-7

My attempt to open a file on a remote machine looks like this:

#include <Windows.h>
#include <cwchar>

void main() {
    HANDLE h = CreateFileW (
        L"\\\\10.10.10.10\\c$\\windows\\system32\\calc.exe",
        GENERIC_READ,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        nullptr,
        OPEN_EXISTING,
        0,
        nullptr);
    if (h == INVALID_HANDLE_VALUE) {
        std::wprintf(L"Error: %u\n", GetLastError());
    } else {
        CloseHandle(h);
    }
}

The problem is: it fails and GetLastError () returns 1326 (the username or password is invalid).

What I've tried:

  • NetUseAdd for IPC$ and C$ with local administrator credentials (both connect successfully)
  • WNetAddConnection2 for IPC$ and C$ with local administrator credentials (both connect successfully)

According to the event log of the remote machine, CreateFile attempts to work with the credentials of the user that started the process.

What should I do to make CreateFile use the provided credentials?

Yes, I try to connect to the C$ share and it can be done from Explorer.

7
  • 1
    What happens if you try to access \\10.10.10.10\c$\windows\system32\calc.exe with the Windows Explorer? May 23 at 14:38
  • Try an explicit share, rather than c$ May 23 at 14:40
  • @Jabberwocky, as I wrote in original post, it does work.
    – Bogudan
    May 23 at 14:52
  • 1
    @Bogudan I mean there is no popup that asks for credentials etc.? What happens with a freshly booted computer? May 23 at 15:12
  • 6
    This question is discussed at meta May 24 at 6:13

1 Answer 1

1

Short answer: LogonUser + ImpersonateLoggedOnUser.

TL;DR

Most of Windows API that are capable of working with remote machines, usually can be made working mounting IPC$ share using either WNetAddConnection* family or NetUseAdd. There are exceptions though.

One of them is CreateFile. This function ignores established IPC$ connections as well as any established connections to shares. You need to use LogonUser + ImpersonateLoggedOnUser pair.

I should point out that the description of LogonUser on the MS's site can be misleading. It's correct in saying that "you cannot use LogonUser to log on to a remote computer". What it actually can do is to prepare network credentials for future connections to the remote computer. Actual logon will be happening during later API calls (CreateFile in this case).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.