正常工作”。 另外，模拟方面仅适用于调用 API 的单个线程。
但是...您可以在不同的用户下运行整个程序...例如当您运行服务时。
因此，您可以编辑主程序中的注册表，以在不同的安全令牌下运行各种服务，并使用 IPC/Sockets 与主应用程序中的这些进程进行通信。 IE。 一大堆（或重新启动并重新配置同一进程）在主应用程序滥用的不同用户下运行的辅助进程。
我意识到这是一个黑客，但它似乎可行；）
Doing this directly and reliably via the Windows API seems next to impossible, plus Windows does so much work behind the scenes to make network access "just work". Plus the impersonation side of things only works for the single thread that called the APIs.
But... you can run a whole program under a different user... such as when you run a service.
So you could edit the registry in your main program to run various services under different security tokens and use IPC/Sockets to communicate with those processes from your main application. ie. a whole bunch (or restarting and reconfiguring the same process) of helper processes running under the different user(s) which your main app abuses.
I realize this is a hack but it seems viable ;)
理论上，您将凭据作为
传递SEC_WINNT_AUTH_IDENTITY结构到 AcquireCredentialsHandle 函数，用于创建 InitializeSecurityContext< 中使用的句柄/a>. 我从来没有在国外域名上尝试过这个，我不知道它是否有效。The theory goes that you pass the credentials as a
SEC_WINNT_AUTH_IDENTITYstructure to the AcquireCredentialsHandle function that creates the handle used in InitializeSecurityContext. I never tried this on foreign domains though and I don't know if it works.如果您想要“访问林外的网络资源”，请使用您提到的 WNetAddConnection2/3 来实现，或者使用带有 RPC_ C__ AUTHN__ GSS__ NEGOTIATE 和显式凭据结构的标准 RPC API。
通常，“模拟”是发生在服务器端的事情。 服务器端将能够模拟连接作为您连接的帐户。
但关键是：模拟只有在模拟服务器可以在其本地 SAM/domain/forest 目录中访问的帐户时才有意义。 如果客户端和服务器位于不同的森林中，那么它们显然无法就模拟令牌的帐户 SID 达成一致（除了像 Administrator 这样的知名 SID 的情况，它们主要用于混淆此类事情），并且这似乎有必要检查 DACL 等。
也许您想要的是使用 LOGON32__ LOGON__ NEW__ CREDENTIALS 标志调用 LogonUserEx。 这应该会成功（即使在不同的森林中 - 它实际上不会验证您提供的凭据），为您提供带有您指定的用户名/密码的令牌。 您可能必须使用 DuplicateToken 将其转换为模拟令牌。 然后您可以使用 SetThreadToken 替换线程上的令牌。
恕我直言，这并不是真正的“模拟”，您只是直接使用凭据，但它允许您以您提供的任意用户名/密码透明地访问网络资源。
编辑：哦，是的，请注意，在这种类型的连接上没有针对中间人的保护。 客户端尤其无法对服务器进行严格的身份验证（缺乏像 IPSEC 这样的英雄行为），因此理论上您不能相信服务器告诉您的任何内容。
If you're wanting to "access network resources" outside of your forest, do that with WNetAddConnection2/3 as you mentioned, or use the standard RPC APIs with RPC_ C__ AUTHN__ GSS__ NEGOTIATE and and explicit credentials structure.
Normally, "impersonation" is something that happens on the server side. The server side will be able to impersonate the connection as the account you're connecting as.
But the key is this: impersonation only makes sense for impersonating an account the server can access in his local SAM/domain/forest directory. If the client and server are in different forests, they clearly can't agree on the SID of an account for an impersonation token (except for the case of well-known SIDs like Administrator which serve mainly to confuse this kind of thing), and that seems necessary to check against DACLs etc.
Perhaps what you want is to call LogonUserEx with the LOGON32__ LOGON__ NEW__ CREDENTIALS flag. This should succeed (even in a different forest - it doesn't actually authenticate the credentials you give it) giving you a token with the username/password you specified. You may have to use DuplicateToken to turn this into an impersonation token. Then you can use SetThreadToken to replace the token on your thread.
IMHO this isn't really "impersonation", you're just using the credentials outright, but it allows you to access network resources transparently as the arbitrary username/password you supply.
Edit: Oh yeah, be aware that there is no protection against man-in-the-middle on this type of connection. The client especially cannot strongly authenticate the server (short of heroics like IPSEC), so in theory you can't trust anything the server tells you.