Re: CreateProcessAsUser "loses" privileges, why?

What OS is this? Do you also see missing privileges if you start a
process with runas?

"Stefan Kuhr" wrote:

> I have a service (running in SYSTEM) that impersonates a client at a
> server end of a named pipe. The client is a local administrator and has
> the SE_DEBUG_NAME privilege granted. If I duplicate the impersonation
> token in the service to make it a primary token and use it to create a
> new process using CreateProcessAsUser, the SE_DEBUG_NAME privilege is
> gone, i.e. I cannot even enable it anymore. Why is that? What can I do
> to create a process with CPAU from the service running as the
> impersonated user with the full set of privileges that the client has?
> Note that this is not a restricted token that I create, it is just a
> primary token created from an impersonation token, everything happens on
> the same machine.
>
> I can successfully enable the SE_DEBUG_NAME privilege within the service
> using the primary token but somehow the process started via CPAU doesn't
> get it and cannot enable it either.


.

Relevant Pages

  • The Weakness of Windows Impersonation Model
    ... The Weakness of Windows Impersonation Model ... Network Service account’s context is elevated to LocalSystem. ... unauthorized privilege elevation. ...
    (Bugtraq)
  • CreateProcessAsUser "loses" privileges, why?
    ... The client is a local administrator and has ... the SE_DEBUG_NAME privilege granted. ... primary token created from an impersonation token, ... using the primary token but somehow the process started via CPAU doesn't ...
    (microsoft.public.win32.programmer.kernel)
  • CreateProcessAsUser "loses" privileges, why?
    ... The client is a local administrator and has ... the SE_DEBUG_NAME privilege granted. ... primary token created from an impersonation token, ... using the primary token but somehow the process started via CPAU doesn't ...
    (microsoft.public.win32.programmer.kernel)
  • Re: The Weakness of Windows Impersonation Model
    ... I believe Longhorn/Vista will address many of issues that currently affect impersonation. ... A context of MS SQL service running as unique user account is ... unauthorized privilege elevation. ...
    (Bugtraq)
  • Re: Impersonation and UNC network resources
    ... need the "Act as part of the operating system" privilege to call it under ... only the SYSTEM account has this. ... privilege to any account you want to, but be very careful about that as it ... Another option for you would be using impersonation with Kerberos delegation ...
    (microsoft.public.dotnet.framework.aspnet.security)
Loading