Custom binary to change / run cmd.exe as other user?

This is such a simple problem yet I struggle with it on 99% of Windows boxes.

On Linux it's a 5-line C program to start a bash as another user.

I'm not talking about SUID, I only want a precompiled binary that allows me to run cmd.exe as another user from a lowpriv shell on the target Windows, when I have valid creds.

Usually "runas" and Powershell commands to run something as another user are disabled.

Anything? (not a revshell)

Hack The Box
Anger is more useful than despair - T800

Comments

  • if you have powershell this might help. https://stackoverflow.com/a/34307483. I havent tried it on any machines.

  • > Usually "runas" and Powershell commands to run something as another user are disabled.

    Hack The Box
    Anger is more useful than despair - T800

  • I have yet to come across a machine that doesn't allow the Powershell method, but my backlog is growing (thanks to my stubbornness with trying to finish RopeTwo, first).

    Without any warranty, but this looks like what you are looking for: https://www.source-code.biz/snippets/c/1.htm


    Hack The Box
    GREM | OSCE | GASF | eJPT

  • I recall auto-it having a runas feature as well. Auto-it scripts can easily be compiled to an exe.

    Auto it is available portable if I recall correctly. But even then the suggestion of @HomeSen looks less work to get going, but it might be a worthy alternative, though.

    Or 'runas':
    runas /user:USER­NAME “C:\full\path\of\Program.exe"
    It should then ask for the password and throw a UAC your way if it's enabled.
  • Thanks, I'll look into it.

    This is weird, I can't even recall ANY machine where one of the two worked.

    Today I made worker. Runas was present but didn't work, Start-Process didn't work either (changing from foothold to user on a nc rev shell).

    Hack The Box
    Anger is more useful than despair - T800

  • edited August 27

    @sparkla said:

    Thanks, I'll look into it.

    This is weird, I can't even recall ANY machine where one of the two worked.

    Today I made worker. Runas was present but didn't work, Start-Process didn't work either (changing from foothold to user on a nc rev shell).

    Try Invoke-Command -Credential ... instead of Start-Process. Worked for me all the time.
    Runas usually requires a "full shell" (similar to TTY's/PTY's under Linux) and also invokes UAC which obviously isn't available on a cmd/powershell ;)


    Hack The Box
    GREM | OSCE | GASF | eJPT

  • Cool, good to know the difference, and the fact there is one.

    I usually go for the simpler syntax with Powershell cause of misssing autocomplete, wouldn't have figured that the one works and the other doesn't (unless disabled on purpose or anything like that)

    Hack The Box
    Anger is more useful than despair - T800

Sign In to comment.