WMIC runas elevate example

wmi.c

#include <windows.h>


DWORD GetIntegrityLevel(HANDLE hProcess)
{
    DWORD dwIntegrityLevel = 0;
    HANDLE hToken;

    if (OpenProcessToken(hProcess, TOKEN_QUERY, &hToken)) {
        DWORD dwSize;

        if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwSize)) {
            if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
                PTOKEN_MANDATORY_LABEL il = (PTOKEN_MANDATORY_LABEL)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwSize);

                if (il != NULL) {
                    if (GetTokenInformation(hToken, TokenIntegrityLevel, il, dwSize, &dwSize))
                        dwIntegrityLevel = *GetSidSubAuthority(il->Label.Sid, 0);

                    HeapFree(GetProcessHeap(), 0, il);
                }
            }
        }
        CloseHandle(hToken);
    }

    return dwIntegrityLevel;
}


int main()
{
    OSVERSIONINFOW os = { .dwOSVersionInfoSize = sizeof(OSVERSIONINFOW) };
    GetVersionExW(&os);

    if (os.dwMajorVersion >= 6) {
        if (GetIntegrityLevel(GetCurrentProcess()) < SECURITY_MANDATORY_HIGH_RID) {
            WCHAR f[MAX_PATH];
            GetModuleFileNameW(NULL, f, sizeof f);

            WCHAR cmd[MAX_PATH + 32];
            wsprintfW(cmd, L"process call create \"%s\"", f);

            SHELLEXECUTEINFOW s = {
                .cbSize = sizeof(SHELLEXECUTEINFOW),
                .lpVerb = L"runas",
                .lpFile = L"wmic",
                .lpParameters = cmd
            };
            
            while (Sleep(512), !ShellExecuteExW(&s));

            ExitProcess(0);
        }
    }

    MessageBoxW(0, L"Test", "Caption", MB_OK);

    return 0;
}