Ditching PsExec – Running Interactive SYSTEM Shells Natively in PowerShell

# Launch an interactive PowerShell session as SYSTEM
psexec -i -s powershell.exe

# The ultimate privilege confirmation
nt authority\system

<#
.SYNOPSIS
    Launches a process in the active interactive user session under the
    SYSTEM account identity, without requiring any third-party tools.

.DESCRIPTION
    This script replicates the core behaviour of PsExec -i -s using native
    Windows APIs via P/Invoke in inline C#. It is intended to be used from
    an elevated (Administrator) PowerShell session.

    BACKGROUND
    ----------
    Running a process as SYSTEM on the interactive desktop is non-trivial
    because SYSTEM operates in Session 0, which is isolated from the user's
    interactive desktop session. Simply duplicating a SYSTEM token and calling
    CreateProcessAsUser is insufficient because that API requires the caller
    to hold SeTcbPrivilege ("Act as part of the operating system"), which is
    present only in a genuine SYSTEM process token — not in an elevated Admin
    token.

    PsExec solves this by installing a temporary Windows Service. Services
    start with a genuine SYSTEM process token and therefore hold all SYSTEM
    privileges natively. This script achieves the same result without a
    service by using a different API: CreateProcessWithTokenW.

    HOW IT WORKS
    ------------
    1.  Open winlogon.exe
        winlogon.exe always runs as SYSTEM in the interactive session. Its
        token is opened and duplicated. This requires only
        PROCESS_QUERY_INFORMATION access, which an Administrator can obtain.

    2.  Impersonate SYSTEM (thread-level, temporary)
        The duplicated winlogon token is used to impersonate SYSTEM on the
        current thread. This is required only to call SetTokenInformation,
        which needs SeTcbPrivilege to modify the session ID of a token.
        Impersonation is reverted immediately after.

    3.  Set the session ID on the primary token
        The SYSTEM primary token (duplicated from winlogon) is associated
        with Session 0 by default. SetTokenInformation is called to reassign
        it to the active console session (the user's interactive desktop
        session). This call is made while impersonating SYSTEM, providing
        the necessary SeTcbPrivilege.

    4.  Revert impersonation
        RevertToSelf returns the thread to the original Admin identity.
        All remaining operations execute under the Admin token.

    5.  CreateProcessWithTokenW
        This API launches the target process using the prepared SYSTEM token.
        Unlike CreateProcessAsUser, CreateProcessWithTokenW requires only
        SeImpersonatePrivilege, which is present in all elevated Admin tokens.
        The process is launched on winsta0\default (the interactive desktop),
        visible to the logged-on user, and runs with the SYSTEM identity.

    REQUIREMENTS
    ------------
    - Must be run as Administrator. If not, the script prompts to relaunch elevated.
    - A user must be logged on interactively (console session must exist).
    - The target executable must be accessible from the SYSTEM context.

    PRIVILEGE SUMMARY
    -----------------
    SetTokenInformation  : requires SeTcbPrivilege  -> obtained via impersonation
    CreateProcessWithTokenW : requires SeImpersonatePrivilege -> Admin has this natively

.PARAMETER FilePath
    The path to the executable to launch. If the path contains spaces it will
    be quoted automatically. Examples:
        powershell.exe
        C:\Windows\System32\cmd.exe
        "C:\Program Files\MyApp\MyApp.exe"

.PARAMETER ArgumentList
    Optional string of arguments to pass to the executable. The full command
    line passed to the process will be: FilePath ArgumentList

.PARAMETER Wait
    If specified, the script blocks until the launched process exits, then
    reports the exit code. The script exits with the same code as the process.

.INPUTS
    None. This script does not accept pipeline input.

.OUTPUTS
    None. Process output appears in the launched window.

.EXAMPLE
    .\Invoke-AsSystem.ps1 -FilePath "powershell.exe"

    Opens an interactive PowerShell window running as NT AUTHORITY\SYSTEM
    on the current user's desktop.

