Running CMD.EXE as Local System(转)
Many times in the past I had to run an interactive command-line shell under the Local SYSTEM account. That is, a CMD window on your desktop running under the system account. This technique is extremely useful in many cases, for example to debug ERROR_ACCESS_DENIED type errors that are coming from a system service.
Let’s take a simple example to illustrate where running CMD as system would be useful. Let’s say that you write an ASP or ASP.NET application, configured to run under local system, without client impersonation. This application gets some weird E_ACCESSDENIED errors when invoking some COM objects (say that you are developing an ASP.NET layer on top of Visual Source Safe, for example).
One option to “debug” this is to attach a debugger to the ASP.NET working process, and attempt to figure out what goes wrong. But how would you debug COM calls, or even a failed CoCreateInstance? The “source code” for the COM infrastructure is not available. And even if you would be able to get access to this complex source code, there is a very high chance that you won’t understand what happens under the cover.
So, instead, here is a simpler solution: just start a CMD.EXE instance, running as local system (using one of the methods described below). Then, in this instance, try to execute an equivalent VB Script (or C++) code that does almost the same thing. You would probably get the same E_ACCESSDENIED but this time you are now able to fine-tune the COM security parameters, like specifying special settings through DCOMCNFG.EXE.
Anyway, let’s go back to the original issue – how to get “CMD.EXE” to run as the system account. Interactively. My first shot was to the RUNAS.EXE command. We already know that RUNAS allows you to run a process under a given user account. Unfortunately, RUNAS won’t work in our case, since a process running under an interactive logon session won’t be able to spawn a Local SYSTEM process. For security reasons, only a system process (that is already running as Local SYSTEM) like the SCM (services.exe) or RPCSS is allowed to spawn another system process.
After asking around, someone told me a quick-and-dirty solution that uses the AT.EXE command. AT can be used to spawn jobs at a certain point in time. What people don’t immediately realize is that these jobs run under the Local SYSTEM account. In fact, what happens under the cover is that AT creates a special Task in the Task Scheduler database. To complete the trick, AT allows tasks to run in “interactive” mode, i.e. the ability to interact with the desktop console (if active). In the end, to run a CMD through the AT.EXE command you must do two things:
1) Get the local time (through the TIME shell command, for example)
2) Add one minute to this time
3) Run the AT command with this new time.
4) Wait one minute for the command window to appear.
E:\Documents and Settings\Adi>time
The current time is: 16:29:00.96
Enter the new time:
E:\Documents and Settings\Adi>at 16:30 /interactive cmd.exe
Added a new job with job ID = 1
Well, this method looked pretty ugly to me. First of all is not scriptable. Second, it requires me to wait for one minute for the command window to appear. At last, the job remains there and needs to be cleaned up.
After this first shot, I started looking for simpler methods to show this command window. A nice start point was the SC.EXE command. If you are not already familiar with it, note just the fact that this is the standard utility for Windows Service related tasks: creating, deleting, enumerating services and their configuration details, etc.
My first attempt was to create an interactive service that just runs CMD.EXE. This didn’t work. I found out that when SCM starts a service, it waits a little for this new process to setup a communication channel (through the RegisterServiceCtrlHandler API). This channel is needed by SCM to send commands to the service.
E:\Documents and Settings\Adi>sc create testsvc binpath= "cmd" type= own type= interact
[SC] CreateService SUCCESS
E:\Documents and Settings\Adi>sc start testsvc
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
But anyway, I succeeded to run CMD.EXE for a very brief period of time as Local System. After a couple of tweaks, I discovered the solution. You need to “convince” the original CMD.EXE process to spawn a separate CMD.EXE command window. Then, even if the original process dies, the other CMD.EXE instance will stay alive. Spawning a new CMD.EXE is very easy through the START shell command. In fact, just running START (with no parameters) from a CMD shell will start another window.
Let’s delete the original service and try again.
E:\Documents and Settings\Adi>sc delete testsvc
[SC] DeleteService SUCCESS
E:\Documents and Settings\Adi>sc create testsvc binpath= "cmd /K start" type= own type= interact
[SC] CreateService SUCCESS
E:\Documents and Settings\Adi>sc start testsvc
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
Note that this time, the SC START immediately creates a new CMD window, even if the original CMD window failed to start with error 1053 (this is expected since CMD.EXE doesn’t have any service related code in it).
