A different way of getting system

A different way of getting system

By ghost | 4853 Reads |

0     0

This is something I discovered and thought some of you might find useful. It's not really a hack, just a bit of convenience. By now, most people are familiar with the 'system' trick in XP. I use it frequently. Whether there are stubborn processes that won't end, files that won't delete, or you're just bored; there are plenty of reasons to use it.

For those that don't know, you can get access to this by typing the following in the command prompt:

at xx:xx /interactive "cmd.exe"

xx:xx would be the time you specify cmd to run.

From there you can jump between shells, whether it's different instances of explorer or some other shell of your choosing. This pretty much gives you unrestricted access to everything on that pc.

The inconvenience is that you have to wait till whatever time you set it for. If you enter a time that has already passed, you have to wait until the following day for that task to run. Otherwise you need to give yourself probably about a one minute window. Plus, you have to do this each time you want to get access as system.

Not a difficult task but there is another way.

If you create a service, you can accomplish the same thing, skip the hassle and the wait.

Intitially, I tried:

sc create mysvc binpath= "cmd" type= own type= interact

That didn't work. The service, essentially, times out. This is because SCM has to establish a channel through the RegisterServiceCtrlHandler API to pass commands to the service. Another issue is that there are no service related codes within the executable. Because of this the service fails to start and produces an error code of 1053. In short, the window simply dies.

The solution is to launch another instance of cmd, so that even when the first instance closes, the second remains and allows commands to be run as system. This is done with the /k switch and start. Start by itself will launch a separate instance of cmd. The switch /k executes the command issued by the string (in this case it opens cmd) and continues.

Now I create the service with the switch and start:

sc create mysvc binpath= "cmd /K start" type= own type= interact

This time the service will open cmd then start. Start opens another instance of cmd. You can now call the service when you need it:

sc start mysvc

This will open cmd and let you run commands as system.