ApplicationLauncher.vb

Imports System.Runtime.InteropServices
Imports System.Security

Friend Class ApplicationLauncher

    Public Enum TOKEN_INFORMATION_CLASS
        TokenUser = 1
        TokenGroups
        TokenPrivileges
        TokenOwner
        TokenPrimaryGroup
        TokenDefaultDacl
        TokenSource
        TokenType
        TokenImpersonationLevel
        TokenStatistics
        TokenRestrictedSids
        TokenSessionId
        TokenGroupsAndPrivileges
        TokenSessionReference
        TokenSandBoxInert
        TokenAuditPolicy
        TokenOrigin
        MaxTokenInfoClass
    End Enum

    Public Const READ_CONTROL As Integer = 131072
    Public Const STANDARD_RIGHTS_REQUIRED As Integer = 983040
    Public Const STANDARD_RIGHTS_READ As Integer = READ_CONTROL
    Public Const STANDARD_RIGHTS_WRITE As Integer = READ_CONTROL
    Public Const STANDARD_RIGHTS_EXECUTE As Integer = READ_CONTROL
    Public Const STANDARD_RIGHTS_ALL As Integer = 2031616
    Public Const SPECIFIC_RIGHTS_ALL As Integer = 65535
    Public Const TOKEN_ASSIGN_PRIMARY As Integer = 1
    Public Const TOKEN_DUPLICATE As Integer = 2
    Public Const TOKEN_IMPERSONATE As Integer = 4
    Public Const TOKEN_QUERY As Integer = 8
    Public Const TOKEN_QUERY_SOURCE As Integer = 16
    Public Const TOKEN_ADJUST_PRIVILEGES As Integer = 32
    Public Const TOKEN_ADJUST_GROUPS As Integer = 64
    Public Const TOKEN_ADJUST_DEFAULT As Integer = 128
    Public Const TOKEN_ADJUST_SESSIONID As Integer = 256
    Public Const TOKEN_ALL_ACCESS_P As Integer = (STANDARD_RIGHTS_REQUIRED Or TOKEN_ASSIGN_PRIMARY Or TOKEN_DUPLICATE Or TOKEN_IMPERSONATE Or TOKEN_QUERY Or TOKEN_QUERY_SOURCE Or TOKEN_ADJUST_PRIVILEGES Or TOKEN_ADJUST_GROUPS Or TOKEN_ADJUST_DEFAULT)
    Public Const TOKEN_ALL_ACCESS As Integer = TOKEN_ALL_ACCESS_P Or TOKEN_ADJUST_SESSIONID
    Public Const TOKEN_READ As Integer = STANDARD_RIGHTS_READ Or TOKEN_QUERY
    Public Const TOKEN_WRITE As Integer = STANDARD_RIGHTS_WRITE Or TOKEN_ADJUST_PRIVILEGES Or TOKEN_ADJUST_GROUPS Or TOKEN_ADJUST_DEFAULT
    Public Const TOKEN_EXECUTE As Integer = STANDARD_RIGHTS_EXECUTE
    Public Const MAXIMUM_ALLOWED As UInteger = 33554432
    Public Const CREATE_NEW_PROCESS_GROUP As Integer = 512
    Public Const CREATE_UNICODE_ENVIRONMENT As Integer = 1024
    Public Const IDLE_PRIORITY_CLASS As Integer = 64
    Public Const NORMAL_PRIORITY_CLASS As Integer = 32
    Public Const HIGH_PRIORITY_CLASS As Integer = 128
    Public Const REALTIME_PRIORITY_CLASS As Integer = 256
    Public Const CREATE_NEW_CONSOLE As Integer = 16
    Public Const SE_DEBUG_NAME As String = "SeDebugPrivilege"
    Public Const SE_RESTORE_NAME As String = "SeRestorePrivilege"
    Public Const SE_BACKUP_NAME As String = "SeBackupPrivilege"
    Public Const SE_PRIVILEGE_ENABLED As Integer = 2
    Public Const ERROR_NOT_ALL_ASSIGNED As Integer = 1300
    Private Const TH32CS_SNAPPROCESS As UInteger = 2
    Public Shared INVALID_HANDLE_VALUE As Integer = -1

