ISA Firewall client. Traffic interception from local system account.

  • Thread starter Thread starter Vladislav Yakovlev
  • Start date Start date
V

Vladislav Yakovlev

Guest
Hi!

ISA Firewall client can intercept users traffic and bypass it to proxy. It all ok with standart interactive launch of my application.

When i start app with system account role - it wont work :(

With procexp i can see FwcWsp.dll injection, but nothing happens.

Of course we can write rules to ISA Server to intercept data from .exe, but is there any other ideas? Im intrested in how ammyy admin, started at system account works properly?

Can thread impersonation help me? And if so - what am i doing wrong:

1. Im getting token with WTSQueryUserToken of current session

2. DuplicateTokenEx for token primary

3. Run creating sockets and network connection in impersonated context.

Continue reading...
 
Back
Top