问带假返回的WTSQueryUserToken

EN

STARTUPINFOW        si = {0,};
PROCESS_INFORMATION pi = {0,};

HANDLE  hTokenNew   = nullptr;
HANDLE  hTokenDup   = nullptr;

HMODULE hModKernel32    = LoadLibrary(TEXT("kernel32.dll"));
HMODULE hModWtsapi32    = LoadLibrary(TEXT("Wtsapi32.dll"));
HMODULE hModUserEnv     = LoadLibrary(TEXT("Userenv.dll"));

auto lpfnWTSGetActiveConsoleSessionId   = reinterpret_cast<DWORD(*)(void)>(GetProcAddress(hModKernel32, "WTSGetActiveConsoleSessionId"));
auto lpfnWTSQueryUserToken              = reinterpret_cast<bool(*)(ULONG, PHANDLE)>(GetProcAddress(hModWtsapi32, "WTSQueryUserToken"));
auto lpfnCreateEnvironmentBlock         = reinterpret_cast<bool(*)(LPVOID*, HANDLE, bool)>(GetProcAddress(hModUserEnv, "CreateEnvironmentBlock"));
auto lpfnDestroyEnvironmentBlock        = reinterpret_cast<bool(*)(LPVOID)>(GetProcAddress(hModUserEnv, "DestroyEnvironmentBlock"));

LPVOID  pEnvironment    = nullptr;
DWORD   dwCreationFlag  = NORMAL_PRIORITY_CLASS;

DWORD dwSessionId = lpfnWTSGetActiveConsoleSessionId();

// FALSE Returned.
lpfnWTSQueryUserToken(dwSessionId, &hTokenNew); 

// 1314 : ERROR_PRIVILEGE_NOT_HELD
DWORD d = GetLastError();

// Since WTSQueryUserToken gives me FALSE and no token, the code below is meaningless.
DuplicateTokenEx(hTokenNew, MAXIMUM_ALLOWED, nullptr, SecurityIdentification, TokenPrimary, &hTokenDup);

si.cb           = sizeof(STARTUPINFO);
si.lpReserved   = nullptr;
si.lpReserved2  = nullptr;
si.cbReserved2  = 0;
si.dwFlags      = STARTF_USESHOWWINDOW;
si.wShowWindow  = SW_SHOW;
si.lpDesktop    = TEXT("winsta0\\default");

if(lpfnCreateEnvironmentBlock != nullptr)
{
    if (lpfnCreateEnvironmentBlock(&pEnvironment, hTokenDup, false))
    {
        dwCreationFlag |= CREATE_UNICODE_ENVIRONMENT;
    }
    else
    {
        pEnvironment = nullptr;
    }
}

if (!CreateProcessAsUserW(
        hTokenDup, 
        nullptr, 
        TEXT("D:\\MyProgram.exe"), 
        nullptr,
        nullptr, 
        false,
        dwCreationFlag,
        pEnvironment,
        nullptr, 
        &si, 
        &pi))
{
    return 0;
}

if(hTokenDup)
{
    CloseHandle(hTokenDup);
}

if (hTokenNew)
{
    CloseHandle(hTokenNew);
}

if (pi.hProcess)
{
    CloseHandle(pi.hProcess);
}

if (pi.hThread)
{
    CloseHandle(pi.hThread);
}

if (nullptr != pEnvironment)
{
    lpfnDestroyEnvironmentBlock(pEnvironment);
}