Operator On The Wire
Join
← Back to Knowledge Base
RED TEAM / C2 / COBALT STRIKE / COMMANDS

Impersonation

CommandUsageNote
make_tokenmake_token [user] [pass]Impersonate a user with known credentials - if invalid password is provided it can create a "netonly" token
steal_tokensteal_token [pid]Steal token from target process
rev2selfRevert to original token
token-storetoken-store steal<br><br>token-store show<br><br>token-store use<br><br>token-store removeStore tokens in Beacon for reuse
pthpth [user] [hashPass the Hash - super loud