In the end, I would like to mention one more thing. You can use this new service to start as many CMD windows as you want, and you will get a new CMD window as soon as you do a “sc start testsvc” again.
Running CMD.EXE as Local System(转)的更多相关文章
- Local System、Local Service與Network Service
CreateService参数介绍SC_HANDLE CreateService( SC_HANDLE hSCManager, //服务控制管理程序维护的登记数据库的句柄,由系统函数OpenSCMan ...
- (转)内置系统账户:Local system/Network service/Local Service 区别
最近会转载一些 MSSQL 基础相关的文章. 参考文献: http://www.cnblogs.com/xianspace/archive/2009/04/05/1429835.html 前言 今天在 ...
- Local System/Network Service/Local Service
// The name of the account under which the service should run// 1 NT AUTHORITY\\SYSTEM 2 NT AUTHORIT ...
- C#程序调用cmd.exe执行命令
代码部分 using System.Diagnostics; public class CmdHelper { private static string CmdPath = @"C:\Wi ...
- C# 调用cmd.exe的方法
网上有很多用C#调用cmd的方法,大致如下: [c-sharp] view plaincopy private void ExecuteCmd(string command) { Proces ...
- [转帖]内置系统账户:Local system/Network service/Local Service 区别
内置系统账户:Local system/Network service/Local Service 区别 学习使用 xp_cmdshell 的时候 发现必须 sqlserver 的服务运行在local ...
- 内置系统账户:Local system/Network service/Local Service 区别
参考文献: http://www.cnblogs.com/xianspace/archive/2009/04/05/1429835.html 前言 今天在安装sqlserver2008 r2的时候,在 ...
- Java 调用cmd.exe命令
原理:java的Runtime.getRuntime().exec(commandText)可以调用执行cmd指令. cmd /c dir 是执行完dir命令后关闭命令窗口. cmd /k dir 是 ...
- C#窗体内嵌外部程序(cmd.exe)的显示【转载】
[DllImport("User32.dll ", EntryPoint = "SetParent")] private static extern IntPt ...
随机推荐
- Failed to load class "org.slf4j.impl.StaticLoggerBinder"
调试程序出现如下错误: SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".SLF4J: Default ...
- C++模板(Templates)
模板(template)是泛型编程的基础,"泛型"的含义就是没有不依赖具体的数据类型.模板的引入是为了创建一般性的类(模板类)或者函数(模板函数).典型的容器比如迭代器/算法等是泛 ...
- C++链接与装载
1..obj文件的内部结构 2.映射到进程虚拟空间 3.链接的原理 C++ Code 123456789 1.未解决符号表:提供了所有在该编译单元里引用但是定义并不在本编译单元里的符号及其 ...
- 我常用的 Python 调试工具 - 博客 - 伯乐在线
.ckrating_highly_rated {background-color:#FFFFCC !important;} .ckrating_poorly_rated {opacity:0.6;fi ...
- CentOS 7 安装Docker CE
本节内容: 背景 Moby项目 安装Docker CE 卸载Docker CE 一.背景 在搭建Registry的过程中,发现使用Docker 1.12版本,在push镜像到Registry时会报错误 ...
- js的等值比较规则
https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Equality_comparisons_and_sameness ES2015中有四种 ...
- Pig的安装和简单使用
1.Pig是基于hadoop的一个数据处理的框架. MapReduce是使用java进行开发的,Pig有一套自己的数据处理语言,Pig的数据处理过程要转化为MR来运行.2.Pig的数据处理语言是数据流 ...
- HBase结合MapReduce批量导入(HDFS中的数据导入到HBase)
HBase结合MapReduce批量导入 package hbase; import java.text.SimpleDateFormat; import java.util.Date; import ...
- 8-4 奖品的价值 uva11491(贪心)
题意:给出一个n位整数 请删除d个数字 使得剩余数字最大 一开始写成窗口扫描 非常的麻烦易错 只要保证前d+1 降序即可 如果非降序 则删除 很巧妙的贪心 每次读入和已经保存的数组相比较 ...
- 005 Hadoop的三种模式区别
1.本地模式 -默认模式. -不对配置文件进行修改. -使用本地文件系统,而不是分布式文件系统. -Hadoop不会启动NameNode.DataNode.ResourceManager.NodeMa ...