Create Process Elevated as domain admin

[chmichael]

Hello,
In a PC on a domain in order to elevate a process it asks for domain admin name and password.
How can i archive the same with NTUtils and be silent (No GUI) ?

Thank you

[diversenok]

Hi. Do I understand correctly that you have credentials of a user and want to spawn a process under this user's identity? In other words, you want to programmatically do what runas.exe does, right? If so, I can provide an example for it. NtUtils has a wrapper for CreateProcessWithLogonW, but there are some caveats related to mismatching logon SID, so it deserves an example.

[diversenok]

Actually, never mind about the logon SID part; it's only relevant when explicitly specifying the desktop name. The minimal example is very simple:

uses
  NtUtils, NtUtils.Processes.Create, NtUtils.Processes.Create.Win32;

function Main(out Info: TProcessInfo): TNtxStatus;
var
  Options: TCreateProcessOptions;
begin
  Options := Default(TCreateProcessOptions);
  Options.Application := 'C:\Windows\system32\cmd.exe';
  Options.Domain := 'Domain name';
  Options.Username := 'User nama';
  Options.Password := 'Password or packed credentials';

  Result := AdvxCreateProcessWithLogon(Options, Info);
end;

You can optionally add Options.LogonFlags := LOGON_WITH_PROFILE; (constant defined in Ntapi.ProcessThreadsApi) to trigger profile loading, allowing the process to access its HKCU.

[chmichael]

Hello,
The problem is that this doesn't elevate the process when i user domain administrator.
I've tried LOGON_WITH_PROFILE and LOGON_NETCREDENTIALS_ONLY.

Any ideas ?

Thank you

[diversenok]

Ahh, you mean UAC gets in the way and filters the new token to medium integrity? Yeah, CreateProcessWithLogonW performs interactive logon, so it makes sense. Does the calling process have admin permissions to begin with? If yes, the easiest option is probably to do LsaLogonUser for network logon and then spawn the process via CreateProcessWithTokenW/CreateProcessAsUser. If no, we might need to reimplement something like this.

[chmichael]

I would call it from a service so it will have system privileges. So i guess your first solution is for service (system) and the 2nd (the twitter solution) is for calling from shell. (user)

[diversenok]

I added the twitter solution as an example project for the library here.

Otherwise, yeah, having system privileges makes things a lot easier. The bare minimum should look something like this:

uses
  Ntapi.ntseapi, Ntapi.NtSecApi, NtUtils, NtUtils.Tokens.Logon,
  NtUtils.Processes.Create, NtUtils.Processes.Create.Win32;

function Main: TNtxStatus;
var
  Credentials: TLogonCredentials;
  Options: TCreateProcessOptions;
  Logon: TLogonInfo;
  ProcessInfo: TProcessInfo;
begin
  Credentials := Default(TLogonCredentials);
  Credentials.Domain := 'Domain name';
  Credentials.Username := 'User name';
  Credentials.Password := 'Password';

  // Perform network logon to avoid UAC filtration
  Result := LsaxLogonUser(Logon, TLogonSubmitType.InteractiveLogon,
    TSecurityLogonType.Network, Credentials, TTokenSource.New);

  if not Result.IsSuccess then
    Exit;

  Options := Default(TCreateProcessOptions);
  Options.Application := 'C:\Windows\system32\cmd.exe';
  Options.hxToken := Logon.hxToken;

  // Create a process using the new token
  Result := AdvxCreateProcess(Options, ProcessInfo);
end;

However, if you want to spawn the process cross-session (to run interactively), it will require more work. You can change the token's session ID like this:

uses
  Ntapi.WinNt, Ntapi.ntseapi, NtUtils, NtUtils.WinStation,
  NtUtils.Tokens, NtUtils.Tokens.Info,

function ChangeSessionToInteractive(const hxToken: IHandle): TNtxStatus;
var
  SessionId: TSessionId;
begin
  Result := WsxFindActiveSessionId(SessionId);

  if not Result.IsSuccess then
    Exit;

  Result := NtxToken.Set(hxToken, TokenSessionId, SessionId);
end;

Additionally, you might need to either adjust the security descriptor on the interactive window station and desktop (which is problematic from a service since it's in a different session) or include the correct logon SID into the token via the AdditionalGroups parameter. But again, retrieving the correct SID from the service might also be a bit challenging.