🚀 go-pugleaf

Hi all! Sorry if I've asked the help of Mr.Gambit, but I know he's familiar 
with this matter cause once he helped me with this problem!
 I had a code that allowed me to redirect standard consolle input/output,
It was in a my service, and allowed a remote user to open a command shell on 
the PC where the service run.
That worked fine, but there's a big security issue:
the service run with SYSTEM privileges, so the shell ("cmd.exe") too run 
with those privileges allowing the remote user to do whatever!!!
So I changed the part of the function that created the shell (it was 
CreateProcess(...) ):
first I LogOn as a provided user, then I use the given AccessToken to 
impersonate that user, and finally I use the same AccessToken with 
CreateProcessAsUser to run the shell with the User rights.
The matter is now that it only works if the user provided with UserId and 
Password is the one currently logged on in the WinXP machine, or better the 
one with his desktop open!!!
Is there a way to make it always working?

Thank You very much in advance!
Stefano B.

I post the code ... I hope there are not too much lines...
int RedirectShellINOUTEx(AnsiString Shell,HANDLE &hShell,AnsiString 
User,AnsiString Password)
{
  SECURITY_ATTRIBUTES sa;
  ZeroMemory(&sa,sizeof(SECURITY_ATTRIBUTES));
  sa.nLength=sizeof(SECURITY_ATTRIBUTES);
  sa.bInheritHandle=true;
  sa.lpSecurityDescriptor=NULL;
  //create pipe for the console stdout
  if(!CreatePipe(&ChildSTDOUT_ReadPipeHandleTmp,&ChildSTDOUT_WritePipeHandle,&sa,0))
      return -1;
  //create pipe for the console stderr
  if(!CreatePipe(&ChildSTDERR_ReadPipeHandleTmp,&ChildSTDERR_WritePipeHandle,&sa,0))
      return -2;
  //create pipe for the console stdin
  if(!CreatePipe(&ChildSTDIN_ReadPipeHandle,&ChildSTDIN_WritePipeHandleTmp,&sa,0))
      return -3;
  HANDLE hProcess = GetCurrentProcess();
  if(!DuplicateHandle(hProcess, ChildSTDOUT_ReadPipeHandleTmp,hProcess, 
&ChildSTDOUT_ReadPipeHandle, 0, FALSE, DUPLICATE_SAME_ACCESS))
   return -4;
  if(!DuplicateHandle(hProcess, ChildSTDERR_ReadPipeHandleTmp,hProcess, 
&ChildSTDERR_ReadPipeHandle, 0, FALSE, DUPLICATE_SAME_ACCESS))
   return -5;
  if(!DuplicateHandle(hProcess, ChildSTDIN_WritePipeHandleTmp,hProcess, 
&ChildSTDIN_WritePipeHandle, 0, FALSE, DUPLICATE_SAME_ACCESS))
   return -6;
  if(!CloseHandle(ChildSTDOUT_ReadPipeHandleTmp))
   return -7;
  if(!CloseHandle(ChildSTDERR_ReadPipeHandleTmp))
   return -8;
  if(!CloseHandle(ChildSTDIN_WritePipeHandleTmp))
   return -9;
  //Create a Console
  STARTUPINFO si;
  ZeroMemory(&si,sizeof(STARTUPINFO));
  si.cb=sizeof(STARTUPINFO);
  si.lpDesktop =  "WinSta0\\Default"; //also tried without anything here!!!
  si.dwFlags=STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
  si.wShowWindow=SW_HIDE;
  si.hStdInput=ChildSTDIN_ReadPipeHandle;
  si.hStdOutput=ChildSTDOUT_WritePipeHandle;
  si.hStdError=ChildSTDERR_WritePipeHandle;
  ZeroMemory(&pi,sizeof(PROCESS_INFORMATION));
  //-------
  // Now impersonate the provided User
  HANDLE TempTokenHandle=NULL;
  if(! LogonUser( User.c_str(), // string that specifies the user name
                    NULL, // string that specifies the domain or server
                    Password.c_str(), // string that specifies the password
                    LOGON32_LOGON_INTERACTIVE, // specifies the type of 
logon operation
                    LOGON32_PROVIDER_DEFAULT, // specifies the logon 
provider
                    &TempTokenHandle // pointer to variable to receive token 
handle
                  )
    )
  {
   return -31;
  }
  if(!ImpersonateLoggedOnUser( TempTokenHandle /* handle to a token that 
represents a logged-on user*/))
  {
   CloseHandle(TempTokenHandle);
   return -32;
  }
  if(!CreateProcessAsUser(TempTokenHandle,NULL,Shell.c_str(),NULL,NULL,true,0,NULL,NULL,&si,&pi))
  {
   CloseHandle(TempTokenHandle);
   return -10;
  }
  CloseHandle(TempTokenHandle);
  hShell=pi.hProcess;
  return 1;
}