Home All Groups Group Topic Archive Search About

Privileges and killing a process

Author
2 Jun 2005 1:54 PM
pithhelmet
Hi Everyone -

This is kinda a crazy one, so i thought i would post it up...

I have an application that is spawned if there is a fatal error in the
primary application.

This spawned program simply goes out and looks for orphaned applications
that are spawned from the main application (activex .exes) and if there are
any, then the application will kill them (by terminating the process by PID).

I have used the code snippet that is floating around the web (kill process)
that changes the privileges at run time....

Trouble is, running in the IDE - the application runs perfect -
running outside the IDE, the program doesn't kill the applications
(notepad.exe) is the example that i'm using.

In win2k, it just jumps right over notepad.exe,
in win2k3, it also jumps over notepad.exe - but it also blows out the themes
and won't allow the logged on user to log off or shutdown the computer.

I've commented out the code section about changing the privileges - and it
stopped the killing of the themes, and will allow the user to log off and
restart the computer, but it will not kill the process (notepad).

I have confirmed the PID of notepad and taskmanager, spy++ and the
application tries to kill the right PID, so thats not the issue (wrong PID)


but the process won't die.

<code>
Function KillProcess(ByVal hProcessID As Long, Optional ByVal ExitCode As
Long) As Boolean
Dim hToken As Long
Dim hProcess As Long
Dim tp As TOKEN_PRIVILEGES


If getVersion() >= 0 Then

If OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES Or
TOKEN_QUERY, hToken) = 0 Then
GoTo CleanUp
End If

' If LookupPrivilegeValue("", "SeDebugPrivilege", tp.LuidUDT) = 0 Then
If LookupPrivilegeValue(vbNullString, "SeImpersonatePrivilege", tp.LuidUDT)
= 0 Then
GoTo CleanUp
End If

tp.PrivilegeCount = 1
tp.Attributes = SE_PRIVILEGE_ENABLED

If AdjustTokenPrivileges(hToken, False, tp, 0, ByVal 0&, ByVal 0&) = 0 Then
GoTo CleanUp
End If
End If

hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, hProcessID)
If hProcess Then

KillProcess = (TerminateProcess(hProcess, ExitCode) <> 0)
' close the process handle
CloseHandle hProcess
End If

If getVersion() >= 0 Then
' under NT restore original privileges
tp.Attributes = 0
AdjustTokenPrivileges hToken, False, tp, 0, ByVal 0&, ByVal 0&

CleanUp:
If hToken Then CloseHandle hToken
End If

End Function

</code>

thanks

tony

Author
2 Jun 2005 2:53 PM
Lee Peedin
Wow, sure seems like a lot of code when you can run a simple script
and accomplish what you want.

watch for line wraps!

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer &
"\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
    ("SELECT * FROM Win32_Process WHERE Name = 'notepad.exe'")
For Each objProcess in colProcessList
    objProcess.Terminate()
Next

Lee


On Thu, 2 Jun 2005 06:54:01 -0700, "pithhelmet"
<pithhel***@discussions.microsoft.com> wrote:

Show quoteHide quote
>Hi Everyone -
>
>This is kinda a crazy one, so i thought i would post it up...
>
>I have an application that is spawned if there is a fatal error in the
>primary application.
>
>This spawned program simply goes out and looks for orphaned applications
>that are spawned from the main application (activex .exes) and if there are
>any, then the application will kill them (by terminating the process by PID).
>
>I have used the code snippet that is floating around the web (kill process)
>that changes the privileges at run time....
>
>Trouble is, running in the IDE - the application runs perfect -
>running outside the IDE, the program doesn't kill the applications
>(notepad.exe) is the example that i'm using.
>
>In win2k, it just jumps right over notepad.exe,
>in win2k3, it also jumps over notepad.exe - but it also blows out the themes
>and won't allow the logged on user to log off or shutdown the computer.
>
>I've commented out the code section about changing the privileges - and it
>stopped the killing of the themes, and will allow the user to log off and
>restart the computer, but it will not kill the process (notepad).
>
>I have confirmed the PID of notepad and taskmanager, spy++ and the
>application tries to kill the right PID, so thats not the issue (wrong PID)
>
>
>but the process won't die.
>
><code>
>Function KillProcess(ByVal hProcessID As Long, Optional ByVal ExitCode As
>Long) As Boolean
>Dim hToken As Long
>Dim hProcess As Long
>Dim tp As TOKEN_PRIVILEGES
>
>
>If getVersion() >= 0 Then
>
>If OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES Or
>TOKEN_QUERY, hToken) = 0 Then
>GoTo CleanUp
>End If
>
>' If LookupPrivilegeValue("", "SeDebugPrivilege", tp.LuidUDT) = 0 Then
>If LookupPrivilegeValue(vbNullString, "SeImpersonatePrivilege", tp.LuidUDT)
>= 0 Then
>GoTo CleanUp
>End If
>
>tp.PrivilegeCount = 1
>tp.Attributes = SE_PRIVILEGE_ENABLED
>
>If AdjustTokenPrivileges(hToken, False, tp, 0, ByVal 0&, ByVal 0&) = 0 Then
>GoTo CleanUp
>End If
>End If
>
>hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, hProcessID)
>If hProcess Then
>
>KillProcess = (TerminateProcess(hProcess, ExitCode) <> 0)
>' close the process handle
>CloseHandle hProcess
>End If
>
>If getVersion() >= 0 Then
>' under NT restore original privileges
>tp.Attributes = 0
>AdjustTokenPrivileges hToken, False, tp, 0, ByVal 0&, ByVal 0&
>
>CleanUp:
>If hToken Then CloseHandle hToken
>End If
>
>End Function
>
></code>
>
>thanks
>
>tony
Author
2 Jun 2005 3:10 PM
pithhelmet
Hi Lee -

