Red-Team Demo Shows Windows Session Hopping to Run Code as Another User

Summary

A lab demonstration uses SessionHub with admin access to launch a Sliver beacon in another Windows user session, then examines the tool’s code, which the presenter says uses a Windows Help COM interface.

Key points

• The demonstration requires administrator access and another active user session on the same system.
• The presenter uses Q user and a custom Windows API tool called Session View to identify active session IDs.
• SessionHub takes a session ID and executable path, then launches the executable in the selected user's session.
• In the lab, the presenter uses SessionHub to run a Sliver beacon in another user's session, demonstrating same-system movement between users.
• The presenter’s code review, supplemented by an AI explanation, identifies a Windows Help COM interface as the mechanism for executing the program in the target session.