For example: new OBJECT_ATTRIBUTES(hDirectoryOpened, @"WinSta0\Default", OBJ_CASE_INSENSITIVE) without luck, but also tried passing just "Default" and supplying the handle from NtUserOpenWindowStation, and no luck either (sidenote: how do you get back NTSTATUS with these APIs?
HANDLE hToken = {}; OpenProcessToken( GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken ); DuplicateTokenEx( hToken, TOKEN_ALL_ACCESS, nullptr, SecurityAnonymous, TokenPrimary, &hToken ); SetTokenInformation(hToken, TokenSessionId, &sessionId, sizeof(sessionId));
-
-
tried changing the token you access it with?
-
OK it may be something access related. I cannot NtOpenDirectoryObject with DIRECTORY_ALL_ACCESS. MAXIMUM_ALLOWED give me only Query, Traverse, Create objects, Read control, Write DAC ... I think this in turn is limited me to what I can open the Window Station with ....
- Show replies
New conversation -
-
-
No I haven’t tried that one. I will do that. But, so this wouldn’t create a duplicate handle but actually change the session of my token right now? What’s odd is why the WinSta could be opened in session 2but not a desktop in that same WinSta. I’m like wtf win32u . dll lol
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
OK so tried just that + ImpersonateLoggedOnUser(hToken); and verified with Process Hacker that that thread is running as Session 2 from a Thread Token it now has. Surprisingly this too fails with the NT Status of AccessDenied = 0xc0000022. Was a good try tho. Idk why it fails!
-
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
