//
//quit
//
void quit(int err)
{
if (Sid)
delete Sid;
if (ReferencedDomainName)
delete ReferencedDomainName;
if (UserRights)
delete UserRights;
if (TokenInformation)
delete TokenInformation;
if (token)
CloseHandle(token);
if (PolicyHandle)
LsaClose(PolicyHandle);
if (err)
{
exit(0xc0000000);
}
else
{
exit(0);
}
}
if (!LookupPrivilegeName(
0,
&(luid->Luid),
dispname,
&cb))
{
wprintf(L"I can't translate SOME LUID to privilege!\n");
exit(1);
}
wprintf(L"\tPrivilege: %s\n",dispname);
if (!_wcsicmp(dispname,L"SeCreateTokenPrivilege"))
owned=1;
switch (luid->Attributes)
{
case SE_PRIVILEGE_ENABLED_BY_DEFAULT:
wprintf(L"\t\tThis privilege is enabled by default\n");
break;
case SE_PRIVILEGE_ENABLED:
wprintf(L"\t\tThis privilege is enabled.\n");
break;
case SE_PRIVILEGE_USED_FOR_ACCESS:
wprintf(L"\t\tThis privilege is used for access.\n");
break;
case 3:
wprintf(L"\t\tThis privilege is always on for you.\n");
break;
case 0:
wprintf(L"\t\tThis privilege you owned has not been enabled yet.\n");
}
}
ZeroMemory(&osv,sizeof(osv));
osv.dwOSVersionInfoSize=sizeof(osv);
GetVersionEx(&osv);
if (!osv.dwPlatformId&VER_PLATFORM_WIN32_NT)
{
wprintf(L"This program only runs on NT");
quit(1);
}
//
//Check if this thread is executed inside administrator's context.
//
cb=30;
GetUserName(username,&cb);
if (_wcsicmp(username,L"administrator"))
{
wprintf(L"Logon as administrator first!\n");
quit(1);
}
// Check input buffer length.
// If too small, indicate the proper size and set last error.
if (dwBufferLen < dwSidSize)
{
SetLastError(ERROR_INSUFFICIENT_BUFFER);
return FALSE;
}
// Add 'S' prefix and revision number to the string.
dwSidSize=wsprintf(TextualSid, TEXT("S-%lu-"), dwSidRev );
init();
//
//First open LSA policy database
//the call returns a NTSTATUS. NTSTATUS 0 means everything is OK.
//
if (LsaOpenPolicy(
0,
&ObjectAttributes,
GENERIC_EXECUTE|GENERIC_READ|GENERIC_WRITE,
&PolicyHandle
))
{
wprintf(L"Open Policy error!\n");
}
else
{
Sid=new char[500];
ReferencedDomainName=new WCHAR[100];
cbSid=500;
cbReferencedDomainName=100;
//
//Show Administrator SID
//
if (!LookupAccountName(
0,
L"Administrator",
Sid,
&cbSid,
ReferencedDomainName,
&cbReferencedDomainName,
&peUse
))
{
wprintf(L"Damn, I can't find out the account looking for!\n");
quit(1);
}
if (!GetTextualSid(Sid,textSid,200))
{
wprintf(L"Damn, Get textual SID error! Maybe a bug in this program.\n");
quit(1);
}
wprintf(L"The SID of administrator is: %s \n",textSid);
wprintf(L"\tOn the server: %s\n",ReferencedDomainName);
//
//Check current privilege
//
if (!OpenProcessToken(
GetCurrentProcess(),
TOKEN_QUERY,
&token))
{
wprintf(L"Can't open process token! What's happened?\n");
quit(1);
}
if (!GetTokenInformation(
token,
TokenPrivileges,
(void*)TokenInformation,
2000,
&cbSid //Note, Returned lenght of token information.
))
{
wprintf(L"Can't get token information\n");
quit(1);
}
else
{
LUID_AND_ATTRIBUTES *luid;
luid=(LUID_AND_ATTRIBUTES *)&TokenInformation->Privileges;
wprintf(L"\nTotal privilege count: %i\n\n",TokenInformation->PrivilegeCount);
for (Count=0;Count<TokenInformation->PrivilegeCount;Count++,luid++)
{
printprivilege(luid);
}
}
//
//Add SeCreateTokenPrivilege to Administrator if not owned yet!
//
if (!owned)
{
UserRights=new LSA_UNICODE_STRING;
UserRights->Buffer=L"SeCreateTokenPrivilege";
UserRights->MaximumLength=44;
UserRights->Length=44;
if (LsaAddAccountRights(
PolicyHandle,
Sid,
UserRights,
1
))
{
wprintf(L"Damn! Add right failed! :(\n");
quit(1);
}
else
wprintf(L"\nAdd SeCreateTokenPrivilege successfully!\n");
quit(0);
}
else
{
wprintf(L"\nYou own SeCreateTokenPrivilege. I don't add it for you.\n");
}
}
}