.EXAMPLE
    .\Invoke-AsSystem.ps1 -FilePath "powershell.exe" -ArgumentList "-NoProfile -NoExit -Command whoami"

    Opens a PowerShell window that runs whoami and stays open. The output
    will show: nt authority\system

.EXAMPLE
    .\Invoke-AsSystem.ps1 -FilePath "cmd.exe" -Wait

    Opens a command prompt as SYSTEM and waits for it to close before
    returning control to the calling script.

.EXAMPLE
    .\Invoke-AsSystem.ps1 -FilePath "C:\Tools\MyDiag.exe" -ArgumentList "/verbose /log C:\Logs\out.txt" -Wait

    Runs a diagnostic tool as SYSTEM, waits for completion, and returns
    the tool's exit code to the calling script.

.NOTES
    Author  : Saugata Datta
    Version : 1.0.0

    TESTED ON   : Windows 11 23H2, Windows Server 2022
    REQUIREMENT : PowerShell 5.1 or later, run as Administrator

    VERSION HISTORY
    ---------------
    1.0.0  Initial release. Uses CreateProcessWithTokenW to avoid the
           SeTcbPrivilege requirement of CreateProcessAsUser.

    TECHNICAL NOTES
    ---------------
    The inline C# type is named SystemLauncher_v6 and LaunchResult_v6.
    The version suffix prevents conflicts if this script is run multiple
    times in the same PowerShell session. Once a .NET type is compiled into
    a PowerShell session it cannot be unloaded — only a new session clears
    the type cache. If the C# code is modified, increment the version suffix
    to force recompilation in existing sessions.

    ERROR CODES
    -----------
    If the script fails with a Win32 error, common codes are:
        5    : Access denied - check Administrator rights
        1314 : Privilege not held - unexpected; verify winlogon.exe is accessible
        2    : File not found - verify FilePath is correct and accessible from SYSTEM
        1008 : An attempt was made to reference a token that does not exist -
               no interactive console session; a user must be logged on
#>

[CmdletBinding()]
param(
    [Parameter(
        Mandatory         = $true,
        HelpMessage       = "Path to the executable to launch as SYSTEM."
    )]
    [ValidateNotNullOrEmpty()]
    [string]$FilePath,

    [Parameter(
        Mandatory         = $false,
        HelpMessage       = "Optional arguments to pass to the executable."
    )]
    [string]$ArgumentList = "",

    [Parameter(
        Mandatory         = $false,
        HelpMessage       = "Wait for the launched process to exit before returning."
    )]
    [switch]$Wait
)

# ==============================================================================
# NATIVE API DECLARATIONS (P/Invoke)
# ==============================================================================
# The type is compiled once per session and cached. The version suffix in the
# type name prevents the "type already exists" error on repeated invocations
# within the same PowerShell session.
# ==============================================================================

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
         ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {

    Write-Host ""
    Write-Host "  This script must run as Administrator." -ForegroundColor Yellow
    Write-Host ""
    Write-Host "  Press any key to relaunch as Administrator, or Ctrl+C to cancel." -ForegroundColor DarkGray
    $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

    # Rebuild the original argument list to pass through to the elevated instance
    $argString = "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    if ($FilePath)      { $argString += " -FilePath `"$FilePath`"" }
    if ($ArgumentList)  { $argString += " -ArgumentList `"$ArgumentList`"" }
    if ($Wait)          { $argString += " -Wait" }

    Start-Process powershell.exe -ArgumentList $argString -Verb RunAs
    exit
}

if (-not ([System.Management.Automation.PSTypeName]'SystemLauncher_v6').Type) {

    Add-Type -TypeDefinition @'
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

// ── Holds the result of a successful process launch ───────────────────────────
public class LaunchResult_v6 {
    public uint   PID;

    public IntPtr ProcessHandle;
}

// ── Main launcher class ───────────────────────────────────────────────────────
public class SystemLauncher_v6 {

    // --------------------------------------------------------------------------
    // Win32 API Imports
    // --------------------------------------------------------------------------

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern IntPtr OpenProcess(uint dwAccess, bool bInherit, uint dwPid);

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern bool CloseHandle(IntPtr hObject);

    [DllImport("kernel32.dll")]
    static extern uint WTSGetActiveConsoleSessionId();

    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);

