#include #include #include #include BOOL setup_privileges () { BOOL rc; HANDLE hToken = NULL; TOKEN_PRIVILEGES sPrivileges; rc = OpenProcessToken ( GetCurrentProcess() , TOKEN_ALL_ACCESS , &hToken ) ; if ( !rc ) return FALSE; rc = LookupPrivilegeValue ( NULL, SE_DEBUG_NAME, &sPrivileges.Privileges[0].Luid ); if ( !rc ) return FALSE; sPrivileges.PrivilegeCount = 1 ; sPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED ; rc = AdjustTokenPrivileges ( hToken, FALSE, &sPrivileges, 0, NULL, NULL ) ; if ( !rc ) return FALSE; CloseHandle ( hToken ); return TRUE; } int client () { HANDLE hMaster, hObject, hDuppedObject; char* buf = "kaboom!"; DWORD bytes_written; printf ( "slave pid=%d\n", GetCurrentProcessId ()); scanf ("%x %x", &hMaster, &hObject); if (!DuplicateHandle (hMaster, hObject, GetCurrentProcess (), &hDuppedObject, 0, FALSE, DUPLICATE_SAME_ACCESS)) return 3; if (!WriteFile (hDuppedObject, buf, strlen (buf), &bytes_written, NULL)) return 4; return 0; } int main (int argc, char** argv) { int fd; DWORD master_pid, slave_pid; HANDLE hMaster, hSlave, hDuppedMaster; if (argc <= 1) return client (); if (!setup_privileges ()) return 2; master_pid = GetCurrentProcessId (); slave_pid = atoi (argv [1]); hMaster = OpenProcess (PROCESS_DUP_HANDLE, FALSE, master_pid); hSlave = OpenProcess (PROCESS_DUP_HANDLE, FALSE, slave_pid); if (!DuplicateHandle (hMaster, hMaster, hSlave, &hDuppedMaster, 0, FALSE, DUPLICATE_SAME_ACCESS)) return 3; fd = open ( "/tmp/secret", O_RDWR ); printf ( "master handle=%p, object handle=%p\n", hDuppedMaster, get_osfhandle (fd)); getchar (); close (fd); return 0; }