title: Windows 7: Taking advantage of auto-elevation to elevate my own process?
body: <p>From a July 2009 Technet article entitled <a href="http://technet.microsoft.com/en-us/magazine/2009.07.uac.aspx" rel="nofollow noreferrer">Inside Windows 7 User Account Control</a>, <strong>Mark Russinovish</strong> describes that it's possible for an application running as standard user to silently elevate and gain administrative rights:</p>
  
  <blockquote>
    <p>...it's possible for third-party
    software running in a PA (Protected Administrator) account with
    standard user rights to take advantage
    of auto-elevation to gain
    administrative rights. For example,
    the software can use the
    <a href="http://msdn.microsoft.com/en-us/library/ms681674.aspx" rel="nofollow noreferrer">WriteProcessMemory API</a> to inject code into <em>Explorer</em> and the
    <a href="http://msdn.microsoft.com/en-us/library/ms682437(VS.85).aspx" rel="nofollow noreferrer">CreateRemoteThread API</a> to execute that code, a technique called <em>DLL
    injection</em>. Since the code is executing
    in Explorer, which is a Windows
    executable, it can leverage the COM
    objects that auto-elevate, like the
    Copy/Move/Rename/Delete/Link Object,
    to modify system registry keys or
    directories and give the software
    administrative rights.</p>
  </blockquote>
  
  <p>He goes on to mention that malware will never do this, because it's too hard:</p>
  
  <blockquote>
    <p>...these steps require
    deliberate intent, aren't trivial...</p>
  </blockquote>
  
  <p>and finally</p>
  
  <blockquote>
    <p>...malware could gain administrative
    rights using the same techniques.</p>
  </blockquote>
  
  <p>So i'm curious to see an actual implementation.</p>
  
  <hr>
  
  <p>i would have thought <strong><a href="http://msdn.microsoft.com/en-us/library/ms684880.aspx" rel="nofollow noreferrer">PROCESS_VM_WRITE</a></strong> would be a right not given to standard users.</p>
  
  <p><strong>Note:</strong> i would never actually do anything bad myself, as is true for every other developer in the world.</p>