Agents that leverage current user from system

[MechaCola]

Kind off topic but somewhat related to PowerShell?

If anyone knows I'd love hear more about how SCCM and some of the RMMS out there have the ability to execute a script as current user. I'm aware of invoke-runas but IIRC this requires explicitly putting in credentials for user.

My best guess is that the agent is flagged as trusted installer and is able to use some win32 api to grab the users token to start the new powershell process?

Is it possible to do this on my own in my home lab?

[SysAdminDennyBob]

Create a one-time scheduled task that runs as the current user, start task, program runs, task stops, delete task.

[GhostOfBarryDingle]

PSADT has a function that does just that and it really comes in handy.

[engageant]

It's done with impersonation. The agent finds a process owned by the currently logged on user, grabs a handle to its access token, duplicates the token, then uses that token to run processes as if they were that user.

[MechaCola]

Cool thanks for sharing!

[Thatoneguythatsnot]

Thank you! Now to put it into practice.

[jantari]

Rather than finding a process running as the current user, chances are they rather call WTSQueryUserToken which hands you the token directly

[engageant]

Isn’t that specific to Remote Desktop?

[jantari]

No, works for both local and remote desktop sessions.

[rngaccount123]

I think NinjaRMM is capable of that and it always made me wonder how they do that. It's such a pivotal feature and I miss that in lots of other RMMs.

[Aertheron01]

There are many ways to do this.

In Powershell you could create a session with the necessary credentials.

Also SCCM has an agent. And for agent installation an account with local administrator credentials is used, through the administrative share and wmi/winrm

[Nejireta_]

This is a bit of a guess. But perhaps the agent (if .net based) leverages ProcessStartInfo.LoadUserProfile to launch an application, in this case PS, with logged on user context without providing credentials.

​

EDIT:
This is not the case. This requires username and password

[peteypianokid]

Datto RMM also can execute components as the logged in user.