Create nonelevated process from elevated process with CreateProcessAsUser function

Question

I am running a program with SYSTEM privleges. I ask for the usename and password for a handle from LogonUser(szUserName, NULL, szPassword, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &hToken) for a local logon. I want to run the cmd.exe program as the user credentials provided from the logon. The logon is successful, but when I try to run the process, nothing happens. The program aborts. My code is...

// cmd.cpp : Defines the entry point for the console application.
//

#include <Windows.h>
#include <Lmcons.h>
#include <iostream>
#include <ctype.h>
#include <string>
#include <stdio.h>

#define winstring LPWSTR
#define stcas(x) static_cast<x>
#define INFO_BUFFER_SIZE    260 

using namespace std;

void ReportError(LPCWSTR pszFunction, DWORD dwError = GetLastError()) 
{ 
    wprintf(L"%s failed w/err 0x%08lx\n", pszFunction, dwError); 
} 

int main()
{
    TCHAR un[UNLEN+1];
    DWORD size = UNLEN + 1;
    GetUserName(un, &size);

    string una(un);

    bool sys = !una.compare("SYSTEM");

    if(!sys) {
        system("cls");
        system("title Command Prompt");
        system("cmd");
        return 0;
    }


    char szUserName[INFO_BUFFER_SIZE] = {}; 
    char szPassword[INFO_BUFFER_SIZE] = {}; 
    char *pc = NULL; 
    HANDLE hToken = NULL; 
    BOOL fSucceeded = FALSE; 
    BOOL logon = FALSE;


    printf("Enter the username: "); 
    fgets(szUserName, ARRAYSIZE(szUserName), stdin); 
    pc = strchr(szUserName, '\n'); 
    if (pc != NULL) *pc = '\0';  // Remove the trailing L'\n' 

    cout << endl;
    //string un(szUserName);

    printf("Enter the password: "); 
    fgets(szPassword, ARRAYSIZE(szPassword), stdin); 
    pc = strchr(szPassword, '\n'); 
    if (pc != NULL) *pc = '\0';  // Remove the trailing L'\n'



    if (!LogonUser(szUserName, NULL, szPassword,  LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &hToken)) 
    {
        ReportError(L"Logon");
        goto Cleanup; 
    } 
    else logon = true;

    // Impersonate the logged on user. 
    if (!ImpersonateLoggedOnUser(hToken)) 
    { 

        ReportError(L"imp");
        goto Cleanup; 
    } 
    fSucceeded = true;

    Cleanup: 

    // Clean up the buffer containing sensitive password. 
    SecureZeroMemory(szPassword, sizeof(szPassword)); 

    LPTSTR szCmdline[] = {"C:\\windows\\system32\\cmd.exe"};
    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    TCHAR uni[UNLEN+1];
    DWORD sizei = UNLEN + 1;
    GetUserName(uni, &sizei);

    string unai(uni);
    cout << unai << endl;

    memset(&si, 0, sizeof(si));
    si.cb = sizeof(si);

    HANDLE phToken = NULL;

    BOOL dup = FALSE;

    if(!DuplicateTokenEx(hToken, TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL, SecurityImpersonation, TokenImpersonation, &phToken)){
        ReportError(L"DUPLICATE TOKEN");
    }

    else dup = TRUE;

    system("pause");

    // If the impersonation was successful, undo the impersonation. 
    if (fSucceeded && logon && dup) 
    { 
        system("cls");
        system("title Command Prompt");
        //system("cmd");

        if(!CreateProcessAsUser(
        phToken,            // client's access token
        NULL,              // file to execute
        *szCmdline,     // command line
        NULL,              // pointer to process SECURITY_ATTRIBUTES
        NULL,              // pointer to thread SECURITY_ATTRIBUTES
        FALSE,             // handles are not inheritable
        NORMAL_PRIORITY_CLASS,   // creation flags
        NULL,              // pointer to new environment block 
        NULL,              // name of current directory 
        &si,               // pointer to STARTUPINFO structure
        &pi                // receives information about new process
        )){
            ReportError(L"Create Process");
        }
        if (!RevertToSelf()) 
        {  
            ReportError(L"Undo Imp");
        } 

    }
    system("pause");
}

I really would like the nonelevated proccess to avoid security issues.

Please don't tell me that my typed password is shown. I know that and will fix that later.

Answer 1

Try using the CreateProcessWithLogonUser Function. This should do that all for you with no errors.

Answer 2

You're not initializing si. You need to do this before calling CreateProcessAsUser:

memset(&si, 0, sizeof(si));
si.cb = sizeof(si);