As a starting point to implementing RunAs functionality, we'll need to be able to create tokens with ZwCreateToken
This is an apparently undocumented API that allows you to execute as a user without their full credentials.
This library normally runs (for us) as NT AUTH\SYSTEM, so permissions shouldn't be a problem.
A good example, I'm told, is "RunAsEx" on CodeProject.
This will then allow "CreateProcessAsUser" with that token.
As a starting point to implementing RunAs functionality, we'll need to be able to create tokens with ZwCreateToken
This is an apparently undocumented API that allows you to execute as a user without their full credentials.
This library normally runs (for us) as NT AUTH\SYSTEM, so permissions shouldn't be a problem.
A good example, I'm told, is "RunAsEx" on CodeProject.
This will then allow "CreateProcessAsUser" with that token.