c - Perl: IsAdminUser returns incorrect value -
i'm new perl. i'm using win32::isadminuser()
function (can't paste code because make runnable have paste whole code). returns 0, curious why because user run member of administrators group, created little test function (c++) , run right before running isadminuser
here code:
int davai() { file * fp; fp = fopen ("c:\\tmp\\davai.txt", "a"); fprintf(fp, "shevedi davai"); fflush(fp); handle token = null; handle duptoken = null; if(!openprocesstoken(getcurrentprocess(), token_query | token_duplicate, &token)) { fprintf(fp, "davai: openprocesstoken cheijva. %d\n", (int)getlasterror()); fflush(fp); } if (duplicatetokenex(token, maximum_allowed, null, securitydelegation, tokenprimary, &duptoken) == 0) { fprintf(fp, "davai: openprocesstoken duplicatetokenex. %d\n", (int)getlasterror()); fflush(fp); } ptoken_groups pprivilegestoken = null; dword cbsize = 0; gettokeninformation(duptoken, tokengroups, null, 0, &cbsize); pprivilegestoken = (ptoken_groups) localalloc(lptr, cbsize); if (gettokeninformation(duptoken, tokengroups, pprivilegestoken, cbsize, &cbsize) == false) { fprintf(fp, "davai: gettokeninformation cheijva. %d\n", (int)getlasterror()); fflush(fp); } char * gio; (ulong = 0; < pprivilegestoken->groupcount; i++) { if (convertsidtostringsid(pprivilegestoken->groups[i].sid, &gio) == 0) { fprintf(fp, "davai: convertsidtostringsid cheijva. %d\n", (int)getlasterror()); fflush(fp); } fprintf(fp, "value: %s\n",gio); fflush(fp); } localfree (gio); return 1; }
which opens current processes token, , lists groups user involved in. here ouput get:
shevedi davaivalue: s-1-5-21-1018819917-2920201817-244685803-513 value: s-1-1-0 value: s-1-5-21-1018819917-2920201817-244685803-1000 value: s-1-5-32-544 value: s-1-5-32-545 value: s-1-5-4 value: s-1-2-1 value: s-1-5-11 value: s-1-5-15 value: s-1-5-5-0-179095 value: s-1-2-0 value: s-1-5-64-10 value: s-1-16-12288
which strange because s-1-5-32-544
represent administrators
group. searched find if someones has similar problem, not find (i'm running windows 7). maybe can me. appreciated.
which strange because s-1-5-32-544 represent administrators group.
really win32::isadminuser()
internally call checktokenmembership function sidtocheck == s-1-5-32-544 , return ismember result. but
if sid present , has se_group_enabled attribute, ismember returns true; otherwise, returns false.
and
even if sid present in token, system may not use sid in access check. sid may disabled or have se_group_use_for_deny_only attribute.
really if user member of admin group (s-1-5-32-544) run without elevation (under uac) s-1-5-32-544 present in token se_group_use_for_deny_only attribute only
in contrast elevated admins have sid se_group_enabled attribute
so guess run not elevated admin. win32::isadminuser()
, must return false in case
Comments
Post a Comment