├── Image
├── cli.png
├── msf.png
└── klist.png
├── RunAsPasswd
├── RunAsPasswd.vcxproj.user
├── RunAsPasswd.vcxproj.filters
├── RunAsPasswd.cpp
└── RunAsPasswd.vcxproj
├── RunAsPasswd.sln
└── README.md
/Image/cli.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Sq00ky/RunAsPasswd/HEAD/Image/cli.png
--------------------------------------------------------------------------------
/Image/msf.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Sq00ky/RunAsPasswd/HEAD/Image/msf.png
--------------------------------------------------------------------------------
/Image/klist.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Sq00ky/RunAsPasswd/HEAD/Image/klist.png
--------------------------------------------------------------------------------
/RunAsPasswd/RunAsPasswd.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/RunAsPasswd/RunAsPasswd.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
--------------------------------------------------------------------------------
/RunAsPasswd.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 17
4 | VisualStudioVersion = 17.3.32811.315
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RunAsPasswd", "RunAsPasswd\RunAsPasswd.vcxproj", "{10A6716F-B604-4896-9678-D3FCB2A9C2DB}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x64.ActiveCfg = Debug|x64
17 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x64.Build.0 = Debug|x64
18 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x86.ActiveCfg = Debug|Win32
19 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Debug|x86.Build.0 = Debug|Win32
20 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x64.ActiveCfg = Release|x64
21 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x64.Build.0 = Release|x64
22 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x86.ActiveCfg = Release|Win32
23 | {10A6716F-B604-4896-9678-D3FCB2A9C2DB}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {2B2EA4C6-DC2F-4AEE-85C7-134470A4F942}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | ```
2 | ______ ___ ______ _
3 | | ___ \ / _ \ | ___ \ | |
4 | | |_/ / _ _ __ / /_\ \___ | |_/ /_ _ ___ _____ ____| |
5 | | / | | | '_ \| _ / __|| __/ _` / __/ __\ \ /\ / / _` |
6 | | |\ \ |_| | | | | | | \__ \| | | (_| \__ \__ \\ V V / (_| |
7 | \_| \_\__,_|_| |_\_| |_/___/\_| \__,_|___/___/ \_/\_/ \__,_|
8 | ```
9 | I'll preface this by saying I'm sure there's plenty of other already existing projects out there that have already written this and have probably done so much better than I have. I built this to expand my personal portfolio and for my own education. If you use it, cool :D I appreciate it.
10 |
11 | ### Overview
12 |
13 | This is a simple "RunAs.exe" clone that has the ability to specify a ``-p || --password`` flag. There has been several instances where I have not been in a fully interactive command prompt and have needed to use the ``runas.exe`` command. Mimikatz's sekurlsa::pth command is great, but obfuscating Mimikatz is not! Sometimes I just need a simple solution. Why bring a sledge hammer when all you need is a normal hammer? So, that's why I built RunAsPasswd. One day I hope to implement a ``-h | --hash`` mechanism for passing a NTLM hash, though I need to do a bit more research on how to actually implement that first.
14 |
15 | ### Technical Details
16 | This clone utilizies the ``CreateProcessWithLogonW`` Windows API and supports ``LOGON_NETCREDENTIALS_ONLY`` and the default (which I believe is ``LOGON_WITH_PROFILE``). You can control which is used by passing with ``-n || --netonly`` flag. If the flag is provided, it with run the program with ``LOGON_NETCREDENTIALS_ONLY``, else, the default.
