Page 1 of 2 12>
Topic Options
#73756 - 2003-02-28 12:51 AM RUNAS
KBG Offline
Lurker

Registered: 2002-10-25
Posts: 2
Loc: Vancouver
Anyone have information on how to insert something like "runas" in a script so that we can have a basic user run a login script but portions as a different id?
Top
#73757 - 2003-02-28 01:13 AM Re: RUNAS
Howard Bullock Offline
KiX Supporter
*****

Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
Do you have a plan on how are you going to get the alternate credentials to the script?
_________________________
Home page: http://www.kixhelp.com/hb/

Top
#73758 - 2003-02-28 03:15 AM Re: RUNAS
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
See also Installing an Application as an Admin
_________________________
There are two types of vessels, submarines and targets.

Top
#73759 - 2003-02-28 08:57 AM Re: RUNAS
Mandala Offline
Fresh Scripter

Registered: 2003-02-17
Posts: 36
i've got the same problem with my xp network

Trouble with su.exe is that it's not 100% compliant with XP PRO. The Microsoft support told us that it's better to use RUNAS on XP but i can't find a "secure" trick to give to runas the password in a logon proc.

[ 28. February 2003, 08:59: Message edited by: Mandala ]
_________________________
P.Maquoi Cellule Antivirus du M.E.T. pmaquoi@met.wallonie.be

Top
#73760 - 2003-02-28 09:02 AM Re: RUNAS
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
mandala, if it's security you want, don't pass the password.

anyway, you can encrypt it with:
KiXtart encryption - UTILITY: KiXcrypt 3.00b
_________________________
!

download KiXnet

Top
#73761 - 2003-02-28 10:09 AM Re: RUNAS
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Mandala knows all about KiXcrypt [Wink]

The problem is that to elevate you privileges you need to use "RunAs" or "SU".

SU is fine, and works well in combination with KiXcrypt, but unfortunately SU just doesn't work reliably with XP.

I've just had a look at RunAs, and I can't find a way of passing the password - you have to type it in.

If anyone else knows different, please let us know.

Top
#73762 - 2003-02-28 10:12 AM Re: RUNAS
Jochen Administrator Offline
KiX Supporter
*****

Registered: 2000-03-17
Posts: 6380
Loc: Stuttgart, Germany
Think the question of how to pass a password to RUNAS was asked before (several times)

IIRC there was indeed no satisfying answer [Frown]
_________________________



Top
#73763 - 2003-02-28 11:42 AM Re: RUNAS
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
yeah...
and the quimeras solution costs manito.
_________________________
!

download KiXnet

Top
#73764 - 2003-02-28 11:50 AM Re: RUNAS
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
k, richard could package this in kixcrypt:
code:
// RunAS.cpp : Defines the entry point for the console application.


// Logon and run an app as a different user
// 1 2 3 4 5 6
// params: user, password, domain, appname, folder, commandline
// Batch file example:
// RunAs Administrator, 123456,,D:\Installer.exe, d:\, -i


#include "stdafx.h"

// params user, password, domain, appname, folder, commandline

int main(int argc, char* argv[])
{

int LOGON_WITH_PROFILE = 1;
int LOGON_NETCREDENTIALS_ONLY = 2;

int res; // results
int creationflags; // flags to pass to define window type
int myerrorlevel; // errorlevel for this function
static PROCESS_INFORMATION myprocessinfo; // process return
static STARTUPINFO mystartupinfo;

// set window flags
creationflags=CREATE_DEFAULT_ERROR_MODE | CREATE_NEW_CONSOLE | CREATE_NEW_PROCESS_GROUP;

// initailise the startupinfo structure
::ZeroMemory(&mystartupinfo, sizeof(mystartupinfo));

// load in size of structure
mystartupinfo.cb = sizeof(mystartupinfo);

// CreateProcessWithLogonW parameters:
// LPCWSTR lpUsername,
// LPCWSTR lpDomain,
// LPCWSTR lpPassword,
// DWORD dwLogonFlags,
// LPCWSTR lpApplicationName,
// LPWSTR lpCommandLine,
// DWORD dwCreationFlags,
// LPVOID lpEnvironment,
// LPCWSTR lpCurrentDirectory,
// LPSTARTUPINFOW lpStartupInfo,
// LPPROCESS_INFORMATION lpProcessInfo