    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool OpenProcessToken(
        IntPtr  hProcessHandle,
        uint    dwDesiredAccess,
        out IntPtr phTokenHandle);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool DuplicateTokenEx(
        IntPtr  hExistingToken,
        uint    dwDesiredAccess,
        IntPtr  lpTokenAttributes,
        int     ImpersonationLevel,
        int     TokenType,
        out IntPtr phNewToken);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool ImpersonateLoggedOnUser(IntPtr hToken);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool RevertToSelf();

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool SetTokenInformation(
        IntPtr  TokenHandle,
        int     TokenInformationClass,
        IntPtr  TokenInformation,
        uint    TokenInformationLength);

    [DllImport("userenv.dll", SetLastError = true)]
    static extern bool CreateEnvironmentBlock(
        out IntPtr lpEnvironment,
        IntPtr     hToken,
        bool       bInherit);

    [DllImport("userenv.dll", SetLastError = true)]
    static extern bool DestroyEnvironmentBlock(IntPtr lpEnvironment);

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    static extern bool CreateProcessWithTokenW(
        IntPtr                hToken,
        uint                  dwLogonFlags,
        string                lpApplicationName,
        string                lpCommandLine,
        uint                  dwCreationFlags,
        IntPtr                lpEnvironment,
        string                lpCurrentDirectory,
        ref STARTUPINFO       lpStartupInfo,
        out PROCESS_INFORMATION lpProcessInformation);

    // --------------------------------------------------------------------------
    // Structures
    // --------------------------------------------------------------------------

    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
    struct STARTUPINFO {
        public int    cb;
        public string lpReserved;
        public string lpDesktop;     // "winsta0\\default" = interactive desktop
        public string lpTitle;
        public uint   dwX;
        public uint   dwY;
        public uint   dwXSize;
        public uint   dwYSize;
        public uint   dwXCountChars;
        public uint   dwYCountChars;
        public uint   dwFillAttribute;
        public uint   dwFlags;
        public short  wShowWindow;
        public short  cbReserved2;
        public IntPtr lpReserved2;
        public IntPtr hStdInput;
        public IntPtr hStdOutput;
        public IntPtr hStdError;
    }

    [StructLayout(LayoutKind.Sequential)]
    struct PROCESS_INFORMATION {
        public IntPtr hProcess;
        public IntPtr hThread;
        public uint   dwProcessId;
        public uint   dwThreadId;
    }

    // --------------------------------------------------------------------------
    // Access rights and constants
    // --------------------------------------------------------------------------

    const uint PROCESS_QUERY_INFORMATION  = 0x0400;
    const uint TOKEN_ALL_ACCESS           = 0xF01FF;
    const uint TOKEN_DUPLICATE            = 0x0002;
    const uint TOKEN_QUERY                = 0x0008;

    // ImpersonationLevel values for DuplicateTokenEx
    const int  SecurityImpersonation      = 2;

    // TokenType values for DuplicateTokenEx
    const int  TokenPrimary               = 1;   // for CreateProcessWithTokenW
    const int  TokenImpersonation         = 2;   // for ImpersonateLoggedOnUser

    // TokenInformationClass value for SetTokenInformation
    const int  TokenSessionId             = 12;

    // Process creation flags
    const uint CREATE_UNICODE_ENVIRONMENT = 0x00000400;
    const uint CREATE_NEW_CONSOLE         = 0x00000010;

    // WaitForSingleObject timeout
    const uint INFINITE                   = 0xFFFFFFFF;

    // Duplicates the winlogon.exe process token.
    // winlogon.exe always runs as SYSTEM in the interactive session.
    // tokenType: TokenPrimary (1) for process creation
    //            TokenImpersonation (2) for thread impersonation
    static IntPtr GetWinlogonToken(int tokenType) {
        foreach (var proc in Process.GetProcessesByName("winlogon")) {
            IntPtr procHandle = OpenProcess(
                PROCESS_QUERY_INFORMATION, false, (uint)proc.Id);
            if (procHandle == IntPtr.Zero) continue;

            try {
                IntPtr rawToken;
                if (!OpenProcessToken(
                        procHandle, TOKEN_DUPLICATE | TOKEN_QUERY, out rawToken))
                    continue;

                try {
                    IntPtr dupToken;
                    if (DuplicateTokenEx(rawToken, TOKEN_ALL_ACCESS, IntPtr.Zero,
                            SecurityImpersonation, tokenType, out dupToken))
                        return dupToken;
                }
                finally { CloseHandle(rawToken); }
            }
            finally { CloseHandle(procHandle); }
        }

        throw new Exception(
            "Could not duplicate the winlogon.exe process token. " +
            "Verify the script is running as Administrator.");
    }

