How to run a program as SYSTEM using c++???

[3hMz8vqX]

Hi all,
How to run a program as SYSTEM using c++???
Thankyou everyone in advance!!! :)

[SneakySnake]

I'm not sure I understand the question.
What do you mean by running a program as SYSTEM?

[3hMz8vqX]

I mean SYSTEM account!:)

[13bSLyTq]

Hi,

In windows NT kernel (Vista, 7 etc.), running process's as SYSTEM is not permitted, the reason behind this is due to end-user have too powerful access to Windows, as much as this may be useful - for the Microsoft ^TM, it is not as the end-user can remove all security restrictions, Microsoft ^TM incorporated into Windows.

A End-User can remove Raw Socket(s) restriction, which can then allow them to spoof IP addresses when DDOSing or accessing Web. This as you know is not too safe nor legal, therefore in Windows it is impossible to run as SYSTEM.

This however can be evaded, as you know Windows & all OS contain Ring's mechanism - Ring3, Ring2, Ring1, Ring0

In Ring0 mode\level, all CPU operations and all command executions taking place among ring0 memory space will automatically be having SYSTEM privileges and have complete access to Windows OS itself. Using Ring0 we can completely remove all Restrictions placed.

How to run in Ring0 Mode:

In Ring0 mode (aka Kernel Mode), you cannot run the usual applications\executable (.EXE) which are run normally (on Ring3 Mode). To run in Ring0 Kernel Mode, you need to develop and launch a Driver (.SYS).

I have created a simple Driver for your sake (Windows 7 Tested):

#include <ntddk.h>
#include <wdf.h>
DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD KmdfSmallEvtDeviceAdd;

NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT  DriverObject, _In_ PUNICODE_STRING RegistryPath)
{
    NTSTATUS status;
    WDF_DRIVER_CONFIG config;
 
    KdPrintEx(( DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: DriverEntry\n" ));
    WDF_DRIVER_CONFIG_INIT(&config, KmdfSmallEvtDeviceAdd);
    status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE);

	DbgPrint("Hello World! By OrionMaster");

    return status;
}

NTSTATUS KmdfSmallEvtDeviceAdd(_In_ WDFDRIVER Driver, _Inout_ PWDFDEVICE_INIT DeviceInit)
{
    NTSTATUS status;
    WDFDEVICE hDevice;
    UNREFERENCED_PARAMETER(Driver);

    KdPrintEx(( DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: KmdfSmallEvtDeviceAdd\n" ));
    status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
    return status;
}

Before trying to run this montage, you need to download Windows 7\8 WDK (Windows Driver Development Kit):

Download:
http://go.microsoft.com/fwlink/p/?LinkId=317353

NOTE: You must have Visual Studio 2012 Premium OR Ultimate in order to develop.

soon after download & installation finished and came to a halt, open you VS2012:

Open Microsoft Visual Studio. On the File menu, choose New > Project. The New Project dialog box opens,

In the New Project dialog box, in the left pane, locate and select WDF.

In the middle pane, select Kernel Mode Driver, Empty (KMDF).

In the Name field, enter any name you wish for the project name.

In the Location field, enter the directory where you want to create the new project.

Check Create directory for solution. Click OK.

Wait for few seconds, allow VS2012 to initialize all settings and such,

VS2012 will create 2 projects - [ProjectName] Package, [ProjectName]

In the Solution Explorer window, right-click the top project and choose Add > New Item.

In the Add New Item dialog box, select C++ File. For Name, enter "Driver.c". C FILE NOT .CPP FILE

In the Solution Explorer window, right-click Solution '[PROJECT NAME]' (2 projects) and choose Configuration Manager. Choose a configuration and platform for both the driver project and the package project. For this exercise, we choose Win7 Debug and x64.

In the Solution Explorer window, right-click the topmost project and choose Properties. In Wpp Tracing > All Options, set Run Wpp tracing to No. Click OK.

Then build.


As you may see after the build completed, the output is a .SYS file, it is the driver. All we programmed is a simple Hello World Kernel Mode Driver, few weeks of learning you will be able to program fluently such as hooks and such.

