mercredi 1 avril 2015

Can I copy TokenPrivileges array from one computer to another?

I'm writing a logging service that may collect privileges of a process for the purpose of transmitting it to another computer. I use the following code to collect it:



HANDLE hToken;
if(OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
DWORD dwSize = 0;
if(!GetTokenInformation(hToken, TokenPrivileges, NULL, dwSize, &dwSize) &&
::GetLastError() == ERROR_INSUFFICIENT_BUFFER)
{
BYTE* pb = new (std::nothrow) BYTE[dwSize];
if(pb)
{
TOKEN_PRIVILEGES* pTPs = (TOKEN_PRIVILEGES*)pb;
DWORD dwSize2;
if(GetTokenInformation(hToken, TokenPrivileges, pTPs, dwSize, &dwSize2) &&
dwSize2 <= dwSize)
{
//Got our BYTE array in 'pb' of size 'dwSize2' bytes
memcpy(pByteArrayToTransmit, pb, dwSize2);

}

delete[] pb;
}
}

CloseHandle(hToken);
}


But I'm curious, if I could pass the pByteArrayToTransmit array to another Windows computer and be able to convert it into a readable form using LookupPrivilegeName API?


PS. The reason I'm not calling LookupPrivilegeName on the client machine (where the data is being logged) is to save on the size of the logged data, since this process may repeat many times over.


Aucun commentaire:

Enregistrer un commentaire