#include #include #pragma comment(lib, "mpr.lib") int __cdecl wmain(int argc, wchar_t** argv) { LPCWSTR pwszNetworkShare = L"\\\\xpvirt\\shared"; LPCWSTR pwszLocalDrive = L"M:"; HANDLE hToke5 = NULL; OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToke5); TOKEN_STATISTICS stats = {0}; ULONG retLen = 0; GetTokenInformation(hToke5, TokenStatistics, &stats, sizeof(stats), &retLen); CloseHandle(hToke5); printf("Token LUID is %08x-%08x\n", stats.AuthenticationId.HighPart, stats.AuthenticationId.LowPart); BOOL isAnAdmin = IsUserAnAdmin(); if(!isAnAdmin) { NETRESOURCE netRes = {0}; netRes.dwType = RESOURCETYPE_DISK; netRes.lpLocalName = pwszLocalDrive; netRes.lpRemoteName = pwszNetworkShare; WCHAR buf[MAX_PATH]; DWORD sizeBuf = ARRAYSIZE(buf), res = 0; DWORD err = WNetUseConnection(NULL, &netRes, NULL, NULL, 0, buf, &sizeBuf, &res); if(err == NO_ERROR) { puts("Unelevated process created drive"); } else { printf("Failed to create drive - error %lu\n", err); return 0; } } puts("Process has access to drives:"); WCHAR massiveBuffer[26 * 4 + 1] = {0}; LPWSTR pIter = massiveBuffer; GetLogicalDriveStrings(ARRAYSIZE(massiveBuffer), massiveBuffer); do { UINT driveType = GetDriveType(pIter); WCHAR target[500] = {0}; pIter[2] = 0; QueryDosDevice(pIter, target, ARRAYSIZE(target)); printf("Drive %ls - type %lu - Target: %ls\n", pIter, driveType, target); } while(*(pIter += 4)); if(!isAnAdmin) { WNetCancelConnection2(L"Z:", 0, TRUE); } return 0; }