Psst! Did you know DevelopmentNow is a mobile web site design agency?

Contact us for help mobilizing your site, or to sign up for our beta Mobile Web SDK!
all groups > iis security > june 2008 >

iis security : IIS7: CreateProcessWithLogonW access denied


Kyle Alons
6/17/2008 3:53:47 PM
Code like this in an ASP.NET web page (code behind .cs file) works in IIS
prior to v7, but fails with access denied (5) on v7. Any ideas on a what
permissions are required for this to work? Thanks.

[StructLayout(LayoutKind.Sequential)]
internal struct PROCESS_INFORMATION
{
internal IntPtr hProcess;
internal IntPtr hThread;
internal int dwProcessId;
internal int dwThreadId;
}

[StructLayout(LayoutKind.Sequential)]
internal struct STARTUPINFO
{
internal int cb;
[MarshalAs(UnmanagedType.LPTStr)]
internal string lpReserved;
[MarshalAs(UnmanagedType.LPTStr)]
internal string lpDesktop;
[MarshalAs(UnmanagedType.LPTStr)]
internal string lpTitle;
internal int dwX;
internal int dwY;
internal int dwXSize;
internal int dwYSize;
internal int dwXCountChars;
internal int dwYCountChars;
internal int dwFillAttribute;
internal int dwFlags;
internal short wShowWindow;
internal short cbReserved2;
internal IntPtr lpReserved2;
internal IntPtr hStdInput;
internal IntPtr hStdOutput;
internal IntPtr hStdError;
}

[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
internal static extern bool CreateProcessWithLogonW(String lpszUsername,
String lpszDomain, String lpszPassword, int dwLogonFlags, string
applicationName,
StringBuilder commandLine, int creationFlags, IntPtr environment,
string currentDirectory,
ref STARTUPINFO sui, out PROCESS_INFORMATION processInfo);

//dwLogonFlags Specifies the logon option
const int LOGON_WITH_PROFILE = 1;
const int LOGON_NETCREDENTIALS_ONLY = 2;

//dwCreationFlags - Specifies how the process is created
const int CREATE_UNICODE_ENVIRONMENT = 0x00000400;

//dwCreationFlags parameter controls the new process's priority class
const int NORMAL_PRIORITY_CLASS = 0x00000020;
const int IDLE_PRIORITY_CLASS = 0x00000040;
const int HIGH_PRIORITY_CLASS = 0x00000080;
const int REALTIME_PRIORITY_CLASS = 0x00000100;
const int BELOW_NORMAL_PRIORITY_CLASS = 0x00004000;
const int ABOVE_NORMAL_PRIORITY_CLASS = 0x00008000;

string app = "cmd";

StringBuilder p = new StringBuilder();

p.Append("/c dir");

PROCESS_INFORMATION processInfo;
STARTUPINFO startInfo = new STARTUPINFO();
startInfo.cb = Marshal.SizeOf(startInfo);
startInfo.lpDesktop = "winsta0\\default";

if (CreateProcessWithLogonW(user, ".", pwd,
LOGON_NETCREDENTIALS_ONLY, app, p,
NORMAL_PRIORITY_CLASS | CREATE_UNICODE_ENVIRONMENT, IntPtr.Zero, "",
ref startInfo, out processInfo))
{
Response.Write("<p>Started with Process ID " +
processInfo.dwProcessId.ToString() + "</p>");
}
else
{
Response.Write(Marshal.GetLastWin32Error());
}

David Wang
6/17/2008 6:56:05 PM
I believe Code Access Security for ASP.Net was "Low" prior to IIS7/
Vista, which allowed code like yours to work with ASP.Net, but it was
*horribly* insecure.

In IIS7 it was raised to "Medium", which will make code like yours
fail.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//


[quoted text, click to view]
Kyle Alons
6/18/2008 6:04:56 AM
[quoted text, click to view]
Vista, which allowed code like yours to work with ASP.Net, but it was
*horribly* insecure.

Is there an alternative that works with the new default security setting?

David Wang
6/18/2008 3:14:45 PM
[quoted text, click to view]


There is no alternative for your type of code to work with the default
setting -- that would be allowing the very security vulnerabilities
which were closed by changing the default.

Your choices are to either change the default or modify the default
Code Access Security on your system.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
Kyle Alons
6/19/2008 11:20:05 AM
[quoted text, click to view]
setting -- that would be allowing the very security vulnerabilities
which were closed by changing the default.

[quoted text, click to view]
Code Access Security on your system.

How is that done?

David Wang
6/19/2008 10:15:52 PM
[quoted text, click to view]


I highly recommend searching on the terms "Modify Code Access
Security" to arrive at good answers for your question.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
Kyle Alons
6/20/2008 1:03:52 PM
[quoted text, click to view]
Security" to arrive at good answers for your question.

Based on http://msdn.microsoft.com/en-us/library/aa302425.aspx, I added a
trust element to machine.config (both 32- and 64-bit flavors):

<system.web>
<!-- level="[Full|High|Medium|Low|Minimal]" -->
<trust level="Full" originUrl=""/>
</system.web>

but still get access denied.

David Wang
6/21/2008 2:08:30 AM
[quoted text, click to view]



How are you certain your settings actually took place at the scope you
desire...


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
Kyle Alons
6/21/2008 10:03:49 PM
[quoted text, click to view]
desire...

I'm not certain of much, but changing the setting does seem to have some
effect. "Full" results in GetLastError of 5 (access denied), while High or
Medium results in:

Security Exception
Description: The application attempted to perform an operation not allowed
by the security policy. To grant this application the required permission
please contact your system administrator or change the application's trust
level in the configuration file.

Exception Details: System.Security.SecurityException: Request for the
permission of type 'System.Security.Permissions.SecurityPermission,
mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
failed.
....


and Low or Minimal gives:

Server Error in '/Test' Application.
--------------------------------------------------------------------------------

Debugging is not supported under current trust level settings.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.

Exception Details: System.Web.HttpException: Debugging is not supported
under current trust level settings.

David Wang
6/22/2008 7:59:10 PM
Do you need to use cmd.exe. Try another EXE.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//



[quoted text, click to view]
David Wang
6/23/2008 10:45:49 AM
[quoted text, click to view]


Those are all EXE in System32, which like CMD.EXE have "special" ACLs
that prevent them from being launched remotely from IIS. CMD.EXE has
further security checks inside of it to prevent being used to launch
batch scripts launched remotely from IIS.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
Kyle Alons
6/23/2008 11:26:02 AM
[quoted text, click to view]

I've tried with xcopy, cscript, and a bogus (non-existent) exe and get the
same result.

Kyle Alons
6/23/2008 12:48:49 PM
[quoted text, click to view]
that prevent them from being launched remotely from IIS.

Even a bogus EXE like 'blah'?

I also have the same problem with a custom console executable (which is what
I was using originally). It and the others previously mentioned (except the
non-existent one, but that one doesn't result in access denied either) work
properly from ASP.NET on Win XP/2003, but I haven't found a way to get it to
work in 2008.

AddThis Social Bookmark Button