Odtnhj

I am trying to strip a process from all privileges using AdjustTokenPrivileges by setting the parameter DisableAllPrivileges to TRUE:

#include <Windows.h>
#include <cwchar>

int main()

 auto process = GetCurrentProcess();
 HANDLE primary_token;

 if (OpenProcessToken(process, TOKEN_ADJUST_PRIVILEGES, &primary_token) == FALSE)
 
 fwprintf(stderr, L"OpenProcessToken: failed");
 

 if (AdjustTokenPrivileges(primary_token, TRUE, nullptr, 0, nullptr, nullptr) == FALSE)
 
 fwprintf(stderr, L"AdjustTokenPrivileges: failed");
 

 CloseHandle(primary_token);

 auto event = CreateEventW(nullptr, FALSE, FALSE, nullptr);
 WaitForSingleObject(event, INFINITE);

It does not seem to working when viewing the process privileges in Sysinternals Process Explorer.

I solved it by querying all privileges and changing the attribute to SE_PRIVILEGE_REMOVED but I am not sure why setting DisableAllPrivileges to TRUE does not work.

It does not seem to working when viewing the process privileges in
Sysinternals Process Explorer.

Sysinternals Process Explorer show wrong image. DisableAllPrivileges work as excepted - remove SE_PRIVILEGE_ENABLED attribute from all privileges in token. but some privileges can also have SE_PRIVILEGE_ENABLED_BY_DEFAULT attribute. SeChangeNotifyPrivilege for example have this attribute. it remain unchanged, what and show your image. but anyway only SE_PRIVILEGE_ENABLED attribute used in PrivilegeCheck or SePrivilegeCheck api. so you really effective disable all privileges in your token, including SeChangeNotifyPrivilege. all calls, which require concrete privilege, which have not SE_PRIVILEGE_ENABLED attribute in your token - fail, even if SE_PRIVILEGE_ENABLED_BY_DEFAULT attribute exist.

test code

#ifndef RtlPointerToOffset
#define RtlPointerToOffset(B,P) ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) ))
#endif

inline ULONG BOOL_TO_ERROR(BOOL fOk)

 return fOk ? NOERROR : GetLastError();


volatile UCHAR guz = 0;

void DumpTokenPrivs(HANDLE hToken)

 union 
 PVOID buf;
 PTOKEN_PRIVILEGES ptp;
 ;

 PVOID stack = alloca(guz);

 ULONG cb = 0, rcb = 0x40;

 ULONG dwError;
 do 
 
 if (cb < rcb)
 
 cb = RtlPointerToOffset(buf = alloca(rcb - cb), stack);
 

 if (NOERROR == (dwError = BOOL_TO_ERROR(
 GetTokenInformation(hToken, TokenPrivileges, buf, cb, &rcb))))
 
 ULONG PrivilegeCount = ptp->PrivilegeCount;

 DbgPrint("PrivilegeCount = %un", PrivilegeCount);
 if (PrivilegeCount)
 
 PLUID_AND_ATTRIBUTES Privileges = ptp->Privileges;
 do 
 
 WCHAR Name[64];
 ULONG cch = RTL_NUMBER_OF(Name);
 if (!LookupPrivilegeNameW(0, &Privileges->Luid, Name, &cch))
 
 _swprintf(Name, L"%u-%u", 
 Privileges->Luid.HighPart, Privileges->Luid.LowPart);
 

 BOOL fResult;
 PRIVILEGE_SET ps = 
 1, PRIVILEGE_SET_ALL_NECESSARY, 
 Privileges->Luid.LowPart, Privileges->Luid.HighPart 
 
 ;

 if (!PrivilegeCheck(hToken, &ps, &fResult))
 
 DbgPrint("PrivilegeCheck=%un", GetLastError());
 

 DbgPrint("%08x %x %Sn", Privileges->Attributes, fResult, Name);

 while (Privileges++, --PrivilegeCount);
 
 

 while (dwError == ERROR_INSUFFICIENT_BUFFER);


void PrivTest()
TOKEN_QUERY, &hToken))
 
 ULONG rcb;
 TOKEN_LINKED_TOKEN tlk;
 GetTokenInformation(hToken, TokenLinkedToken, &tlk, sizeof(tlk), &rcb);
 CloseHandle(hToken);
 hToken = tlk.LinkedToken;

 DumpTokenPrivs(hToken);

 if (AdjustTokenPrivileges(hToken, TRUE, 0, 0, 0, 0) && GetLastError() == NOERROR)
 
 DumpTokenPrivs(hToken);
 
 

 CloseHandle(hToken);

and output:

PrivilegeCount = 5
00000000 0 SeShutdownPrivilege
00000003 1 SeChangeNotifyPrivilege
00000000 0 SeUndockPrivilege
00000000 0 SeIncreaseWorkingSetPrivilege
00000000 0 SeTimeZonePrivilege
PrivilegeCount = 5
00000000 0 SeShutdownPrivilege
00000001 0 SeChangeNotifyPrivilege
00000000 0 SeUndockPrivilege
00000000 0 SeIncreaseWorkingSetPrivilege
00000000 0 SeTimeZonePrivilege

note that before call was

00000003 1 SeChangeNotifyPrivilege

was mean SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED attributes and PrivilegeCheck say that privilege is enabled.

after call was

00000001 0 SeChangeNotifyPrivilege

was mean SE_PRIVILEGE_ENABLED_BY_DEFAULT attributes and PrivilegeCheck say that privilege is disabled.