Pfthb

I wrote a program that needs to be running as SYSTEM. I add the linker option 'UAC Execution Level' to 'requireAdministrator' and it pops the UAC like it should but now I need to escalate from admin to SYSTEM how can I do that?
I thought about opening the program's token and inject it the SYSTEM token but it is not legit way. How can I do it neatly because I know once you admin you can be SYSTEM.

Write a windows service. It will run as SYSTEM user by default.

A simple tutorial is here, but remember that installing a service requires administrator privileges.

Once you're running as administrator, here are some options:

1. 
   

   If you know you're not going to be using GUI functions, you can create a scheduled task that runs your same exe as NT AUTHORITYSYSTEM within a few seconds, and check within your code which account the process is running as.

   
   
   

   Copied from a project of mine and slightly modified:

   
   
   

   #include <Windows.h>
   #include <WinNls.h>
   #include <shobjidl.h>
   #include <objbase.h>
   #include <ObjIdl.h>
   #include <ShlGuid.h>
   #include <taskschd.h>
   #include <comdef.h>
   #include <strsafe.h>
   
   #pragma comment(lib, "taskschd.lib")
   #pragma comment(lib, "comsupp.lib")
   
   HRESULT WINAPI CreateSchedTask(WCHAR *wszExePath)
   
    ITaskService *pService = NULL;
    ITaskFolder *pRoot = NULL;
    ITaskDefinition *pTask = NULL;
    ITaskSettings *pSettings = NULL;
    IRegistrationInfo *pInfo = NULL;
    ITriggerCollection *pCollection = NULL;
    ITrigger *pTrigger = NULL;
    ITimeTrigger *pTime = NULL;
    IPrincipal *pPrincipal = NULL;
    IActionCollection *pActionCollection = NULL;
    IAction *pAction = NULL;
    IExecAction *pExecAction = NULL;
    IRegisteredTask *pRegTask = NULL;
    SYSTEMTIME stNow;
    WCHAR wFmt[100];
    VARIANT vBlank = _variant_t();
   
    CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
    //CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, 0, NULL);
    CoCreateInstance(CLSID_TaskScheduler, NULL, CLSCTX_INPROC_SERVER, IID_ITaskService, (LPVOID *)&pService);
   
    pService->Connect(vBlank, vBlank, vBlank, vBlank);
    pService->GetFolder(SysAllocString(L"\"), &pRoot);
    pService->NewTask(0, &pTask);
    pService->Release();
   
    pTask->get_RegistrationInfo(&pInfo);
   
    pInfo->put_Author(SysAllocString(L"TASKNAMEHERE"));
   
    pInfo->Release();
   
    pTask->get_Settings(&pSettings);
    pSettings->put_StartWhenAvailable(VARIANT_TRUE);
    pSettings->put_Enabled(VARIANT_TRUE);
    pSettings->Release();
   
    pTask->get_Triggers(&pCollection);
    pCollection->Create(TASK_TRIGGER_TIME, &pTrigger);
    pCollection->Release();
    pTrigger->QueryInterface(IID_ITimeTrigger, (void **)&pTime);
   
    GetLocalTime(&stNow);
    // Note: replace -07:00 with the appropriate UTC offset for your time zone
    StringCchPrintfW(wFmt, 100, L"%.4hu-%.2hu-%.2huT%.2hu:%.2hu:%.2hu-07:00", stNow.wYear, stNow.wMonth, stNow.wDay, stNow.wHour, stNow.wMinute, stNow.wSecond + 30);
    pTime->put_StartBoundary(SysAllocString(wFmt));
    StringCchPrintfW(wFmt, 100, L"%.4hu-%.2hu-%.2huT%.2hu:%.2hu:%.2hu-07:00", stNow.wYear, stNow.wMonth, stNow.wDay, stNow.wHour, stNow.wMinute + 1, stNow.wSecond);
    pTime->put_EndBoundary(SysAllocString(wFmt));
    pTime->put_Id(SysAllocString(L"TimeTrigger"));
    pTime->Release();
   
    pTask->get_Actions(&pActionCollection);
    pActionCollection->Create(TASK_ACTION_EXEC, &pAction);
    pActionCollection->Release();
   
    pAction->QueryInterface(IID_IExecAction, (void **)&pExecAction);
    pAction->Release();
   
    pExecAction->put_Path(SysAllocString(wszExePath));
    pExecAction->Release();
   
    pTask->get_Principal(&pPrincipal);
    pPrincipal->put_RunLevel(TASK_RUNLEVEL_HIGHEST);
    pPrincipal->put_LogonType(TASK_LOGON_SERVICE_ACCOUNT);
    pTask->put_Principal(pPrincipal);
    pPrincipal->Release();
   
    pRoot->RegisterTaskDefinition(
    SysAllocString(L"System Elevation"),
    pTask, TASK_CREATE_OR_UPDATE,
    _variant_t(L"NT AUTHORITY\SYSTEM"),
    _variant_t(), TASK_LOGON_SERVICE_ACCOUNT,
    _variant_t(L""), &pRegTask);
   
    pRoot->Release();
    pTask->Release();
    pRegTask->Release();
    CoUninitialize();
   
    return S_OK;
   
   
   INT APIENTRY wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, INT nShowCmd)
   
    WCHAR wUsername[100], wExePath[MAX_PATH];
    GetEnvironmentVariableW(L"USERNAME", wUsername, 100);
   
    if (!wcschr(wUsername, L'$'))
    
    GetModuleFileNameW(hInstance, wExePath, MAX_PATH);
    CreateSchedTask(wExePath);
    
    else
    GENERIC_READ, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    DWORD dwWritten;
    UINT uLen;
    CHAR szBuf[100];
    SetFilePointer(hLog, 0, NULL, FILE_END);
    StringCchPrintfA(szBuf, 100, "Hello from NT AUTHORITY\SYSTEMrn", wUsername);
    StringCbLengthA(szBuf, 100, &uLen);
    WriteFile(hLog, szBuf, uLen, &dwWritten, NULL);
    CloseHandle(hLog);
    
    return 0;
   
   

   
   



2. Use the Windows Process API to elevate to System. I don't have much in the way of example code for this, but you can look at PAExec, an open source alternative to SysInternals PSExec tool, that allows creating new interactive processes as System.




3. The idiomatic way of doing this on Windows, which is create a Windows service.