Page 1 of 1 1
Topic Options
#211704 - 2016-06-27 11:20 PM RunAsTI or RunAsTrustedInstaller
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Just an FYI of a recent tool I saw and passing the information along. I've not used it yet besides firing it up and confirming I was now at a System level token.

RunAsTI or RunAsTrustedInstaller

 Quote:
Is a tool to launch a program of choice (usually cmd.exe) with the same privileges as the TrustedInstaller. That privilege is very powerfull! Actually the tool makes a clone of the token from TrustedInstaller, and thus the newly created process has an identical token.

Why would you need it? Sometimes it is just not enough to just be running as "nt authority\system". Maybe it's a file or a registry key that is locked. Running a tool with this powerfull privilege most likely solve that. Usually such an issue may be due to Windows Resource Protection (WRP) protecting it (previously called Windows File Protection (WFP)); http://msdn.microsoft.com/en-us/library/windows/desktop/aa382503(v=vs.85).aspx

How do you run it? Simply double click it and cmd.exe will launch. Or pass it the program to launch as parameter.

The tool is actually a merge of 2 previous tools; RunAsSystem and RunFromToken. The curious ones might notice that RunFromToken is attached as a resource.

The tool only runs on nt6.x (Vista and later), since TrustedInstaller does not exist on earlier Windows versions.

Requirement: Administrator.


Download from here
https://github.com/jschicht/RunAsTI

Top
#211710 - 2016-06-28 12:24 PM Re: RunAsTI or RunAsTrustedInstaller [Re: NTDOC]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
well, this can be a mixed blessing...

On one hand this provides admins with a very powerful tool. I'll certainly test it and add it to the arsenal if it proves useful. On the other hand, with so many users still running day-to-day with admin privileges, it would seem that this could be used to further exploit an attack threshold.

Just another argument for running as a regular user and elevating to super powers only when necessary. Heck - Clark and Linda Lee didn't wear their Super garb all day/every day, did they? ;\)

Thanks for sharing, Ron!

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#211714 - 2016-06-28 08:52 PM Re: RunAsTI or RunAsTrustedInstaller [Re: Glenn Barnas]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
No doubt we're going to see quite a few borked systems by users using tools like this. No way around it. Great tool if used by someone that truly understands the ramifications of its use, but most don't and initially won't care. Then as they find out later that it broke things they'll blame the tool instead of themselves. Sorry bud... format and reinstall Windows if you want to fix it properly :-)
Top
Page 1 of 1 1


Moderator:  Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1046 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.052 seconds in which 0.024 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org