6

Is there a way to run a PowerShell command as NT AUTHORITY\SYSTEM from a script?
I know I can use psexec and get a PowerShell prompt running as NT AUTHORITY\SYSTEM, but I was wondering if there's a way to do it from a "normal" script.

4
  • what version of the os?
    – tony roth
    Jun 21, 2013 at 13:54
  • @tonyroth I'm using Windows 8, but it should also run on 7 and 2008... Jun 21, 2013 at 14:08
  • hmm much more difficult with those versions, uac etc. If you kill all the security you could run a wmi Win32_ProcessStartup function.
    – tony roth
    Jun 21, 2013 at 14:31
  • @tonyroth of course I would run everything with high privileges, I did not think it was possible otherwise Jun 21, 2013 at 19:55

2 Answers 2

7

You can use Invoke-TokenManipulation.ps1 script:

This script requires Administrator privileges. It can enumerate the Logon Tokens available and use them to create new processes. This allows you to use anothers users credentials over the network by creating a process with their logon token. This will work even with Windows 8.1 LSASS protections.

Copy-paste it or save alongside with your script as Invoke-TokenManipulation.ps1 and use dot-sourcing to load:

$ScriptDir = Split-Path $script:MyInvocation.MyCommand.Path
. (Join-Path -Path $ScriptDir -ChildPath 'Invoke-TokenManipulation.ps1')

And then you can use Invoke-TokenManipulation function.

Example:

# This command fails on my machine, even with admin rights
Get-ChildItem C:\Windows\CSC

# Makes the current PowerShell thread impersonate SYSTEM.
Invoke-TokenManipulation -ImpersonateUser -Username "nt authority\system"

# Now we can get contents of this folder
Get-ChildItem C:\Windows\CSC

# Stop impersonating an alternate users Token
Invoke-TokenManipulation -RevToSelf

# Check again
Get-ChildItem C:\Windows\CSC
3

https://github.com/mkellerman/Invoke-CommandAs

Made a function to Invoke-Command as SYSTEM, or provided credential, against local/remote computer. Returns PSObjects, handles network interruptions and resolves any Double-Hop issues.

Try it out let me know if this resolves your issues.

1
  • Checking out your module right now, looks very nice. How do you manage to capture the output of the task when running as system? Does it have to do with the combination of ScheduledJob and ScheduledTask? Oct 5, 2023 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .