0

I am currently writing a DLL injection program (C++) which adds specified certificate to certmgr.exe.

I wrote the whole thing connected with injection (OpenProcess, etc.). When I am executing it - attached to svchost - my DLL is not loading since it seems that it doesn't have such rights as svchost has.

How can I pass rights?

In my DLL file, I am using system("certmgr.exe -add ....") and I think this might be the problem because the command line opens as a separate program (as if I opened it via start).

Azeem
  • 7,094
  • 4
  • 19
  • 32
dandeiro
  • 1
  • 2
  • 2
    see [here](https://stackoverflow.com/a/6418873/2747962) – Darklighter Oct 23 '17 at 10:46
  • I don't know if I described my problem correctly: I have a code that injects to svchost and when I try r\to run f.ex. a simple messagebox, there is no problem with it. The problem occyrs when I try to make my code execute sth with administrator rights. I want my dll to work exactly the same as if I opened command line as administrator and passed the command: "c:\Program Files\Microsoft SDKs\Windows\v7.1A\Bin\certmgr.exe" -add -all -c "c:\Users\Damian\Desktop\wwwtesthttpdev.crt" -s -r localMachine root. – dandeiro Oct 30 '17 at 15:58
  • I think the link perfectly caters to your problem, what do you think it doesn’t answer? – Darklighter Nov 01 '17 at 22:13

1 Answers1

0

Use ShellExecute() using the "runas" argument, which will make it try to run as administrator

ShellExecuteA( NULL, 
    "runas",  
    "c:\\windows\\certmgr.exe",  
    "-add ....",     
    NULL,                 
    SW_SHOWNORMAL  
);
GuidedHacking
  • 2,683
  • 1
  • 7
  • 38