I'm confused....

This script that you are quoting - can it be included in
a VB6 application??





Show quoteHide quote
"Lee Peedin" wrote:

> Wow, sure seems like a lot of code when you can run a simple script
> and accomplish what you want.
>
> watch for line wraps!
>
> strComputer = "."
> Set objWMIService = GetObject("winmgmts:" _
>     & "{impersonationLevel=impersonate}!\\" & strComputer &
> "\root\cimv2")
> Set colProcessList = objWMIService.ExecQuery _
>     ("SELECT * FROM Win32_Process WHERE Name = 'notepad.exe'")
> For Each objProcess in colProcessList
>     objProcess.Terminate()
> Next
>
> Lee
>
>
> On Thu, 2 Jun 2005 06:54:01 -0700, "pithhelmet"
> <pithhel***@discussions.microsoft.com> wrote:
>
> >Hi Everyone -
> >
> >This is kinda a crazy one, so i thought i would post it up...
> >
> >I have an application that is spawned if there is a fatal error in the
> >primary application.
> >
> >This spawned program simply goes out and looks for orphaned applications
> >that are spawned from the main application (activex .exes) and if there are
> >any, then the application will kill them (by terminating the process by PID).
> >
> >I have used the code snippet that is floating around the web (kill process)
> >that changes the privileges at run time....
> >
> >Trouble is, running in the IDE - the application runs perfect -
> >running outside the IDE, the program doesn't kill the applications
> >(notepad.exe) is the example that i'm using.
> >
> >In win2k, it just jumps right over notepad.exe,
> >in win2k3, it also jumps over notepad.exe - but it also blows out the themes
> >and won't allow the logged on user to log off or shutdown the computer.
> >
> >I've commented out the code section about changing the privileges - and it
> >stopped the killing of the themes, and will allow the user to log off and
> >restart the computer, but it will not kill the process (notepad).
> >
> >I have confirmed the PID of notepad and taskmanager, spy++ and the
> >application tries to kill the right PID, so thats not the issue (wrong PID)
> >
> >
> >but the process won't die.
> >
> ><code>
> >Function KillProcess(ByVal hProcessID As Long, Optional ByVal ExitCode As
> >Long) As Boolean
> >Dim hToken As Long
> >Dim hProcess As Long
> >Dim tp As TOKEN_PRIVILEGES
> >
> >
> >If getVersion() >= 0 Then
> >
> >If OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES Or
> >TOKEN_QUERY, hToken) = 0 Then
> >GoTo CleanUp
> >End If
> >
> >' If LookupPrivilegeValue("", "SeDebugPrivilege", tp.LuidUDT) = 0 Then
> >If LookupPrivilegeValue(vbNullString, "SeImpersonatePrivilege", tp.LuidUDT)
> >= 0 Then
> >GoTo CleanUp
> >End If
> >
> >tp.PrivilegeCount = 1
> >tp.Attributes = SE_PRIVILEGE_ENABLED
> >
> >If AdjustTokenPrivileges(hToken, False, tp, 0, ByVal 0&, ByVal 0&) = 0 Then
> >GoTo CleanUp
> >End If
> >End If
> >
> >hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, hProcessID)
> >If hProcess Then
> >
> >KillProcess = (TerminateProcess(hProcess, ExitCode) <> 0)
> >' close the process handle
> >CloseHandle hProcess
> >End If
> >
> >If getVersion() >= 0 Then
> >' under NT restore original privileges
> >tp.Attributes = 0
> >AdjustTokenPrivileges hToken, False, tp, 0, ByVal 0&, ByVal 0&
> >
> >CleanUp:
> >If hToken Then CloseHandle hToken
> >End If
> >
> >End Function
> >
> ></code>
> >
> >thanks
> >
> >tony
>
>
Author
2 Jun 2005 4:51 PM
Lee Peedin
As far as I know it can be.  I got this out of the Win2K Scripting
Guide.  There's a lot of power in using WMI.