To test this, you driver need to be signed digitally by a Certificate, or you can change the configuration build type to Win7 Debug and Win32.

The reason you need digitally signed certificate on ALL x64 machines is solely because of Patch Guard on the Kernel to protect it from "rogue" Kernel Drivers. Therefore it is important to sign else Patch Guard denies the Driver access to the Kernel. On other hand on x86 machines you can launch and register "rogue" Driver softwares.

If you want to try bypass Patch-guard, obviously which should be more or less "sketchy" as Legitimate Software should\would not behave in that manner. Take a look at CodeProject:

http://www.codeproject.com/Articles/28318/Bypassing-PatchGuard-3

This trick\technique can be easily adapted to newer versions of the PatchGuard, just to make you aware using these tricks may not be a good trial to use as Microsoft is notorious to fix Kernel Bugs as soon as possible, thus once your technique is patched on all machines with the exploitable PatchGuard - your Software will become useless and unable to run. That is why I advise to digitally sign it.

If you cannot afford to sign this, some legitimate developers steal signatures just to test if the driver works - but do again be aware Malware Developers also use this method. To understand how to steal digital signatures just for TEST (I am not promoting Signature Stealing) read Symantec's blog regarding stealing signatures and technical details:

http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates

There are 2 ways to run a driver - One being Registry and one other being CreateService. I find CreateService being the easiest to do:

// Thanks CodeProject
int _cdecl main(void)
{
    HANDLE hSCManager;
    HANDLE hService;
    SERVICE_STATUS ss;

    hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
    
    printf("Load Driver\n");

    if(hSCManager)
    {
        printf("Create Service\n");

        hService = CreateService(hSCManager, "Example", 
                                 "Example Driver", 
                                  SERVICE_START | DELETE | SERVICE_STOP, 
                                  SERVICE_KERNEL_DRIVER,
                                  SERVICE_DEMAND_START, 
                                  SERVICE_ERROR_IGNORE, 
                                  "C:\\example.sys", 
                                  NULL, NULL, NULL, NULL, NULL);

        if(!hService)
        {
            hService = OpenService(hSCManager, "Example", 
                       SERVICE_START | DELETE | SERVICE_STOP);
        }

        if(hService)
        {
            printf("Start Service\n");

            StartService(hService, 0, NULL);
            printf("Press Enter to close service\r\n");
            getchar();
            ControlService(hService, SERVICE_CONTROL_STOP, &ss);

            DeleteService(hService);

            CloseServiceHandle(hService);
            
        }

        CloseServiceHandle(hSCManager);
    }
    
    return 0;
}

Now, I will answer how to run a usual - Ring3 Application as SYSTEM. In Kernel Mode as said before you have complete control over System, this means we can elevate applications\process to any privilege level we wish. To do this we need to do a simple token trick.

To read about how to implement it I recommend you read: Subverting Windows Kernel, although it is very old it can easily be run in the Newer OS.

More Driver Development:

MSDN:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff557573(v=vs.85).aspx

ADP-GMBH
http://www.adp-gmbh.ch/win/misc/writing_devicedriver.html

Noz3001 WordPress
http://noz3001.wordpress.com/2007/05/16/beginner-driver-programming/

Until Next Time,
OrionMaster

[modoran]

I think OP is just asking how to run an external program with administrative privileges. For this just use ShellExecute with "runas" lpVerb parameter (you will get UAC prompt).

The above code requires administrative privileges already, why bother and not just call CreateProcess directly ?

[13bSLyTq]

Nope, OP is asking how to get SYSTEM privileges on a process. I am set-solid about this especially since all\majority of his question are somewhat related to Security System's Development.
In addition, the code above does require Administrative privileges however, when it comes to a AV development - it is never a flaw & in fact most if not all AV installation procedures require UAC elevation.

If OP did want to know how to run a external program with administrative privileges, I would advice him to take a look at CodeProject about run-time elevation: http://www.codeproject.com/Articles/320748/Haephrati-Elevating-during-runtime

Now using the above code in the CodeProject article, you can elevate your application - now to run a different application as a Administrative privileges, all you need to do is run normally with runas as a flag set for the program you wish to start.