17 |
18 | ### Help & Changes
19 | The program is fairly similar to the ``runas.exe`` command on Windows, just with a few minor changes. Flags are now passed in a unix stlye vs the windows /arg style, so /user: is now -u or --username
20 | ```
21 | C:\Users\nanaisu\Downloads>.\RunAsPasswd.exe
22 | Usage: RunAsPasswd.exe -u da-nanaisu -p P@ssw0rd123! -d CONTOSO -c command
23 |
24 | Options:
25 | -u USERNAME, --username USERNAME
26 | the username to use for the process
27 | -p PASSWORD, --password PASSWORD
28 | the password to use for the process
29 | -d DOMAIN, --domain DOMAIN
30 | the domain to use for the process
31 | -c COMMAND, --command COMMAND
32 | the command to execute with the specified credentials
33 | -a ARGS, --args ARGS
34 | the arguments to pass to the command
35 | -n, --netonly run with the NETLOGON flag (may result in process creation with invalid credentials)
36 |
37 | This program is a runas.exe clone, but with the added ability to provide the password as a command line argument. It uses the CreateProcessWithLogonW function to create a new process with the given credentials.
38 | ```
39 |
40 | ### Usage
41 | Usage is fairly simple, specify the username, password, domain name, command and optionally argument and netonly flag. Sample usage looks like so:
42 | ```
43 | C:\Users\nanaisu\Downloads>.\RunAsPasswd.exe -u administrator -p P@ssw0rd123! -d CONTOSO -c shell.exe
44 | [+] Command executed successfully!
45 |
46 | C:\Users\hubert\Downloads>.\RunAsPasswd.exe -u administrator -p P@ssw0rd123! -d CONTOSO -c shell.exe -n
47 | [!] Running with the NETLOGON flag may result in session creation with invalid credentials.
48 | [+] Command executed successfully!
49 | ```
50 |
51 |
52 |
53 | And the results in Metasploit...
54 |
55 |
56 |
57 | I'll point out a quick note here that I thought was interesting - There are two sessions returned, one with the netlogon flag running as Hubert, and the other as Administrator. This is due to the behavior of the netlogon flag. From what I understand, the only real trace that can be found that netlogon worked correctly is the Kerberos tickets stored in memory. Interestingly enough, no process tokens are created for the Administrator user.
58 |
59 |
60 |
61 | Anyways - I'm no Windows expert, but I thought that was an interesting thing to note. At first, I was going to have it default to ``LOGON_NETCREDENTIALS_ONLY``, but it turns out that may be confusing for some individuals, so I left it as is.
62 |
63 | ### Disclaimers
64 | I'm not responsible for any damage this program may cause. Use at your own risk. This program is meant for educational purposes only.
65 |
66 | ### Resources
67 | - https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithlogonw
68 | - https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes
69 |
--------------------------------------------------------------------------------
/RunAsPasswd/RunAsPasswd.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | using namespace std;
5 | int main(int argc, char* argv[])
6 | {
7 | STARTUPINFO si;
8 | PROCESS_INFORMATION pi;
9 | ZeroMemory(&si, sizeof(si));
10 | string username, password, domain, args, command;
11 | DWORD netonly;
12 | for (int i = 1; i < argc; i++) {
13 | string arg = argv[i];
14 | if (arg == "-u" || arg == "--username") {
15 | if (i + 1 < argc) {
16 | username = argv[++i];
17 | }
18 | else {
19 | cout << "-u || --username option requires one argument." << std::endl;
20 | exit(1);
21 | }
22 | }
23 | else if (arg == "-p" || arg == "--password") {
24 | if (i + 1 < argc) {
25 | password = argv[++i];
26 | }
27 | else {
28 | cout << "-p || --password option requires one argument." << std::endl;
29 | exit(1);
30 | }
31 | }
32 | else if (arg == "-d" || arg == "--domain") {
33 | if (i + 1 < argc) {
34 | domain = argv[++i];
35 | }
36 | else {
37 | cout << "-d || --domain option requires one argument." << std::endl;
38 | exit(1);
39 | }
40 |
41 | }
42 | else if (arg == "-c" || arg == "--command") {
43 | if (i + 1 < argc) {
44 | command = argv[++i];
45 | }
46 | else {
47 | cout << "-c || --command option requires one argument." << std::endl;
