Elevate-TI

A safe, idiomatic Rust library to obtain Windows TrustedInstaller privileges.

Overview

elevate-ti is an ergonomic Windows systems library designed to elevate privileges to NT SERVICE\TrustedInstaller. It isolates Session 0 services, acquires primary tokens via chained impersonation, and spawns processes directly onto the active user's interactive desktop (WinSta0\Default).

Architecture Flow

Caller (Admin)
  │
  ├─> 1. Enable SeDebugPrivilege & SeImpersonatePrivilege
  ├─> 2. Ensure TrustedInstaller service is running (SCM)
  ├─> 3. Locate winlogon.exe in caller session & impersonate SYSTEM
  │     └─> Duplicate TrustedInstaller Primary Token
  │     └─> Bind Token to caller Session ID
  │
  └─> 4. Spawn target process onto active desktop (WinSta0\Default)

Quickstart

Add elevate-ti to your Cargo.toml by running:

cargo add elevate-ti

Automatic Self-Relaunch

use elevate_ti::{status, relaunch, ElevationStatus};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    if status()? == ElevationStatus::RequiresElevation {
        relaunch()?;
        return Ok(());
    }

    println!("Running with TrustedInstaller privileges!");
    Ok(())
}

Spawning an Elevated Child Process

use elevate_ti::elevated_command;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    elevated_command()?
        .exe("%SystemRoot%\\System32\\cmd.exe")
        .args("cmd.exe /k whoami /groups")
        .spawn()?;

    Ok(())
}

License

Licensed under either of:

• Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.