Account Impersonation in ASP

[mrcrazy04]

I've realised I left one of the computers on at my university residence, and am on my way home for Easter.

I've figured I can upload an ASP page in order to run shutdown.exe, but in order to do that I need administrative privileges.

 

Does anyone know a simple way to impersonate an account in ASP, I'm sure I recall seeing a WSH or similar object to facilitate it, but can't remember where I saw it, and can't find anything on the net.

[SYNACK]

This is code that performs a shutdown via WMI:

http://www.robvanderwoude.com/files/shutdown_vbs.txt

 

and this page is about impersonation:

Microsoft Corporation

 

but it looks like it only offers impersonation of the already existing process not providing new user credentials to run with.

 

You may be able to use a shell.run though depending on the computers config:

<%
Dim wshell, intReturn
set wshell = server.createobject("wscript.shell")
intReturn = wshell.run("shutdown -s", 0, True)
Response.Write( intReturn )
set wshell = nothing
%>

 

or even a command prompt that uses the runas command then uses sendkeys to type in the required password.