rapid7/metasploit-framework — pull request #1229 by shellster (2013-01-03 16:00:18+00:00)
Title: Please review module enhancements for master commit.

I've made several enhancements to the current run_as module.

My version has the following improvements:
-- Allows quoted arguments and commands.
-- Allows chained commands.
-- Allows commands with arguments
-- Allows run as with domain accounts
-- Removes requirement of running module as SYSTEM or Administrator account.

It fixes the following bugs:
-- Due to bugs in the parameters being passed to CreateProcessWithLogonW, the old run_as would always error out unless it was initiated from a process running as SYSTEM.
-- Fixed a bug where an unhandled EOFError was being thrown if CMDOUT was set to "true" but the command issued, never returned any output.

Other changes:
-- Set CMDOUT to default to "true", as there is no downside (other than a mild delay, since my changes [not true with previous version]).
-- Added a minor delay before attempting to read the output file to make sure that Windows has time to relinquish its handles on the file.
-- Removed password reset functionality which was inexplicably included in a module called "run_as", and which was broken if domain credentials are used. (The functionality can obviously either be kept by the Metasploit admins, with minor modification to this code, or a user can issue their own "net user" command through this module).