How do I run a program as nt authority/system without using 3rd party app (such as psexec)?
I have tried runas "/user:system@nt authority" <app> and runas "/user:nt authority\system" <app> but they all say unable to acquire user password.
(At least if there is no way using runas is there a way without using 3rd party apps?)
2 Answers
You can't using runas probably because of the below:
"The LocalSystem account is a predefined local account used by the service control manager. This account is not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. The name of the account in all locales is .\LocalSystem. The name, LocalSystem or ComputerName\LocalSystem can also be used. This account does not have a password."
PSExec basically uploads and starts a Windows service PSEXECSVC through SMB. It's possible for a Windows service installed with admin privileges (provided by PSExec command line) to run as the LocalSystem account (that's specifiable in services.msc, for example). When you are "remoted in" to a system via PSExec you are actually talking to the running PSEXECSVC temporarily installed on the other end over the SMB protocol. I'm not sure on further finer details but this is likely how PSExec is able to do things as the LocalSystem account.
So you might be able to run it as LocalSystem by wrapping the executable in a service wrapper such as srvany.exe from the Windows 2000 Resource Kit (if it still works) or NSSM but if the executable tries to use Windows UI elements it will probably not work (that was disabled after Windows XP).
One way is a temporary scheduled task that runs as NT AUTHORITY\SYSTEM.
Here's a one-liner (multiple statements, obviously, but no newlines stops PowerShell from complaining when you paste it in).
Replace YOUR_COMMAND_HERE and YOUR_ARGUMENTS_HERE.
Import-Module ScheduledTasks; $n = "RunAs_LocalSystem_$(New-Guid)"; Register-ScheduledTask -TaskName $n -Action (New-ScheduledTaskAction -Execute 'YOUR_COMMAND_HERE' -Argument 'YOUR_ARGUMENTS_HERE') -Principal (New-ScheduledTaskPrincipal -UserId 'NT AUTHORITY\SYSTEM' -LogonType Interactive) | Start-ScheduledTask; Unregister-ScheduledTask $n -Confirm:$false
