Sign in to follow this  
Followers 0
LarryDalooza

Run As Local Service

9 posts in this topic

I don't really have a question or a need... but I would like to give the unchallenged something to focus on. This seems a good place for it because most of the other forum categories tend to be cesspools of unfiltered thoughts.

I have this little bit of code that I use to test launching processes as "Local Service" context...

$process = @scriptdir & "setup.exe"

$process = FileGetShortName($process)

RunWait("sc create testsvc binpath= ""cmd /K start " & $process & """ type= own","",@SW_HIDE) ; sometimes type= interact

RunWait("sc start testsvc","",@SW_HIDE)

RunWait("sc delete testsvc","",@SW_HIDE)

I would like a function using LogonUser API or some other API to launch a process as "Local Network", "Local Service", or "Local System"...

I hope that keeps someone busy who is otherwise unemployed.

Lar.


f_mrcleansmalm_77ce002.jpgAutoIt has helped make me wealthy

Share this post


Link to post
Share on other sites



Larry, I'm pretty sure you can't. The trick you are using (which doesn't work on Vista, at least for me) is how I run a process as SYSTEM. I did some looking around when I was working on RunAs()/RunAsWait() and the only way I found to run as any of the system accounts was to do exactly what you are doing.

There's some problems. First, even if you could use LogonUser() to get a token to one of the system accounts, you couldn't use it. CreateProcessAsUser() requires more privileges than the Administrator's group has (by default). In order to use CreateProcessAsUser() you have to already be a system account.

The second problem, the system accounts either don't have a password or the system just treats those accounts differently and won't let you log on to them. The net result in either case is that you can't get the token you would need to create a process.

Share this post


Link to post
Share on other sites

Thanks for the thought cycles... I am curious now about the Vista thing ... I have a Vista project that would require me to test processes as "SYSTEM" ... maybe using PSEXEC to push local...

Lar.


f_mrcleansmalm_77ce002.jpgAutoIt has helped make me wealthy

Share this post


Link to post
Share on other sites

under Vista, I use psexec -s cmd.exe to run some scripts under System Accounts

Share this post


Link to post
Share on other sites

The general idea of that article is, you write the service, install it once with fully elevated administrator rights (You go through a UAC prompt) and then from there, any non-elevated process can send a message to the service to start a process. That's the Secondary Logon Service in a nut-shell. Obviously a custom service can do more or less than the Secondary Logon Service. However, the core problem remains: You must install a service. I gather from Larry's original post that he doesn't want to install a service to do this.

The RunAs command line program forwards information to the Secondary Logon Service. So does the Windows API function CreateProcessWithLogonW(). Psexec installs a service, runs the program and removes the service. No matter how you go about it, somewhere along the line, a service is going to be involved.

Share this post


Link to post
Share on other sites

Larry,

If you don't want to install a service (using sc or psexec), how about using an existing service of windows to launch your process under SYSTEM account?

The Schedule service exists in all windows versions and runs a process under SYSTEM account.

Use the command line interface (AT.EXE) of Schedule service to run a process interactively or in background with SYSTEM priviledges.

Just schedule a command to run one-minute ahead of the current time (in 24-hr format) eg.

AT 17:10 /interactive "NOTEPAD.EXE"

and the process gets launched at the scheduled time with SYSTEM priviledges.

Posted Image

Surprisingly, I've seen many 2000/XP system guest accounts having access to the AT command.

Share this post


Link to post
Share on other sites

Be sure the Scehduler service is enabled&started.

Share this post


Link to post
Share on other sites

If running windows Vista, in order to start the service as interactive you will need to use schtasks.exe

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0