// todo
// concatenate commandline arguments into a string
// argv[6 and +] should be moved into a string

// Start the process
res=CreateProcessWithLogonW(argv[1], argv[3], argv[2], LOGON_WITH_PROFILE,
argv[4], argv[6], creationflags, NULL, argv[5], &mystartupinfo, &myprocessinfo);


// return errorlevel
myerrorlevel=0;
if (res==0){
myerrorlevel=1;
}
else {
// close unwanted handles
CloseHandle (myprocessinfo.hThread); // close the handle to the main thread, since we don't use it
CloseHandle (myprocessinfo.hProcess); // close handle to the process
}
return (myerrorlevel);
}

_________________________
!

download KiXnet

Top
#73765 - 2003-03-01 12:38 AM Re: RUNAS
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Cheers Jooel, I was wondering what to use the spare command switch letters for [Roll Eyes]

Seriously, I'd already considered using the CreateProcessAsUser() call to similar effect.

I want to spend a little time thinking about security implications before adding this as a feature.

The CreateProcessWithLogon() information will be useful.

[edit]
Update: CreateProcessWithLogonW has the following requirements:
quote:
Requirements
Client: Included in Windows XP and Windows 2000 Professional.
Server: Included in Windows Server 2003 and Windows 2000 Server.
Unicode: Implemented only as Unicode.

Which is too restrictive.
[/edit]

[ 28. February 2003, 12:53: Message edited by: Richard H. ]

Top
#73766 - 2003-03-01 12:58 AM Re: RUNAS
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
yeah...
need to find better solution then [Wink]
_________________________
!

download KiXnet

Top
#73767 - 2003-02-28 01:12 PM Re: RUNAS
cellnet Offline
Starting to like KiXtart

Registered: 2002-02-26
Posts: 115
Loc: Sweden
I run the "run as" part with a encrypted vbs code.

not 100 % success.

the window have to be "active" otherwise the script will fail, and the password is pasted to the active window.

kixcode
code:
 IF $OS = "WinNT4"
? "Do Noting procced"
else
Run '%comspec% /c wscript x:\script\vbs\hfnetchk.vbe'
sleep 2
endif

hfnetchk.vbs
code:
 Dim vbOK: vbOK = 1
Dim vbCancel: vbCancel=2
Dim Wshell, ret, msg01, msghdr01, strUser, strPass
Dim CompName: CompName="Blank"

Set WshNetwork = WScript.CreateObject("WScript.Network")
CompName = WshNetworK.ComputerName
Set WshNetwork = nothing

function execute()
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.Run "%windir%\system32\runas.exe /user:" & strUser & " " & Chr(34)& "\\whatand where to start" & CompName & ".bat" & Chr(34)
Wscript.Sleep 100
WshShell.AppActivate "runas"
wScript.Sleep 100
WshShell.SendKeys strPass
wScript.Sleep 100
WshShell.SendKeys "~"
Wscript.Quit
end function

'** Start Encode **
strUser="domain\user"
strPass="password"
execute()

\erik

Top
#73768 - 2003-02-28 01:22 PM Re: RUNAS
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
I've looked into this further, and it is not going to happen in KiXcrypt

The CreateProcessAsUser() call requires security a security token provided by LogonUser(). This can only be a local (machine) login. To run stuff in a network user environment requires a client/server approach, which is why su.exe requires the "suss" service. Requests are send to the login server which I assume either executes calls in a local context (on the server), or executes LogonUser() locally and then returns security tokens that can be used by the client to start processes.

To implement this would require me to write a secure client server product which is well beyond the remit of KiXcrypt.

Best option is to get MS to fix SU.EXE for XP [Frown]

While looking into this I found a third-party su here:
http://www.stefan-kuhr.de/supsu/main.php3
At least this one is actively supported [Razz]

Top
#73769 - 2003-02-28 02:13 PM Re: RUNAS
Mandala Offline
Fresh Scripter

Registered: 2003-02-17
Posts: 36
I've tested Supsu yesterday

and the result is ....