Next, drivers do\are not processes but are infact services, so all you are doing to the driver is useless and nothing's going to happen.

[3hMz8vqX]

Thankyou everyone for your replys...
but what Im trying to ask is how will you run a process as user 'SYSTEM' we can see such processes in task manager like AVs...
can I use CreateProcessAsUser API function to do that???
Thankyou everyone in advance!!! :)

[13bSLyTq]

I just answered it, man that too with approx - 8000 letters.
I answered all you questions, can you read or what?

For the last time, nothing can run your process as "SYSTEM" accept from Drivers.

Did you read or what?

[modoran]

Aravind33 wrote:

but what Im trying to ask is how will you run a process as user 'SYSTEM' we can see such processes in task manager like AVs...

OrionMaster wrote:

For the last time, nothing can run your process as "SYSTEM" accept from Drivers.

Just write a windows service, the default user for that is SYSTEM.
http://www.codeproject.com/Articles/499465/Simple-Windows-Service-in-Cplusplus
http://code.msdn.microsoft.com/windowsdesktop/CppWindowsService-cacf4948

[13bSLyTq]

Good Work Modoran, but this can be changed via a simple ACL\DACLS change or maybe a Injection. Whereas as a AV does Drivers are far more safer.
So if you want stable SYSTEM access go for the drivers.

Therefore Malware will simply delete the service. :D

[modoran]

Therefore Malware will simply delete the service. :D

If malware can delete a service then it means is already running and has administrative privileges. In that case it can stop and delete your driver too :)

Drivers are far more safer

Yea, a bug in a driver causes BSOD, whereas a bug in a service only crash the service :)

[13bSLyTq]

Nope, not if your Driver hooks Nt* function at kernel level. LOL.
That way the Malware cannot even unhook as it is in Kernel Level.

Well of course driver bug can cause BSOD, but this logic is pretty - if the driver is developed properly, it should be good.

Don't ya think AV's would then use Userland API's than going Kernel mode for protection?

[3hMz8vqX]

Can anyone give me a simple windows service tutorial???

[Computergeek01]

@ OrionMaster: Sys Admin here (not for this site, but professionally), for the last 10 years I would say Anti-virus programs have been the third on my list of reasons why my job causes me to drink; the only two above AV suites are users and printers. They are a PITA to install usually because their remote installations do not support batch installations, they run about a 10:1 ratio of false positives to actual virus ID's, they interfere with legitimate outgoing Email to the point of making it unusable which causes me to then have to disable this feature THAT MY COMPANY PAYS FOR, I won't even go into my rant about the absolute BS they call "heuristics" and the actual protection they offer over UAC is barely quantifiable. The point of my rant is that the AV companies are not the end all authority on what is "good code", in fact given the number of infections I have to fix a month I wonder if their code, for all it's shiny complexity, does anything at all. By the way, your method of hooking the Nt* functions is trumped if the infection installs a custom boot loader.

[13bSLyTq]

Hi,

I would be wise to listen to you, so yes - I cannot comment on this as you have much more experience in this field than me, but heuristic algorithms is a massive in AV field especially as the industry is going nuts to prevent these very problems.

Heuristics can be developed in a nice way, this is ironic but Malware(s) which are equip with Botkillers using heuristic do a much better job. Trust me.

As for AV being bypassed by MBR infection, it is too slim for such a incident to happen maybe in some isolated occasions with Rovnix (Carberp), Stoned and few more bypassed proactives mainly because the Malware was FUD, therefore bypassed the AV proactive scanning then simply dropped the file and got the handle to sector 0 and performed Evil Maids Attack.

This can be prevented fairly easily, via simple denying access MBR\VBR memory. After the leak of Carberp bootkit and Stoned, pretty much all AV available added MBR protection one way or another.

Your idea of bypassing AV's is not as easy as simply using custom Injection methods such as what Carberp did.

Regards,
OrionMaster

[3hMz8vqX]

Can anyone give me a simple windows service tutorial???