├── Image ├── cli.png ├── msf.png └── klist.png ├── RunAsPasswd ├── RunAsPasswd.vcxproj.user ├── RunAsPasswd.vcxproj.filters ├── RunAsPasswd.cpp └── RunAsPasswd.vcxproj ├── RunAsPasswd.sln └── README.md /Image/cli.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Sq00ky/RunAsPasswd/HEAD/Image/cli.png -------------------------------------------------------------------------------- /Image/msf.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Sq00ky/RunAsPasswd/HEAD/Image/msf.png -------------------------------------------------------------------------------- /Image/klist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Sq00ky/RunAsPasswd/HEAD/Image/klist.png -------------------------------------------------------------------------------- /RunAsPasswd/RunAsPasswd.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /RunAsPasswd/RunAsPasswd.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /RunAsPasswd.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.3.32811.315 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RunAsPasswd", "RunAsPasswd\RunAsPasswd.vcxproj", "{10A6716F-B604-4896-9678-D3FCB2A9C2DB}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x64.ActiveCfg = Debug|x64 17 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x64.Build.0 = Debug|x64 18 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x86.ActiveCfg = Debug|Win32 19 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x86.Build.0 = Debug|Win32 20 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x64.ActiveCfg = Release|x64 21 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x64.Build.0 = Release|x64 22 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x86.ActiveCfg = Release|Win32 23 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {2B2EA4C6-DC2F-4AEE-85C7-134470A4F942} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ``` 2 | ______ ___ ______ _ 3 | | ___ \ / _ \ | ___ \ | | 4 | | |_/ / _ _ __ / /_\ \___ | |_/ /_ _ ___ _____ ____| | 5 | | / | | | '_ \| _ / __|| __/ _` / __/ __\ \ /\ / / _` | 6 | | |\ \ |_| | | | | | | \__ \| | | (_| \__ \__ \\ V V / (_| | 7 | \_| \_\__,_|_| |_\_| |_/___/\_| \__,_|___/___/ \_/\_/ \__,_| 8 | ``` 9 | I'll preface this by saying I'm sure there's plenty of other already existing projects out there that have already written this and have probably done so much better than I have. I built this to expand my personal portfolio and for my own education. If you use it, cool :D I appreciate it. 10 | 11 | ### Overview 12 | 13 | This is a simple "RunAs.exe" clone that has the ability to specify a ``-p || --password`` flag. There has been several instances where I have not been in a fully interactive command prompt and have needed to use the ``runas.exe`` command. Mimikatz's sekurlsa::pth command is great, but obfuscating Mimikatz is not! Sometimes I just need a simple solution. Why bring a sledge hammer when all you need is a normal hammer? So, that's why I built RunAsPasswd. One day I hope to implement a ``-h | --hash`` mechanism for passing a NTLM hash, though I need to do a bit more research on how to actually implement that first. 14 | 15 | ### Technical Details 16 | This clone utilizies the ``CreateProcessWithLogonW`` Windows API and supports ``LOGON_NETCREDENTIALS_ONLY`` and the default (which I believe is ``LOGON_WITH_PROFILE``). You can control which is used by passing with ``-n || --netonly`` flag. If the flag is provided, it with run the program with ``LOGON_NETCREDENTIALS_ONLY``, else, the default. 17 | 18 | ### Help & Changes 19 | The program is fairly similar to the ``runas.exe`` command on Windows, just with a few minor changes. Flags are now passed in a unix stlye vs the windows /arg style, so /user: is now -u or --username 20 | ``` 21 | C:\Users\nanaisu\Downloads>.\RunAsPasswd.exe 22 | Usage: RunAsPasswd.exe -u da-nanaisu -p P@ssw0rd123! -d CONTOSO -c command 23 | 24 | Options: 25 | -u USERNAME, --username USERNAME 26 | the username to use for the process 27 | -p PASSWORD, --password PASSWORD 28 | the password to use for the process 29 | -d DOMAIN, --domain DOMAIN 30 | the domain to use for the process 31 | -c COMMAND, --command COMMAND 32 | the command to execute with the specified credentials 33 | -a ARGS, --args ARGS 34 | the arguments to pass to the command 35 | -n, --netonly run with the NETLOGON flag (may result in process creation with invalid credentials) 36 | 37 | This program is a runas.exe clone, but with the added ability to provide the password as a command line argument. It uses the CreateProcessWithLogonW function to create a new process with the given credentials. 38 | ``` 39 | 40 | ### Usage 41 | Usage is fairly simple, specify the username, password, domain name, command and optionally argument and netonly flag. Sample usage looks like so: 42 | ``` 43 | C:\Users\nanaisu\Downloads>.\RunAsPasswd.exe -u administrator -p P@ssw0rd123! -d CONTOSO -c shell.exe 44 | [+] Command executed successfully! 45 | 46 | C:\Users\hubert\Downloads>.\RunAsPasswd.exe -u administrator -p P@ssw0rd123! -d CONTOSO -c shell.exe -n 47 | [!] Running with the NETLOGON flag may result in session creation with invalid credentials. 48 | [+] Command executed successfully! 49 | ``` 50 | 51 | 52 | 53 | And the results in Metasploit... 