.

Author: CBenoit

crates/pedm-simulator/src/main.rs

@@ -25,32 +25,54 @@ fn main() -> anyhow::Result<()> {
         .context("open current process token")?;
 
     // Verify that the current account is assigned with the SE_CREATE_TOKEN_NAME privilege.
-    let account_username = get_username(Security::Authentication::Identity::NameSamCompatible).unwrap();
+    println!("Attempting to verify whether the current account is assigned with the SE_CREATE_TOKEN_NAME privilege");
+    let account_username =
+        get_username(Security::Authentication::Identity::NameSamCompatible).context("retrieve account username")?;
     println!("Account name: {account_username:?}");
-    let account = lookup_account_by_name(&account_username).unwrap();
-    let rights = enumerate_account_rights(&account.sid).unwrap();
-    let has_create_token_right = rights.iter().any(|right| right == u16cstr!("SeCreateTokenPrivilege"));
 
-    if expect_elevation {
-        assert!(has_create_token_right);
-
-        // SE_CREATE_TOKEN_NAME is required for performing the elevation.
-        let se_create_token_name_luid = privilege::lookup_privilege_value(None, privilege::SE_CREATE_TOKEN_NAME)
-            .context("lookup SE_CREATE_TOKEN_NAME privilege")?;
-        token
-            .adjust_privileges(&TokenPrivilegesAdjustment::Enable(vec![se_create_token_name_luid]))
-            .context("enable SE_CREATE_TOKEN_NAME privilege")?;
-
-        // Verify the SE_CREATE_TOKEN_NAME privilege is actually enabled.
-        let se_create_token_name_is_enabled = token
-            .privileges()
-            .context("list token privileges")?
-            .as_slice()
-            .iter()
-            .find(|privilege| privilege.Luid == se_create_token_name_luid)
-            .is_some();
-
-        assert!(se_create_token_name_is_enabled);
+    match lookup_account_by_name(&account_username) {
+        Ok(account) => {
+            let rights = enumerate_account_rights(&account.sid)
+                .with_context(|| format!("enumerate account rights for {account_username:?}"));
+            let has_create_token_right = rights.iter().any(|right| right == u16cstr!("SeCreateTokenPrivilege"));
+
+            if expect_elevation {
+                assert!(has_create_token_right);
+
+                // SE_CREATE_TOKEN_NAME is required for performing the elevation.
+                let se_create_token_name_luid =
+                    privilege::lookup_privilege_value(None, privilege::SE_CREATE_TOKEN_NAME)
+                        .context("lookup SE_CREATE_TOKEN_NAME privilege")?;
+                token
+                    .adjust_privileges(&TokenPrivilegesAdjustment::Enable(vec![se_create_token_name_luid]))
+                    .context("enable SE_CREATE_TOKEN_NAME privilege")?;
+
+                // Verify the SE_CREATE_TOKEN_NAME privilege is actually enabled.
+                let se_create_token_name_is_enabled = token
+                    .privileges()
+                    .context("list token privileges")?
+                    .as_slice()
+                    .iter()
+                    .find(|privilege| privilege.Luid == se_create_token_name_luid)
+                    .is_some();
+
+                assert!(se_create_token_name_is_enabled);
+            }
+        }
+        Err(e) => {
+            eprintln!("Failed at looking up account for {account_username:?}: {e}");
+
+            // Possible issue when running this program using psexec -s, under `NT AUTHORITY\SYSTEM` (LocalSystem):
+            // - There is no direct domain credentials by default, unless the machine is domain joined and has a line-of-sight to the DC.
+            // - This context may not be able to see the same network resources or DC that the interactive user.
+            // Causing LookupAccountNameW to fail with a "no mapping" error.
+            // Let’s just go ahead with the elevation in this case, assuming LocalSystem is enough for all intents and purposes at this point.
+            if e.code().0 == 0x80070534 {
+                println!("Got the 'no mapping' error; continuing...")
+            } else {
+                return Err(anyhow::Error::new(e), "an unexpected error");
+            }
+        }
     }
 
     let token_source = build_token_source(LADM_SRC_NAME, LADM_SRC_LUID);