Python windows privilege escalation -


so, want run program in administrator mode (uac)

after digging foud this:

import os import types traceback import print_exc sys import argv, executable     def isuseradmin():      if os.name == 'nt':         import ctypes         # warning: requires windows xp sp2 or higher!         try:             return ctypes.windll.shell32.isuseranadmin()         except:             print_exc()             print "admin check failed, assuming not admin."             return false     elif os.name == 'posix':         # check root on posix         return os.getuid() == 0     else:         raise runtimeerror, "unsupported operating system module: %s" % (os.name,)  def runasadmin(cmdline=none, wait=true):      if os.name != 'nt':         raise runtimeerror, "this function implemented on windows."      import win32api, win32con, win32event, win32process     win32com.shell.shell import shellexecuteex     win32com.shell import shellcon      python_exe = executable      if cmdline none:         cmdline = [python_exe] + argv     elif type(cmdline) not in (types.tupletype,types.listtype):         raise valueerror, "cmdline not sequence."     cmd = '"%s"' % (cmdline[0],)     # xxx todo: isn't there function or can call massage command line params?     params = " ".join(['"%s"' % (x,) x in cmdline[1:]])     cmddir = ''     showcmd = win32con.sw_shownormal     #showcmd = win32con.sw_hide     lpverb = 'runas'  # causes uac elevation prompt.      # print "running", cmd, params      # shellexecute() doesn't seem allow fetch pid or handle     # of process, can't useful it. therefore     # more complex shellexecuteex() must used.      # prochandle = win32api.shellexecute(0, lpverb, cmd, params, cmddir, showcmd)      procinfo = shellexecuteex(nshow=showcmd,                               fmask=shellcon.see_mask_nocloseprocess,                               lpverb=lpverb,                               lpfile=cmd,                               lpparameters=params)      if wait:         prochandle = procinfo['hprocess']             obj = win32event.waitforsingleobject(prochandle, win32event.infinite)         rc = win32process.getexitcodeprocess(prochandle)         #print "process handle %s returned code %s" % (prochandle, rc)     else:         rc = none      return rc  def test():     rc = 0     if not isuseradmin():         print "you're not admin.", os.getpid(), "params: ", argv         #rc = runasadmin(["c:\\windows\\notepad.exe"])         rc = runasadmin()     else:         print "you admin!", os.getpid(), "params: ", argv         rc = 0     x = raw_input('press enter exit.')     return rc if __name__ == "__main__":     if not isuseradmin():         runasadmin() 

which asks user admin. permission,but have 2 main problems it:

1.the user needs give program permission.(problematic pentesting)

2.every time program run user needs give program permission.(which suspicious)

is there way bypass this?

ps. windows 7 , no direct access

assuming have access computers script running on can follow instructions in link...

http://www.howtogeek.com/124087/how-to-create-a-shortcut-that-lets-a-standard-user-run-an-application-as-administrator/

it allow standard user run particular application administrator. i've used guide on other apps never on python script. might work you.


Comments