Elevate-TI

A safe, idiomatic Rust library to obtain Windows TrustedInstaller privileges.

Overview

elevate-ti is an ergonomic Windows systems library designed to elevate privileges to NT SERVICE\TrustedInstaller. It acquires primary tokens via chained impersonation, navigates Session 0 isolation, and supports launching processes either onto an active interactive desktop (WinSta0\Default) or within headless background sessions (CI, services, and tasks).

Architecture Flow

Caller (Admin)
  │
  ├─> 1. Enable SeDebugPrivilege & SeImpersonatePrivilege
  ├─> 2. Ensure TrustedInstaller service is running (SCM)
  ├─> 3. Impersonate SYSTEM (via winlogon.exe or Session 0 SYSTEM process)
  │     └─> Duplicate TrustedInstaller Primary Token
  │     └─> Optionally bind Token to target Session ID (Caller/Interactive/None)
  │
  └─> 4. Spawn target process (Interactive Desktop or Headless)

Quickstart

Add elevate-ti to your Cargo.toml by running:

cargo add elevate-ti

Automatic Self-Relaunch

use elevate_ti::{status, relaunch, ElevationStatus};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    if status()? == ElevationStatus::RequiresElevation {
        relaunch()?;
        return Ok(());
    }

    println!("Running with TrustedInstaller privileges!");
    Ok(())
}

Spawning an Elevated Child Process (Interactive Desktop)

use elevate_ti::elevated_command;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    elevated_command()?
        .exe("%SystemRoot%\\System32\\cmd.exe")
        .args("cmd.exe /k whoami /groups")
        .spawn()?;

    Ok(())
}

Headless Execution (Session 0 / CI / Background Services)

use elevate_ti::headless_command;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    headless_command()?
        .exe("%SystemRoot%\\System32\\cmd.exe")
        .args("cmd.exe /c whoami /groups")
        .spawn()?;

    Ok(())
}

Examples

For complete and runnable scenarios, check the examples directory:

relaunch.rs: Automatic self-elevation and privilege verification.
spawn_cmd.rs: Spawning interactive processes onto user or secure desktops.
headless_cmd.rs: Non-interactive background execution in Session 0.

License

Licensed under either of:

Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

elevate-ti 0.6.0