C++ code to switch its running EXE from Administrator to Local System

[RobHicSunt]

I can successfully launch CMD under Local System in my Visual C++ code, ley’s call it mycode.cpp:


1. get the Local System process token

2. duplicate the token with DuplicateTokenEx

3. launch CMD under Local Sytem using CreateProcessWithToken


I run into issues when replacing step 3 in mycode.cpp: instead of launching CMD, I would like that mycode.EXE changes its running token from Administrator to LocalSystem. Alternatively, I would like to CreateThread with the Local System token. (I am afraid that it cannot be done.)


I can solve this issue by splitting mycode.cpp into two separated programs, say, mycode1.cpp and mycode2.cpp. I compile them independently. Then the former (mycode1.EXE) runs as Administrator and launches mycode2.EXE as Local System in step 3. I am wondering if I can avoid to split the code. Thanks


-Roberto

Continue reading...