WMI remote connect in c# uses wrong username - c#

I'm trying to create program in C#, that will retrieve some data from local or remote server. Local part is working great, remote connection does not at all. I'm getting access denied.
Here is the code
public void ConnectToWmi()
{
var options = new ConnectionOptions();
options.Username = "admin";
options.Password = "admin";
options.Impersonation = ImpersonationLevel.Impersonate;
options.EnablePrivileges = true;
var scope = new ManagementScope("\\SERVER_NAME\root\cimv2",options);
scope.Connect();
}
I have verified using wbemtest.exe, that connection acctually works.
When I examinated both connections using Wireshark I noticed strange thing - wbemtest is sending correct username "admin" but my program is sending username of current user logged on computer.
So i experimented a little and created administrator account with credentials username "admin" password "admin" on computer that I'm running my program on. And it works!
So in short: Why is my C# program using credentials of currently logged in user instead of credentials that I supplied to it in the code?
more info
server is running as virtual machine in Hyper V on my notebook
client OS is win 8.1, server is win 7
connection between client and server works and all firewalls are disabled

Related

Using WindowsIdentity to connect to ManagementScope(WMI)

I have a .net core application that is hosted on IIS. This application utilizes System.Management to connect to other machines to gather information.
I am noticing that some of my calls are getting an access denied response. The application pool is running as a user that is an admin on the remote machines. However the ManagementScope does not appear to be using the Application pool's identity.
I was wondering if there is a way to use the WindowsIdentity while connecting to the remote machine?
I am looking for something like the following.
private ManagementScope GetManagementScope(string machineName)
{
WindowsIdentity identity = WindowsIdentity.GetCurrent();
ConnectionOptions options = new ConnectionOptions
{
Impersonation = ImpersonationLevel.Impersonate,
Username = identity.Name
// Something here to pass along the password?
};
ManagementPath path = new ManagementPath
{
Server = machineName,
NamespacePath = "\\root\\MicrosoftIISv2"
};
return new ManagementScope(path, options);
}
I have tried hard coding the User name and password and that works fine but I would really like to use the Application pools identity.
I think, and hope, there is no way to retrieve the password.
The only way is to pass it as external parameter and possibly stored in a secure application.
Maybe you can consider to store this secret in Azure Key Vault and retrieve that setting.

Retrieve processes information remote computer using C#

I'm developing a desktop application using C# language. I'm trying to retrieve all the current active processes on the remote computer with the following code:
else if (infocomboBox.SelectedIndex == 2)
{
string compname = compnameLabel.Text;
Process[] remoteAll = Process.GetProcesses(compnameLabel.Text);
foreach (Process process in remoteAll)
{
ListViewItem item = new ListViewItem(process.ProcessName);
item.Tag = process;
listProcessView.Items.Add(item);
}
}
I put the code inside the button_click function.
I can't seem to retrieve it with an error saying "InvalidOperationException was unhandled"
"Couldn't connect to remote machine"
Log in username and password is disabled on the remote computer. Firewall and antivirus are off also.
Refer below for the error screenshot
Screenshot of the error
What is exactly the problem? Can anybody give solution?
Thank you very much in advance!
I would try to verify from a command line that the hostname is resolvable.
ping theOtherComputerName
If that resolves to an IP address and responds then you've eliminated one possible issue. Next up would have to be connection issues.
I believe the GetProcesses command tries to login to the remote machine using the current username and password, so you would need the same username and password on the other machine,
OR you'll need to impersonate an admin user on the remote machine doing something like this impersonate user in c#

