Let's say I have a simple console program to fetch a list of files given the folder name. I want to call the console program using PHP code on a site that is running on a unique Windows user account (ie not the default web user account). Is there a way I can allow the Windows account access to the console program without giving it blanket access to cmd.exe? I'm working with IIS 6 on Windows 2003 Server.
Update:
Here's some code I've tried using popen()
$reg_cmd = '"C:\WINDOWS\system32\notepad.exe"' ;
$error = '';
$handle = popen($reg_cmd, 'r');
if (!$handle){
$last_error = error_get_last();
$error = $last_error['message'];
}
else{
while (!feof($handle)) {
$result .= fread($handle, 2096);
}
}
pclose($handle);
$error ends up containing either:
popen("C:\WINDOWS\system32\notepad.exe",r) [function.popen]: Result too large
OR
popen("C:\WINDOWS\system32\notepad.exe",r) [function.popen]: No such file or directory
I've no idea why the error message is inconsistent. The results were even less promising using proc_open().
Can you use proc_open() instead of exec()?
From version 5.2.1 proc_open() no longer requires you to give access to cmd.exe.
Related
As part of a larger .Net 4.0 program I have a piece that queries the WMI for a list of network adapters and from that creates a list<> of physical adapters with MAC addresses.
It works on the machines I've tried it on, but when sent to the client, the list is empty. If they run IPCONFIG /ALL at a command prompt the MACs are listed.
My first thought is that there is a group policy in place preventing the enumeration, but everything I've found so far points to group policies that affects remote access through the firewall.
I've tried it locally as both a standard user and administration user, both provide the same list.
The empty query does not generate an exception.
I could ask them to go to the machines and check individual permissions, but since this seems to be a group issue that seems to be the wrong direction. What am I missing?
public static List<WmiNetworkInterfaceItem> QueryphysicalNetworkInterfaces()
{
ManagementObjectSearcher searcher =
new ManagementObjectSearcher("root\\CIMV2",
"SELECT * FROM Win32_NetworkAdapter");
List<WmiNetworkInterfaceItem> result = new List<WmiNetworkInterfaceItem>();
foreach (ManagementObject queryObj in searcher.Get()) {
if (queryObj["PhysicalAdapter"].Equals(true)) {
if (queryObj["AdapterTypeId"] != null) {
if (queryObj["AdapterTypeId"].ToString().Equals("0")) {
WmiNetworkInterfaceItem wmiNetworkInterfaceItem = new WmiNetworkInterfaceItem();
wmiNetworkInterfaceItem.Name = ManagementObjectPropertyString(queryObj["Name"]);
wmiNetworkInterfaceItem.MacAddress = ManagementObjectPropertyString(queryObj["MACAddress"]);
wmiNetworkInterfaceItem.PhysicalAdapter = queryObj["PhysicalAdapter"].Equals(true);
wmiNetworkInterfaceItem.AdapterType = ManagementObjectPropertyString(queryObj["AdapterType"]);
wmiNetworkInterfaceItem.AdapterTypeId = -1;
int.TryParse(ManagementObjectPropertyString(queryObj["AdapterTypeId"]), out wmiNetworkInterfaceItem.AdapterTypeId);
wmiNetworkInterfaceItem.Description = ManagementObjectPropertyString(queryObj["Description"]);
wmiNetworkInterfaceItem.PermanentAddress = ManagementObjectPropertyString(queryObj["PermanentAddress"]);
result.Add(wmiNetworkInterfaceItem);
}
}
}
}
return result;
}
Using the WBEMTest utility included with Windows as suggested by user atp_09 in comments, I was able to have the customer query his machine. Using this query exactly one adapter was returned in both standard and administrative user accounts indicating there was nothing in the machine preventing this from working.
SELECT * FROM Win32_NetworkAdapter where PhysicalAdapter = true
Upon further review there was an error in how I later dealt with the list with a single response.
