Can an EXE bypass user confirmation while invoking another EXE?

I have 2 applications written in Delphi. The first exe (with a user
interface) calls another using ShellExecuteEx(), which runs as a
background process.

When the first exe invokes the second, one of these two things happen:

1. When I log in as an admin, a UAC dialog comes up with the
Allow/Cancel prompts. Selecting Allow continues the execution.

2. If I log in as non-admin, an admin credentials dialog box is
displayed, and I need to enter the admin username/password to continue.

On both occasions, I want the second exe to run without any user
intervention. How can I make it possible?

And yes, I tried applying the ElevateCreateProcess mitigation as
suggested by SUA tool, but it doesn't seem to work - the behavior is as
before.

Thanks for your help.


--
kskarun

One way is by subverting. Look up Patch Guard. But I would not do this if I
were you.
You could seriously harm your users as well as your own security.

There's a whitepaper written up on Google code about this and many other
places.

"kskarun" <> wrote in message
news:...
>
> I have 2 applications written in Delphi. The first exe (with a user
> interface) calls another using ShellExecuteEx(), which runs as a
> background process.
>
> When the first exe invokes the second, one of these two things happen:
>
> 1. When I log in as an admin, a UAC dialog comes up with the
> Allow/Cancel prompts. Selecting Allow continues the execution.
>
> 2. If I log in as non-admin, an admin credentials dialog box is
> displayed, and I need to enter the admin username/password to continue.
>
> On both occasions, I want the second exe to run without any user
> intervention. How can I make it possible?
>
> And yes, I tried applying the ElevateCreateProcess mitigation as
> suggested by SUA tool, but it doesn't seem to work - the behavior is as
> before.
>
> Thanks for your help.
>
>
> --
> kskarun
>
> __________ Information from ESET Smart Security, version of virus
> signature database 4176 (20090622) __________
>
> The message was checked by ESET Smart Security.
>
> http://www.eset.com
>
>
>

__________ Information from ESET Smart Security, version of virus signature database 4176 (20090622) __________

The message was checked by ESET Smart Security.

http://www.eset.com