Closing handles of a process as a regular user

Question

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles while as a regular user. handle.exe and ProcExplorer wont let me do so as a regular user. Is this because of Windows' security or because of ProcExplorer and Handle.exe's limitation ?

Answer 1

This can be done ! Process explorer doesn't allow you to do it but you can write a simple python script to close the handles using the DUPLICATEHANDLE_CLOSE SOURCE can be used to close handles of the same user level processes.

Answer 2

Considering the only way you could get to the process is through debugging hooks (I think). The Local Security policy in windows 7 has the following for the debug permission:

Debug programs

This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components.

Caution

Assigning this user right can be a security risk. Only assign this user right to trusted users.

Default: Administrators

If this is the case only users with this permission could cause the issue you're referring to. Your bigger issue is users that are able to escalate permissions, but that's the battle we all fight.