[FEATURE] interactive logon type execution

[CravateRouge]

Because we are using WinRM we have a "network" logon type which has less permissions than an "interactive" logon type. "interactive" logon type is particularly useful when using COM objects to privesc as the "NT authority\Interactive" group has much more permissions on COM objects than "NT authority\Network" but "interactive" is also useful for a lot of other purposes.

To give a concrete example, in order to display all sessions on the current machine the easiest is to run it with RunasCs.exe like this:
evil-winrm-py PS[...]> .\RunasCs.exe x x -l 9 "qwinsta"

Which calls CreateProcessWithLogonW with the LOGON_NETCREDENTIALS_ONLY behind the hood. Or if plaintext password has been provided to evil-winrm-py it's even better as it would allow to have an interactive session working also for network operations such as ldap, etc (I don't think a krb key, ticket or nt hash can be used to get an interactive process).

So I was thinking about having a builtin command for it like below:

$ evil-winrm-py -i 192.168.100.10 -u john -p 'password'
evil-winrm-py PS[...]> interactive
evil-winrm-py PS-interactive [...]> qwinsta
evil-winrm-py PS-interactive [...]> ([ADSI]"").distinguishedName
evil-winrm-py PS-interactive[...]> exit
evil-winrm-py PS [...]>

$ evil-winrm-py -i 192.168.100.10 -u john -H 'somehash'
evil-winrm-py PS[...]> interactive
[!] password plaintext not provided, network ops won't work
evil-winrm-py PS-netonly [...]> qwinsta
evil-winrm-py PS-netonly [...]> ([ADSI]"").distinguishedName
< SOME ERROR MSG CAUSE DUMMY CREDS>
evil-winrm-py PS-netonly[...]> exit
evil-winrm-py PS [...]>

[adityatelange]

I understand that winrm is not fully interactive, but how should we make it work with winrm without using any external tooling. I see you mention RunasCs.exe but having that as a binary ship with this tool is not a good idea I believe.
Again, I am not againt the idea, just with tooling to be extended by libraries which can be easily integrated intead of a exe.

[CravateRouge]

I don't know the internal details of evil-winrm-py but I thought a call directly to the WinAPI could work? I saw you got some .ps1 files, so maybe calling the WinAPI functions using powershell?

That's what RunasCs.exe is doing, calling CreateProcessWithLogonW behind the hood or CreateProcessAsUserW() or CreateProcessWithTokenW() depending of the context.

As I said depends which type of credentials the user provided to evil-winrm-py