Many times in the past I had to run an interactive command-line shell under the Local SYSTEM account. That is, a CMD window on your desktop running under the system account. This technique is extremely useful in many cases, for example to debug ERROR_ACCESS_DENIED type errors that are coming from a system service.

Let’s take a simple example to illustrate where running CMD as system would be useful. Let’s say that you write an ASP or ASP.NET application, configured to run under local system, without client impersonation. This application gets some weird E_ACCESSDENIED errors when invoking some COM objects (say that you are developing an ASP.NET layer on top of Visual Source Safe, for example).

One option to “debug” this is to attach a debugger to the ASP.NET working process, and attempt to figure out what goes wrong. But how would you debug COM calls, or even a failed CoCreateInstance? The “source code” for the COM infrastructure is not available. And even if you would be able to get access to this complex source code, there is a very high chance that you won’t understand what happens under the cover.

So, instead, here is a simpler solution: just start a CMD.EXE instance, running as local system (using one of the methods described below). Then, in this instance, try to execute an equivalent VB Script (or C++) code that does almost the same thing. You would probably get the same E_ACCESSDENIED but this time you are now able to fine-tune the COM security parameters, like specifying special settings through DCOMCNFG.EXE.

Anyway, let’s go back to the original issue – how to get “CMD.EXE” to run as the system account. Interactively. My first shot was to the RUNAS.EXE command. We already know that RUNAS allows you to run a process under a given user account. Unfortunately, RUNAS won’t work in our case, since a process running under an interactive logon session won’t be able to spawn a Local SYSTEM process. For security reasons, only a system process (that is already running as Local SYSTEM) like the SCM (services.exe) or RPCSS is allowed to spawn another system process.

After asking around, someone told me a quick-and-dirty solution that uses the AT.EXE command. AT can be used to spawn jobs at a certain point in time. What people don’t immediately realize is that these jobs run under the Local SYSTEM account. In fact, what happens under the cover is that AT creates a special Task in the Task Scheduler database. To complete the trick, AT allows tasks to run in “interactive” mode, i.e. the ability to interact with the desktop console (if active). In the end, to run a CMD through the AT.EXE command you must do two things:

1) Get the local time (through the TIME shell command, for example)

2) Add one minute to this time

3) Run the AT command with this new time.

4) Wait one minute for the command window to appear.

E:\Documents and Settings\Adi>time

The current time is: 16:29:00.96

Enter the new time:

E:\Documents and Settings\Adi>at 16:30 /interactive cmd.exe

Added a new job with job ID = 1

Well, this method looked pretty ugly to me. First of all is not scriptable. Second, it requires me to wait for one minute for the command window to appear. At last, the job remains there and needs to be cleaned up.

After this first shot, I started looking for simpler methods to show this command window. A nice start point was the SC.EXE command. If you are not already familiar with it, note just the fact that this is the standard utility for Windows Service related tasks: creating, deleting, enumerating services and their configuration details, etc.

My first attempt was to create an interactive service that just runs CMD.EXE. This didn’t work. I found out that when SCM starts a service, it waits a little for this new process to setup a communication channel (through the RegisterServiceCtrlHandler API). This channel is needed by SCM to send commands to the service.

E:\Documents and Settings\Adi>sc create testsvc binpath= "cmd" type= own type= interact

[SC] CreateService SUCCESS

E:\Documents and Settings\Adi>sc start testsvc

[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

But anyway, I succeeded to run CMD.EXE for a very brief period of time as Local System. After a couple of tweaks, I discovered the solution. You need to “convince” the original CMD.EXE process to spawn a separate CMD.EXE command window. Then, even if the original process dies, the other CMD.EXE instance will stay alive. Spawning a new CMD.EXE is very easy through the START shell command. In fact, just running START (with no parameters) from a CMD shell will start another window.

Let’s delete the original service and try again.

E:\Documents and Settings\Adi>sc delete testsvc

[SC] DeleteService SUCCESS

E:\Documents and Settings\Adi>sc create testsvc binpath= "cmd /K start" type= own type= interact

[SC] CreateService SUCCESS

E:\Documents and Settings\Adi>sc start testsvc

[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

Note that this time, the SC START immediately creates a new CMD window, even if the original CMD window failed to start with error 1053 (this is expected since CMD.EXE doesn’t have any service related code in it).

In the end, I would like to mention one more thing. You can use this new service to start as many CMD windows as you want, and you will get a new CMD window as soon as you do a “sc start testsvc” again.

