Understanding Runas

During security assessments, it's common to have network access and come across Active Directory (AD) credentials. However, there may be limitations, such as lacking the means or privileges to create a new domain-joined machine. In such scenarios, the ability to use these discovered credentials on a Windows machine you control is essential.

One way to achieve this is by using "Runas," a legitimate Windows binary, to inject the credentials into memory. A typical Runas command takes the following form:

runas.exe /netonly /user:<domain>\<username> cmd.exe

Let's break down the parameters:

• /netonly: Since we are not part of the domain, this parameter allows us to load the credentials for network authentication without directly authenticating against a domain controller. Commands executed locally on the computer will run in the context of the standard Windows account, but any network connections will use the specified credentials.

• /user: Here, we provide the domain and the username. It's generally a good practice to use the Fully Qualified Domain Name (FQDN) rather than just the NetBIOS name of the domain for better resolution.

• cmd.exe: This specifies the program we want to execute once the credentials are injected. While it can be changed to other programs, using "cmd.exe" is a safer choice because it provides flexibility to launch other processes with the injected credentials.

Upon running this command, you will be prompted to provide the password. Notably, with the /netonly parameter, the credentials won't be directly verified by a domain controller, making them accept any password. It's still necessary to confirm that the network credentials are successfully loaded and accurate.

Once the password is provided, a new command prompt window opens. To verify that the credentials work, listing the SYSVOL directory is a reliable approach. Any AD account, regardless of its privileges, can read the contents of the SYSVOL directory.

You can perform the following steps to validate the credentials and access SYSVOL:

1. Set the DNS server to the Domain Controller (DC) IP address:

   $dnsip = "<DC IP>"
   $index = Get-NetAdapter -Name ‘[INTERFACE]’ | Select-Object -ExpandProperty 'ifIndex'
   Set-DnsClientServerAddress -InterfaceIndex $index -ServerAddresses $dnsip

2. View the SYSVOL directory:

   dir \\DCHOSTNAME\SYSVOL\

Additional enumeration and assessment can be conducted using Microsoft Management Console (MMC) to gain further insights into the compromised system and network.