Skip to content

Commit 0ba50b5

Browse files
committed
Module Runas: improved help
1 parent bd5d00f commit 0ba50b5

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

modules/runas.py

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,11 @@ class Runas(Module):
1616
The calling process will wait until the end of the execution of the spawned process.
1717
The two processes will communicate through 2 pipeline files (1 for stdout and 1 for stderr).
1818
The default logon type is 3 (Network_Logon).
19-
If you set Interactive (2) logon type you will face some restriction problems.
19+
If you set Interactive (2) logon type you will face some UAC restriction problems.
20+
You can make interactive login without restrictions by setting the following regkey to 0 and restart the server:
21+
22+
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
23+
2024
If you need to spawn a background or async process, i.e. spawning a reverse shell, set the argument
2125
'process_timeout_ms' to 0.
2226
@@ -129,8 +133,8 @@ class Runas(Module):
129133
const uint WAIT_ABANDONED = 0x00000080;
130134
const uint WAIT_OBJECT_0 = 0x00000000;
131135
const uint WAIT_TIMEOUT = 0x00000102;
132-
133-
[PermissionSetAttribute(SecurityAction.Demand, Name = "FullTrust")]
136+
137+
[PermissionSetAttribute(SecurityAction.Demand, Name = "FullTrust")]
134138
public string RunAs(string userName, string password, string domainName, string cmd, string stdout_file, string stderr_file, string working_directory, int logon_type, uint process_ms_timeout)
135139
{
136140
SafeTokenHandle safeTokenHandle;

0 commit comments

Comments
 (0)