C# run executable from remote server on remote client

I have the following function for connecting to a remote client machine and running an executable on it.
I copied it from a response on this site, but don't have the link anymore, so I'm not sure who to give credit to.
public static void ConnectToRemoteClient(string client_machine, string user, string password, string target_exe )
{
var connection = new ConnectionOptions();
// The '.\' is for a local user on the remote machine
// or 'mydomain\user' for a domain user
connection.Username = user;
connection.Password = password;
object[] theProcessToRun = { target_exe };
var wmiScope = new ManagementScope($#"\\{client_machine}\root\cimv2", connection);
wmiScope.Connect();
using (var managementClass = new ManagementClass(wmiScope, new ManagementPath("Win32_Process"), new ObjectGetOptions()))
{
managementClass.InvokeMethod("Create", theProcessToRun );
}
}
It is called using the following syntax:
string exe = string.Format("taskkill.exe {0} {1}", #"/F", #"/PID 8704");
ConnectToRemoteClient("ClientMachine", #"Domain\Username", #"password", exe);
It works just fine for executables that exist on the remote client machine.
However, I want to call an executable from a server, and run it on that remote client machine.
Not sure how best to approach this. I tried feeding it the following:
ConnectToRemoteClient("ClientMachine", #"Domain\User", #"password", #"\\ServerName\MyDir\Myfile.exe");
But it never initiated the executable on the machine. No error messages.
The reason I want to do this, is to save me from having to copy the large executable and supporting files to each client, but rather just run it from the server depot on each remote client.
Do I have to call a CMD window and feed it the \\ServerName\MyDir\Myfile.exe in order to get it to work properly? or is there a way I can make this work?
You are connecting to the remote machine using the passed credentials, but that only establishes your rights to open WMI. The command you then pass to WMI to execute is not running as the credentials you pass in, but under the LocalSystem account credentials.
LocalSystem does not have access to the network share.
To do this you need to remotely execute PSEXEC (https://ss64.com/nt/psexec.html) which allows you to pass the parameters to launch the application as. PSEXEC runs as LocalSystem but allows you to pass credentials to use when it launches your designated application. The launched program will then impersonate the user you pass in, and will have access to the network share.

How to access a remote desktops active directory? (ASP.NET MVC)

I'm trying to connect to a remote desktops active directory.
When I ping the remote desktop I get a response back, so is it possible to connect to it?
Currently, when I connect locally while on the remote desktop, I use the following code: (It works)
PrincipalContext context = new PrincipalContext(ContextType.ApplicationDirectory, "doris-dev", "cn=" + SupplierName + ",cn=suppliers,o=doris");
UserPrincipal user = UserPrincipal.FindByIdentity(context, Username);
I use the same code when I try to remotely connect to the machine, but then the exception message says it needs a username and password. Which username and password is this? Where does it come from?

Cyber Ark .NETPasswordSDK not able to connect

I am not able to find any good documentation on .NET SDK for CyberArk.
I am trying to integrate CyberArk password management system to get password for an Outlook account using the below code
PSDKPasswordRequest passReq = new PSDKPasswordRequest();
PSDKPassword password = null;
// What is the purpose of CredFile??
passReq.CredFilePath = "F:\\CredFiles\\AppUser.cred";
passReq.Safe = "SAFE_NAME";
passReq.Folder = "root";
passReq.Object = userName;
passReq.Reason = "Get some stuff done.";
// Sending the request to get the password
password = CyberArk.AIM.NetPasswordSDK.PasswordSDK.GetPassword(passReq);
However I am not able to connect and getting the following error
"PDKTC006E Failed to connect to provider (Reason=[connect command failed])"\
As I understand it, the API (NetPasswordSDK) is actually a caching service that sits between you and the CyberArk appliance. So you have to configure the service correctly during install as it handles the connection to the CyberArk appliance.
Instructions:
Write down a CyberArk Administrator account's username/password
Write down the CyberArk IP address. This is NOT the web access IP address (PVWA). It's the IP address of the appliance.
On your dev machine, run the CyberArk SDK installer and enter in the IP address and Admin username/password from steps #1 and #2
Assuming the installer completes successfully, it is going to create a user called "Prov_MACHINENAME." (MACHINENAME will equal your NetBIOS hostname) on the CyberArk appliance.
On your dev machine, open C:\Program Files (x86)\CyberArk\ApplicationPasswordProvider\Vault\AppProviderUser.cred and write down the name generated during the install.
Log in to the CyberArk appliance as an administrator
Create a Safe named MySafe
Add the Administrator account from step #1 as a member to MySafe
Add the Prov_MACHINENAME account from step #5 as a member to MySafe
Create an Application named MyApp
Add the Application as a member MySafe
Create an Account named MyAccount and assign it to MySafe
You can now use the following code to connect:
PSDKPasswordRequest objPasswordRequest;
PSDKPassword objPassword;
objPasswordRequest = new PSDKPasswordRequest();
objPasswordRequest.AppID = "MyApp";
objPasswordRequest.Safe = "MySafe";
objPasswordRequest.Object = "MyAccount";
objPassword = PasswordSDK.GetPassword(objPasswordRequest);
password = objPassword.Content;
username = objPassword.UserName;

Categories

Resources