今天在討論區看到這樣的問題
有時利用ASP.NET執行時,會遇到權限不足的問題
所以必需提高權限才能執行某些程式
小朱大大提供了一個不錯的參考網址
小弟就用一的實例教大家如何實現這個功能
ASP.NET(C#)
HighLevelUser.aspx
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="HighLevelUser.aspx.cs" Inherits="HighLevelUser" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head runat="server"> <title>HighLevelUser</title> </head> <body> <form id="form1" runat="server"> <div> </div> </form> </body> </html>
HighLevelUser.aspx.cs
using System; using System.Data; using System.Configuration; using System.Collections; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Web.UI.HtmlControls; using System.Runtime.InteropServices; using System.Security.Principal; using System.IO; public partial class HighLevelUser : System.Web.UI.Page { public const int LOGON32_LOGON_INTERACTIVE = 2; public const int LOGON32_PROVIDER_DEFAULT = 0; WindowsImpersonationContext impersonationContext; [DllImport("advapi32.dll")] public static extern int LogonUserA(String lpszUserName, String lpszDomain, String lpszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken); [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)] public static extern int DuplicateToken(IntPtr hToken, int impersonationLevel, ref IntPtr hNewToken); [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)] public static extern bool RevertToSelf(); [DllImport("kernel32.dll", CharSet = CharSet.Auto)] public static extern bool CloseHandle(IntPtr handle); public void Page_Load(Object s, EventArgs e) { //使用者(ASPNET) //下面這行在沒有高權限的使用者會產生,拒絕存取路徑 'e:\log.txt'。 //File.AppendAllText(@"e:\log.txt", "F6 Team"); if (impersonateValidUser("Administrator", "localhost", "123456")) { Response.Write(string.Format("驗證成功,目前使用者：{0}<br/>", WindowsIdentity.GetCurrent().Name)); //提高權限(Administrator),才能寫檔 File.AppendAllText(@"e:\log.txt", "F6 Team"); //還原使用者 undoImpersonation(); Response.Write(string.Format("作業完成,目前使用者：{0}<br/>", WindowsIdentity.GetCurrent().Name)); } else { Response.Write(string.Format("驗證失敗,目前使用者：{0}<br/>", WindowsIdentity.GetCurrent().Name)); } } private bool impersonateValidUser(String userName, String domain, String password) { WindowsIdentity tempWindowsIdentity; IntPtr token = IntPtr.Zero; IntPtr tokenDuplicate = IntPtr.Zero; if (RevertToSelf()) { if (LogonUserA(userName, domain, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, ref token) != 0) { if (DuplicateToken(token, 2, ref tokenDuplicate) != 0) { tempWindowsIdentity = new WindowsIdentity(tokenDuplicate); impersonationContext = tempWindowsIdentity.Impersonate(); if (impersonationContext != null) { CloseHandle(token); CloseHandle(tokenDuplicate); return true; } } } } if (token != IntPtr.Zero) CloseHandle(token); if (tokenDuplicate != IntPtr.Zero) CloseHandle(tokenDuplicate); return false; } private void undoImpersonation() { impersonationContext.Undo(); } }
執行結果：
沒有權限的結果
有權限的結果
參考網址：http://www.blueshop.com.tw/board/show.asp?subcde=BRD20090224193357J4D&fumcde=FUM20041006161839LRJhttp://support.microsoft.com/default.aspx/kb/306158
# re: [ASP.NET]在ASP.NET應用程式中模擬高權限使用者執行程式, Posted by Jason on 2009/4/21 上午 01:54 回覆
呼~!啦~~!啦~~~!這種提升方式不知道會不會造成一些實體權限問題喲!不過，有沒有可能開發成一種Maintain hook的模組?如果配合用push method威力不小喲~~!PUMA! 近日小公司聚會再約你囉!Jason