Application: Connecting to BigQuery using BigQuery APIs for Java
Environment: Eclipse, Windows 7
My application was running fine until last night. I've made no changes (except for restarting my computer) and my code is suddenly giving me this error:
Application name is not set. Call Builder#setApplicationName.
Thankfully I had a tar'd version of my workspace from last night. I ran a folder compare and found the local_db.bin file was different. I deleted the existing local_db.bin file and tried to run the program again. And it worked fine!
Any idea why this might have happened?
Hopefully this will help anyone else who stumbles upon this issue.
Try this to set your application name
Drive service = new Drive.Builder(httpTransport, jsonFactory, null)
.setHttpRequestInitializer(credential)
.setApplicationName("Your app name")
.build();
If you are working with only Firebase Dynamic Links without Android or iOS app
Try this.
builder.setApplicationName(firebaseUtil.getApplicationName());
FirebaseUtil is custom class add keys and application name to this class
FirebaseDynamicLinks.Builder builder = new FirebaseDynamicLinks.Builder(
GoogleNetHttpTransport.newTrustedTransport(), JacksonFactory.getDefaultInstance(), null);
// initialize with api key
FirebaseDynamicLinksRequestInitializer firebaseDynamicLinksRequestInitializer = new FirebaseDynamicLinksRequestInitializer(
firebaseUtil.getFirebaseApiKey());
builder.setFirebaseDynamicLinksRequestInitializer(firebaseDynamicLinksRequestInitializer);
builder.setApplicationName(firebaseUtil.getApplicationName());
// build dynamic links
FirebaseDynamicLinks firebasedynamiclinks = builder.build();
// create Firebase Dynamic Links request
CreateShortDynamicLinkRequest createShortLinkRequest = new CreateShortDynamicLinkRequest();
createShortLinkRequest.setLongDynamicLink(firebaseUtil.getFirebaseUrlPrefix() + "?link=" + urlToShorten);
Suffix suffix = new Suffix();
suffix.setOption(firebaseUtil.getShortSuffixOption());
createShortLinkRequest.setSuffix(suffix);
// request short url
FirebaseDynamicLinks.ShortLinks.Create request = firebasedynamiclinks.shortLinks()
.create(createShortLinkRequest);
CreateShortDynamicLinkResponse createShortDynamicLinkResponse = request.execute();
How can I check if a script is running with root-privileges?
I am using the following code, but it uses linux commands to get the user id so it would not work on m$ win. Is there an platform independent approach to handle this problem ?
if { [exec id -u] eq 0 } {
//nice, let us destroy something!
} else {
//sorry. you are not root
}
Windows has no root privileges.
Maybe the SYSTEM account or a member of the Administrators group is what you want.
There is no known platform independent approach that I know of.
I suggest branching for different OS.
On Windows: To check if the current process runs as a member of the Administrators group you could do the following thing:
package require twapi
set token [twapi::open_process_token]
set groups [twapi::get_token_groups_and_attrs $token]
twapi::close_token $token
if {[dict exists $groups S-1-5-32-544] && {enabled} in [dict get $groups S-1-5-32-544]} {
puts "I run as administrator"
} else {
puts "No admin rights"
}
This requires twapi, a great package for windows.
The Administrators' SID is hardcoded, because it is the same on every system, while the name of the Administrators group is not (on my system it is "Administratoren").
You should check if the group is enabled because starting with Windows Vista there is UAC, which will list the Administrators' group SID (S-1-5-32-544) for members of this group, but with a use_for_deny_only flag. (Only when invoked with the "run as administrator", this group will be enabled.)
On Unix/Linux I suggest using TclX.
here it is simple:
package require TclX
if {[id userid]} {
puts "Not root"
} else {
puts "root"
}
This might even work with OS/X, but I'm not sure.
PS: Don't be evil.
