go-win64api
go-win64api copied to clipboard
Create Session Tokens with ZwCreateToken
As a starting point to implementing RunAs functionality, we'll need to be able to create tokens with ZwCreateToken
This is an apparently undocumented API that allows you to execute as a user without their full credentials.
This library normally runs (for us) as NT AUTH\SYSTEM, so permissions shouldn't be a problem.
A good example, I'm told, is "RunAsEx" on CodeProject.
This will then allow "CreateProcessAsUser" with that token.
This might be helpful: https://github.com/ansible/ansible/issues/34343