2

Operating system is Windows 7 or higher with UAC enabled. Calling process has admin rights, already confirmed by the UAC box.

I want to spawn a new Console window (cmd.exe) under user SYSTEM (don't ask why). I can do this interactively by using PsExec tool from Sysinternals or something similar, but I don't have the source code and I need to understand how this works.

I understand that I have to call CreateProcessAsUser() and that works fine with the first parameter (hToken) set to NULL, but now I need to know how to get the hToken. I understand that I can get such a token by calling LogonUser() - but not for SYSTEM. How would I get the token for SYSTEM?

I thought of using DuplicateTokenEx(), but that requires an original token, that I don't have.

Would I have to query the process list, find any SYSTEM process and try to get that token duplicated or something? I don't want to reverse engineer the PsExec tool or one of the others doing exactly this.

e4ch
  • 31
  • 1
  • 5

2 Answers2

4

Typically you would install and launch a service, configured to log in as SYSTEM. You can then use OpenProcessToken and DuplicateTokenEx to make a copy of the token.

You will probably need to use SetTokenInformation to change the session ID for the token to match that of the interactive user. You need Act As Part Of the Operating System privilege to do that, so you should do this from inside the service itself. Once the duplicate token is ready to use, you can use DuplicateHandle to copy the handle into the administrative process, or (with the right options) you could launch the command shell directly from the service too.

Harry Johnston
  • 35,639
  • 6
  • 68
  • 158
0

alternative open the winlogon process with maximum permitted access, try to open the process token, (also with maximum permitted) and then try to duplicate this winlogon handle with impersonate rights. On win8.1 this will succeed. On others, you will need to temporary change the token dacl, with either a null or your own admin process token

user3409863
  • 47
  • 3
  • I would still recommend installing your own service rather than using a system process, but if that is not possible for some reason this sounds like a workable alternative. Note that enabling backup and restore privilege bypasses most permissions checks, so it might work in this case as well and save you from dangerous messing with the DACL. If you *do* have to mess with the DACL, definitely don't use a null DACL - that would introduce a security vulnerability. – Harry Johnston Aug 17 '14 at 20:30