Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery
 
PerlMonks  

Creating a process as a normal user without password (Linux 'su' for Windows 7?)

by stringZ (Acolyte)
on Nov 03, 2011 at 02:09 UTC ( #935549=perlquestion: print w/ replies, xml ) Need Help??
stringZ has asked for the wisdom of the Perl Monks concerning the following question:

Hey there,

Does anyone know if there's a library or tool which could create a process as a normal user that has empty password. The situation is the following. My application runs with full administrative credentials (as a Windows service) under a LUA-enabled Windows 7. There are normal users (with limited rights) who are logged on locally (has their desktop shown), they can open applications (run processes) by double-clicking icons or from the command-line. I would like my service to create a process impersonating one of these logged on users. These users don't and won't have password, so Win32::AdminMisc::CreateProcessAsUser() is not an option since it requires LogonAsUser() which fails to impersonate a user with empty password. Running an application as a different user is also impossible with the command-line tool RUNAS. I understand this is for security reasons, but a network service should be able to somehow bypass this. So I'm looking for a solution similar to the su (or login -f) command under Linux. It doesn't require a password if you're root. My network service has elevated rights over the normal users I want it to impersonate.
Is there any solution or API call?

I have an older thread in which I asked about creating a process with elevated privileges using the Windows API.
One of the answers I got suggested using Win32::FileOp::ShellExecute(). Its syntax is the following:

Win32::FileOp::ShellExecute( runas => 'theProgram.exe' )

You can replace the string runas by open, in this case it won't elevate, but run theProgram.exe as the current user. Jenda, who wrote me this answer, noted that I can use runasuser instead of runas, but I don't understand how it would fit in this syntax. Is it possible with ShellExecute()?

If there is no solution with my configuration, is there any if I disable LUA (still need to run as another user)?

Thank you,
stringZ

Comment on Creating a process as a normal user without password (Linux 'su' for Windows 7?)
Download Code
Re: Creating a process as a normal user without password (Linux 'su' for Windows 7?)
by Jenda (Abbot) on Nov 03, 2011 at 12:14 UTC
    Win32::FileOp::ShellExecute( runasuser => 'theProgram.exe' );

    It will not let you specify the user to run the program under, it just displays a dialog box asking you to enter the credentials.

    There is no way to pass the username&password to the ShellExecute API function. There is no way even with the ShellExecuteEx.

    Seems you would need to call the CreateProcessAsUser function. It used to be available via Win32::AdminMisc, but you could call it yourself using Win32::API. Another option is to run the process through the "runas" utility. Run "runas /?" in the command prompt.

    Jenda
    Enoch was right!
    Enjoy the last years of Rome.

Re: Creating a process as a normal user without password (Linux 'su' for Windows 7?)
by cavac (Chaplain) on Nov 03, 2011 at 20:01 UTC

    As for the security problems of the windows service: Did you try to enable "Allow service to interact with desktop" in the services properties?

    As long as the users are logged on, you could also run a system tray application on the users desktop which interacts with the service.

    Don't use '#ff0000':
    use Acme::AutoColor; my $redcolor = RED();
    All colors subject to change without notice.
      As long as the users are logged on, you could also run a system tray application on the users desktop which interacts with the service.

      I think that's also the way officially proposed by Microsoft: Write a privileged background service and use a dedicated application running in the context of an ordinary user for the user interface. Windows offers serveral ways for IPC between the two processes. Named pipes and IP sockets (via localhost) are commonly used.

      To start an unprivileged process running under the user account, the service process simply sends a message to the user interface process, containing all required information.

      And to start the unprivileged user interface process, use one of the various autostart mechanisms. Creating a shortcut in the Autostart group of the start menu is a very simple way, other ways need some registry editing.

      Alexander

      --
      Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://935549]
Approved by ww
Front-paged by Corion
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others studying the Monastery: (9)
As of 2014-10-20 22:57 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    For retirement, I am banking on:










    Results (92 votes), past polls