M2Team/Privexec

Suggest adding the "No Elevated (UAC)" implementation with WTSQueryUserToken.

MouriNaruto opened this issue · 3 comments

I think it is better than using the Task Scheduler or search the explorer.exe process token.

How to:

  1. Get the current session's winlogon.exe process token and duplicate its returned token.
  2. Enable SE_TCB_NAME privilege on the duplicated token.
  3. Get the current process's Session ID. (Reason: https://forums.mydigitallife.net/threads/nsudo-a-powerful-system-administration-tool.59268/page-7#post-1348433 )
  4. Call WTSQueryUserToken and duplicate its returned token.

For more information, you can read the source code of the NSudo project.

Mouri.

WORKING IN PROGRESS

app branch done. we need merge to master

done