Sign in to follow this  
Followers 0
supergg02

Run your script in the System account

12 posts in this topic

Try this command to know what i mean:

PsExec -d -s C:\WINDOWS\SYSTEM32\notepad.exe

and you will see that notepad is launched in a system account (look at tasklist) that mean 2 thinks:

-No way for user to Kill this task (notepad.exe in my exemple here) :lmao: (usefull to protect you script fror CTRL +ALT+DEL)

-Your exe is totally hidden (no GUI is shown !)

So my question: is ther a way to do same thing like PsExec ? ie run an exe in System account ?

Thinks for any help

Share this post


Link to post
Share on other sites



-No way for user to Kill this task (notepad.exe in my exemple here) :lmao: (usefull to protect you script fror CTRL +ALT+DEL)

Like what a Virus, or something along those lines? stuff running that cannot be shut down can be very dangerous. You maybe barking up the wrong tree, becareful what you follow up with. because activity of non killable scripts is not taken happily because autoit already has problems with false positives with antivirus.

 

Spoiler

shoot_zpsfd329d66.png
dontbelieveeverythingyouthink_zps0e1e900

Madness is the first step to understanding...

Share this post


Link to post
Share on other sites

Like what a Virus, or something along those lines? stuff running that cannot be shut down can be very dangerous. You maybe barking up the wrong tree, becareful what you follow up with. because activity of non killable scripts is not taken happily because autoit already has problems with false positives with antivirus.

Whay you say that ??? I'm asking about some thing like sysinternal tools (PSExec) !

never mine, Thinks for your replay, I'll ask my question in other developper's forums.

Share this post


Link to post
Share on other sites

#4 ·  Posted (edited)

Finally i find a solution. great thinks for this no parano forum

In other word, we can use AT command from XP

Here a full description

Schedules commands and programs to run on a computer at a specified time and date. You can use at only when the Schedule service is running. Used without parameters, at lists scheduled commands.

Syntax

Create an AT job:

AT [\\computername] hh:mm [/iNTERACTIVE] [ /EVERY:day(s) | /NEXT:day(s) ] "command"

Delete an AT job:

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]

Edited by supergg02

Share this post


Link to post
Share on other sites

-No way for user to Kill this task

I can do it without any problem from Task Manager even if it run in System account.

Anyway this method works good, thanx for sharing.

Share this post


Link to post
Share on other sites

I can do it without any problem from Task Manager even if it run in System account.

Anyway this method works good, thanx for sharing.

Are you sure about possibility to kill process when it run in System account from Task Manager ???

would you please explain how (are you logged with admin account or did you use other methode ?....)

Share this post


Link to post
Share on other sites

#7 ·  Posted (edited)

Are you sure about possibility to kill process when it run in System account from Task Manager ???

would you please explain how (are you logged with admin account or did you use other methode ?....)

Yes, I'm logged as admin. Now I understand you meant that a no-admin user can't kill a system process, right?

In any case, I'm testing a way for a AutoIT compiled to (re)run itself in system account, but I still can't found a good way. I can imagine 2 way:

1st. it checks if its own PID (@AutoItPID) is already running as system (how can I do it?); if not then it create an AT job (with a minimum 1 minute delay if you don't use "soon.exe" from MS) for itself (@ScriptFullPath) and exit;

2nd. it runs first time, drops something (a temporary text file or a registry key) as a sign that it has already runned normal, creates an AT job and exit. On next running as system it deletes sign and so on.

Any better idea?

Edited by masvil

Share this post


Link to post
Share on other sites

Yes, I'm logged as admin. Now I understand you meant that a no-admin user can't kill a system process, right?

right !

1st. it checks if its own PID (@AutoItPID) is already running as system (how can I do it?);

No idea but there is an acrobatic :lmao: way to know if it is running as in system account (trying kill it self from non adm account ...killprocess(@AutoItPID) will return a failer result...I imagine...)

maybe there is an other clean way by running it as xp service (using registry or SC commande)

i'm thinking...

Share this post


Link to post
Share on other sites

#9 ·  Posted (edited)

Yes there is quite a system way :lmao:

Make a service from your script by using instsrv.exe and srvany.exe. Look at this guide how to do it (it can be done all by commands if you want to know them, I will write)

And then simply start your script

net start mygreatservice and see how it runs as system o:)

To make it able to interact with desktop you must yet check the "allow service to interact with desktop" checkbox in the service properties. This can by done by this command:

sc config mygreatservice type= own type= interact

"type= own" is necessary because of bug in the sc.exe utility ;)

All those exe files are in resource kit, or maybe they can be downloaded from that guide

Note: when your script ends, the system will not know that the service itself has ended, so he will consider it still running until you type net stop mygreatservice

Edited by LoWang

Share this post


Link to post
Share on other sites

Yes there is quite a system way :lmao:

Nice find ;)

Make a service from your script by using instsrv.exe and srvany.exe. Look at this guide how to do it (it can be done all by commands if you want to know them, I will write)

OK, write them, I can't do it even if I've read the guides.

Share this post


Link to post
Share on other sites

You could use command line switches to start the AutoIt Program up. I've done this in the past where i needed pseudo multi treading form one autoit exe.

so you have the autoit exe start its self with a command line switch. Look in the help for an example though if i remember right it the example in there kinda sucks.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0