run

token::run executes a new process with its token.

It has the following command line arguments:

  • /id: Token id to use for the new process

  • /user: Execute the process with the tokens of this user (instead of specifying the token ID)..

  • /process: The process to run. By default, the command whoami is executed.

Preparation

List tokens of user to impersonate using the token::list module:

mimikatz # token::list /user:ffast
Token Id  : 0
User name : ffast
SID name  :
 
5332    {0;000563b2} 2 F 457263         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,24p)       Primary
4432    {0;000563b2} 2 F 2839551        winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,24p)       Primary
668     {0;00050574} 0 D 329079         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (12g,24p)       Impersonation (Impersonation)
668     {0;000563e4} 2 L 353269         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,02p)       Impersonation (Impersonation)
800     {0;000563e4} 2 L 456098         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,02p)       Impersonation (Impersonation)
920     {0;000563e4} 2 L 380750         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,02p)       Impersonation (Impersonation)
920     {0;000563e4} 2 L 387116         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,01p)       Impersonation (Identification)
920     {0;000563e4} 2 L 436160         winattacklab\ffast     S-1-5-21-1345929560-157546789-2569868433-1123   (15g,02p)       Impersonation (Impersonation)
[...]

id

Run a command using a specified token by it's token ID. By default, the command whoami is executed:

user

Run a command using a specified token by it's username. The domain name must not be specified. By default, the command whoami is executed:

process

Other processes to spawn can be specified.

Example to access DC system drive:

Add backdoor user:

It's not possible to directly start a new interactive PowerShell process, because the user input of a new process is somehow not handled correctly. However, when PowerShell is started via PsExec, it can be interactively used:

A new PowerShell window is then opened wich can be used interactively:

Demystifying the kull_m_process_run_data Error

Even as a local administrator, you can get the kull_m_process_run_data error:

  • The error message says that the CreateProcessAsUser function could not be executed.

The token::run command uses the function CreateProceasAsUser to create a new process in the security context of the specified token and requires the following privileges (source: CreateProcessAsUserA function (processthreadsapi.h)):

  • SeIncreaseQuotaPrivilege privilege

  • SeAssignPrimaryTokenPrivilege privilege (if the token is not assignable)

A local admin has the permission to get the SeIncreaseQuotaPrivilege privilege but not the SeAssignPrimaryTokenPrivilege privilege:

If you start mimikatz as SYSTEM, these privileges can be acquired:

Then, it's possible to use the token::run command and use stolen tokens as primary tokens.

PreviousrevertNextwhoami

Last updated