Tuesday, August 5, 2008

Acquiring System privileges under Windows

At some occasions, while using a relatively recent version of Microsoft Windows (I'll refer XP and above, but 2000 might also work), it is required to acquire System privileges (aka LocalSystem). This might happen for malicious purposes, but also legitimate reasons exist, such as finding a bug in a service which runs under LocalSystem. At such occasions, one would like to get a terminal (cmd) that runs as LocalSystem.

Of course, one cannot login using LocalSystem, since it is not meant to be logged-in with. But this is not a reason to despair. Actually, opening a cmd under LocalSystem is quite easy:
open a cmd (using the currently logged-on user) and type:
at 00:00 /interactive "cmd"
This will create a new scheduled task, which will never run, and would open a new cmd using LocalSystem. Now, all you have to do is: Start->Run->tasks and run the newly created task (usually "At1"). The cmd window that just got opened allow you to run everything as if you were the System account.

No comments:

Post a Comment