1

If a Windows program is run with ‘runas’ using the ‘/netonly’ argument is there any way to see what credentials are being used by it for the network? Similar to the way you might see a process is being run by a certain user in the task manager, or in ‘tasklist’ or in Get-Process?

leeand00
  • 4,869
  • 15
  • 69
  • 110

1 Answers1

3

Do the following as any user with administrative privileges. Naturally, this only works after the process -- that has been started with runas /netonly -- accessed a network resource.

  • Open a command line with elevated permissions (Run as Administrator) and enter klist sessions.
  • Search for the session where it says Negotiate:NewCredentials (comes from the /netonly switch ➜ logon type 9) and that contains the username that executed the runas command.
  • Note the session id, e.g. 0x154f7a8.
  • Enter the command klist -li 0x154f7a8. This will show you all the kerberos tickets for this session. The kerberos tickets are granted to the user account that was used for the runas /netonly command. If the command does not return any tickets, then the process has not yet accessed a network resource, thus did not receive a ticket yet. In that case I think your only chance is to use something like mimikatz to read the cached credentials from memory.
leeand00
  • 4,869
  • 15
  • 69
  • 110
Daniel
  • 6,940
  • 6
  • 33
  • 64
  • 1
    Interesting info - would not work if only NTLM authentication is used though. – Greg Askew Dec 05 '19 at 19:17
  • @Daniel This is great, but it doesn't tell me which process id is associated with the ticket...(or is it just ...the last ticket listed from `klist -li `?) – leeand00 Jan 16 '20 at 18:49
  • @Daniel So the processes go to the system that go to Keberos that retrieve the tgt that sends the system the ticket? – leeand00 Jan 17 '20 at 14:54