Running CMD.EXE as Local System(转)的更多相关文章

  1. Local System、Local Service與Network Service

    CreateService参数介绍SC_HANDLE CreateService( SC_HANDLE hSCManager, //服务控制管理程序维护的登记数据库的句柄,由系统函数OpenSCMan ...

  2. (转)内置系统账户:Local system/Network service/Local Service 区别

    最近会转载一些 MSSQL 基础相关的文章. 参考文献: http://www.cnblogs.com/xianspace/archive/2009/04/05/1429835.html 前言 今天在 ...

  3. Local System/Network Service/Local Service

    // The name of the account under which the service should run// 1 NT AUTHORITY\\SYSTEM 2 NT AUTHORIT ...

  4. C#程序调用cmd.exe执行命令

    代码部分 using System.Diagnostics; public class CmdHelper { private static string CmdPath = @"C:\Wi ...

  5. C# 调用cmd.exe的方法

    网上有很多用C#调用cmd的方法,大致如下: [c-sharp] view plaincopy private void ExecuteCmd(string command)   {   Proces ...

  6. [转帖]内置系统账户:Local system/Network service/Local Service 区别

    内置系统账户:Local system/Network service/Local Service 区别 学习使用 xp_cmdshell 的时候 发现必须 sqlserver 的服务运行在local ...

  7. 内置系统账户:Local system/Network service/Local Service 区别

    参考文献: http://www.cnblogs.com/xianspace/archive/2009/04/05/1429835.html 前言 今天在安装sqlserver2008 r2的时候,在 ...

  8. Java 调用cmd.exe命令

    原理:java的Runtime.getRuntime().exec(commandText)可以调用执行cmd指令. cmd /c dir 是执行完dir命令后关闭命令窗口. cmd /k dir 是 ...

  9. C#窗体内嵌外部程序(cmd.exe)的显示【转载】

    [DllImport("User32.dll ", EntryPoint = "SetParent")] private static extern IntPt ...

随机推荐

  1. docker强制关闭命令

    删除容器: 优雅的关闭容器:docker stop  容器id/容器名字 强制关闭容器:docker kill 容器id/容器名字 删除镜像: docker rmi 容器id/容器名字

  2. Python开发环境(3):使用Eclipse+PyDev插件创建Django项目

    OS:Windows 10家庭中文版,Python:3.6,Eclipse:Oxygen.1a Release (4.7.1a), PyDev:6.3.2,Django:2.0.3 本文展示了怎么使用 ...

  3. 缓存数据库-redis数据类型和操作(set)

    一:Redis 集合(Set) Redis的Set是string类型的无序集合.集合成员是唯一的,这就意味着集合中不能出现重复的数据. Redis 中 集合是通过哈希表实现的,所以添加,删除,查找的复 ...

  4. Code Conventions for the JavaScript Programming Language

    This is a set of coding conventions and rules for use in JavaScript programming. It is inspired by t ...

  5. (二)Jsoup 查找 DOM 元素

    第一节: Jsoup 查找 DOM 元素 getElementById(String id) 根据 id 来查询 DOM getElementsByTag(String tagName) 根据 tag ...

  6. MySQL学习笔记:while循环

    思考:while循环是否只能使用在存储过程或者存储函数之中,不能直接在查询语句中使用? ———— 循环一般在存储过程和存储函数中使用. 直接放几个例子: 例一: 1.创建存储过程 DELIMITER ...

  7. hdu 3951 硬币围成一圈(博弈)

    n个硬币围成一个环 每次只能取1-K个硬币 最后取完者胜 假如5个硬币 每次取1-2个情况1 先手取1个 后手取剩下4个中间2个 破坏了连续 虽然最后剩2个,但先手只能取一个 然后后再取一个 后手胜 ...

  8. USACO 6.2 Packing Rectangles

    Packing RectanglesIOI 95 The six basic layouts of four rectangles Four rectangles are given. Find th ...

  9. HTTP.Socket.TCP详解

    这会没事,整理了一下HTTP,socket,TCP之间的关系与区别,我们在面试的时候应该会经常问到这方面的东西,那么什么是HTTP呢? HTTP属于老话题了,在项目中我们经常需要往服务端发POST或者 ...

  10. Tensorflow学习:(一)tensorflow框架基本概念

    一.Tensorflow基本概念 1.使用图(graphs)来表示计算任务,用于搭建神经网络的计算过程,但其只搭建网络,不计算 2.在被称之为会话(Session)的上下文(context)中执行图 ...