Following simple scenario during pen test:
- I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose)
- I got my hands on local or domain credentials I want to use (as in: have a remote shell as that guy).
- no user is logged in (if one was loggend in, and there was no protection software, I could inject into one of their processes. Yes, bad idea, very noisy.)
Now windows runas.exe does not even start, metasploit runas does not work, empire runas / spawnas does not work, because I am SYSTEM in session 0. As I understand it, the latter two do fairly naìve LogonUser() => CreateProcessAsUser(). I cannot even spawn an process as local Admin that way, even though I have his credentials.
My uninformed guess is you would need to do more involved magic (worst case create a new desktop session. E.g. the RDP service runs as system and does use my credentials to create fully functional processes as me).
Currently the only way I see is a multiday journey into windows internals and writing my own implant or metasploit railgun module. But this problem must have been solved, ms08_067 was 10 years ago.
How do I properly go from SYSTEM to DOMAIN\joe or .\jane if I have the credentials?