Failed to check against Nt Authority\System SID - c

Question

I have a process which can be spawned by a service with either NT AUTHORITY\Network Service or NT AUTHORITY\System, and i need to check for it. So i have written a code like this:
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) {
GetTokenInformation(hToken, 1, 0, 0, &dwOut);
if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
hTokenUser = (TOKEN_USER*)malloc( dwOut );
if (!GetTokenInformation(hToken, TokenUser, hTokenUser, dwOut, &dwOut))
return false;
}
else
return false;
PSID psid = NULL;
SID_IDENTIFIER_AUTHORITY ntAuth = SECURITY_NT_AUTHORITY;
AllocateAndInitializeSid(&ntAuth, 1, SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, &psid);
if (EqualSid(psid, hTokenUser->User.Sid)) {
bResult = TRUE;
}
}
So what i do, i get current process token, and i get a SID from it using GetTokenInfo then i create the NT_AUTHORITY\System SID, using AllocateAndInitializeSid, and i compare two values together, however, it never works, when the process is run under NT_AUTHORITY\System check is always failing. Is this the correct way to get NT_AUTHORITY\System SID and compare it with the process sid?

Answer 1

Your code leaks handles and memory but it does provide the correct result on my machine. It might be different on your system so it would really help if you print out the result and GetLastError of every function call to help you debug. You should also code your function so you can tell the difference between errors and a negative (successful) result.
HRESULT isSystemUser()
{
HRESULT hr = E_FAIL;
HANDLE hToken;
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
TOKEN_USER *pTU = NULL;
DWORD dwOut;
GetTokenInformation(hToken, TokenUser, 0, 0, &dwOut);
hr = HRESULT_FROM_WIN32(GetLastError());
if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
pTU = (TOKEN_USER*) malloc(dwOut), hr = E_OUTOFMEMORY;
if (pTU)
{
if (GetTokenInformation(hToken, TokenUser, pTU, dwOut, &dwOut))
{
PSID psid = NULL;
SID_IDENTIFIER_AUTHORITY ntAuth = SECURITY_NT_AUTHORITY;
if (AllocateAndInitializeSid(&ntAuth, 1, SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, &psid))
{
hr = EqualSid(psid, pTU->User.Sid) ? S_OK : S_FALSE;
FreeSid(psid);
}
else
hr = HRESULT_FROM_WIN32(GetLastError());
}
else
hr = HRESULT_FROM_WIN32(GetLastError());
free(pTU);
}
CloseHandle(hToken);
}
else
hr = HRESULT_FROM_WIN32(GetLastError());
return hr;
}
...
printf("isSystemUser=%d\n", isSystemUser()); // 0 = true, 1 = false, < 0 = error
and when running it:
C:\windows\system32>c:\test.exe
isSystemUser=0
C:\windows\system32>whoami
nt authority\system
Is it possible that you are not actually running as the real System user? What does ConvertSidToStringSid return for your TokenUser?