SuperPrompt

[txomin]

The quickest way I know to have the DOS prompt running under Windows as a SYSTEM process.

Useful when you want to kill a process that normally doesn't stop.

Every application you launch with this will be run with SYSTEM credentials.

If IsAdmin() Then
     Run(@ComSpec & " /c " & "sc create testsvc binpath= ""cmd /K start"" type= own type= interact", "", @SW_HIDE)
     Run(@ComSpec & " /c " & "sc start testsvc", "", @SW_HIDE)
     Sleep(1000)
     Run(@ComSpec & " /c " & "sc delete testsvc", "", @SW_HIDE)
Else
     MsgBox(16,"Error","You do not have administrator priviledges on the local machine.")
EndIf

[RazerM]

This Works really well.

What about udf syntax?

;===============================================================================
;
; Function Name:   _CmdSystem
; Description::    Starts cmd with SYSTEM credentials
; Parameter(s):    None
; Requirement(s):  None
; Return Value(s): 1 - Success, 0 and @error = 1 - Failure
; Author(s):       txomin
;
;===============================================================================
;
Func _CmdSystem()
    If IsAdmin() Then
        Run(@ComSpec & " /c " & "sc create testsvc binpath= ""cmd /K start"" type= own type= interact", "", @SW_HIDE)
        Run(@ComSpec & " /c " & "sc start testsvc", "", @SW_HIDE)
        Sleep(1000)
        Run(@ComSpec & " /c " & "sc delete testsvc", "", @SW_HIDE)
        Return 1
    Else
        Return SetError(1, 0, 0)
    EndIf
EndFunc   ;==>_CmdSystem

edit: mistake with seterror

Edited September 9, 2006 by RazerM

[txomin]

This Works really well.

What about udf syntax?

Very good idea RazerM, I like it. You could also write easily an UDF called _RunAsSystemProcess. Follows the script, even if incompleted - sorry no enough time today ;-)

;===============================================================================
;
; Function Name:   _RunAsSystemProcess
; Description::    Launches a process with SYSTEM credentials
; Parameter(s):    command to execute
; Requirement(s):  To be system administrator
; Return Value(s): 1 - Success, 0 and @error = 1 - Failure
; Author(s):       txomin
;
;===============================================================================
;
Func _RunAsSystemProcess(ByRef $CommandToEx)
Local $SysPID
    If IsAdmin() Then
        Run(@ComSpec & " /c " & "sc create testsvc binpath= ""cmd /K start"" type= own type= interact", "", @SW_HIDE)
        $SysPID = Run(@ComSpec & " /c " & "sc start testsvc", "", @SW_HIDE)
        Sleep(1000)
        Run(@ComSpec & " /c " & "sc delete testsvc", "", @SW_HIDE)
        WinActivate(           ;... the parameters to activate
        WinwaitActive(        ;... the ms-dos prompt using his PID
        Send($CommandToEx & "{ENTER}")
        Send("exit{ENTER}")
        Return 1
    Else
        Return SetError(1, 0, 0)
    EndIf
EndFunc   ;==>_CmdSystem

Edited September 9, 2006 by txomin

[jftuga]

Great ideas! I really like this.

-John

[therks]

* Edit: My edited function did not work as intended, ignore this post.

Very good idea RazerM, I like it. You could also write easily an UDF called _RunAsSystemProcess. Follows the script, even if incompleted - sorry no enough time today ;-)

Doesn't that code seem a bit silly to you?

Think about it. You create a service to run the cmd prompt so that it can run another command?

Why not just create a service with the command you want you want to run, like such:

... removed ...

(Also, why did you use ByRef?)

Edited September 16, 2006 by Saunders

[SmOke_N]

I'm still not getting the relevance for this... I like the idea of how easily it opens the process as a service, but it only opens it for a short while, is this primarily for debugging?

[txomin]

Doesn't that code seem a bit silly to you?

Think about it. You create a service to run the cmd prompt so that it can run another command?

Why not just create a service with the command you want you want to run, like such:

I'm still not getting the relevance for this... I like the idea of how easily it opens the process as a service, but it only opens it for a short while, is this primarily for debugging?

@SmOke_N

You should complete and use the UDF in Post#3

@Saunders

Sorry, as SmOke_N says, it doesn't last so long with your UDF

[therks]

@Saunders

Sorry, as SmOke_N says, it doesn't last so long with your UDF

Ah, I did not realize it closed the process after a short amount of time. I tested it with a few different programs, but didn't leave them open for long. My apologies.

[WSCPorts]

Technically u are all wrong...

lol

sc uses the LocalService Acct and not the system...

if it comes up with the system, then that means there is a distinct vulnerabity just waiting to be exploited on 2k3 and xp and 2k systems.. privledge escalation is just one that comes to mind.

this vulnerablity is described in pseudo code as such

runAsSystem()
EnableDebugPrivs()
OpenProcessToken()
DuplicateToken()
use the duplicated token to do some nasty stuff;)

even running as the LocalService Acct which is higher privledge then the administrator but lower then SYSTEM on can do some pretty nasty stuff.

[txomin]

Technically u are all wrong...

1. Probably we are all wrong about 1000 of different ideas BUT this code is working so I don't get your point.

2. It is not a Windows vulnerability, actually it is a Microsoft documented feature you can find on MSDN.

[jaenster]

note on this..

CHeck please the os, under 2000 this dont work.

[daslick]

Run("cmd.exe /c sc create testsvc binpath= " & '"' & $file & '"' & " type= own type= interact", "", $howdoirun)

just make a func that uses $file as the file you want to run, and how to run (@SW_NORM / @SW_HIDE / etc) as $howdoirun and the above line will work well.... Keep in mind if $file = cmd or a cmd dependent program you may need to use cmd /k start

EXCELLENT WORK! I love this!

[jaenster]

run(@comspec&" /c at "&@hour&&":"&@min+1&" /interactive 'cmd.exe'")