IE保护程序

最新推荐文章于 2022-08-06 15:08:06 发布

原创最新推荐文章于 2022-08-06 15:08:06 发布 · 429 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#ie #attributes #token #security #domain #null

c++ 专栏收录该内容

1 篇文章

订阅专栏

编了个小程序，该程序使你在浏览网页时被流氓软件，恶意脚本等等攻击的可能性降低，这里主要是使用了受限令牌开启IE浏览器。

1 通过指定禁用安全标示符（deny-only security identifier，deny-only SID）限制访问需要被保护的资源。
2 通过指定受限SID实现额外的访问检查。
3 通过删除权限。

声明：大部分代码来源于网络，我只是进行少部分的修改。

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <malloc.h>
#include <crtdbg.h>
void ProtectIE()
{
HANDLE hCurrentProcessToken = NULL;
HANDLE hProcess = ::GetCurrentProcess();
OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &hCurrentProcessToken);
DWORD dwTokenInfoLen = 0;

SID_IDENTIFIER_AUTHORITY sid_Auth;
SID_AND_ATTRIBUTES sid_and_attr;
sid_and_attr.Attributes = 0;
PSID &adminGroupSID = sid_and_attr.Sid;
sid_Auth.Value[0] = 0;
sid_Auth.Value[1] = 0;
sid_Auth.Value[2] = 0;
sid_Auth.Value[3] = 0;
sid_Auth.Value[4] = 0;
sid_Auth.Value[5] = 5;

BOOL bRet = FALSE;
//! 初始化一个 Administrator Group 的 SID , SECURITY_BUILTIN_DOMAIN_RID/*0x20
bRet = ::AllocateAndInitializeSid(&sid_Auth, 0x2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &adminGroupSID);

_ASSERTE(bRet);
//! 获取当前进程 token 的 privileges
bRet = ::GetTokenInformation(hCurrentProcessToken, TokenPrivileges, NULL, 0, &dwTokenInfoLen);

TOKEN_PRIVILEGES *pTokenPrivileges = (TOKEN_PRIVILEGES *)new BYTE[dwTokenInfoLen];
TOKEN_PRIVILEGES *pTokenPrivileges4Delete = (TOKEN_PRIVILEGES *)new BYTE[dwTokenInfoLen];
bRet = ::GetTokenInformation(hCurrentProcessToken, TokenPrivileges, pTokenPrivileges, dwTokenInfoLen, &dwTokenInfoLen);
_ASSERTE(bRet);
PSID userGroupSID;
//! 初始化一个User Group 的 SID
bRet = ::AllocateAndInitializeSid(&sid_Auth, 0x2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &userGroupSID);
_ASSERTE(bRet);

DWORD dwLUIDCount = 0;

//! 获取 User Group account 的 privileges
// PLUID pLUIDs = GetAllPrivilegeLUIDs(userGroupSID, dwLUIDCount);
LUID SeChangeNotifyPrivilege = { 0 };
LookupPrivilegeValue(0, // local system
SE_CHANGE_NOTIFY_NAME,
&SeChangeNotifyPrivilege);

dwLUIDCount=1;
///*!
//找到当前进程 token 的有而User Group account没有的 privileges
LUID_AND_ATTRIBUTES *pTokenLUID = pTokenPrivileges->Privileges;
size_t nCnt = 0;
for(size_t i = 0; i < pTokenPrivileges->PrivilegeCount; ++i)
{

bool bFound = false;
for(size_t j = 0; j < dwLUIDCount; ++j)
{
   if(memcmp(&(pTokenLUID->Luid), &SeChangeNotifyPrivilege, sizeof(LUID)) == 0)
   {
    bFound = true;
    break;
   }
}
if(!bFound)
{
   (pTokenPrivileges4Delete->Privileges)[nCnt] = *pTokenLUID;
   ++nCnt;
}

++pTokenLUID;
}
pTokenPrivileges4Delete->PrivilegeCount = nCnt;

///*!
//此时 pTokenPrivileges4Delete 保存了当前进程 token 有
//而User Group account没有的 privileges
//
HANDLE hRestrictedToken = NULL;
///*!
//CreateRestrictedToken 将删除 pTokenPrivileges4Delete 中有的 privileges
//
//! 注意 sid_and_attr 的 Attributes 被 CreateRestrictedToken 忽略
bRet = ::CreateRestrictedToken(hCurrentProcessToken, 0, 0x1, &sid_and_attr, pTokenPrivileges4Delete->PrivilegeCount,
pTokenPrivileges4Delete->Privileges, 0, NULL, &hRestrictedToken);

_ASSERTE(bRet);
bRet = ::CloseHandle(hCurrentProcessToken);
_ASSERTE(bRet);

//!此时受限的Token已经创建
// CreateProcessAsUser(hRestrictedToken, argv[1]);
STARTUPINFO startupInfo= { sizeof (STARTUPINFO) };
PROCESS_INFORMATION processInfo;

CreateProcessAsUser(hRestrictedToken,
    "C://Program Files//Internet Explorer//IEXPLORE.EXE",
    NULL, // cmd line
    NULL, // process attributes
    NULL, // thread attributes
    FALSE, // don't inherit handles
    NULL, // flags
    NULL, // inherit environment
    NULL, &startupInfo,
    &processInfo);

bRet = ::CloseHandle(hRestrictedToken);
_ASSERTE(bRet);

::FreeSid(userGroupSID);
::FreeSid(adminGroupSID);

//delete [] pLUIDs;
delete [] (BYTE*)pTokenPrivileges;
delete [] (BYTE*)pTokenPrivileges4Delete;
}

main()
{
ProtectIE();
exit(1);
}