Something went wrong. Try again.
Reactos
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180/* * PROJECT: ReactOS RPC Subsystem Service * LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+) * PURPOSE: One-time service setup configuration. * COPYRIGHT: Copyright 2018 Hermes Belusca-Maito */
/* INCLUDES *****************************************************************/
/* PSDK/NDK Headers */#define WIN32_NO_STATUS#include <windef.h>#include <winbase.h>#include <winreg.h>#include <winsvc.h>
#include <ndk/rtlfuncs.h>#include <ntsecapi.h>
#include "wine/debug.h"
WINE_DEFAULT_DEBUG_CHANNEL(rpcss);
/* FUNCTIONS ****************************************************************/
static BOOLSetupIsActive(VOID){ LONG lResult; HKEY hKey; DWORD dwData = 0; DWORD cbData = sizeof(dwData); DWORD dwType = REG_NONE;
lResult = RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SYSTEM\\Setup", 0, KEY_QUERY_VALUE, &hKey); if (lResult != ERROR_SUCCESS) return FALSE;
lResult = RegQueryValueExW(hKey, L"SystemSetupInProgress", NULL, &dwType, (LPBYTE)&dwData, &cbData); RegCloseKey(hKey);
if ((lResult == ERROR_SUCCESS) && (dwType == REG_DWORD) && (cbData == sizeof(dwData)) && (dwData == 1)) { return TRUE; }
return FALSE;}
static BOOLRunningAsSYSTEM(VOID){ /* S-1-5-18 -- Local System */ static SID SystemSid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
BOOL bRet = FALSE; PTOKEN_USER pTokenUser; HANDLE hToken; DWORD cbTokenBuffer = 0;
/* Get the process token */ if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) return FALSE;
/* Retrieve token's information */ if (GetTokenInformation(hToken, TokenUser, NULL, 0, &cbTokenBuffer) || GetLastError() != ERROR_INSUFFICIENT_BUFFER) { goto Quit; }
pTokenUser = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, cbTokenBuffer); if (!pTokenUser) goto Quit;
if (GetTokenInformation(hToken, TokenUser, pTokenUser, cbTokenBuffer, &cbTokenBuffer)) { /* Compare with SYSTEM SID */ bRet = EqualSid(pTokenUser->User.Sid, &SystemSid); }
HeapFree(GetProcessHeap(), 0, pTokenUser);
Quit: CloseHandle(hToken); return bRet;}
static VOIDRpcSsConfigureAsNetworkService(VOID){ SC_HANDLE hSCManager, hService;
/* Open the service controller */ hSCManager = OpenSCManagerW(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT); if (!hSCManager) { ERR("OpenSCManager() failed with error 0x%lx\n", GetLastError()); return; }
/* Open the RPCSS service */ hService = OpenServiceW(hSCManager, L"RPCSS", SERVICE_CHANGE_CONFIG); if (!hService) ERR("OpenService(\"RPCSS\") failed with error 0x%lx\n", GetLastError()); if (hService) { /* Use the NetworkService account */ if (!ChangeServiceConfigW(hService, SERVICE_NO_CHANGE, SERVICE_NO_CHANGE, SERVICE_NO_CHANGE, NULL, NULL, NULL, NULL, L"NT AUTHORITY\\NetworkService", L"", NULL)) { ERR("ChangeServiceConfig(\"RPCSS\") failed with error 0x%lx\n", GetLastError()); }
CloseServiceHandle(hService); }
CloseServiceHandle(hSCManager);}
static VOIDAddImpersonatePrivilege(VOID){ /* S-1-5-6 -- "Service" group */ static SID ServiceSid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } };
NTSTATUS Status; LSA_HANDLE PolicyHandle; LSA_OBJECT_ATTRIBUTES ObjectAttributes; LSA_UNICODE_STRING RightString;
ZeroMemory(&ObjectAttributes, sizeof(ObjectAttributes)); Status = LsaOpenPolicy(NULL, &ObjectAttributes, POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, &PolicyHandle); if (!NT_SUCCESS(Status)) { ERR("LsaOpenPolicy() failed with Status 0x%08lx\n", Status); return; }
RtlInitUnicodeString(&RightString, L"SeImpersonatePrivilege"); Status = LsaAddAccountRights(PolicyHandle, &ServiceSid, &RightString, 1); if (!NT_SUCCESS(Status)) { ERR("LsaAddAccountRights(\"S-1-5-6\", \"%wZ\") failed with Status 0x%08lx\n", Status, &RightString); }
LsaClose(PolicyHandle);}
VOID DoRpcSsSetupConfiguration(VOID){ /* * On first run during the setup phase, the RPCSS service runs under * the LocalSystem account. RPCSS then re-configures itself to run * under the NetworkService account and adds the Impersonate privilege * to the "Service" group. * This is done in this way, because the NetworkService account does not * initially exist when the setup phase is running and the RPCSS service * is started, but this account is created later during the setup phase. */ if (SetupIsActive() && RunningAsSYSTEM()) { RpcSsConfigureAsNetworkService(); AddImpersonatePrivilege(); }}