The same error !

Too bad but nice third party upgrade tool

The quest continue
_________________________
P.Maquoi Cellule Antivirus du M.E.T. pmaquoi@met.wallonie.be

Top
#73770 - 2003-02-28 02:18 PM Re: RUNAS
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Try dropping a note to the maintainer of SupSu.

I'm sure he will want to know if there is a problem, and he may be able to give you some idea how to get around it.

Top
#73771 - 2003-02-28 03:54 PM Re: RUNAS
Mandala Offline
Fresh Scripter

Registered: 2003-02-17
Posts: 36
YES ! THE SOLUTION !

So simple, so easy

To use SU from a shared drive / Network drive on a XP Pro, you MUST be localised on a local drive before executing it

I'll mix my code on monday (It's a long and complex script) and i'll post it here

[ 28. February 2003, 16:33: Message edited by: Mandala ]
_________________________
P.Maquoi Cellule Antivirus du M.E.T. pmaquoi@met.wallonie.be

Top
#73772 - 2003-02-28 06:06 PM Re: RUNAS
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
hehee!
I think I mentioned in my reply at:
http://www.kixtart.org/board/ultimatebb.php?ubb=get_topic;f=2;t=004220

that you should try packaging the su.exe and all needed files withing the kixcrypt package [Wink]
_________________________
!

download KiXnet

Top
#73773 - 2003-03-03 03:45 AM Re: RUNAS
Jason L Stenklyft Offline
Lurker

Registered: 2003-03-03
Posts: 2
I've got an idea, and I just put a script together to provide a possible solution.
I posted it at my website: RUNAS Example
Click the link on the main page called RUNAS.

It seems to work well. It uses the SENDKEYS function.

I'll also post the script here for your reading pleasure.

code:
;RUNAS USER
;Kixtart script put together by Jason L Stenklyft
;Jason@Stenklyft.com
;example of using sendkeys to pass a password to runas
;not recommended for production networks, due to security risks

;Requirements to test this script
;Create a make a user on the local box named LUser and set the password to password

SETTITLE ("SENDKEYS ROCKS!")
;set self window title
RUN '%COMSPEC% /e:1024 /c runas /user:@WKSTA\LUser "notepad"'
;launch some notepad action as LUser
$trash= SetFocus ("SENDKEYS ROCKS!")
;set focus back to self
$trash= SendKeys("password{ENTER}")
;send the password and enter
sleep 3
;wait a few for notepad to launch
If SetFocus ("Untitled - Notepad") = 0
;if we can now setfocus to notepad, write some text
$trash = SendKeys("Would you like to play a game?")
Endif

_________________________
Jason Lee Stenklyft Jason@Stenklyft.com Depend upon it there comes a time when for every addition of knowledge you forget something that you knew before. It is of the highest importance, therefore, not to have useless facts elbowing out the useful ones. The Stenklyft.com domain and all associated e-mail addresses are located in the State of Washington, and sending mail to addresses at this domain is subject to the provisions of the Revised Code of Washington.

Top
#73774 - 2003-03-03 04:22 AM Re: RUNAS
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
This is not a solution as the password is still contained in plain-text inside a script.
_________________________
There are two types of vessels, submarines and targets.

Top
#73775 - 2003-03-03 04:34 AM Re: RUNAS
Jason L Stenklyft Offline
Lurker

Registered: 2003-03-03
Posts: 2
The original post did not require the password to be masked or hidden.
_________________________
Jason Lee Stenklyft Jason@Stenklyft.com Depend upon it there comes a time when for every addition of knowledge you forget something that you knew before. It is of the highest importance, therefore, not to have useless facts elbowing out the useful ones. The Stenklyft.com domain and all associated e-mail addresses are located in the State of Washington, and sending mail to addresses at this domain is subject to the provisions of the Revised Code of Washington.

Top
Page 1 of 2 12>


Moderator:  Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 320 anonymous users online.
Newest Members
ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder, M_Moore
17887 Registered Users

Generated in 0.219 seconds in which 0.151 seconds were spent on a total of 12 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org