C#如何实现无需密码以其他用户身份创建进程

实现原理 #

你当前使用的.NET原生Process类启动其他用户进程的逻辑强制要求传入密码，要实现无密码启动，需要调用Windows原生API，借助管理员权限直接获取目标用户的安全令牌，用令牌启动进程，不需要显式传入密码。
该方案仅在程序已完成UAC提权、获得管理员权限的场景下可用。

完整实现代码 #

首先需要引入对应的命名空间和P/Invoke声明：

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security.Principal;

public class ProcessHelper
{
    // 导入Windows API
    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    private static extern bool LogonUser(string lpszUsername, string lpszDomain, string lpszPassword,
        int dwLogonType, int dwLogonProvider, out IntPtr phToken);

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    private static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine,
        IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags,
        IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFO lpStartupInfo,
        out PROCESS_INFORMATION lpProcessInformation);

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool CloseHandle(IntPtr hObject);

    // 结构体定义
    [StructLayout(LayoutKind.Sequential)]
    private struct STARTUPINFO
    {
        public int cb;
        public string lpReserved;
        public string lpDesktop;
        public string lpTitle;
        public int dwX;
        public int dwY;
        public int dwXSize;
        public int dwYSize;
        public int dwXCountChars;
        public int dwYCountChars;
        public int dwFillAttribute;
        public int dwFlags;
        public short wShowWindow;
        public short cbReserved2;
        public IntPtr lpReserved2;
        public IntPtr hStdInput;
        public IntPtr hStdOutput;
        public IntPtr hStdError;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct PROCESS_INFORMATION
    {
        public IntPtr hProcess;
        public IntPtr hThread;
        public int dwProcessId;
        public int dwThreadId;
    }

    private const int LOGON32_LOGON_INTERACTIVE = 2;
    private const int LOGON32_PROVIDER_DEFAULT = 0;
    private const uint CREATE_NEW_CONSOLE = 0x00000010;

    // 无密码以指定用户身份启动进程方法
    public static bool CreateProcessAsUserWithoutPassword(string userName, string exePath)
    {
        IntPtr userToken = IntPtr.Zero;
        PROCESS_INFORMATION procInfo = new PROCESS_INFORMATION();
        STARTUPINFO startupInfo = new STARTUPINFO();
        startupInfo.cb = Marshal.SizeOf(startupInfo);

        try
        {
            // 管理员权限下无需传入密码即可登录获取令牌，域用户可指定域名，本地用户传"."即可
            bool logonSuccess = LogonUser(userName, ".", null, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, out userToken);
            if (!logonSuccess)
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            // 用用户令牌启动进程
            bool createSuccess = CreateProcessAsUser(userToken, exePath, null, IntPtr.Zero, IntPtr.Zero, false,
                CREATE_NEW_CONSOLE, IntPtr.Zero, null, ref startupInfo, out procInfo);
            if (!createSuccess)
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            return true;
        }
        finally
        {
            // 释放句柄避免内存泄漏
            if (userToken != IntPtr.Zero) CloseHandle(userToken);
            if (procInfo.hProcess != IntPtr.Zero) CloseHandle(procInfo.hProcess);
            if (procInfo.hThread != IntPtr.Zero) CloseHandle(procInfo.hThread);
        }
    }
}

使用示例 #

直接调用方法即可，无需传入密码：

// 以用户test的身份启动notepad.exe
ProcessHelper.CreateProcessAsUserWithoutPassword("test", @"C:\Windows\notepad.exe");

注意事项 #

• 目标用户必须是本地存在的有效用户，若是域用户，将LogonUser方法的第二个参数改为对应的域名即可。
• 启动的进程默认继承目标用户的权限上下文，不会继承当前程序的管理员权限，符合sudo切换用户的行为逻辑。
• 如果调用失败，可通过Win32Exception的错误代码定位具体原因，常见错误包括用户不存在、权限不足无法模拟用户等。

内容的提问来源于stack exchange，提问作者Peyang