wiki created

documentation-payload/Cazalla/commands/make_token.md

@@ -0,0 +1,61 @@
+# make_token - Create Token from Credentials
+
+Create a new security token using plaintext credentials and impersonate it.
+
+## Description
+
+The `make_token` command creates a new security token using plaintext credentials and impersonates it. Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API.
+
+## Syntax
+
+```
+make_token <domain> <username> <password> [logon_type]
+```
+
+## Parameters
+
+- `domain` (required): Domain name (or empty string for local machine)
+- `username` (required): Username to authenticate as
+- `password` (required): Password for authentication
+- `logon_type` (optional): Logon type (default: 9 - NewCredentials)
+
+## Examples
+
+```
+make_token "" Administrator P@ssw0rd123
+make_token DOMAIN user01 MyPassword
+make_token WORKGROUP localuser Secret123 9
+```
+
+## Features
+
+- Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API
+- The logon_type parameter (default: 9 - NewCredentials) determines the authentication type
+- The impersonation context is automatically tracked and displayed in the Mythic UI
+- Less detectable than `steal_token` as it doesn't require accessing LSASS memory, but may still generate authentication logs
+- Use `rev2self` to revert to the original token
+
+## Output
+
+```
+[make_token] Creating token for: DOMAIN\User01
+[make_token] Authentication successful
+[make_token] Impersonating user: DOMAIN\User01
+```
+
+## OPSEC Considerations
+
+- Authentication events are logged by Windows Event Log
+- Less detectable than token theft, but still generates logs
+- Authentication failures may trigger alerts
+- Use `rev2self` after completing operations to reduce detection risk
+
+## Related
+
+[Token Support](../../../features.md#token-support), [Context Tracking](../../../features.md#context-tracking)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)