Lee

On Thu, 2 Jun 2005 08:10:06 -0700, "pithhelmet"
<pithhel***@discussions.microsoft.com> wrote:

Show quoteHide quote
>
>Hi Lee -
>
>I'm confused....
>
>This script that you are quoting - can it be included in
>a VB6 application??
>
>
>
>
>
>"Lee Peedin" wrote:
>
>> Wow, sure seems like a lot of code when you can run a simple script
>> and accomplish what you want.
>>
>> watch for line wraps!
>>
>> strComputer = "."
>> Set objWMIService = GetObject("winmgmts:" _
>>     & "{impersonationLevel=impersonate}!\\" & strComputer &
>> "\root\cimv2")
>> Set colProcessList = objWMIService.ExecQuery _
>>     ("SELECT * FROM Win32_Process WHERE Name = 'notepad.exe'")
>> For Each objProcess in colProcessList
>>     objProcess.Terminate()
>> Next
>>
>> Lee
>>
>>
>> On Thu, 2 Jun 2005 06:54:01 -0700, "pithhelmet"
>> <pithhel***@discussions.microsoft.com> wrote:
>>
>> >Hi Everyone -
>> >
>> >This is kinda a crazy one, so i thought i would post it up...
>> >
>> >I have an application that is spawned if there is a fatal error in the
>> >primary application.
>> >
>> >This spawned program simply goes out and looks for orphaned applications
>> >that are spawned from the main application (activex .exes) and if there are
>> >any, then the application will kill them (by terminating the process by PID).
>> >
>> >I have used the code snippet that is floating around the web (kill process)
>> >that changes the privileges at run time....
>> >
>> >Trouble is, running in the IDE - the application runs perfect -
>> >running outside the IDE, the program doesn't kill the applications
>> >(notepad.exe) is the example that i'm using.
>> >
>> >In win2k, it just jumps right over notepad.exe,
>> >in win2k3, it also jumps over notepad.exe - but it also blows out the themes
>> >and won't allow the logged on user to log off or shutdown the computer.
>> >
>> >I've commented out the code section about changing the privileges - and it
>> >stopped the killing of the themes, and will allow the user to log off and
>> >restart the computer, but it will not kill the process (notepad).
>> >
>> >I have confirmed the PID of notepad and taskmanager, spy++ and the
>> >application tries to kill the right PID, so thats not the issue (wrong PID)
>> >
>> >
>> >but the process won't die.
>> >
>> ><code>
>> >Function KillProcess(ByVal hProcessID As Long, Optional ByVal ExitCode As
>> >Long) As Boolean
>> >Dim hToken As Long
>> >Dim hProcess As Long
>> >Dim tp As TOKEN_PRIVILEGES
>> >
>> >
>> >If getVersion() >= 0 Then
>> >
>> >If OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES Or
>> >TOKEN_QUERY, hToken) = 0 Then
>> >GoTo CleanUp
>> >End If
>> >
>> >' If LookupPrivilegeValue("", "SeDebugPrivilege", tp.LuidUDT) = 0 Then
>> >If LookupPrivilegeValue(vbNullString, "SeImpersonatePrivilege", tp.LuidUDT)
>> >= 0 Then
>> >GoTo CleanUp
>> >End If
>> >
>> >tp.PrivilegeCount = 1
>> >tp.Attributes = SE_PRIVILEGE_ENABLED
>> >
>> >If AdjustTokenPrivileges(hToken, False, tp, 0, ByVal 0&, ByVal 0&) = 0 Then
>> >GoTo CleanUp
>> >End If
>> >End If
>> >
>> >hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, hProcessID)
>> >If hProcess Then
>> >
>> >KillProcess = (TerminateProcess(hProcess, ExitCode) <> 0)
>> >' close the process handle
>> >CloseHandle hProcess
>> >End If
>> >
>> >If getVersion() >= 0 Then
>> >' under NT restore original privileges
>> >tp.Attributes = 0
>> >AdjustTokenPrivileges hToken, False, tp, 0, ByVal 0&, ByVal 0&
>> >
>> >CleanUp:
>> >If hToken Then CloseHandle hToken
>> >End If
>> >
>> >End Function
>> >
>> ></code>
>> >
>> >thanks
>> >
>> >tony
>>
>>
Author
21 Jul 2005 1:22 PM
aaa
> strComputer = "."
> Set objWMIService = GetObject("winmgmts:" _
>     & "{impersonationLevel=impersonate}!\\" & strComputer &
> "\root\cimv2")
> Set colProcessList = objWMIService.ExecQuery _
>     ("SELECT * FROM Win32_Process WHERE Name = 'notepad.exe'")
> For Each objProcess in colProcessList
>     objProcess.Terminate()
> Next

What kind of objects are objWMIService, colProcessList, and objProcess?