Error when using ($STDIN_CHILD, $STDOUT_CHILD)

[inopia]

Hey fellow scripters!

I wanted to create a script to change the bitlocker PIN of our Win7 machines for users without admin rights. While researching I found out, that this doesn't seem to be an easy task. I came up with a pretty dirty solution:

expandcollapse popup

$gui=GUICreate("Bitlocker PIN",180,180,-1,-1,$WS_SYSMENU,-1)
GUICtrlCreateLabel("PIN eingeben (min. 6 Zeichen):",15,15,150,15,-1,-1)
$bit1=GUICtrlCreateInput("",15,30,150,20,$ES_PASSWORD,$WS_EX_CLIENTEDGE)
GUICtrlCreateLabel("PIN bestätigen:",15,60,77,15,-1,-1)
$bit2=GUICtrlCreateInput("",15,75,150,20,$ES_PASSWORD,$WS_EX_CLIENTEDGE)
$button=GUICtrlCreateButton("Neue PIN Setzen",35,110,110,30, $BS_DEFPUSHBUTTON, -1)
GUISetState(@SW_SHOW,$gui)

While 1
        $nMsg = GUIGetMsg()
        Switch $nMsg
            Case $GUI_EVENT_CLOSE
                Exit
                ExitLoop
            Case $button
                $res1=GUICtrlRead($bit1)
                $res2=GUICtrlRead($bit2)
                If $res1 = $res2 And StringLen($res1) >= 6 Then
                    GUISetState(@SW_HIDE,$gui)
                    ClipPut ($res1)
                    BlockInput(1)
                    $proc=RunAs($o1acc, $domain, $o1pwd, 2, @ComSpec & " /c C:\Windows\System32\manage-bde.exe -changepin c:")
                    WinWaitActive("C:\Windows\system32\cmd.exe","")
                    Sleep(2000)
                    Send ("!{Space}")
                    Sleep(20)
                    Send ("B")
                    Sleep(20)
                    Send ("E")
                    Sleep(20)
                    Send ("{ENTER}")
                    Sleep(100)
                    Send ("!{Space}")
                    Sleep(20)
                    Send ("B")
                    Sleep(20)
                    Send ("E")
                    Sleep(20)
                    Send ("{ENTER}")
                    WinWaitClose("C:\Windows\system32\cmd.exe")
                    Sleep(100)
                    BlockInput(0)
                    ExitLoop
                ElseIf StringLen($res1) < 6 Then
                    MsgBox($MB_ICONERROR,"Fehler","PIN zu kurz. Minimum 6 Zeichen.")
                Else
                    MsgBox($MB_ICONERROR,"Fehler","PINs sind nicht gleich."&@WindowsDir)
                EndIf
        EndSwitch
    Sleep(20)
WEnd

It works on my test system, but the problem here is, that a user could easily pause the script and have a nice cmd with elevated rights.

So I wanted to give $STDIN_CHILD + $STDOUT_CHILD and StdoutRead + StdinWrite a try. The problem here was, that when I executed the command it would give me the following output:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.

C:\Windows\System32>manage-bde.exe -changepin c:

BitLocker-Laufwerkverschlüsselung: Konfigurationstoolversion 6.1.7601
Copyright (C) Microsoft Corporation. Alle Rechte vorbehalten.


FEHLER: Ein Fehler ist aufgetreten (Code 0x80070006):
Das Handle ist ungültig.

~ Error: An error occured (Code 0x80070006)

    Invalid handle .

This is the code that I tried:

$pid = RunAs($acc, $domain, $pwd, 2, @ComSpec, "C:\Windows\System32\", @SW_SHOW, BitOR($STDERR_CHILD, $STDIN_CHILD, $STDOUT_CHILD))
StdinWrite($pid, "manage-bde.exe -changepin c:" & @CRLF)

While Sleep(50)
    $sOut = StdoutRead($pid)
    If @error Then ExitLoop
    If $sOut <> "" Then ConsoleWrite($sOut & @CRLF)
WEnd

Has anyone experienced errors like this (or has a better solution for changing the bitlocker PIN)?

 

Regards

ino

[AutoBert]

Try

$pid = RunAs($acc, $domain, $pwd, 2, @ComSpec, "C:\Windows\System32\", @SW_SHOW, BitOR($STDERR_MERGED,$STDIN_CHILD))

 

[inopia]

5 minutes ago, AutoBert said:

Try

$pid = RunAs($acc, $domain, $pwd, 2, @ComSpec, "C:\Windows\System32\", @SW_SHOW, BitOR($STDERR_MERGED,$STDIN_CHILD))

 

Thank you for your response. 

It didn't work. The result is still the same.

[AdamUL]

First few things.  Using the RunAs or RunAsWait function does not give you the full admin token under Windows 7.  It only runs the process under the context of the user specified, even if that user is an Admin on the PC.  You can check to see if the RunAs user has the full admin token with the IsAdmin function.  If it does not, the manage-bde command will fail for not having full admin rights.  You are trying to StdinWrite to cmd.exe, instead of manage-bge.exe directly.  Also, is the script running as 32, 64 bit, or both PC?

Here is an example script to run with the full admin token from a user that is not an admin.  To do what you would like to do, it could be modified to do that. 

Concerning manage-bde, run it directly, after you get the script elevated correctly.   Read the output for the prompt to enter the PIN with StdoutRead, and then use StdinWrite to enter the new PIN.  The Run command would be the following.  I used @SW_SHOW for testing to see what is going on.  Normally you would want to use @SW_HIDE.  

$iPID = Run("C:\Windows\System32\manage-bde.exe -changepin c:", "C:\Windows\System32\", @SW_SHOW, BitOR($STDERR_MERGED, $STDIN_CHILD))

 

Adam

[inopia]

Hello Adam, 

thank you for answering.

All of our machines are running on 64-Bit Win7. Your Script results in IsAdmin => 1 so it seems that we have full admin access. Nonetheless executing the manage-bde.exe with BitOR($STDERR_MERGED, $STDIN_CHILD) will result in the same error as I stated above. Without it the console windows appears just fine asking for a new PIN.

 

~ino

[AdamUL]

Your welcome.  Did you run the Run command at the end of the example script, or did you run it separately?  Invalid handle sounds like a permission issue.  That is why I ask.  

Adam

[inopia]

I tried both, running it after your example script as well as running it standalone in my code.