Elevate-TI

A safe, idiomatic Rust library to obtain Windows TrustedInstaller privileges.

Overview

elevate-ti is an ergonomic Windows systems library designed to elevate privileges to NT SERVICE\TrustedInstaller. It isolates Session 0 services, acquires primary tokens via chained impersonation, and spawns processes directly onto the active user's interactive desktop (WinSta0\Default).

Architecture Flow

Caller (Admin)
  │
  ├─> 1. Enable SeDebugPrivilege & SeImpersonatePrivilege
  ├─> 2. Ensure TrustedInstaller service is running (SCM)
  ├─> 3. Locate winlogon.exe in caller session & impersonate SYSTEM
  │     └─> Duplicate TrustedInstaller Primary Token
  │     └─> Bind Token to caller Session ID
  │
  └─> 4. Spawn target process onto active desktop (WinSta0\Default)

Quickstart

Add elevate-ti to your Cargo.toml:

[dependencies]

elevate-ti = { git = "https://github.com/Z7K9T2Y5X8V4N1Q6P0M3L8R2S9W5H1G7J4D6C0F/elevate-ti.git", branch = "main" }

Automatic Self-Relaunch

use elevate_ti::{status, relaunch, ElevationStatus};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    if status()? == ElevationStatus::RequiresElevation {
        relaunch()?;
        return Ok(());
    }

    println!("Running with TrustedInstaller privileges!");
    Ok(())
}

Spawning an Elevated Child Process

use elevate_ti::elevated_command;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    elevated_command()?
        .exe("%SystemRoot%\\System32\\cmd.exe")
        .args("cmd.exe /k whoami /groups")
        .spawn()?;

    Ok(())
}

License

This project is licensed under the GNU General Public License v3.0 (GPL-3.0).