Following simple scenario during pen test:

  • I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose)
  • I got my hands on local or domain credentials I want to use (as in: have a remote shell as that guy).
  • no user is logged in (if one was loggend in, and there was no protection software, I could inject into one of their processes. Yes, bad idea, very noisy.)

Now windows runas.exe does not even start, metasploit runas does not work, empire runas / spawnas does not work, because I am SYSTEM in session 0. As I understand it, the latter two do fairly naìve LogonUser() => CreateProcessAsUser(). I cannot even spawn an process as local Admin that way, even though I have his credentials.

My uninformed guess is you would need to do more involved magic (worst case create a new desktop session. E.g. the RDP service runs as system and does use my credentials to create fully functional processes as me).

Currently the only way I see is a multiday journey into windows internals and writing my own implant or metasploit railgun module. But this problem must have been solved, ms08_067 was 10 years ago.

How do I properly go from SYSTEM to DOMAIN\joe or .\jane if I have the credentials?

  • 1
    Can you just use the credentials to log in remotely or use psexec over SMB? – multithr3at3d Jun 7 '18 at 16:30
  • Not what I asked. Yes, of course, if I have admin creds for another machine and I am sure there is no monitoring or protection software, I can do a psexec style service creation which gives me rce as SYSTEM on another box. – manduca Jun 7 '18 at 17:12
  • Of course you are right, that there are always fun things you can do if what you want does not work. So Why would I want to become a user? For example, I can run the local sqlplus.exe to interact with the local db. Or I can do an easy dcsync if the user has that right. – manduca Jun 7 '18 at 17:28
  • Think CreateProcessWithLogonW with the LOGON_WITH_PROFILE might do what you need it to. Unsure of any tools that use this, maybe try a GitHub search. – Peanut Jul 13 '18 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.