Windows impersonate user session creation process

In infiltration, this problem is often encountered. A machine, several users on a machine, or a domain that wants to have a session of a machine execute the program you want to execute, or a Chinese horse, to go online with the current session.

Now simulate one of the following conditions:

Strict Dmz, intranet-->DMZ, and dmz->x<-intranet.

While there are several sessions on the server in the DMZ, we can create the process by impersonating the user login to see if there are some connections to other session users on the DMZ server for further analysis.

The environment tests are as follows: Windows 2008 64-bit, 2 sessions on the machine. Webshell has been acquired.

A User: Administrator (Webshell permissions)

B User: SQLDebug

Regardless of whether the password is caught or not, all we have to do now is simulate the sqldebug session to create a process to see if the user has done something else.

If you want the code, you can leave mail. We make progress together.

Tested Windows 2008,windows 10,windows 2012. Other not tested.

Windows impersonate user session creation process