54 | 55 | 56 | 57 | I'll point out a quick note here that I thought was interesting - There are two sessions returned, one with the netlogon flag running as Hubert, and the other as Administrator. This is due to the behavior of the netlogon flag. From what I understand, the only real trace that can be found that netlogon worked correctly is the Kerberos tickets stored in memory. Interestingly enough, no process tokens are created for the Administrator user. 58 | 59 | 60 | 61 | Anyways - I'm no Windows expert, but I thought that was an interesting thing to note. At first, I was going to have it default to ``LOGON_NETCREDENTIALS_ONLY``, but it turns out that may be confusing for some individuals, so I left it as is. 62 | 63 | ### Disclaimers 64 | I'm not responsible for any damage this program may cause. Use at your own risk. This program is meant for educational purposes only. 65 | 66 | ### Resources 67 | - https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithlogonw 68 | - https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes 69 | -------------------------------------------------------------------------------- /RunAsPasswd/RunAsPasswd.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | using namespace std; 5 | int main(int argc, char* argv[]) 6 | { 7 | STARTUPINFO si; 8 | PROCESS_INFORMATION pi; 9 | ZeroMemory(&si, sizeof(si)); 10 | string username, password, domain, args, command; 11 | DWORD netonly; 12 | for (int i = 1; i < argc; i++) { 13 | string arg = argv[i]; 14 | if (arg == "-u" || arg == "--username") { 15 | if (i + 1 < argc) { 16 | username = argv[++i]; 17 | } 18 | else { 19 | cout << "-u || --username option requires one argument." << std::endl; 20 | exit(1); 21 | } 22 | } 23 | else if (arg == "-p" || arg == "--password") { 24 | if (i + 1 < argc) { 25 | password = argv[++i]; 26 | } 27 | else { 28 | cout << "-p || --password option requires one argument." << std::endl; 29 | exit(1); 30 | } 31 | } 32 | else if (arg == "-d" || arg == "--domain") { 33 | if (i + 1 < argc) { 34 | domain = argv[++i]; 35 | } 36 | else { 37 | cout << "-d || --domain option requires one argument." << std::endl; 38 | exit(1); 39 | } 40 | 41 | } 42 | else if (arg == "-c" || arg == "--command") { 43 | if (i + 1 < argc) { 44 | command = argv[++i]; 45 | } 46 | else { 47 | cout << "-c || --command option requires one argument." << std::endl; 48 | exit(1); 49 | } 50 | } 51 | else if (arg == "-a" || arg == "--args") { 52 | if (i + 1 < argc) { 53 | args = argv[++i]; 54 | } 55 | } 56 | else if (arg == "-n" || arg == "--netonly") { 57 | netonly = 0x00000002; 58 | cout << "[!] Running with the NETLOGON flag may result in session creation with invalid credentials.\n"; 59 | } 60 | } 61 | 62 | if (username.empty() && password.empty() && domain.empty() && args.empty() && command.empty()) { 63 | cout << "Usage: RunAsPasswd.exe -u da-nanaisu -p P@ssw0rd123! -d CONTOSO -c command\n\nOptions:\n -u USERNAME, --username USERNAME\n the username to use for the process\n -p PASSWORD, --password PASSWORD\n the password to use for the process\n -d DOMAIN, --domain DOMAIN\n the domain to use for the process\n -c COMMAND, --command COMMAND\n the command to execute with the specified credentials\n -a ARGS, --args ARGS\n the arguments to pass to the command\n -n, --netonly run with the NETLOGON flag (may result in process creation with invalid credentials)\n\nThis program is a runas.exe clone, but with the added ability to provide the password as a command line argument. It uses the CreateProcessWithLogonW function to create a new process with the given credentials.\n"; 64 | exit(1); 65 | } 66 | if (username.empty()) { 67 | cerr << "-u || --username option is required." << endl; 68 | return 1; 69 | } 70 | if (password.empty()) { 71 | cerr << "-p || --password option is required." << endl; 72 | return 1; 73 | } 74 | if (domain.empty()) { 75 | cerr << "-d || --domain option is required." << endl; 76 | return 1; 77 | } 78 | if (command.empty()) { 79 | cerr << "-c || --command option is required." << endl; 80 | } 81 | wchar_t w_username[1024], w_password[1024], w_domain[1024], w_command[1024], w_args[1024]; 82 | mbstowcs(w_password, password.data(), sizeof(password)); 83 | mbstowcs(w_username, username.data(), sizeof(username)); 84 | mbstowcs(w_domain, domain.data(), sizeof(domain)); 85 | mbstowcs(w_command, command.data(), sizeof(command)); 86 | 87 | if (args.empty()) { 88 | if(CreateProcessWithLogonW(w_username, w_domain, w_password, netonly, w_command, NULL, CREATE_NO_WINDOW, NULL, NULL, &si, &pi)){ 89 | cout << "[+] Command executed successfully!\n"; 90 | } 91 | else { 92 | cout << "[-] Failed to execute command. Error: " << GetLastError(); 93 | } 94 | } 95 | else { 96 | string combinedArgs; 97 | combinedArgs = command + " " + args; 98 | mbstowcs(w_args, combinedArgs.data(), sizeof(args)); 99 | if (CreateProcessWithLogonW(w_username, w_domain, w_password, netonly, w_command, w_args, CREATE_NO_WINDOW, NULL, NULL, &si, &pi)) { 100 | cout << "[+] Command executed successfully!\n"; 101 | } 102 | else { 103 | cout << "[-] Failed to execute command. Error: " << GetLastError(); 104 | } 105 | } 106 | } 107 | -------------------------------------------------------------------------------- /RunAsPasswd/RunAsPasswd.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {10a6716f-b604-4896-9678-d3fcb2a9c2db} 25 | RunAsPasswd 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | true 77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 78 | true 79 | 80 | 81 | Console 82 | true 83 | 84 | 85 | 86 | 87 | Level3 88 | true 89 | true 90 | true 91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | Console 96 | true 97 | true 98 | true 99 | 100 | 101 | 102 | 103 | Level3 104 | false 105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | 108 | 109 | Console 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | true 118 | false 119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 120 | true 121 | 122 | 123 | Console 124 | true 125 | true 126 | true 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | --------------------------------------------------------------------------------