How To Restart IIS without Admin Rights in C# - c#

What code do I need for a C# application to restart the user's IIS while the user does not have Admin rights?

I don't think it's possible through code alone (and if it was, it'd be an exploit.)
You'd need to write a daemon that ran as a privileged user that accepted restart commands from unprivileged sources, say by checking for the existence of a lockfile or similar, or accepting commands over a socket, and then restarted the server accordingly.
Which would be a serious security risk, still, but whatever floats your boat.
It still might be better to think hard about why you want to do this. I think you'll find that whatever criteria prevent you from making the relevant user an IIS admin are excellent arguments for why the user shouldn't be rebooting IIS either.

Related

Is it possible to defend my program whilst offline?

I need to find a way to block user access to my database that will be installed in his pc.
So, here on the company we have a problem. We need to block user access to our database that will be installed on their pc, what I mean by this is...
We have 2 softwares. A web App ERP and an instalable finances App.
We reached the conclusion that it was unnecessary to have 2 standalone apps, and that we should put the finances app inside our ERP.
But this comes with a problem, theres a big part of our users that don't trust the web, and web apps, they think that what is on their pc is what is
safe, and is where it should be.
We don't want to maintain the 2 standalone softwares needlessly.
We asked our users if they'd be happy with a progressive web app, their answer was the same.
Then we tried to make a way to run our ERP on their pc whilst offline, as an executable, but that comes with a lot of troubles, we need to install IIS, PostgreSQL, .net frameworks, pgadmin, our metadata database (which it shouldn't be accessible in any way shape or form by the user!), etc... that lets our app run on the users pc.
Of course we don't want to do that, but we got no choice left. We need to at least block our metadata database from being accessed, since the whole structure of the web app is there and we don't want to share it with the competition
Our solution was installing all that was needed inside a virtual drive and run the app from there. but all the files and databases are available to the user for him to mess with.
How can we restrict acess to that virtual drive the best possible, and protect our intelligence property? is it even feasable? I've run out of ideas and don't know what else to do, so any help is welcome.
Should I take another route or is it a lost cause?
Whoever has control of the database machine has control of the database. So if the database is running on the client's machine, there is no way to keep an administrative user out of the database.
So if the users don't trust a web application, they will have to trust their system administrators (or themselves, if they have administrator rights to their machines).

Console Application stopped working

Is it possible for code to work perfectly on the Administrator profile and not work at all while logged in as another user?
I am building certain applications at work, and while developing, coded and tested while logged on as Administrator. Every application working normally.
Now before deployment, when I execute the same application, but now logged in with a specific user account, I just get the error "Console Application stopped working" etc etc. I have handled all possible exceptions with my own Message Box, but this error is something I did not expect?!
In the exe's, I tried changing setting to "Run as Administrator", no use!
Any help would be much appreciated. Thanks!
PS - There are certain FTP methods I reuse from another class. And by handling all possible exceptions, I mean, I would have a try-catch block for the FTP method, so in case of error encountered after deployment, affected user may call helpdesk and notify the exact error.
Well, its not the right way to go, but right click and run as Admin, works butter smooth. Should I go ahead and modify all executables to - Run as Administrator under Properties->Compatibility??
You should firstly investigate if your application does need Admin rights indeed. A few scenarios that I can think of where an App needs admin rights are writing to protected locations of the system, writing to registry (excluding the areas that the user has rights on). If you think that admin access is not needed, you could always seek other ways to make it work. For example, instead of writing to a protected location, create a directory for you application in the user's application data folder and write to that location.
When you launch the application, if you're running on I believe Windows Vista or higher(7 works this way for sure)
You can Right click on the application and click on Run as Administrator
And yes, Sometimes the application won't work if you're not running as an administrator. For instance, If it's trying to change files in a protected location.
There are other variances that can cause your program to not work, For me, "Console Application stopped working" normally means that you don't have the right version of the .net framework installed, but it can mean any number of things.

Debug while Impersonating Another Domain Account

Is it possible to debug a C# .NET 4 application, run unit tests, etc., using domain user credentials other than my own? I have several elevated permissions that the users and/or service accounts will not posses, and want to avoid skewing my tests and ultimately suffering from "it works on my machine" syndrome.
I specifically want to create a SqlConnection object that uses a domain service account, rather than my own. I must use a domain account, and not SQL Server account, to allow SQL Server to emit PEXEC calls to other hardware. (Sounds fun, eh?)
I am surprised the option to run debug/release as a different domain user is not already setting in the solution/project Debug properties panel. It seems like something that would be useful. Sure, I understand the security risks, but you have to admit that would be very useful in many cases.
Thanks in advance!
Possible duplicate of this question? (Using VSCommands addon)
Or this cheap way, from VBForums:
Create your executable, then using "Run As" execute it under the normal user's credentials. Once it starts, open an instance of VS and attach the debugger to it.