48 | exit(1);
49 | }
50 | }
51 | else if (arg == "-a" || arg == "--args") {
52 | if (i + 1 < argc) {
53 | args = argv[++i];
54 | }
55 | }
56 | else if (arg == "-n" || arg == "--netonly") {
57 | netonly = 0x00000002;
58 | cout << "[!] Running with the NETLOGON flag may result in session creation with invalid credentials.\n";
59 | }
60 | }
61 |
62 | if (username.empty() && password.empty() && domain.empty() && args.empty() && command.empty()) {
63 | cout << "Usage: RunAsPasswd.exe -u da-nanaisu -p P@ssw0rd123! -d CONTOSO -c command\n\nOptions:\n -u USERNAME, --username USERNAME\n the username to use for the process\n -p PASSWORD, --password PASSWORD\n the password to use for the process\n -d DOMAIN, --domain DOMAIN\n the domain to use for the process\n -c COMMAND, --command COMMAND\n the command to execute with the specified credentials\n -a ARGS, --args ARGS\n the arguments to pass to the command\n -n, --netonly run with the NETLOGON flag (may result in process creation with invalid credentials)\n\nThis program is a runas.exe clone, but with the added ability to provide the password as a command line argument. It uses the CreateProcessWithLogonW function to create a new process with the given credentials.\n";
64 | exit(1);
65 | }
66 | if (username.empty()) {
67 | cerr << "-u || --username option is required." << endl;
68 | return 1;
69 | }
70 | if (password.empty()) {
71 | cerr << "-p || --password option is required." << endl;
72 | return 1;
73 | }
74 | if (domain.empty()) {
75 | cerr << "-d || --domain option is required." << endl;
76 | return 1;
77 | }
78 | if (command.empty()) {
79 | cerr << "-c || --command option is required." << endl;
80 | }
81 | wchar_t w_username[1024], w_password[1024], w_domain[1024], w_command[1024], w_args[1024];
82 | mbstowcs(w_password, password.data(), sizeof(password));
83 | mbstowcs(w_username, username.data(), sizeof(username));
84 | mbstowcs(w_domain, domain.data(), sizeof(domain));
85 | mbstowcs(w_command, command.data(), sizeof(command));
86 |
87 | if (args.empty()) {
88 | if(CreateProcessWithLogonW(w_username, w_domain, w_password, netonly, w_command, NULL, CREATE_NO_WINDOW, NULL, NULL, &si, &pi)){
89 | cout << "[+] Command executed successfully!\n";
90 | }
91 | else {
92 | cout << "[-] Failed to execute command. Error: " << GetLastError();
93 | }
94 | }
95 | else {
96 | string combinedArgs;
97 | combinedArgs = command + " " + args;
98 | mbstowcs(w_args, combinedArgs.data(), sizeof(args));
99 | if (CreateProcessWithLogonW(w_username, w_domain, w_password, netonly, w_command, w_args, CREATE_NO_WINDOW, NULL, NULL, &si, &pi)) {
100 | cout << "[+] Command executed successfully!\n";
101 | }
102 | else {
103 | cout << "[-] Failed to execute command. Error: " << GetLastError();
104 | }
105 | }
106 | }
107 |
--------------------------------------------------------------------------------
/RunAsPasswd/RunAsPasswd.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | Win32Proj
24 | {10a6716f-b604-4896-9678-d3fcb2a9c2db}
25 | RunAsPasswd
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v143
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v143
39 | true
40 | Unicode
41 |
42 |
43 | Application
44 | true
45 | v143
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v143
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 | Level3
76 | true
77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
78 | true
79 |
80 |
81 | Console
82 | true
83 |
84 |
85 |
86 |
87 | Level3
88 | true
89 | true
90 | true
91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
92 | true
93 |
94 |
95 | Console
96 | true
97 | true
98 | true
99 |
100 |
101 |
102 |
103 | Level3
104 | false
105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
106 | true
107 |
108 |
109 | Console
110 | true
111 |
112 |
113 |
114 |
115 | Level3
116 | true
117 | true
118 | false
119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
120 | true
121 |
122 |
123 | Console
124 | true
125 | true
126 | true
127 |
128 |
129 |
130 |
131 |
132 |
133 |
134 |
135 |
--------------------------------------------------------------------------------