    <DllImport("advapi32.dll", SetLastError:=True)>
    Public Shared Function LookupPrivilegeValue(ByVal lpSystemName As IntPtr, ByVal lpname As String, <MarshalAs(UnmanagedType.Struct)> ByRef lpLuid As LUID) As Boolean
    End Function

    <DllImport("advapi32.dll", EntryPoint:="CreateProcessAsUser", SetLastError:=True, CharSet:=CharSet.Ansi, CallingConvention:=CallingConvention.StdCall)>
    Public Shared Function CreateProcessAsUser(ByVal hToken As IntPtr, ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal bInheritHandle As Boolean, ByVal dwCreationFlags As Integer, ByVal lpEnvironment As IntPtr, ByVal lpCurrentDirectory As String, ByRef lpStartupInfo As STARTUPINFO, <Out> ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean
    End Function

    <DllImport("advapi32.dll", CharSet:=CharSet.Auto, SetLastError:=True)>
    Public Shared Function DuplicateToken(ByVal ExistingTokenHandle As IntPtr, ByVal SECURITY_IMPERSONATION_LEVEL As Integer, ByRef DuplicateTokenHandle As IntPtr) As Boolean
    End Function

    <DllImport("advapi32.dll", EntryPoint:="DuplicateTokenEx")>
    Public Shared Function DuplicateTokenEx(ByVal ExistingTokenHandle As IntPtr, ByVal dwDesiredAccess As UInteger, ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal TokenType As Integer, ByVal ImpersonationLevel As Integer, ByRef DuplicateTokenHandle As IntPtr) As Boolean
    End Function

    <DllImport("advapi32.dll", SetLastError:=True)>
    Public Shared Function AdjustTokenPrivileges(ByVal TokenHandle As IntPtr, ByVal DisableAllPrivileges As Boolean, ByRef NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Integer, ByVal PreviousState As IntPtr, ByVal ReturnLength As IntPtr) As Boolean
    End Function

    <DllImport("advapi32.dll", SetLastError:=True)>
    Public Shared Function SetTokenInformation(ByVal TokenHandle As IntPtr, ByVal TokenInformationClass As TOKEN_INFORMATION_CLASS, ByRef TokenInformation As UInteger, ByVal TokenInformationLength As UInteger) As Boolean
    End Function

    <DllImport("userenv.dll", SetLastError:=True)>
    Public Shared Function CreateEnvironmentBlock(ByRef lpEnvironment As IntPtr, ByVal hToken As IntPtr, ByVal bInherit As Boolean) As Boolean
    End Function

    Public Shared Function CreateProcessInConsoleSession(ByVal CommandLine As String, ByVal bElevate As Boolean) As Boolean
        Dim pi As PROCESS_INFORMATION
        Dim bResult As Boolean = False
        Dim dwSessionId As UInteger, winlogonPid As UInteger = 0
        Dim hUserToken As IntPtr = IntPtr.Zero, hUserTokenDup As IntPtr = IntPtr.Zero, hPToken As IntPtr = IntPtr.Zero, hProcess As IntPtr = IntPtr.Zero
        Debug.Print("CreateProcessInConsoleSession")
        dwSessionId = WTSGetActiveConsoleSessionId()
        Dim procEntry = New PROCESSENTRY32()
        Dim hSnap As UInteger = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
        If hSnap = INVALID_HANDLE_VALUE Then
            Return False
        End If

        procEntry.dwSize = CUInt(Marshal.SizeOf(procEntry))
        If Process32First(hSnap, procEntry) = 0 Then
            Return False
        End If

        Dim strCmp As String = "explorer.exe"
        Do
            If strCmp.IndexOf(procEntry.szExeFile) = 0 Then
                Dim winlogonSessId As UInteger = 0
                If ProcessIdToSessionId(procEntry.th32ProcessID, winlogonSessId) AndAlso winlogonSessId = dwSessionId Then
                    winlogonPid = procEntry.th32ProcessID
                    Exit Do
                End If
            End If
        Loop While Process32Next(hSnap, procEntry) <> 0

