From 0ba50b53dfabeb7f33aaefca854b59a56a3ea845 Mon Sep 17 00:00:00 2001 From: antonioCoco Date: Fri, 22 Mar 2019 11:42:13 +0100 Subject: [PATCH] Module Runas: improved help --- modules/runas.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/runas.py b/modules/runas.py index 028cb44..24dfcaa 100644 --- a/modules/runas.py +++ b/modules/runas.py @@ -16,7 +16,11 @@ class Runas(Module): The calling process will wait until the end of the execution of the spawned process. The two processes will communicate through 2 pipeline files (1 for stdout and 1 for stderr). The default logon type is 3 (Network_Logon). - If you set Interactive (2) logon type you will face some restriction problems. + If you set Interactive (2) logon type you will face some UAC restriction problems. + You can make interactive login without restrictions by setting the following regkey to 0 and restart the server: + + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + If you need to spawn a background or async process, i.e. spawning a reverse shell, set the argument 'process_timeout_ms' to 0. @@ -129,8 +133,8 @@ class Runas(Module): const uint WAIT_ABANDONED = 0x00000080; const uint WAIT_OBJECT_0 = 0x00000000; const uint WAIT_TIMEOUT = 0x00000102; - - [PermissionSetAttribute(SecurityAction.Demand, Name = "FullTrust")] + + [PermissionSetAttribute(SecurityAction.Demand, Name = "FullTrust")] public string RunAs(string userName, string password, string domainName, string cmd, string stdout_file, string stderr_file, string working_directory, int logon_type, uint process_ms_timeout) { SafeTokenHandle safeTokenHandle;