Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 94 additions & 0 deletions readme.txt
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,100 @@ process' are not supported on Windows XP.



SysExec - Lightweight NT AUTHORITY\SYSTEM Command Executor
==========================================================

SysExec is a compact C++ command-line tool included in this package that
lets you run any command as NT AUTHORITY\SYSTEM — both on the local
machine and on remote computers — with live output streaming back to
your console. It is inspired by PsExec and the remote-service mechanism
already used internally by AdvancedRun.


How SysExec obtains SYSTEM privileges
--------------------------------------

1. SysExec installs a short-lived Windows service (named SysExecSvc)
that points back to the SysExec.exe binary itself.
2. The execution parameters (command, working directory, named-pipe
address) are written to a temporary registry key under the service's
Parameters sub-key.
3. The service starts under the LocalSystem (NT AUTHORITY\SYSTEM) account
and connects to a named pipe created by the main SysExec process.
4. The service launches the requested command with its stdout and stderr
redirected to the named pipe; the main process streams this output to
the console in real time.
5. Once the command finishes the service exits, is unregistered, and all
temporary registry keys are cleaned up automatically.

For remote execution SysExec additionally:
- Copies itself to the target machine's admin$ share.
- Creates the service on the remote machine via the remote SCM.
- Stores parameters in the remote machine's registry via RegConnectRegistry.
- After completion the remote copy of SysExec.exe is deleted.


SysExec Usage
-------------

SysExec /system <command> [arguments]
Run the command as NT AUTHORITY\SYSTEM on the local machine.

SysExec /computer <host> <command> [arguments]
Run the command as NT AUTHORITY\SYSTEM on a remote machine.
<host> may be a hostname or IP address (leading \\ is optional).

SysExec /dir <path> ...
Set the working directory for the launched process.

SysExec /?
Show the full help text.


SysExec Examples
----------------

SysExec /system cmd.exe
Open a SYSTEM command prompt on the local machine.

SysExec /system whoami
Print the current user (will show "nt authority\system").

SysExec /system /dir C:\Windows regedit.exe
Launch regedit as SYSTEM in the C:\Windows directory.

SysExec /computer 192.168.1.10 ipconfig /all
Run ipconfig on a remote machine and stream the output locally.

SysExec /computer SERVER01 /dir C:\Temp cmd.exe
Open a SYSTEM cmd window in C:\Temp on SERVER01.


SysExec Requirements
--------------------

* Administrator privileges on the local machine.
* For remote execution: SMB admin-share (admin$) access and RPC
connectivity to the target machine.
* Windows Vista / Server 2008 or later (32-bit and 64-bit).


Building SysExec from Source
-----------------------------

The source code is located in src/SysExec/SysExec.cpp.

With CMake (recommended):
cmake -S src/SysExec -B build/SysExec -G "Visual Studio 17 2022" -A x64
cmake --build build/SysExec --config Release

With MSVC directly (from a VS Developer Command Prompt):
cl /nologo /W4 /WX /O2 /MT /EHsc /D_UNICODE /DUNICODE ^
src\SysExec\SysExec.cpp advapi32.lib ^
/link /SUBSYSTEM:CONSOLE /OUT:SysExec.exe



Versions History
================

Expand Down
8 changes: 6 additions & 2 deletions setup.iss
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
; Inno Setup Script for AdvancedRun v1.51
; This script packages AdvancedRun.exe and its associated configuration/help files.
; Inno Setup Script for AdvancedRun v1.51 + SysExec v1.0
; This script packages AdvancedRun.exe, SysExec.exe and associated files.

[Setup]
; Basic Application Information
Expand Down Expand Up @@ -33,6 +33,8 @@ Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{
[Files]
; The main executable
Source: "AdvancedRun.exe"; DestDir: "{app}"; Flags: ignoreversion
; SysExec - lightweight NT AUTHORITY\SYSTEM / remote command executor
Source: "SysExec.exe"; DestDir: "{app}"; Flags: ignoreversion
; Help file
Source: "AdvancedRun.chm"; DestDir: "{app}"; Flags: ignoreversion
; Command script
Expand All @@ -45,6 +47,8 @@ Source: "readme.txt"; DestDir: "{app}"; Flags: ignoreversion isreadme
[Icons]
; Main Application Shortcut
Name: "{group}\AdvancedRun"; Filename: "{app}\AdvancedRun.exe"
; SysExec shortcut
Name: "{group}\SysExec (SYSTEM Executor)"; Filename: "{app}\SysExec.exe"; Parameters: "/?"; Comment: "Lightweight NT AUTHORITY\SYSTEM command executor"
; Searchable Command Shortcut (This allows it to appear in Windows Search)
Name: "{group}\AdvancedRun System Command"; Filename: "{app}\AdvancedRunSysCmd.cmd"; IconFilename: "{app}\AdvancedRun.exe"
; Help and Uninstall
Expand Down
77 changes: 77 additions & 0 deletions src/SysExec/CMakeLists.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
# CMakeLists.txt for SysExec
# Requires CMake 3.15+ and the MSVC toolchain (cl.exe).
#
# Typical build (from repo root):
# cmake -S src/SysExec -B build/SysExec -G "Visual Studio 17 2022" -A x64
# cmake --build build/SysExec --config Release
#
# Or from a VS Developer Command Prompt:
# mkdir build && cd build
# cmake .. -G "NMake Makefiles" -DCMAKE_BUILD_TYPE=Release
# cmake --build .

cmake_minimum_required(VERSION 3.15)

project(SysExec
VERSION 1.0.0
DESCRIPTION "Lightweight NT AUTHORITY\\SYSTEM / remote command executor"
LANGUAGES CXX)

# -----------------------------------------------------------------------
# Source target
# -----------------------------------------------------------------------
add_executable(SysExec SysExec.cpp)

# Unicode entry point
target_compile_definitions(SysExec PRIVATE
_UNICODE
UNICODE
WIN32_LEAN_AND_MEAN
_WIN32_WINNT=0x0600 # Vista+ minimum
)

# -----------------------------------------------------------------------
# Compiler options (MSVC)
# -----------------------------------------------------------------------
if(MSVC)
target_compile_options(SysExec PRIVATE
/W4 # High warning level
/WX # Warnings as errors

# Static CRT: /MT for Release, /MTd for Debug
$<$<CONFIG:Debug>:/MTd>
$<$<NOT:$<CONFIG:Debug>>:/MT>

# Optimization flags – only for non-Debug configs.
# In Debug, CMake already injects /Od /RTC1 which conflict with /O2.
$<$<NOT:$<CONFIG:Debug>>:/O2> # Full optimization
$<$<NOT:$<CONFIG:Debug>>:/Oi> # Enable intrinsic functions
$<$<NOT:$<CONFIG:Debug>>:/GL> # Whole-program optimization
)

target_link_options(SysExec PRIVATE
/SUBSYSTEM:CONSOLE
/MANIFEST:NO # No side-by-side manifest needed

# /LTCG requires /GL; restrict to the same non-Debug configs
$<$<NOT:$<CONFIG:Debug>>:/LTCG>
)
endif()

# -----------------------------------------------------------------------
# Required Windows libraries
# -----------------------------------------------------------------------
target_link_libraries(SysExec PRIVATE
advapi32 # Service Control Manager, registry, token APIs
kernel32
user32
)

# -----------------------------------------------------------------------
# Install rule
# Installs SysExec.exe to CMAKE_INSTALL_PREFIX/bin (default).
# Override with: cmake --install <builddir> --prefix <destination>
# -----------------------------------------------------------------------
install(TARGETS SysExec
RUNTIME DESTINATION bin
)
Loading
Loading