【情シスさん向け】標準ユーザーでもアプリをインストールできるようにする

<Project Sdk="Microsoft.NET.Sdk.Worker">

  <PropertyGroup>
    <TargetFramework>net7.0-windows</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <UserSecretsId>dotnet-MyService-24f66dd5-0856-40e4-a83b-0086ec7054b5</UserSecretsId>
    <OutputType>exe</OutputType>
    <PublishSingleFile Condition="'$(Configuration)' == 'Release'">true</PublishSingleFile>
    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
    <PlatformTarget>x64</PlatformTarget>
    <PublishSingleFile>true</PublishSingleFile>
    <SelfContained>true</SelfContained>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.Extensions.Hosting" Version="7.0.1" />
    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="7.0.1" />
  </ItemGroup>
</Project>

using MyService;
using Microsoft.Extensions.Logging.Configuration;
using Microsoft.Extensions.Logging.EventLog;

HostApplicationBuilder builder = Host.CreateApplicationBuilder(args);
builder.Services.AddWindowsService(options => options.ServiceName = ".NET Joke Service");

LoggerProviderOptions.RegisterProviderOptions<
    EventLogSettings, EventLogLoggerProvider>(builder.Services);

builder.Services.AddHostedService<Worker>();

IHost host = builder.Build();
host.Run();

namespace MyService;

using System;
using System.IO;
using System.Runtime.InteropServices;

public class Worker : BackgroundService
{
    [DllImport("Dll1.dll")]
    public static extern void CallProc();

    private readonly ILogger<Worker> _logger;
    private readonly string _flgFileName = "a.flg";
    private readonly string _exeFileName = "a.exe";

    public Worker(ILogger<Worker> logger) => _logger = logger;

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        string aflg = Path.Combine("c:/Temp", _flgFileName);
        string aexe = Path.Combine("c:/Temp", _exeFileName);

        try
        {
            while (!stoppingToken.IsCancellationRequested)
            {
                _logger.LogInformation("Worker running at: {time}", DateTimeOffset.Now);

                if (Path.Exists(aflg))
                {
                    _logger.LogWarning("flag file exists");

                    var file = new FileInfo(aexe);
                    long size = file.Length;
                    _logger.LogInformation("file size1: {0} bytes", size);

                    using (var sr = new StreamReader(aflg))
                    {
                        string line = sr.ReadLine();
                        if (long.TryParse(line, out long s))
                        {
                            _logger.LogInformation("file size*2: {0} bytes", s);

                            // ★ flgファイルの内容が正当でなければ
                            // 悪意ある操作とみなして、インストーラーを実行させない
                            if (size * 2 == s) 
                            {
                                CallProc();
                            }
                        }
                    }

                    File.Delete(aflg);
                    _logger.LogInformation("flag file deleted");
                }
                else if (Path.Exists(aexe))
                {
                    try
                    {
                        File.Delete(aexe);
                        _logger.LogInformation("exe file deleted");
                    }
                    catch (UnauthorizedAccessException)
                    {
                        _logger.LogInformation("exe file access denied");
                    }
                    catch (IOException)
                    {
                        _logger.LogInformation("exe file in use");
                    }
                }

                _logger.LogInformation("wait five minutes");
                await Task.Delay(5000, stoppingToken);
            }
        }
        catch (TaskCanceledException)
        {
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "{Message}", ex.Message);
            Environment.Exit(1);
        }
    }
}

#include <windows.h>
#include <string>
#include <iostream>
#include <windows.h>
#include <tlhelp32.h>
#include <tchar.h>

extern "C" __declspec(dllexport) void __stdcall CallProc();

BOOL APIENTRY DllMain(HMODULE hModule,
                      DWORD ul_reason_for_call,
                      LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

BOOL createProcessAsUser(const std::wstring &app, const std::wstring &param, HANDLE token, DWORD creationFlags)
{
    wchar_t arg[MAX_PATH] = L"";
    wcscpy_s(arg, (param.empty() ? app.c_str() : (app + L" " + param).c_str()));

    WCHAR tmp[64] = L"winsta0\\default";
    STARTUPINFO si = {sizeof(STARTUPINFO), nullptr, tmp};
    PROCESS_INFORMATION pi = {};
    const BOOL retval = CreateProcessAsUser(token, nullptr, arg, nullptr, nullptr, FALSE, creationFlags, nullptr, nullptr, &si, &pi);

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    return retval;
}

void __stdcall CallProc()
{
    DWORD dwSesId = ::WTSGetActiveConsoleSessionId();

    DWORD currentProcessId = GetCurrentProcessId();
    std::cout << "currentProcessId: " << currentProcessId << std::endl;

    HANDLE hProcess = OpenProcess(MAXIMUM_ALLOWED, false, currentProcessId);
    HANDLE hPToken = NULL;

    if (!OpenProcessToken(hProcess, TOKEN_DUPLICATE, &hPToken))
    {
        std::cout << "err1" << std::endl;
        CloseHandle(hProcess);
        return;
    }

    SECURITY_ATTRIBUTES sa = {0};
    sa.nLength = sizeof(sa);

    HANDLE hUserTokenDup = NULL;

    if (!DuplicateTokenEx(hPToken, MAXIMUM_ALLOWED, &sa, SecurityIdentification, TokenPrimary, &hUserTokenDup))
    {
        std::cout << "err2" << std::endl;
        CloseHandle(hProcess);
        CloseHandle(hPToken);
        return;
    }

    STARTUPINFO si = {0};
    si.cb = sizeof(si);

    DWORD creationFlags = CREATE_NEW_CONSOLE | NORMAL_PRIORITY_CLASS;
    BOOL _ = SetTokenInformation(hUserTokenDup, TokenSessionId, &dwSesId, sizeof(DWORD));
    BOOL retval = createProcessAsUser(L"c:\\Temp\\a.exe", L"", hUserTokenDup, creationFlags);
    std::cout << "retval:" << retval << std::endl;
}

@REM 2023.10

echo "IEXPRESS: extract the installer"
powershell sleep 1

if exist c:\Temp\a.flg (
    echo flg file exists, exit
    powershell sleep 1
    exit
)

if exist c:\Temp\a.exe (
    echo exe file exists, exit
    powershell sleep 1
    exit
)

copy a.exe c:\Temp\
copy a.flg c:\Temp\
@REM powershell (Get-Item a.exe).Length > c:\Temp\a.flg
@REM type nul > %TEMP%\a.flg

echo "IEXPRESS: finish to 1 sec"

powershell sleep 1
@REM REM pause