Application requiring elevation

user_480982 0
Viewed 76

I have a .NET executable that shows the (German) message when started:

Eine Referenzauswertung wurde vom Server zurückgesendet

which I translate as

A referral was sent back from the server

Googling about the message

  • revealed some certificate problems, which I tend to exclude from my analysis, because the executable is not code-signed.

  • says I shoud run the application as an administrator, which I don't know why, because the assembly manifest just says "asInvoker"

    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
  <security>
    <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
      <requestedExecutionLevel level="asInvoker" uiAccess="true" />
    </requestedPrivileges>
  </security>
</trustInfo>

I then thought I would figure out something interesting in WinDbg, so I tried to run it under the debugger. However, it didn't even reach the initial breakpoint.

Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: [...].exe
Cannot execute '[...].exe', Win32 error 0n740
    "Der angeforderte Vorgang erfordert erhöhte Rechte."

The German message translates as "The requested action required elevated privileges".

Digging much deeper using IL disassembly with dotPeek, I find that declaration on a method:

[PermissionSet(SecurityAction.Demand, Name = "FullTrust")]

which obviously contradicts the manifest. But still, Windows was able to figure out that admin access is needed.

The whole analysis took about 3 hours. Is there an easier way to find out why a .NET application requests elevation?

permissions debugging .net
1 Answers

I just had the same issue with WPRUI.exe and it turns out, that applications that have uiAccess="true" set in manifest, have to be signed and have to be executed from inside "program files" or Windows folder.

So running it from any other location triggers that "Der angeforderte Vorgang erfordert erhöhte Rechte." message.

So, set change uiAccess="true" to uiAccess="false" to fix it.

user_14660460
Related