# make_token - Create Token from Credentials

Create a new security token using plaintext credentials and impersonate it.

## Description

The `make_token` command creates a new security token using plaintext credentials and impersonates it. Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API.

## Syntax

```
make_token <domain> <username> <password> [logon_type]
```

## Parameters

- `domain` (required): Domain name (or empty string for local machine)
- `username` (required): Username to authenticate as
- `password` (required): Password for authentication
- `logon_type` (optional): Logon type (default: 9 - NewCredentials)

## Examples

```
make_token "" Administrator P@ssw0rd123
make_token DOMAIN user01 MyPassword
make_token WORKGROUP localuser Secret123 9
```

## Features

- Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API
- The logon_type parameter (default: 9 - NewCredentials) determines the authentication type
- The impersonation context is automatically tracked and displayed in the Mythic UI
- Less detectable than `steal_token` as it doesn't require accessing LSASS memory, but may still generate authentication logs
- Use `rev2self` to revert to the original token

## Output

```
[make_token] Creating token for: DOMAIN\User01
[make_token] Authentication successful
[make_token] Impersonating user: DOMAIN\User01
```

## OPSEC Considerations

- Authentication events are logged by Windows Event Log
- Less detectable than token theft, but still generates logs
- Authentication failures may trigger alerts
- Use `rev2self` after completing operations to reduce detection risk

## Related

[Token Support](../../../features.md#token-support), [Context Tracking](../../../features.md#context-tracking)

---

**Command Category:** Token Operations  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)