    // Launches cmdLine as SYSTEM on the active interactive desktop.
    // Returns a LaunchResult_v6 with the PID and process handle.
    public static LaunchResult_v6 Launch(string cmdLine) {
        IntPtr impersonationToken = IntPtr.Zero;
        IntPtr primaryToken       = IntPtr.Zero;
        IntPtr environmentBlock   = IntPtr.Zero;

        try {

            // Phase 1: Impersonate SYSTEM to call SetTokenInformation.
            // SetTokenInformation requires SeTcbPrivilege, which only SYSTEM holds.
            // Impersonation is reverted immediately after the call.

            impersonationToken = GetWinlogonToken(TokenImpersonation);

            if (!ImpersonateLoggedOnUser(impersonationToken))
                throw new Exception(
                    "ImpersonateLoggedOnUser failed. Win32 error: " +
                    Marshal.GetLastWin32Error());

            try {
                // Determine which session the interactive user is in.
                uint sessionId = WTSGetActiveConsoleSessionId();
                if (sessionId == 0xFFFFFFFF)
                    throw new Exception(
                        "WTSGetActiveConsoleSessionId returned no active session. " +
                        "A user must be logged on interactively.");

                // Duplicate winlogon's token as a PRIMARY token.
                // This will be passed to CreateProcessWithTokenW.
                primaryToken = GetWinlogonToken(TokenPrimary);

                // Reassign the token from Session 0 to the active console session
                // so the process appears on the interactive desktop.
                // Requires SeTcbPrivilege — valid here because we are impersonating SYSTEM.
                IntPtr sessionBuffer = Marshal.AllocHGlobal(4);
                try {
                    Marshal.WriteInt32(sessionBuffer, (int)sessionId);
                    if (!SetTokenInformation(
                            primaryToken, TokenSessionId, sessionBuffer, 4))
                        throw new Exception(
                            "SetTokenInformation(TokenSessionId) failed. Win32 error: " +
                            Marshal.GetLastWin32Error());
                }
                finally { Marshal.FreeHGlobal(sessionBuffer); }
            }
            finally {
                // Revert impersonation — all subsequent calls run as Admin.
                RevertToSelf();
            }

            // Phase 2: Launch the process.
            // CreateProcessWithTokenW requires SeImpersonatePrivilege only —
            // Admin tokens hold this natively, no impersonation needed.

            bool envCreated = CreateEnvironmentBlock(
                out environmentBlock, primaryToken, false);
            if (!envCreated) environmentBlock = IntPtr.Zero;

            var startupInfo = new STARTUPINFO();
            startupInfo.cb        = Marshal.SizeOf(startupInfo);
            startupInfo.lpDesktop = "winsta0\\default";  // interactive desktop

            var processInfo = new PROCESS_INFORMATION();

            uint creationFlags = CREATE_UNICODE_ENVIRONMENT | CREATE_NEW_CONSOLE;

            bool launched = CreateProcessWithTokenW(
                primaryToken,
                0,                  // dwLogonFlags: no special logon behaviour
                null,               // lpApplicationName: derived from lpCommandLine
                cmdLine,
                creationFlags,
                envCreated ? environmentBlock : IntPtr.Zero,
                null,               // lpCurrentDirectory: inherit from caller
                ref startupInfo,
                out processInfo);

            if (!launched)
                throw new Exception(
                    "CreateProcessWithTokenW failed. Win32 error: " +
                    Marshal.GetLastWin32Error() +
                    " (2=FileNotFound, 5=AccessDenied, 1008=NoConsoleSession)");

