make_token - Create Token from Credentials

Create a new security token using plaintext credentials and impersonate it.

Description

The make_token command creates a new security token using plaintext credentials and impersonates it. Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API.

Syntax

make_token <domain> <username> <password> [logon_type]

Parameters

domain (required): Domain name (or empty string for local machine)
username (required): Username to authenticate as
password (required): Password for authentication
logon_type (optional): Logon type (default: 9 - NewCredentials)

Examples

make_token "" Administrator P@ssw0rd123
make_token DOMAIN user01 MyPassword
make_token WORKGROUP localuser Secret123 9

Features

Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API
The logon_type parameter (default: 9 - NewCredentials) determines the authentication type
The impersonation context is automatically tracked and displayed in the Mythic UI
Less detectable than steal_token as it doesn't require accessing LSASS memory, but may still generate authentication logs
Use rev2self to revert to the original token

Output

[make_token] Creating token for: DOMAIN\User01
[make_token] Authentication successful
[make_token] Impersonating user: DOMAIN\User01

OPSEC Considerations

Authentication events are logged by Windows Event Log
Less detectable than token theft, but still generates logs
Authentication failures may trigger alerts
Use rev2self after completing operations to reduce detection risk

Token Support, Context Tracking

Command Category: Token Operations
Requires Admin: No
MITRE ATT&CK: T1134 - Access Token Manipulation

2.0 KiB Raw Blame History