Block the user from changing the System Date/Time

We have a windows application (C# .net) and we'll be giving installers to client. The requirement is that once the application has been installed , user should not be able to edit the system time/date . This is to make sure that the application generated dates/reports are not manipulated.
My target OS is Win-XP
What is the best way to do that ?
Does OS provide any facility to do that ?
Client machine is a stand alone machine and is not on any network.
Thanks in Advance
As said here already, you can use group policies, but they are easily circumvented. Also, your customers may react hostile (rightfully so) if your app does that. Still, in case your application is in a closed network, talk to the sysadmin and get it rolled out as a policy.
If you really need a trusted time source, then do so: Write a Web Service or use an existing NTP Service that your application contacts and use the time returned by that trusted service. Then use signing techniques to prevent tampering with the reports afterwards.
Downside: you need internet access. Possibility is to have the client setup a NTP Server within their network (AFAIK Windows Domain Controllers can do that automatically?) and use that, but then the client can again tamper with it.
But bottom line is: Contact a webservice to make tampering hard or use group policies to make tampering easy. Making tampering impossible isn't possible anyway.
That sounds more like a server-fault question; I wonder if "group policy" is the way to do that on a per-machine basis;
However - for a programming answer - why not get the time from a central server when your app starts? Calculate the offset from the local time and apply that throughout your app.
If security needs to be tight you may need to sign the response from the server to prevent spoofing (in particular via "hosts" etc).
You block this by changing Windows Policy. You can either do this from Active Directory (Group Policy) or by manipulating the local seurity policy.
See link: http://www.sevenforums.com/tutorials/113557-date-time-allow-prevent-users-groups-changing.html
But I would rather recommend that you check time with an online server instead. Preventing such a thing for users may give them big problems if their BIOS resets or something.
I don't think that is possible because that is related to group policy rather than your application changing any system settings which will prevent users from changing system date time. Go through these it might come of use -
If XP Pro, use the Group Policy Editor to create fine-grained
permissions.Start>Run gpedit.msc [enter]
If XP Home, look at Doug Knox's Security Console and see if it will do
the job for you: http://www.dougknox.com
No, you can't prevent a basic OS function like this (aside from a group policy...but not programmatically, especially if the users had admin permissions). If you could do this programmatically, it could easily be exploited for mis-use (changing the time and breaking Kerberos authentication for example).
Only through Domain policy - admins must prevent the user not to mess with the time.
Windows 2008 has an option to sync time with internet.
Alternative is that you create a web service that your app could access through internet and get the non-modified time.
You need to implement local or group policy for that. I don't know if you can easily manipulate it from C#.
Assuming these machines are not actually under your administrative control then clearly you can't do this. But an alternative would be to get the time used to generate your timestamps from an external web service, you could use some sort of encryption to access the service to ensure the client can't tamper with the result en-route.

Determine whether the SQLSERVR process has write access to a given folder (C#)

I've got an winforms application which uses a SQL Express back-end (which is always on the local machine).
I've run into a variety of user issues where a user performs a task that creates a new database in a particular location, but it turns out that the "NT Authority\Network Service" does not have sufficient permissions over the location they specify.
I'd like to check at runtime if the user running SQLSERVR has access to a particular folder.
I've got WMI code running to determine the user/SID of the SQLSERVR process. My next step is to try to get the WindowsIdentity/WindowsPrincipal of the user so that I can query the file access rules.
But I'm stuck - how can I reliably get a WindowsIdentity when all I have is the user/domain/SID? It doesn't seem like there's a constructor that is well suited to this?
You would have to pinvoke LogonUser to obtain a token. I seriously doubt that's going to work, these service accounts are highly privileged.
Do ask yourself if this is worth the hassle. Maybe a warning is desirable but there is nothing that you could do yourself to fix the problem. It is going to require an administrator to really fix the issue. Focus on getting a good diagnostic out of the exception you get.
Can I suggest you take a different (simpler) approach? Try just impersonating the service/user account and write a quick temp file and then delete it. If you can write that file (and delete it) you can be sure that the SQL Server can do the same thing.
Here's a post that talks about impersonating the NETWORK SERVICE account: http://geek.hubkey.com/2008/02/impersonating-built-in-service-account.html

Categories