            // The thread handle is not needed — close it immediately.
            CloseHandle(processInfo.hThread);

            return new LaunchResult_v6 {
                PID           = processInfo.dwProcessId,
                ProcessHandle = processInfo.hProcess
            };

        }
        finally {
            if (environmentBlock   != IntPtr.Zero) DestroyEnvironmentBlock(environmentBlock);
            if (primaryToken       != IntPtr.Zero) CloseHandle(primaryToken);
            if (impersonationToken != IntPtr.Zero) CloseHandle(impersonationToken);
        }
    }

    // Blocks until the process exits and returns its exit code.
    public static uint WaitForProcess(IntPtr processHandle) {
        WaitForSingleObject(processHandle, INFINITE);
        uint exitCode = 0;
        GetExitCodeProcess(processHandle, out exitCode);
        CloseHandle(processHandle);
        return exitCode;
    }
}
'@ -Language CSharp -ErrorAction Stop

} # end if type not already loaded

# ==============================================================================
# BUILD COMMAND LINE
# ==============================================================================

# Quote the executable path if it contains spaces to ensure correct parsing
# by CreateProcessWithTokenW.
$quotedPath = if ($FilePath -match '\s') { "`"$FilePath`"" } else { $FilePath }
$commandLine = if ($ArgumentList) { "$quotedPath $ArgumentList" } else { $quotedPath }

# ==============================================================================
# OUTPUT AND LAUNCH
# ==============================================================================

Write-Host ""
Write-Host "  Invoke-AsSystem" -ForegroundColor Cyan
Write-Host ("  {0}" -f ("─" * 50)) -ForegroundColor DarkGray
Write-Host ("  Target     : {0}" -f $FilePath) -ForegroundColor White
Write-Host ("  Arguments  : {0}" -f $(if ($ArgumentList) { $ArgumentList } else { "(none)" })) -ForegroundColor White
Write-Host ("  Wait       : {0}" -f $Wait) -ForegroundColor White
Write-Host ("  Command    : {0}" -f $commandLine) -ForegroundColor DarkGray
Write-Host ""

try {
    $launchResult = [SystemLauncher_v6]::Launch($commandLine)
    Write-Host ("  Launched successfully.  PID: {0}" -f $launchResult.PID) -ForegroundColor Green

    if ($Wait) {
        Write-Host "  Waiting for process to exit..." -ForegroundColor DarkGray
        $exitCode = [SystemLauncher_v6]::WaitForProcess($launchResult.ProcessHandle)
        $displayColor = if ($exitCode -eq 0) { "Green" } else { "Yellow" }
        Write-Host ("  Process exited.  Exit code: {0}" -f $exitCode) -ForegroundColor $displayColor

        # Safely cast uint exit code to int for the PowerShell exit statement.
        # Exit codes above 0x7FFFFFFF are negative when interpreted as signed int32.
        $safeExitCode = [int][Math]::Min([long]$exitCode, [long][int]::MaxValue)
        exit $safeExitCode
    }

} catch {
    Write-Host ("  ERROR: {0}" -f $_.Exception.Message) -ForegroundColor Red
    Write-Host ""
    Write-Host "  Troubleshooting:" -ForegroundColor DarkGray
    Write-Host "    - Confirm the script is running as Administrator." -ForegroundColor DarkGray
    Write-Host "    - Confirm a user is logged on interactively (console session must exist)." -ForegroundColor DarkGray
    Write-Host "    - Confirm the target executable path is correct and reachable from SYSTEM." -ForegroundColor DarkGray
    exit 1
}

Write-Host ""

# Open an interactive SYSTEM shell seamlessly
.\Invoke-AsSystem.ps1 -FilePath "powershell.exe"

# Run a specific command as SYSTEM and keep the window open to review the output
.\Invoke-AsSystem.ps1 -FilePath "powershell.exe" -ArgumentList "-NoProfile -NoExit -Command whoami"

# Execute a background tool as SYSTEM, wait for completion, and pass the exit code back
.\Invoke-AsSystem.ps1 -FilePath "C:\Tools\MyDiag.exe" -Wait