In perl you can write following to get user name of under which the script is running as follows (independent of OS)
print "Current username is " . (getpwuid($<))[0] . "\n";
I don't know muhc about TCL though - but you can look here
how to do getpwnam/getpwuid etc in tcl
and here http://wiki.tcl.tk/1649
I am having an issue trying to query the ScriptDb of a resource file in Google Apps Script. I create a script file (file1), add it as a resource to another script file (file2). I call file1 from file2 to return a handle to its ScriptDb. This works fine. I then try to query the ScriptDb but have a permissions error returned.
Both files owned by same user and in same google environment
See code below:
file 1:
function getMyDb() {
return ScriptDb.getMyDb;
}
file 2 (references file1):
function getDataFromFile1() {
var db = file1.getMyDb(); // This works
var result = db.query({..............}); // This results in a permissions error!
}
I am at a loss to understand why I can access file1 and get back a handle on the ScriptDb, but then am not able to query it, due to an permissions issue.
I have tried to force file1 to require re-authorization, but have not yet been successful. I tried adding a new function and running it, so any suggestions there would be gratefully received.
Thanks in advance
Chris
There appears to be an error in file1/line2. It says "return ScriptDb.getMyDb;" but it should say "return ScriptDb.getMyDb();"
If you leave out the ()s then when you call file1 as a library, file1.getMyDb() will return a function which you store in var db. Then the line var result = db.query({..............}) results in an error because there is no method "query" in the function.
Is that what's causing your error?
I have figured out what the problem was, a misunderstanding on my part regarding authorisation. I was thinking of it in terms of file permissions, when in fact that problem was that my code was not authorised to run the DbScript service. As my code calls a different file and receives back a pointer to a ScriptDb database it is not using the ScriptDb service, so then when it calls the db.query() it invokes the ScriptDb service, for which it is not authorised.
To resolve this I just had to create a dummy function and make a ScriptDb.getMyDb() call, which triggered authorisation for the service. The code then worked fine.
Thanks for the input though.
Chris
I have wrote a user manager script the uses NTLMSetUserInfo to set passwords of some users, including ADMIN... What I have noticed though is that if I do this the username / password combination works perfectly for all scenarios such as Telnet, HTTP Auth etc but NOT file browsing.
Upon further inspection I noticed that when setting the Admin password through the built in CE configuration web pages it works.
The registry for Admin looks like so when I use NTLMSetUserInfo
NT = [hex value]
The registry for Admin contains an extra field, Password when I set the admin password via the CE web pages.
NT = [hex value]
Password = [hex value]
I figure NTLMSetUserInfo doesn't set the global CE password for Admin properly, hence not being able to file browse onto the box.
I found the following function in the CE web code parsing DLL that does the job called SetPassword. I wrote a separate function to deal with Admin cases but I cannot get it to compile. Here is a snippet of it
#include <windbase.h>
bool UserAccounts::SetAdminPassword(const std::string &passwordOld, const std::string &password)
{
wchar_t wpass[512];
wchar_t wpassold[512];
mbstowcs(wpass, password.c_str(), 512);
mbstowcs(wpassold, passwordOld.c_str(), 512);
return SetPassword(wpassold, wpass) == TRUE;
}
This will not compile stating that 'SetPassword': identifier not found. I notice in the CE documentation for SetPassword it has the following line
To use this function, you must include
the password component, Fspass, in
your Cesysgen.bat file.
I'm not sure what this means as I am pretty new to PlatformBuilder etc...
Can anyone help me or point me in the right direction?
Add the following to the top of your code file:
extern "C" BOOL SetPassword(LPWSTR lpszOldPassword, LPWSTR lpszNewPassword);
The linker will do the rest.
I can't give an exact answer right now (never used this authentication). But, I just tried to use (actually compile) SetPassword in a cloned version of the bluetooth AudioGateway driver I have and it compiles without problems.
When I tried to use it in a subproject or a regular independent project I had the same error that you got. So a quick solution might be to do this in a driver and see if it works.
Regarding the comment in the docs I assume they it goes down to having the SYSGEN_FSPASSWORD selected in the catalog though I did not trace this yet. I guess you have this selected if you can set passwords and such.