Skip to content

Instantly share code, notes, and snippets.

@Sarafian
Created April 11, 2017 06:46
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Sarafian/ed7ec82e1aef12f77661b81cf8b9361d to your computer and use it in GitHub Desktop.
Save Sarafian/ed7ec82e1aef12f77661b81cf8b9361d to your computer and use it in GitHub Desktop.
Start PowerShell ISE or execute scripts as if the Windows System account was
<#
.Synopsis
Starts a remote desktop connection
.DESCRIPTION
Starts a remote desktop connection
.EXAMPLE
Start-MyRemoteDesktopConnection
#>
function Start-MyAsSystem
{
param(
[Parameter(Mandatory=$true,ParameterSetName="ISE")]
[switch]$ISE,
[Parameter(Mandatory=$true,ParameterSetName="PowerShell")]
[switch]$PowerShell,
[Parameter(Mandatory=$true,ParameterSetName="File")]
[string]$Path,
[Parameter(Mandatory=$true,ParameterSetName="Block")]
[string]$Block,
[Parameter(Mandatory=$false,ParameterSetName="PowerShell")]
[Parameter(Mandatory=$false,ParameterSetName="ISE")]
[Parameter(Mandatory=$false,ParameterSetName="File")]
[Parameter(Mandatory=$false,ParameterSetName="Block")]
[ValidateSet("32Bit","64Bit")]
[string]$ProcessModel="64Bit",
[Parameter(Mandatory=$false,ParameterSetName="PowerShell")]
[Parameter(Mandatory=$false,ParameterSetName="ISE")]
[Parameter(Mandatory=$false,ParameterSetName="File")]
[Parameter(Mandatory=$false,ParameterSetName="Block")]
[switch]$Wait=$false
)
$psExecPath="$PSScriptRoot\PsExec64.exe"
switch($ProcessModel)
{
'32Bit' {
$powerShellPath="C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
$powerShellISEPath="C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ISE.exe"
}
'64Bit' {
$powerShellPath="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$powerShellISEPath="C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ISE.exe"
}
}
$psExecArguments=@(
"-accepteula"
"-s"
"-i"
)
$processArgs=@(
)
switch($PSCmdlet.ParameterSetName)
{
'ISE' {
$psExecArguments+=$powerShellISEPath
}
'PowerShell' {
$psExecArguments+=$powerShellPath
$processArgs+="-NoExit"
$Block='Write-Host "env:USERNAME=$env:USERNAME"'
# $Block='Write-Host "env:USERNAME=$env:USERNAME on $((Get-Process -Id $PID).StartInfo.EnvironmentVariables["PROCESSOR_ARCHITECTURE"]) Process"'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($Block)
$encodedCommand = [Convert]::ToBase64String($bytes)
$processArgs+="-EncodedCommand"
$processArgs+=$encodedCommand
}
'File' {
$psExecArguments+=$powerShellPath
if($Wait)
{
$processArgs+="-NoExit"
}
$processArgs+="-File"
$processArgs+=$Path
}
'Block' {
$psExecArguments+=$powerShellPath
if($Wait)
{
$processArgs+="-NoExit"
}
$bytes = [System.Text.Encoding]::Unicode.GetBytes($Block)
$encodedCommand = [Convert]::ToBase64String($bytes)
$processArgs+="-EncodedCommand"
$processArgs+=$encodedCommand
}
}
$startProcessHash=@{
FilePath=$psExecPath
ArgumentList=$psExecArguments+$processArgs
Verb="runas"
}
if($Wait)
{
$startProcessHash.Wait=$true
}
Write-Host "$psExecPath $($psExecArguments -join ' ') $($processArgs -join ' ') "
Start-Process @startProcessHash -WindowStyle Hidden
}
@Sarafian
Copy link
Author

next to the script you need to have the PsExec.exe and PsExec64.exe files. You can download them from SysInternals.

Example 1

Start-MyAsSystem -Block {$env:USERNAME} -Wait

outputs MECDEVASAR03$

Example 2

Start-MyAsSystem -Block {whoami} -Wait

outputs nt authority\system

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment