How does pskill work across the UAC/elevation boundary?

Question

Disclaimer: I'm asking specifically on Stackoverflow because I want to know how to re-implement this feature.

We recently noticed that the Sysinternals tool pskill can kill an elevated process from a non-elevated context.

Specifically, if you open a program with Run-As-Administrator and then run a normal shell (non-elevated) and try to kill that RunAs programm (e.g. another cmd.exe) via pskill, it will succeed.

Note: Both Powershell Stop-Process and the taskkill.exe utility cannot do this.

Killing Windows Services running as NT-Auth/System ~ Session 0 still gives access denied from a non-elevated context though, even with pskill, which is fine.

Which Windows API is used here? Our tooling uses OpenProcess(PROCESS_ALL_ACCESS... and TerminateProcess but this only works on the same elevation level.

Answer 1

really nothing strange. pskill try open process with PROCESS_TERMINATE|SYNCHRONIZE access. which is ok. by default elevated process grant

PROCESS_ALL_ACCESS to BUILTIN\Administrators (S-1-5-32-544) and NT AUTHORITY\SYSTEM (S-1-5-18)

and SYNCHRONIZE|READ_CONTROL|PROCESS_QUERY_LIMITED_INFORMATION|PROCESS_QUERY_INFORMATION|PROCESS_VM_READ|PROCESS_TERMINATE for the LogonSession sid (S-1-5-5-0-ID)

also mandatory label set for SYSTEM_MANDATORY_LABEL_NO_WRITE_UP | SYSTEM_MANDATORY_LABEL_NO_READ_UP for Mandatory Label\High Mandatory Level - this disable all generic read and generic write access for tokens with low integrity level than High. so this label disable READ_CONTROL|PROCESS_QUERY_INFORMATION|PROCESS_VM_READ as part of general read access for process. but we still have SYNCHRONIZE|PROCESS_QUERY_LIMITED_INFORMATION|PROCESS_TERMINATE as maximum access. and this is enough for terminate.

so even if we run as low integrity process, but in the same logon session - we still can kill elevated process