How does task manager elevate without UAC Prompt?

Question

This has been on my mind for sometime. I can open task manager by pressing Ctrl + Shift + Esc and on the second tab (Processes), I can easily press Alt + S -- Show processes from all users to elevate my task manager without any prompts whatsoever. And voila, I have a powerful tool to play with. I've been unable to find any documents explaining this and I'm very curious about how this feat is achieved; since the button should actually ask for a prompt but does not.

Fractional

@KenWhite are you saying Ctrl + Shift + Esc actually runs TaskManager with Administrator rights? – Fractional

It's an interesting observation, but I have no idea what it has to do with C#. – Traditionalism

@KenWhite His point is that UAC prevents processes from starting with administrator priveleges unless specifically granted. You can't just open a normal application logged in as an account with administrator priveleges and have administrative access without elevating the access and hitting the UAC prompt. – Traditionalism

@KenWhite You seem to miss the point -- Taskmgr is the only program I know that can run elevated commands without UAC prompts. – Fractional

Microsoft have white-listed most of the included programs in Windows from having to show UAC prompts at the default settings, because that was easier for them than to implement UAC support properly. Of course all other applications still need to deal with it. If you crank UAC up to maximum it will still need to prompt. – Forerunner

@JonathanPotter I suspected as much! I'm not sure though how such whitelisting is made possible since it could mean that if I replace taskmgr.exe, I could get some special chocolate. I'm thinking that the whitelisted applications make some special request that enables the system to identify them. – Fractional

As @ScottChamberlain as provided details that shows I'm wrong :-), I've cleaned up the comment clutter. – Caracas

Answer 1

What you are describing is called Auto Elevation. It is done by a lot more than just task manager, but there is no way to make your program do it. To auto elevate the following requirements must be met.

1. <autoElevate>true</autoElevate> must be in the assembly manifest.
2. It must be located in one of a handful of "secure" directories. A secure directory is one that standard users can't modify and they include %SystemRoot%\System32 and most of its subdirectories, %SystemRoot%\Ehome, as well as a handful of directories under %ProgramFiles% that include Windows Defender and Windows Journal.
3. It must be digitally signed by the Windows publisher, which is the certificate used to sign all code included with Windows (it's not sufficient to be signed by Microsoft, so Microsoft software that's not shipped in Windows isn't included)

You can do number 1 and 2 yourself, but there is no way you can fulfill requirement #3.

Deuno

Interesting, thanks! I'd think 2 was unnecessary though. – Fractional

Note that this leads to a gaping security hole in Windows with the default settings. – Forerunner

@JonathanPotter makes a good point; this is one of the reasons you should use a standard user account. UAC is a speed bump, not a wall. – Ovate

This is horrible, I'm glad I asked this question. Hopefully, this may have been fixed in Windows 8. – Fractional

You can work around the WriteProcessMemory vulnerability by returning UAC to it's Vista default setting: "Always notify me when..." – Drennan

I wonder about the third condition, C:\Windows\System32\taskmgr.exe and C:\Windows\System32\resmon.exe are not signed on my system. – Oloroso

@Oloroso It also does not show up for me if I go to the properties menu, however if I use sigcheck you can see that it is indeed signed by Microsoft – Deuno

@ScottChamberlain That's weird :D – Oloroso