如何在Visual Studio中以服务帐户(例如网络服务)的身份调试应用程序?

huangapple go评论51阅读模式
英文:

How can I debug an application as a service account (f.e. network service) in Visual Studio?

问题

Windows拥有不同的内置标准服务帐户,例如NetworkService帐户。这个SO帖子提供了关于在Visual Studio调试时如何以不同用户身份调试代码的不同答案,但这些答案展示了针对需要密码来运行代码的不同本地用户帐户/管理员帐户的解决方案(这些内置帐户没有密码)。是否有办法在Visual Studio中以其中一个内置服务帐户的身份运行和调试代码?


我的用例:我想要调试在生产中以NetworkService帐户运行的服务(和测试)。这个答案解释了如何使用PsExecNetworkService身份运行应用程序。我是否可以以某种方式使用PsExec启动服务或测试,然后附加Visual Studio到该进程并对其进行调试?

英文:

Windows has different built-in standard service accounts, f.e. the NetworkService account. This SO post provides different answers on how to debug code as a different user than the current one when debugging in Visual Studio, but these answers show solutions for different local user accounts / admin accounts that request passwords to run code (these built-in accounts have no passwords). Is there a way to run and debug code from Visual Studio as one of these built-in service accounts?


My use case: I want to debug a service (and tests) that runs in production as the NetworkService account. This answer explains how to run an application as a NetworkService by using PsExec. Can I somehow start the service or tests with PsExec and then attach Visual Studio to the process and debug it?

答案1

得分: 0

以下是翻译好的部分:


1. 使用所需的服务帐户执行应用程序,以便Visual Studio调试器可以附加到它

这可以通过注册为服务来完成,然后在“服务”应用程序中输入服务帐户凭据,方法是右键单击服务名称 -> 属性 并在 登录 选项卡中设置帐户,或者可以通过PowerShell来执行,就像在 此SO答案 中描述的那样。

另一种方法是使用 PsExec,如 此答案中描述的那样。下载 PsExec 后,在shell中运行以下命令以以服务帐户身份打开cmd,例如网络服务帐户:

psexec -i -u "nt authority\network service" cmd.exe 

在cmd中运行 whoami 以确保它以所需的帐户执行。现在导航到应该进行调试的可执行文件,并从这个cmd中启动它。


注意:我在我的应用程序开头添加了一个睡眠,以确保在连接调试器之前不执行任何代码(C++示例):

while (!IsDebuggerPresent())
{
  std::this_thread::sleep_for(std::chrono::seconds(5));
}

2. 将Visual Studio调试器附加到正在运行的进程

以管理员身份打开Visual Studio,单击调试 -> 附加到进程以打开“附加到进程”窗口。一旦窗口打开,请确保在搜索进程时单击“显示所有用户的进程”复选框,因为它是在不同的用户帐户下执行的。然后搜索在前面步骤中启动的进程,然后单击“附加”。现在应该可以调试该应用程序。

如何在Visual Studio中以服务帐户(例如网络服务)的身份调试应用程序?

英文:

Turns out this is actually pretty easy and straight forward:


1. Execute the application with the desired service account to have a running process that the Visual Studio debugger can attach itself to

This can just be done by registering as a service, and either entering the service account credentials in the Service app, by right clicking on the service name -> Properties and setting the account in the Log on tab, or via PowerShell, like it is described in this SO answer.

Another way is to use PsExec as described in this answer. After downloading PsExec, run the following command inside a shell to open a cmd as a service account, f.e. for the network service account:

psexec -i -u "nt authority\network service" cmd.exe 

Run whoami in the cmd to ensure that it is getting executed as the desired account. Now navigate to the executable that should be debugged, and launch it from this cmd.


Note: I added a sleep at the beginning of my app to ensure that it does not execute any code until I connected with a debugger to it (C++ example):

while (!IsDebuggerPresent())
{
  std::this_thread::sleep_for(std::chrono::seconds(5));
}

2. Attach the Visual Studio debugger to the running process

Open Visual Studio as Administrator, click on Debug -> Attach to Process to open the Attach to Process window. Once the window is open, make sure to click the Show processes for all users checkbox when searching for the process, since it is getting executed under a different user account. Then search for the process that has been started in the previous step and click on Attach. It should now be possible to debug the app.

如何在Visual Studio中以服务帐户(例如网络服务)的身份调试应用程序?

huangapple
  • 本文由 发表于 2023年7月13日 19:02:14
  • 转载请务必保留本文链接:https://go.coder-hub.com/76678628.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定