티스토리 뷰

개발/윈도우

프로세스 실행 권한을 알아 봅시다.

-=HaeJuK=- 2018. 1. 30. 15:46
728x90

프로세스 실행 권한을 알아봅시다.

Windows OS에서 실행되는 Process의 Integrity Level을 체크해 봅시다.

Integrity Level이란?
https://msdn.microsoft.com/en-us/library/bb625957.aspx

 

구현

* Windows SDK 8.1 설치 및 사용 유무에 따라 코딩이 다릅니다. 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
#include "stdafx.h" 
#include <windows.h> 
#include <Tlhelp32.h> 
#include <process.h> 
#define WIN81SDK 0 
#ifndef WIN81SDK 
    typedef struct _TOKEN_MANDATORY_LABEL 
    { 
        SID_AND_ATTRIBUTES Label; 
    } TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL; 
    
    #define ECURITY_MANDATORY_UNTRUSTED_RID 0x00000000 
    #define SECURITY_MANDATORY_LOW_RID 0x00001000 
    #define SECURITY_MANDATORY_MEDIUM_RID 0x00002000 
    #define SECURITY_MANDATORY_MEDIUM_PLUS_RID SECURITY_MANDATORY_MEDIUM_RID + 0x100 
    #define SECURITY_MANDATORY_HIGH_RID 0X00003000 
    #define SECURITY_MANDATORY_SYSTEM_RID 0x00004000
    #define SECURITY_MANDATORY_PROTECTED_PROCESS_RID 0x00005000 
    #define TokenIsAppContainer (TOKEN_INFORMATION_CLASS)29
    #define TokenIntegrityLevel (TOKEN_INFORMATION_CLASS)25 
#endif    
 
BOOL SetPrivilege(LPCTSTR lpszPrivilege)
{
    TOKEN_PRIVILEGES TokenPrivileges;
    TOKEN_PRIVILEGES PreviousTokenPrivileges;
    LUID luid;
    HANDLE hToken = NULL;
    DWORD dwPreviousTokenPrivilegesSize = sizeof(TOKEN_PRIVILEGES);
 
    if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) 
    {
        return FALSE;
    }
 
    if(!LookupPrivilegeValue(NULL, lpszPrivilege, &luid))
    {
        return FALSE;
    }
 
    TokenPrivileges.PrivilegeCount = 1;
    TokenPrivileges.Privileges[0].Luid = luid;
    TokenPrivileges.Privileges[0].Attributes = 0;
 
    if(ERROR_NOT_ALL_ASSIGNED == AdjustTokenPrivileges(hToken, 
                                    FALSE, 
                                    &TokenPrivileges, 
                                    sizeof(TOKEN_PRIVILEGES), 
                                    &PreviousTokenPrivileges, 
                                    &dwPreviousTokenPrivilegesSize)) 
    {
        return FALSE;
    }
 
    PreviousTokenPrivileges.PrivilegeCount = 1;
    PreviousTokenPrivileges.Privileges[0].Luid = luid;
    PreviousTokenPrivileges.Privileges[0].Attributes |= SE_PRIVILEGE_ENABLED;
 
    if(ERROR_NOT_ALL_ASSIGNED == AdjustTokenPrivileges(hToken, 
                                    FALSE, 
                                    &PreviousTokenPrivileges, 
                                    dwPreviousTokenPrivilegesSize, NULL, NULL))
    {
        return FALSE;
    }
 
    if( NULL != hToken )
    {
        ::CloseHandle(hToken);
    }
    return TRUE;
}
 
void ShowProcessIntegrityLevel(TCHAR* szProccessName, HANDLE hProcess, DWORD dwProcessId)
{
    HANDLE hToken = NULL;
    DWORD dwLengthNeeded = 0x00;
    DWORD dwError = ERROR_SUCCESS;
    PTOKEN_MANDATORY_LABEL pTIL = NULL;
    DWORD dwIntegrityLevel = 0x00;
 
    if ( FALSE == OpenProcessToken(hProcess, TOKEN_QUERY, &hToken)) 
    {
        return;
    }
 
