title: Is it possible for one process to inject code into another without administrative privileges?
body: <p>The <a href="http://msdn.microsoft.com/en-us/library/aa380262%28v=vs.85%29.aspx" rel="noreferrer"><code>CryptProtectMemory</code></a> API in the DPAPI allows you to pass the <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> flag, which prevents other processes from decrypting the memory. One way around this would be to use <code>OpenProcess</code>, <code>WriteProcessMemory</code>, and <code>CreateRemoteThread</code> to inject code into the target process and have it call <code>CryptUnprotectMemory</code>, thus decrypting the memory and leaking it to the other process.</p>
  
  <p>Assuming both processes are running under the context of the same limited privilege user (i.e. not an administrator) on Windows Vista or later, is this still possible? I was under the impression that process memory write operations were denied to limited users, regardless of the process ACL, but I may be wrong.</p>