marcos.luna
62 lines
2.0 KiB
Markdown
62 lines
2.0 KiB
Markdown
# make_token - Create Token from Credentials
|
|
|
|
Create a new security token using plaintext credentials and impersonate it.
|
|
|
|
## Description
|
|
|
|
The `make_token` command creates a new security token using plaintext credentials and impersonates it. Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
make_token <domain> <username> <password> [logon_type]
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `domain` (required): Domain name (or empty string for local machine)
|
|
- `username` (required): Username to authenticate as
|
|
- `password` (required): Password for authentication
|
|
- `logon_type` (optional): Logon type (default: 9 - NewCredentials)
|
|
|
|
## Examples
|
|
|
|
```
|
|
make_token "" Administrator P@ssw0rd123
|
|
make_token DOMAIN user01 MyPassword
|
|
make_token WORKGROUP localuser Secret123 9
|
|
```
|
|
|
|
## Features
|
|
|
|
- Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API
|
|
- The logon_type parameter (default: 9 - NewCredentials) determines the authentication type
|
|
- The impersonation context is automatically tracked and displayed in the Mythic UI
|
|
- Less detectable than `steal_token` as it doesn't require accessing LSASS memory, but may still generate authentication logs
|
|
- Use `rev2self` to revert to the original token
|
|
|
|
## Output
|
|
|
|
```
|
|
[make_token] Creating token for: DOMAIN\User01
|
|
[make_token] Authentication successful
|
|
[make_token] Impersonating user: DOMAIN\User01
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- Authentication events are logged by Windows Event Log
|
|
- Less detectable than token theft, but still generates logs
|
|
- Authentication failures may trigger alerts
|
|
- Use `rev2self` after completing operations to reduce detection risk
|
|
|
|
## Related
|
|
|
|
[Token Support](../../../features.md#token-support), [Context Tracking](../../../features.md#context-tracking)
|
|
|
|
---
|
|
|
|
**Command Category:** Token Operations
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
|