daem0nc0re/privfuKernel mode WinDbg extension and PoCs for token privilege investigation.
Kernel mode WinDbg extension and PoCs for testing how token privileges work.
There are notable repository and articles about token privilege abuse such Grzegorz Tworek's Priv2Admin. Codes in this repository are intended to help investigate how token privileges work.
This project covers how to get system privileges from high integrity level shell. See README.md for details.
The purpose of this project is to investigate how attackers abuse arbitrary kernel write vulnerability. All PoCs are written for HackSys Extreme Vulnerable Driver. Most of these PoCs perform to get SYSTEM integrity level by abusing arbitrary kernel write vulnerability and token privileges. Tested on Windows 10 version 1809/1903, but they should work most of Windows 10 theoretically:
| PoC Name | Description |
|---|---|
| CreateAssignTokenVariant | This PoC performs EoP with SeCreateTokenPrivilege and SeAssignPrimaryTokenPrivilege. |
| CreateImpersonateTokenVariant | This PoC performs EoP with SeCreateTokenPrivilege and SeImpersonatePrivilege. |
| CreateTokenVariant | This PoC performs EoP with SeCreateTokenPrivilege. |
| DebugInjectionVariant | This PoC performs EoP with SeDebugPrivilege. Uses code injection to winlogon.exe at final stage. |
| DebugUpdateProcVariant | This PoC performs EoP with SeDebugPrivilege. Creates SYSTEM process from winlogon.exe with UpdateProcThreadAttribute API at final stage. |
| RestoreServiceModificationVariant | This PoC performs EoP with SeRestorePrivilege. Use HijackShellLib with this PoC. |
| SecondaryLogonVariant | This PoC performs EoP with SeCreateTokenPrivilege and SeImpersonatePrivilege. Uses secondary logon service at final stage. |
| TakeOwnershipServiceModificationVariant | This PoC performs EoP with SeTakeOwnershipPrivilege. Use HijackShellLib with this PoC. |
| TcbS4uAssignTokenVariant | This PoC performs EoP with SeTcbPrivilege. Get System mandatory level shell from medium mandatory level. |
| TcbS4uImpersonationVariant | This PoC performs EoP with SeTcbPrivilege. Performs thread impersonation with S4U logon. Not get high or system integrity level. |
Warning
In some environment, Debug build does not work. Release build is preferred.
PrivEditor is kernel mode WinDbg extension to manipulate token privilege of specific process. This extension makes it easy to configure the token privilege you want to investigate:
0: kd> .load C:\dev\PrivEditor\x64\Release\PrivEditor.dll
PrivEditor - Kernel Mode WinDbg extension for token privilege edit.
Commands :
+ !getps : List processes in target system.
+ !getpriv : List privileges of a process.
+ !addpriv : Add privilege(s) to a process.
+ !rmpriv : Remove privilege(s) from a process.
+ !enablepriv : Enable privilege(s) of a process.
+ !disablepriv : Disable privilege(s) of a process.
+ !enableall : Enable all privileges available to a process.
+ !disableall : Disable all privileges available to a process.
[*] To see command help, execute "!<Command> help" or "!<Command> /?".
This command is to list processes in your target system:
0: kd> !getps /?
!getps - List processes in target system.
Usage : !getps [Process Name]
Process Name : (OPTIONAL) Specifies filter string for process name.
If you execute this command without any arguments, this command list all processes in your target system as follows:
0: kd> !getps
PID nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name
======== =================== ======================== ============
0 0xfffff805`81233630 0x00000000`00000000 Idle
4 0xffffd60f`ec068380 0xffffaf00`cec07a40 System
68 0xffffd60f`f1780480 0xffffaf00`d3b290a0 svchost.exe
88 0xffffd60f`ec0db080 0xffffaf00`cec0d080 Registry
324 0xffffd60f`ef342040 0xffffaf00`d0416080 smss.exe
348 0xffffd60f`f052f100 0xffffaf00`d25d30a0 dwm.exe
408 0xffffd60f`eca8e140 0xffffaf00`d21bd930 csrss.exe
480 0xffffd60f`f05a8340 0xffffaf00`d2568670 svchost.exe
484 0xffffd60f`efcd60c0 0xffffaf00`d06430e0 wininit.exe
500 0xffffd60f`efd130c0 0xffffaf00`d23100a0 csrss.exe
580 0xffffd60f`efdc0080 0xffffaf00`d2266630 winlogon.exe
--snip--
If you want to know specific processes, set string filter as follows. The filter works with forward matching and case insensitive:
0: kd> !getps micro
PID nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name
======== =================== ======================== ============
4568 0xffffd60f`f14ed080 0xffffaf00`d3db60a0 MicrosoftEdge.exe
4884 0xffffd60f`f1647080 0xffffaf00`d3fc17b0 MicrosoftEdgeCP.exe
4892 0xffffd60f`f1685080 0xffffaf00`d3fc07b0 MicrosoftEdgeSH.exe
This command is to list token privileges of a specific process:
0: kd> !getpriv /?
!getpriv - List privileges of a process.
Usage : !getpriv <PID>
PID : Specifies target process ID.
To use this command, you need to set a target process ID in decimal format as follows:
0: kd> !getpriv 5704