How to run only some commands in a Windows batch file as admin?

Question

Via email, I'm helping someone else set up Windows 7 firewall rules to prevent the Zoom video conferencing client from possibly accessing the internet unless it is explicitly launched by the user. (No current evidence that Zoom does this, but with all the issues revealed about Zoom, she wants to be extra cautious.)

She has the "allow" Windows Firewall rules set up and named them "Zoom 1" & "Zoom 2" (the "1" and "2" are for OUT and IN rules).

So now, when she want wants to use Zoom, she enables those 2 firewall rules, and when she's done, she disables them.

I want to help her automate this, so I wrote a simple batch file and sent it to her:

 netsh advfirewall firewall set rule name="Zoom 1" new enable=yes
 netsh advfirewall firewall set rule name="Zoom 2" new enable=yes
 pathname\zoom.exe
 netsh advfirewall firewall set rule name="Zoom 1" new enable=no
 netsh advfirewall firewall set rule name="Zoom 2" new enable=no

When she runs it, she gets notified that "The requested operation requires elevation" (admin) for the netsh commands.

How can this batch file be modified to run the netsh commands as admin, but not zoom.exe?

@HackingAddict1337 If it successfully runs zoom.exe, how would she determine the trust level at which it is actually running? — RockPaperLz- Mask it or Casket, Apr 11 '20 at 04:12
use external tools like [procmon](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) — ScriptKidd, Apr 11 '20 at 04:46
@HackingAddict1337 Thank you for the tips. What technique do you recommend for running the batch file with elevation so that the `netsh` commands work? — RockPaperLz- Mask it or Casket, Apr 11 '20 at 05:05
@HackingAddict1337 Currently, she get the message "the requested operation requires elevation" for the `netsh` commands. A way to solve that issue. — RockPaperLz- Mask it or Casket, Apr 11 '20 at 05:25

score 0 · Answer 1 · answered Apr 11 '20 at 05:35

I'm not sure what exactly you mean, but:

@echo off
net session >nul 2>&1 || (
MSHTA "javascript: var shell = new ActiveXObject('shell.application'); shell.ShellExecute('%~nx0', '', '', 'runas', 1);close();"
exit /b
)
whoami /priv
pause
netsh advfirewall firewall set rule name="Zoom 1" new enable=yes
netsh advfirewall firewall set rule name="Zoom 2" new enable=yes
explorer zoom.exe
netsh advfirewall firewall set rule name="Zoom 1" new enable=no
netsh advfirewall firewall set rule name="Zoom 2" new enable=no

Use mshta to prompt UAC.

explorer ALWAYS runs at medium (or low) integrity, no matter the parent process' integrity level.

How to run only some commands in a Windows batch file as admin?

1 Answers1