process username OpenProcess -> OpenProcessToken access denied

[chupper]

Hi, I've seen lots of posts about this on line, but it appears that no
one ever gets it to work.
I'm trying to open a process, other than mine, and get the username
the process is running as.

I've found .net code which does this via
System.Management.ManagementObject, but it's slow, apparently runs via
WMI, and I'd just rather do it natively.
Taskmanager does it fine.
I'm running as local admin and trying to view the owner of a process
that was spawned with the runas cmd.

Yet I can't. I get access denied no matter what I do. What am I
missing? Why does the wmi work? It's got to be just using winapi
down below anyway, perhaps it's because of the privileges the wmi
service is running as?

Here's my code, mostly copied, I believe via a MS page.
Can someone tell me what I need to do?
I've tried adjusting my token and the other processes.

Would it be easier to just ::CreateRemoteThread and do it the hard
way?

I can't get past the OpenProcessToken when the proc handle is the
handle to the remote process.
I've tried many combinations of access rights.

Here's the current code.


void sysLog( LPTSTR lpFrom )
{
WCHAR s[512];
DWORD dwErr = ::GetLastError();
::ZeroMemory( s, 512 );

if( (FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM,
NULL,
dwErr,
0,
s,
512,
NULL ) ) == 0 )
{
::std::wcout << lpFrom << L" FormatMessage error ::GetLastError()
was " << dwErr << std::endl;
}
else
{
::std::wcout << lpFrom << L" Error: " << dwErr << L" " << s <<
std::endl;
}
}


BOOL SetPrivilege(
HANDLE hToken, // access token handle
LPCTSTR lpszPrivilege, // name of privilege to enable/disable
BOOL bEnablePrivilege // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;

if ( !LookupPrivilegeValue(
NULL, // lookup privilege on local system
lpszPrivilege, // privilege to lookup
&luid ) ) // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %u\n", GetLastError() );
return FALSE;
}

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;

// Enable the privilege or disable all privileges.

if ( !AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES) NULL,
(PDWORD) NULL) )
{
printf("AdjustTokenPrivileges error: %u\n", GetLastError() );
return FALSE;
}

if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

{
printf("The token does not have the specified privilege. \n");
return FALSE;
}

return TRUE;
}

BOOL GetCurrentUserAndDomain( DWORD dwPID,
PTSTR szUser, PDWORD pcchUser,
PTSTR szDomain, PDWORD pcchDomain)
{

BOOL fSuccess = FALSE;
HANDLE hToken = NULL;
PTOKEN_USER ptiUser = NULL;
DWORD cbti = 0;
SID_NAME_USE snu;
HANDLE hProc = NULL;

HANDLE hProcSelf = NULL;
HANDLE hTokenSelf = NULL;

__try
{



// not needed if dwPID is the id of this process
hProcSelf = ::OpenProcess( PROCESS_ALL_ACCESS,
FALSE,
::GetCurrentProcessId() );

::OpenProcessToken( hProcSelf,
TOKEN_ADJUST_PRIVILEGES,
&hTokenSelf);

SetPrivilege( hTokenSelf, SE_DEBUG_NAME, TRUE );

// always fails
//SetPrivilege( hTokenSelf, SE_TCB_NAME, TRUE );
//SetPrivilege( hTokenSelf, SE_IMPERSONATE_NAME, TRUE );


hProc = ::OpenProcess( PROCESS_QUERY_INFORMATION,
FALSE,
dwPID );

if( NULL == hProc )
{
sysLog( L"OpenProcess" );
__leave;
}

// fails here always
if( 0 == ::OpenProcessToken( hProc,
TOKEN_QUERY,
&hToken))
{
sysLog( L"OpenProcessToken" );
__leave;
}

// always fails
//SetPrivilege( hToken, SE_DEBUG_NAME, TRUE );
//SetPrivilege( hTokenSelf, SE_TCB_NAME, TRUE );
//SetPrivilege( hToken, SE_IMPERSONATE_NAME, TRUE );

// Obtain the size of the user information in the token.
if (GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti))
{
sysLog( L"GetTokenInformation" );
// Call should have failed due to zero-length buffer.
__leave;

}
else
{
// Call should have failed due to zero-length buffer.
if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
{
sysLog( L"GetTokenInformation" );
__leave;
}
}

// Allocate buffer for user information in the token.
ptiUser = (PTOKEN_USER) HeapAlloc(GetProcessHeap(), 0, cbti);
if (!ptiUser)
{
sysLog( L"GetTokenInformation" );
__leave;
}

// Retrieve the user information from the token.
if (!GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
{
sysLog( L"GetTokenInformation" );
__leave;
}

// Retrieve user name and domain name based on user's SID.
if (!LookupAccountSid( NULL, ptiUser->User.Sid, szUser, pcchUser,
szDomain, pcchDomain, &snu))
{
sysLog( L"GetTokenInformation" );
__leave;
}

fSuccess = TRUE;
}
__finally
{
if( hTokenSelf )
::CloseHandle( hTokenSelf );

// Free resources.
if( hProcSelf )
::CloseHandle( hProcSelf );

if (hToken)
::CloseHandle(hToken);

if (ptiUser)
::HeapFree:GetProcessHeap(), 0, ptiUser);

if( hProc )
::CloseHandle( hProc );
}

return fSuccess;
}
// http://win32.mvps.org/
int _tmain(int argc, _TCHAR* argv[])
{
TCHAR szUN[64];
TCHAR szD[64];

DWORD dwUNSize = 64;
DWORD dwDSize = 64;

DWORD dwPID = 0;

BOOL bStatus = FALSE;

if( argc == 2 )
{
dwPID = (DWORD)_ttoi( argv[1] );
std::wcout << "Looking up user account for pid: " << dwPID <<
std::endl;
bStatus = GetCurrentUserAndDomain( dwPID, szUN, &dwUNSize, szD,
&dwDSize );
}
else
{
dwPID = ::GetCurrentProcessId();
std::wcout << "Looking up user account for current process pid: " <<
dwPID << std::endl;
bStatus = GetCurrentUserAndDomain( dwPID, szUN, &dwUNSize, szD,
&dwDSize );
}

if( bStatus )
std::wcout << L"User: " << szUN << " Domain: " << szD << std::endl;
}