How can I create a elevated child process with inherited handles from his parent

user_8629453 0
Viewed 870

I'm trying to create a child process with elevated rights in Windows (by trigerring a UAC prompt) and get this child process to inherit his parent STDOUT handle to be able to output back to the parent's console.

Additionnal Infos:

  • Win32 APIs
  • Im currently using ShellExecuteEx() with a ShellExecuteInformation that specifies a "runas" verb to trigger the UAC but any other solution that can create a elevated copy of the current running program (The child process is the same executable as the parent) but beeing able to output back to the parent's console.
winapi parent-child c++
1 Answers

When you use ShellExecuteEx with runas - The function CreateProcessAsUserW is called not from your process, but from svchost.exe -k netsvcs where appinfo.dll is running. And bInheritHandles is hardcoded to be FALSE - so your process does not inherit any handles in this case. for making handles inheritable the only way is a direct call to CreateProcessAsUserW with a primary elevated token. But from where you got this token ? ok, you can run self exe second time as elevated (with runas) and duplicate elevated token back to original not-elevated process. but anyway (even with elevated token) - you need SE_ASSIGNPRIMARYTOKEN_NAME privilege for call CreateProcessAsUser. but you have no this privilege.

Otherwise you could if you found some exploit.

The process handle, returned by ShellExecuteEx have no PROCESS_DUP_HANDLE access - So you can't use it for manual handle duplication later.

So in general - This is impossible by design

user_64016560
Related