イグトランスの頭の中（のかけら）

// RunAsAdminTest.cpp
 
#define UNICODE
#define WINVER 0x0600
#define _WIN32_WINNT 0x0600
 
#include <iostream>
#include <memory>
#include <windows.h>
#include <wtsapi32.h>
#include <userenv.h>
 
#pragma comment(lib, "wtsapi32.lib")
#pragma comment(lib, "userenv.lib")
 
template<typename F>
class ScopeExitHolder
{
public:
  ScopeExitHolder(F f) : deleter(f) {}
 
  ~ScopeExitHolder()
  {
    deleter();
  }
  // VC++2013はムーブのdefault/deleteに非対応
  //ScopeExitHolder(ScopeExitHolder&&) = default;
  ScopeExitHolder(const ScopeExitHolder&) = default;
  //ScopeExitHolder& operator=(ScopeExitHolder&&) = delete;
  ScopeExitHolder& operator=(const ScopeExitHolder&) = delete;
 
private:
  F deleter;
 
};
enum MakeScopeExitTag {};
template<typename F>
inline ScopeExitHolder<F> operator*(MakeScopeExitTag, F&& f)
{
  return std::move(f);
}
 
void OutputError(const char* function, DWORD error)
{
  std::wcout << function << ": " << error << std::endl;
}
 
#define SCOPE_EXIT_ID2(n) ScopeExit ## n
#define SCOPE_EXIT_ID(n) SCOPE_EXIT_ID2(n)
#define SCOPE_EXIT auto SCOPE_EXIT_ID(__LINE__) \
  = MakeScopeExitTag() * [&]()
 
int wmain(int argc, wchar_t** argv)
{
  if (argc <= 1)
  {
    return 1;
  }
 
  try
  {
    WTS_SESSION_INFO* sessionInfo;
    DWORD count;
    if (!WTSEnumerateSessions(
      WTS_CURRENT_SERVER_HANDLE, 0, 1, &sessionInfo, &count))
    {
      OutputError("WTSEnumerateSessions", GetLastError());
    }
    SCOPE_EXIT{ WTSFreeMemory(sessionInfo); };
    for (DWORD i = 0; i < count; ++i)
    {
      if (sessionInfo[i].State != WTSActive)
      {
        continue;
      }
      if (sessionInfo[i].SessionId == 0)
      {
        break;
      }
      std::cout << "Session: " << sessionInfo[i].SessionId << std::endl;
      HANDLE hTokenBase = nullptr;
      if (!WTSQueryUserToken(sessionInfo[i].SessionId, &hTokenBase))
      {
        OutputError("WTSQueryUserToken", GetLastError());
      }
      SCOPE_EXIT{ CloseHandle(hTokenBase); };
 
      // 本当はここでGetTokenInformation(TokenElevationType)を使い、
      // 昇格済みトークンの取得処理が必要かどうか判断すべき。
 
      TOKEN_LINKED_TOKEN tlt = {};
      DWORD length = {};
      if (!GetTokenInformation(
        hTokenBase, TokenLinkedToken, &tlt, sizeof tlt, &length))
      {
        OutputError(
          "GetTokenInformation(TokenLinkedToken)", GetLastError());
      }
      SCOPE_EXIT{ CloseHandle(tlt.LinkedToken); };
 
      HANDLE hToken;
      if (!DuplicateTokenEx(tlt.LinkedToken, MAXIMUM_ALLOWED,
        nullptr, SecurityImpersonation, TokenPrimary, &hToken))
      {
        OutputError("DuplicateTokenEx", GetLastError());
      }
      SCOPE_EXIT{ CloseHandle(hToken); };
 
      DWORD tokenUserLength;
      if (!GetTokenInformation(hToken, TokenUser,
        nullptr, 0, &tokenUserLength)
        && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
      {
        OutputError("GetTokenInformation(TokenUser) 1", GetLastError());
      }
      std::unique_ptr<BYTE[]> buffer(new BYTE[tokenUserLength]);
      if (!GetTokenInformation(hToken, TokenUser,
        buffer.get(), tokenUserLength, &tokenUserLength))
      {
        OutputError("GetTokenInformation(TokenUser) 2", GetLastError());
      }
      auto tokenUser = reinterpret_cast<const TOKEN_USER*>(buffer.get());
 
      DWORD nameLength = 0;
      DWORD domainLength = 0;
      SID_NAME_USE nameUse;
      if (!LookupAccountSid(nullptr, tokenUser->User.Sid,
        nullptr, &nameLength, nullptr, &domainLength, &nameUse)
        && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
      {
        OutputError("LookupAccountSid 1", GetLastError());
      }
      std::unique_ptr<TCHAR[]> name(new TCHAR[nameLength]);
      std::unique_ptr<TCHAR[]> domain(new TCHAR[domainLength]);
      if (!LookupAccountSid(nullptr, tokenUser->User.Sid,
        name.get(), &nameLength, domain.get(), &domainLength, &nameUse))
      {
        OutputError("LookupAccountSid 2", GetLastError());
      }
 
      std::wcout << "User: " << name.get() << std::endl;
      std::wcout << "Domain: " << domain.get() << std::endl;
 
      // 移動プロファイルのときが不安
      PROFILEINFO profileInfo = { sizeof profileInfo };
      profileInfo.lpUserName = name.get();
      if (!LoadUserProfile(hToken, &profileInfo))
      {
        OutputError("LoadUserProfile", GetLastError());
      }
      SCOPE_EXIT{ UnloadUserProfile(hToken, profileInfo.hProfile); };
 
      void* environment;
      if (!CreateEnvironmentBlock(&environment, hToken, FALSE))
      {
        OutputError("CreateEnvironmentBlock", GetLastError());
      }
      SCOPE_EXIT{ DestroyEnvironmentBlock(environment); };
 
      STARTUPINFOW si = { sizeof si };
      PROCESS_INFORMATION pi = {};
      if (!CreateProcessAsUser(hToken, nullptr, argv[1],
        nullptr, nullptr, FALSE, CREATE_UNICODE_ENVIRONMENT,
        environment, nullptr, &si, &pi))
      {
        OutputError("CreateProcessAsUser", GetLastError());
      }
      CloseHandle(pi.hThread);
      WaitForSingleObject(pi.hProcess, INFINITE);
      CloseHandle(pi.hProcess);
 
      break;
    }
  }
  catch (const std::exception& e)
  {
    std::cerr << "std::exception: " << e.what() << std::endl;
  }
}