列举当前连接的会话

本文详细介绍了如何在Windows系统中使用LSA(Local Security Authority)API来枚举并获取所有登录会话的详细信息,包括用户名、登录类型、认证包、所属域等。
int 
main(argc, argv)
  int argc;
  char *argv[];
{
  NTSTATUS
    status;

  PSECURITY_LOGON_SESSION_DATA
    // This structure contains information about a logon session.
    data = NULL;

  PLUID
    /*
     * The pointer receives the first element of an array of logon 
     * session identifiers.
     */
    list;

  ULONG 
    count;
    
  int i;
  
  char
    username[MAX_PRINT_BUFFER],
    logontype[MAX_PRINT_BUFFER],
    package[MAX_PRINT_BUFFER],
    domain[MAX_PRINT_BUFFER],
    buffer[256];

  /*
   * The LsaEnumerateLogonSessions function retrieves the set of existing logon 
   * session identifiers (LUIDs) and the number of sessions.
   *
   * Parameters:
   *   LogonSessionCount [out] 
   *     Pointer to a long integer that receives the number of elements 
   *     returned in the array returned in LogonSessionList parameter.
   *
   *   LogonSessionList [out] 
   *     Address of a pointer to a LUID. The pointer receives the first 
   *     element of an array of logon session identifiers. 
   *     The memory used by the array is allocated by the LSA. 
   *     When the array is no longer needed, call the LSAFreeReturnBuffer 
   *     function to free it.
   *
   * Return Value:
   *   If the function succeeds, the return value is STATUS_SUCCESS.
   *   If the function fails, the return value is an NTSTATUS code indicating the reason.
   */
  status = LsaEnumerateLogonSessions(&count, &list);
  if (status != STATUS_SUCCESS)
  {
    GetNtStatusErrorText(status, buffer, 256);
    fprintf(stderr, buffer);
    return 1;
  }

  fprintf(stdout, " No. User            LogonType      Package     Domain         Error\n");
  for (i = 0; i < 75; i++)
    fprintf(stdout, "-");
  fprintf(stdout, "\n");

  // Process the array of session LUIDs...
  for (i =0; i < count; i++)
  {
    lstrcpy(username, "-");
    lstrcpy(logontype, username);
    lstrcpy(package, username);
    lstrcpy(domain, username);

    data = NULL;

    // Check for a valid session.
    if (&list[i])
    {
      /*
       * The LsaGetLogonSessionData function retrieves information 
       * about a specified logon session. To retrieve information about a logon session, 
       * the caller must be the owner of the session or a local system administrator.
       *
       * Parameters:
       *   LogonId [in] 
       *     Specifies a pointer to a LUID that identifies the logon session whose 
       *     information will be retrieved. For information about valid values for this parameter, 
       *     see Remarks.
       *
       *   ppLogonSessionData [out] 
       *     Address of a pointer to a SECURITY_LOGON_SESSION_DATA structure containing 
       *     information on the logon session specified by LogonId. This structure is allocated 
       *     by the LSA. When the information is no longer needed, call the LSAFreeReturnBuffer 
       *     function to free the memory used by this structure.
       *
       * Return Value:
       *   If the function succeeds, the return value is STATUS_SUCCESS.
       *   If the function fails, the return value is an NTSTATUS code indicating the reason.
       */
      status = LsaGetLogonSessionData(&list[i], &data);
      if (status != STATUS_SUCCESS)
      {
        // If have an error occurred.
        GetNtStatusErrorText(status, buffer, 256);
        // Free the memory returned by the LSA.
        if (data)
          LsaFreeReturnBuffer(data);
        data = NULL;
      }
      else
        // no data for session
        lstrcpy(buffer, "Invalid session data.\n");
    }
    else
      // no data for session
      lstrcpy(buffer, "Invalid session data.\n");

    // Determine whether there is session data to parse.
    if (data)
    {
      // Get the user name.
      PW2A(&data->UserName, username, MAX_PRINT_BUFFER);
      // Get the authentication package name.
      PW2A(&data->AuthenticationPackage, package, MAX_PRINT_BUFFER);
      // Get the domain name.
      PW2A(&data->LogonDomain, domain, MAX_PRINT_BUFFER);

      // Get the logon type.
      switch ((SECURITY_LOGON_TYPE)data->LogonType)
      {
      case Interactive:
        lstrcpy(logontype, "Interactive");
        break;
      case Network:
        lstrcpy(logontype, "Network");
        break;
      case Batch:
        lstrcpy(logontype, "Batch");
        break;
      case Service:
        lstrcpy(logontype, "Service");
        break;
      case Proxy:
        lstrcpy(logontype, "Proxy");
        break;
      case Unlock:
        lstrcpy(logontype, "Unlock");
        break;
      case NetworkCleartext:
        lstrcpy(logontype, "NetworkCleartext");
        break;
      case NewCredentials:
        lstrcpy(logontype, "NewCredentials");
        break;
      case RemoteInteractive:
        lstrcpy(logontype, "RemoteInteractive");
        break;
      case CachedInteractive:
        lstrcpy(logontype, "CachedInteractive");
        break;
      case CachedRemoteInteractive:
        lstrcpy(logontype, "CachedRemoteInteractive");
        break;
      case CachedUnlock:
        lstrcpy(logontype, "CachedUnlock");
        break;
      default:
        lstrcpy(logontype, "Unknown");
      }
      
      lstrcpy(buffer, "\n");
      
        // Free the session data.
      LsaFreeReturnBuffer(data);
      data = NULL;
    }
    
    // Adjust the length of print texts.
    FillRightSpace(username, 16);
    FillRightSpace(logontype, 15);
    FillRightSpace(package, 12);
    FillRightSpace(domain, 15);
    FillRightSpace(buffer, 0);
    
    fprintf(stdout, " %02u  %s%s%s%s%s", i + 1, username, logontype, package, domain, buffer);    
  }

  fprintf(stdout, "\n\tTotal %lu users.\n", count);
  
  // Free the array of session LUIDs allocated by the LSA.
  LsaFreeReturnBuffer(list);

  return 0;
}

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值