    // Get the Integrity level.
    if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLengthNeeded))
    {
        dwError = GetLastError();
        if (dwError == ERROR_INSUFFICIENT_BUFFER)
        {
            pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0,dwLengthNeeded);
            if (pTIL != NULL)
            {
                if( GetTokenInformation(hToken, 
                                TokenIntegrityLevel, 
                                pTIL, 
                                dwLengthNeeded, 
                                &dwLengthNeeded))
                {
                    dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, 
                                            (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid)-1));
            
                    if(dwIntegrityLevel < SECURITY_MANDATORY_LOW_RID)
                    {
                        wprintf(L"[%d][%s][%x]  Error \n",dwProcessId,szProccessName,dwIntegrityLevel);
                    }
                    else if (dwIntegrityLevel == SECURITY_MANDATORY_LOW_RID)
                    {
                        // Low Integrity        
                        DWORD dwAppContainer = 0;
                        DWORD dwDummy = 0;
 
                        if (::GetTokenInformation(hToken, 
                                    TokenIsAppContainer, 
                                    &dwAppContainer, 
                                    sizeof(dwAppContainer), 
                                    &dwDummy))
                        {
                            if( dwAppContainer == 1 )
                            {
                                wprintf(L"[%d][%s]    This Process AppContanier \r\n",dwProcessId,szProccessName);
                            }
                            else
                            {
                                wprintf(L"[%d][%s]    Low Process \r\n",dwProcessId,szProccessName);
                            }
                        }
                    }
                    else if (dwIntegrityLevel >= SECURITY_MANDATORY_MEDIUM_RID && 
                                dwIntegrityLevel < SECURITY_MANDATORY_HIGH_RID)
                    {
                        // Medium Integrity
                        wprintf(L"[%d][%s][%x]  Medium Process\r\n",dwProcessId,
                                                        szProccessName,dwIntegrityLevel);
                    }
                    else if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID && 
                                dwIntegrityLevel < SECURITY_MANDATORY_SYSTEM_RID )
                    {
                        // High Integrity
                        wprintf(L"[%d][%s][%x]  High Integrity Process\r\n",dwProcessId,
                                                        szProccessName,dwIntegrityLevel);
                    }
                    else if (dwIntegrityLevel >= SECURITY_MANDATORY_SYSTEM_RID)
                    {
                        // System Integrity
                        wprintf(L"[%d][%s][%x]  System Integrity Process\r\n",dwProcessId,
                                                        szProccessName,dwIntegrityLevel);
                    }
                    else
                    {
                        wprintf(L"[%d][%s][%d] /2t ==================== Process\r\n",dwProcessId,
                                                        szProccessName,dwIntegrityLevel);
                    }
                }
                LocalFree(pTIL);
            }
        }
    }
    CloseHandle(hToken);
}
 
 cs

사용법

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
int _tmain(int argc, _TCHAR* argv[])
{
    SetPrivilege(SE_DEBUG_NAME); 
    HANDLE hModuleShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); 
    if(hModuleShot == NULL || hModuleShot == INVALID_HANDLE_VALUE)
    {
         return FALSE;
    }
    
    PROCESSENTRY32W pe;
    SecureZeroMemory(&pe, sizeof(PROCESSENTRY32W));
    pe.dwSize = sizeof(PROCESSENTRY32W);
 
    if(!Process32First(hModuleShot, &pe))
    {
        CloseHandle(hModuleShot); 
        return FALSE;
    } 
    
    do 
    { 
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe.th32ProcessID);
        if( hProcess != NULL && hProcess != INVALID_HANDLE_VALUE)
        {
            ShowProcessIntegrityLevel(pe.szExeFile,hProcess,pe.th32ProcessID); 
            CloseHandle(hProcess); 
        }
        else
        { 
            //wprintf(L"[%s][%d] Open FAIL Process\r\n",pe.szExeFile,pe.th32ProcessID);
        }
    } while(Process32Next(hModuleShot, &pe));
    
    CloseHandle(hModuleShot);
    hModuleShot = NULL; 
    system("pause"); 
    return 0; 
}        
 cs

 

 

동작 확인

[PID][PROCESSNAME][LEVEL]

 

반응형
저작자표시
공유하기 링크
댓글
공지사항
최근에 올라온 글
최근에 달린 댓글
Total
Today
Yesterday
링크
TAG more
«   2024/11   »
일 월 화 수 목 금 토
1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30
글 보관함
250x250