Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows can do things that require UAC without prompting for UAC.

For example, Windows can change any file in C:\Windows without requiring UAC. Could a malicious program "pretend" to be windows and do the same kind of thing, but with worse results?

share|improve this question
I don't know of any proof of concept that this is even possible. – Randy E Jun 25 '13 at 2:26
What do you mean by "Windows"? Are you referring to a particular process running in Windows? – void_in Jun 25 '13 at 4:17
You need to review your terms. An operating system, by definition, consists of all functions it is designed to provide. Windows is an operating system not a thing that one can pretend to be. Onc can pretend to be an identity inside that system with related rights and privileges. – zedman9991 Jun 25 '13 at 12:09
up vote 6 down vote accepted

Acting as Windows is called running as SYSTEM. SYSTEM is the user account that has the lowest level access and can do anything on, well, the system. Windows uses the SYSTEM account to run key services that keeps the system in order.

If you can run as SYSTEM then yes you can pretty much do anything you want on that machine. The problem is that it's really difficult (relatively speaking) to get a program to run as SYSTEM, as you need administrative permissions to do so.

share|improve this answer
+1 There are various methods where you can inject into a process and then migrate to SYSTEM. A large portion of how Meterpreter from Metasploit works. It gets harder to do as we move into Windows 8 and 2008 R2 world, but you'll see advisories that support development in this space is really active. Here is a fresh privilege escalation from May – g3k Jun 28 '13 at 18:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.