        WTSQueryUserToken(dwSessionId, hUserToken)
        Dim si = New STARTUPINFO()
        si.cb = Marshal.SizeOf(si)
        si.lpDesktop = "winsta0\default"
        Dim tp = New TOKEN_PRIVILEGES()
        Dim luid = New LUID()
        hProcess = OpenProcess(MAXIMUM_ALLOWED, False, winlogonPid)
        If Not OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY Or TOKEN_DUPLICATE Or TOKEN_ASSIGN_PRIMARY Or TOKEN_ADJUST_SESSIONID Or TOKEN_READ Or TOKEN_WRITE, hPToken) Then
            Debug.Print(String.Format("CreateProcessInConsoleSession OpenProcessToken error: {0}", Marshal.GetLastWin32Error()))
        End If

        If Not LookupPrivilegeValue(IntPtr.Zero, SE_DEBUG_NAME, luid) Then
            Debug.Print(String.Format("CreateProcessInConsoleSession LookupPrivilegeValue error: {0}", Marshal.GetLastWin32Error()))
        End If

        Dim sa = New SECURITY_ATTRIBUTES()
        sa.Length = Marshal.SizeOf(sa)
        If Not DuplicateTokenEx(hPToken, MAXIMUM_ALLOWED, sa, CInt(SECURITY_IMPERSONATION_LEVEL.SecurityIdentification), CInt(TOKEN_TYPE.TokenPrimary), hUserTokenDup) Then
            Debug.Print(String.Format("CreateProcessInConsoleSession DuplicateTokenEx error: {0} Token does not have the privilege.", Marshal.GetLastWin32Error()))
            CloseHandle(hProcess)
            CloseHandle(hUserToken)
            CloseHandle(hPToken)
            Return False
        End If

        If bElevate Then
            tp.PrivilegeCount = 1
            tp.Privileges = New Integer(3) {}
            tp.Privileges(2) = SE_PRIVILEGE_ENABLED
            tp.Privileges(1) = luid.HighPart
            tp.Privileges(0) = luid.LowPart
            If Not SetTokenInformation(hUserTokenDup, TOKEN_INFORMATION_CLASS.TokenSessionId, dwSessionId, CUInt(IntPtr.Size)) Then
                Debug.Print(String.Format("CreateProcessInConsoleSession SetTokenInformation error: {0} Token does not have the privilege.", Marshal.GetLastWin32Error()))
            End If

            If Not AdjustTokenPrivileges(hUserTokenDup, False, tp, Marshal.SizeOf(tp), IntPtr.Zero, IntPtr.Zero) Then
                Dim nErr As Integer = Marshal.GetLastWin32Error()
                If nErr = ERROR_NOT_ALL_ASSIGNED Then
                    Debug.Print(String.Format("CreateProcessInConsoleSession AdjustTokenPrivileges error: {0} Token does not have the privilege.", nErr))
                Else
                    Debug.Print(String.Format("CreateProcessInConsoleSession AdjustTokenPrivileges error: {0}", nErr))
                End If
            End If
        End If

        Dim dwCreationFlags As UInteger = NORMAL_PRIORITY_CLASS Or CREATE_NEW_CONSOLE
        Dim pEnv As IntPtr = IntPtr.Zero
        If CreateEnvironmentBlock(pEnv, hUserTokenDup, True) Then
            dwCreationFlags = dwCreationFlags Or CREATE_UNICODE_ENVIRONMENT
        Else
            pEnv = IntPtr.Zero
        End If

        bResult = CreateProcessAsUser(hUserTokenDup, Nothing, CommandLine, sa, sa, False, CInt(dwCreationFlags), pEnv, Nothing, si, pi)
        Dim iResultOfCreateProcessAsUser As Integer = Marshal.GetLastWin32Error()
        CloseHandle(hProcess)
        CloseHandle(hUserToken)
        CloseHandle(hUserTokenDup)
        CloseHandle(hPToken)
        Return If((iResultOfCreateProcessAsUser = 0), True, False)
    End Function

