从管理员帐户模拟 SYSTEM（或同等帐户）
这个问题是关于我当前正在处理的权限问题的这个问题的后续和延续。
问题摘要：
我正在域管理员帐户下运行一个程序，该帐户没有调试程序 (SeDebugPrivilege) 权限，但我需要在本地计算机上使用它。
克鲁吉解决方案：
该程序可以将自身安装为本地计算机上的服务，并启动该服务。该服务现在在 SYSTEM 帐户下运行，这使我们能够使用 SeTCBPrivilege 权限来创建一个具有 SeDebugPrivilege 的新访问令牌。然后，我们可以使用新创建的令牌以提升的权限重新启动初始程序。
我个人不喜欢这个解决方案。我认为应该可以获得作为管理员的必要权限，而无需进行系统修改，例如安装服务（即使只是临时的）。
我希望有一个解决方案可以最大限度地减少系统修改，并且最好可以即时完成（即：不需要重新启动本身）。我尝试将 LogonUser 作为 SYSTEM 尝试使用 LogonUser 失败，并尝试在已知的 SYSTEM 进程（例如 csrss.exe）上使用 OpenProcessToken （失败是因为如果没有我试图获取的权限，您无法使用 PROCESS_QUERY_INFORMATION 来 OpenProcess 来获取进程的句柄）。
我只是无能为力，试图想出一个替代解决方案来解决这个问题。我希望有一种简单的方法可以在主机上获取特权令牌并为该程序模拟它，但我还没有找到方法。
如果有人知道解决这个问题的方法，或者甚至对可能有效的事情有建议，请告诉我。我真的很感谢您的帮助，谢谢！
This question is a follow up and continuation of this question about a Privilege problem I'm dealing with currently.
Problem Summary:
I'm running a program under a Domain Administrator account that does not have Debug programs (SeDebugPrivilege) privilege, but I need it on the local machine.
Klugey Solution:
The program can install itself as a service on the local machine, and start the service. Said service now runs under the SYSTEM account, which enables us to use our SeTCBPrivilege privilege to create a new access token which does have SeDebugPrivilege. We can then use the newly created token to re-launch the initial program with the elevated rights.
I personally do not like this solution. I feel it should be possible to acquire the necessary privileges as an Administrator without having to make system modifications such as installing a service (even if it is only temporary).
I am hoping that there is a solution that minimizes system modifications and can preferably be done on the fly (ie: Not require restarting itself). I have unsuccessfully tried to LogonUser as SYSTEM and tried to OpenProcessToken on a known SYSTEM process (such as csrss.exe) (which fails, because you cannot OpenProcess with PROCESS_QUERY_INFORMATION to get a handle to the process without the privileges I'm trying to acquire).
I'm just at my wit's end trying to come up with an alternative solution to this problem. I was hoping there was an easy way to grab a privileged token on the host machine and impersonate it for this program, but I haven't found a way.
If anyone knows of a way around this, or even has suggestions on things that might work, please let me know. I really appreciate the help, thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
根据设计，不允许任何进程获得 NT AUTHORITY\SYSTEM 权限，除非该进程是由具有 NT AUTHORITY\SYSTEM 权限的另一个进程启动的。该服务是一种解决方法，因为服务控制管理器本身是在系统启动时由内核启动的。
不幸的是，操作系统的设计目的就是阻止您想要做的事情。如果您希望之后能够删除服务，只需向相关用户授予本地计算机的 SeDebugPrivilege，然后让服务自行卸载即可。
更好的是，让要修改内存的程序更改 DACL，以允许管理员在没有 SeDebugPrivilege 的情况下访问其内存。那么你根本不需要享有特权。
EDIT2：更好的是，首先使用共享内存。这就是它的用途。
By design, no process is allowed to achieve NT AUTHORITY\SYSTEM rights, unless it is started by another process with NT AUTHORITY\SYSTEM rights. The service is a workaround because the Service Control Manager itself is started by the Kernel at system start.
Unfortunately, the operating system is designed to prevent exactly what you're trying to do. If you want to be able to remove your service afterwards, simply grant the user in question SeDebugPrivilege for the local machine and then have the service uninstall itself.
Better yet, have the program whose memory is to be modified change DACLs to allow your administrator access to it's memory without SeDebugPrivilege. Then you don't need to take privilege at all.
EDIT2: And even better yet, just use shared memory in the first place. That's what it's for.