Yes, it's true. Microsoft break their own rules on this score. The general consensus from the readers of Bugtraq / NTBugtraq / Slashdot / god knows where else, as well as from Microsoft, is that if you place a window on the desktop as LocalSystem, you're begging for trouble. Well, I guess Microsoft must be begging for trouble - I've found two that are normally there, and a third you can create.

1 - NetDDE. Regular DDE runs within explorer.exe as whoever is logged on at the time, however the network flavour has a window on the desktop which is running within winlogon.exe. What's that you say? Winlogon is a critical system process? Why yes! Critical system processes having windows on the desktop is a really clever thing to do! Wonderful!

2 - "MM Notify Callback" Quite frankly, I don't actually have the faintest clue WHAT this window does. Quite frankly, I don't care either. What I do care about, is that it's owned by winlogon.exe. What's that you say? Winlogon is a critical system process? Why yes! More loveliness!

3 - Messenger service (discovered by Georgi Guninski). On a default installation of Win2K pro, drop to a command prompt and type "net send 127.0.0.1 hello". A neat little window pops up that says who the message was from, at what time, yadda yadda yadda. Unfortunately, that window is owned by the Client-Server Runtime Sub-System (great acronym), AKA csrss.exe. Guess what? It's another critical system process, with another localsystem window on the desktop.

No localsystem desktop windows? No problem!


Well actually, you really don't need a window handle to a LocalSystem process. As Michael Durig kindly pointed out, the Win32 API has a friendly little function called PostThreadMessage(). Enumerating processes is not a privileged operation, so you can get a PID for a localsystem process with no problems. The ToolHelp functions allow you to also enumerate the threads for that process (Under Win2k and XP, anyway), and even if you're stuck under NT4 the performance database does the same thing. So, you have a list of all threads running as LocalSystem on the machine. PostThreadMessage will send any message you like to any thread you like, assuming that thread has implemented a message queue. No, you don't have to call OpenProcess(). No, there are no privileges involved.