    <DllImport("kernel32.dll")>
    Private Shared Function Process32First(ByVal hSnapshot As UInteger, ByRef lppe As PROCESSENTRY32) As Integer
    End Function

    <DllImport("kernel32.dll")>
    Private Shared Function Process32Next(ByVal hSnapshot As UInteger, ByRef lppe As PROCESSENTRY32) As Integer
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Shared Function CreateToolhelp32Snapshot(ByVal dwFlags As UInteger, ByVal th32ProcessID As UInteger) As UInteger
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Shared Function CloseHandle(ByVal hSnapshot As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll")>
    Private Shared Function WTSGetActiveConsoleSessionId() As UInteger
    End Function

    <DllImport("Wtsapi32.dll")>
    Private Shared Function WTSQueryUserToken(ByVal SessionId As UInteger, ByRef phToken As IntPtr) As UInteger
    End Function

    <DllImport("kernel32.dll")>
    Private Shared Function ProcessIdToSessionId(ByVal dwProcessId As UInteger, ByRef pSessionId As UInteger) As Boolean
    End Function

    <DllImport("kernel32.dll")>
    Private Shared Function OpenProcess(ByVal dwDesiredAccess As UInteger, ByVal bInheritHandle As Boolean, ByVal dwProcessId As UInteger) As IntPtr
    End Function

    <DllImport("advapi32", SetLastError:=True)>
    <SuppressUnmanagedCodeSecurity>
    Private Shared Function OpenProcessToken(ByVal ProcessHandle As IntPtr, ByVal DesiredAccess As Integer, ByRef TokenHandle As IntPtr) As Boolean
    End Function

    <StructLayout(LayoutKind.Sequential)>
    Friend Structure LUID
        Public LowPart As Integer
        Public HighPart As Integer
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Friend Structure LUID_AND_ATRIBUTES
        Public Luid As LUID
        Public Attributes As Integer
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Private Structure PROCESSENTRY32
        Public dwSize As UInteger
        Public ReadOnly cntUsage As UInteger
        Public ReadOnly th32ProcessID As UInteger
        Public ReadOnly th32DefaultHeapID As IntPtr
        Public ReadOnly th32ModuleID As UInteger
        Public ReadOnly cntThreads As UInteger
        Public ReadOnly th32ParentProcessID As UInteger
        Public ReadOnly pcPriClassBase As Integer
        Public ReadOnly dwFlags As UInteger
        <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=260)>
        Public ReadOnly szExeFile As String
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Public Structure PROCESS_INFORMATION
        Public hProcess As IntPtr
        Public hThread As IntPtr
        Public dwProcessId As UInteger
        Public dwThreadId As UInteger
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Public Structure SECURITY_ATTRIBUTES
        Public Length As Integer
        Public lpSecurityDescriptor As IntPtr
        Public bInheritHandle As Boolean
    End Structure

    Private Enum SECURITY_IMPERSONATION_LEVEL
        SecurityAnonymous = 0
        SecurityIdentification = 1
        SecurityImpersonation = 2
        SecurityDelegation = 3
    End Enum

    <StructLayout(LayoutKind.Sequential)>
    Public Structure STARTUPINFO
        Public cb As Integer
        Public lpReserved As String
        Public lpDesktop As String
        Public lpTitle As String
        Public dwX As UInteger
        Public dwY As UInteger
        Public dwXSize As UInteger
        Public dwYSize As UInteger
        Public dwXCountChars As UInteger
        Public dwYCountChars As UInteger
        Public dwFillAttribute As UInteger
        Public dwFlags As UInteger
        Public wShowWindow As Short
        Public cbReserved2 As Short
        Public lpReserved2 As IntPtr
        Public hStdInput As IntPtr
        Public hStdOutput As IntPtr
        Public hStdError As IntPtr
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Friend Structure TOKEN_PRIVILEGES
        Friend PrivilegeCount As Integer
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=3)>
        Friend Privileges As Integer()
    End Structure

    Private Enum TOKEN_TYPE
        TokenPrimary = 1
        TokenImpersonation = 2
    End Enum
End Class