Jonas L

wait- what stops you from just opening the windowstation in another session - the doing relative open to that?

Results in access denied from RtlGetLastNtStatus. This is with granting Everyone : Full Control on the entire WinSta in WinObjEx as well as on the desktop, and running as system. Lol. Strange that NtUserOpenWindowStation is fine but NtUserOpenDesktop not

tried making sure you have access to every objdir in the path to reach it?

or wait- is it in session 0 you try to open`?

Yep tried that one

HANDLE hToken = {}; OpenProcessToken( GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken ); DuplicateTokenEx( hToken, TOKEN_ALL_ACCESS, nullptr, SecurityAnonymous, TokenPrimary, &hToken ); SetTokenInformation(hToken, TokenSessionId, &sessionId, sizeof(sessionId));

OK so tried just that + ImpersonateLoggedOnUser(hToken); and verified with Process Hacker that that thread is running as Session 2 from a Thread Token it now has. Surprisingly this too fails with the NT Status of AccessDenied = 0xc0000022. Was a good try tho. Idk why it fails!