Skip to content

3lp4tr0n/SessionHop

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 

Repository files navigation

SessionHop

SessionHop is a C# tool that utilizes the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions. By creating a session moniker and utilizing the COM object's Execute interface, operators can run arbitrary files within another user's session. This session hijacking technique is an alternative to remote process injection or dumping lsass, and may come in handy when operators need to keylog, screenshot, or access LDAP as the affected user. Credits to James Forshaw for content and code: https://googleprojectzero.blogspot.com/2016/01/raising-dead.html

Note: Must be executed from high integrity.

Usage

SessionHop.exe <session_id> <executable>

sessionhop_demo.mp4

About

Windows Session Hijacking via COM

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages