Since a buddy asked for some clarification on using incognito extension with Metasploit/Meterpreter I'll post some more notes on it.
Let's set up the scenario.
We either exploited something...yea! or we guessed an admin password and used the psexec module (that's what I did). the psexec module will drop us to a SYSTEM shell if all went well.
will then be made in the context of that token.
-H        Create the process hidden from view.
-a   The arguments to pass to the command.
-c        Channelized I/O (required for interaction).
-d   The 'dummy' executable to launch when using -m.
-f   The executable command to run.
-i        Interact with the process after creating it.
We need to use the "-t" so we can use the impersonated thread token, otherwise you'll get a shell as SYSTEM or whoever you were.
Completely awesome! Thanks for the post, and the MWR Infosecurity paper reference.
Chris.. once again, you rock.
Is the "find_token REMOTEHOST" command going to be implemented in this incognito extension for meterpreter?
Thanks for the post, the MWR Infosecurity paper wag a really good read.
Nice post, is there any easy way to become system from administrator and then use incognito. The impersonation has failed for me if I get a meterpreter shell as Admin user (e.g. by using msfpayload) and not as system by exploiting stuff.
I have tried becoming admin to system first and that worked, but then becoming system to some other user, again failed.
i'd set up meterpreter binary as a service or using at/sc. your connect back should be as system and the token tools should work for you.