public static extern bool DuplicateTokenEx(
SafeNativeHandle hExistingToken,
TokenAccessLevels dwDesiredAccess,
IntPtr lpTokenAttributes,
SecurityImpersonationLevel ImpersonationLevel,
TokenType TokenType,
out SafeNativeHandle phNewToken);
private extern static bool DuplicateTokenEx(
IntPtr hExistingToken,
TokenAcess desiredAccess,
IntPtr tokenAttributes,
SecurityImpersonationLevel impersonationLevel,
TokenType tokenType,
out IntPtr hNewToken);
bool DuplicateTokenEx(
[In] IntPtr ExistingToken,
[In] TokenAccessLevels DesiredAccess,
[In] IntPtr TokenAttributes,
[In] SecurityImpersonationLevel ImpersonationLevel,
[In] TokenType TokenType,
[In, Out] ref IntPtr NewToken);
DuplicateTokenEx(
[In] SafeCloseHandle ExistingToken,
[In] TokenAccessLevels DesiredAccess,
[In] IntPtr TokenAttributes,
[In] SecurityImpersonationLevel ImpersonationLevel,
[In] TokenType TokenType,
[Out] out SafeCloseHandle NewToken);
internal static extern bool DuplicateTokenEx(
IntPtr hExistingToken,
uint dwDesiredAccess,
ref SecutiryAttributes lpTokenAttributes,
SecurityImpersonationLevel ImpersonationLevel,
TokenType TokenType,
out IntPtr phNewToken);
public static extern bool DuplicateTokenEx(
IntPtr hExistingToken,
TokenAccess dwDesiredAccess,
SecurityAttributes lpThreadAttributes,
SecurityImpersonationLevel impersonationLevel,
TokenType dwTokenType,
out IntPtr phNewToken);
internal static extern bool DuplicateTokenEx(
SafeTokenHandle existingTokenHandle,
TokenAccessLevels desiredAccess,
IntPtr tokenAttributes,
SecurityImpersonationLevel impersonationLevel,
TokenType tokenType,
ref SafeTokenHandle duplicateTokenHandle);
public extern static bool DuplicateTokenEx(
IntPtr hExistingToken,
uint dwDesiredAccess,
ref SECURITY_ATTRIBUTES lpTokenAttributes,
SecurityImpersonationLevel ImpersonationLevel,
TokenType TokenType,
out IntPtr phNewToken);
public SafeTokenHandle OpenTokenAsImpersonation(SecurityImpersonationLevel imp_level)
{
using (SafeTokenHandle token = OpenToken())
{
return(token.DuplicateImpersonation(imp_level));
}
}
public static extern bool DuplicateTokenEx(
SafeFileHandle hExistingToken,
uint dwDesiredAccess,
SecurityAttributes lpTokenAttributes,
SecurityImpersonationLevel impersonationLevel,
TokenType tokenType,
out IntPtr hNewToken);
internal static extern bool DuplicateTokenEx(
[In] SafeCloseHandle existingToken,
[In] TokenAccessLevels desiredAccess,
[In] IntPtr tokenAttributes,
[In] SecurityImpersonationLevel impersonationLevel,
[In] TokenType tokenType,
out SafeCloseHandle newToken);
public static extern bool DuplicateTokenEx(
SafeFileHandle hExistingToken,
uint dwDesiredAccess,
SecurityAttributes lpTokenAttributes,
SecurityImpersonationLevel impersonationLevel,
TokenType tokenType,
out IntPtr hNewToken);
internal static extern bool DuplicateTokenEx(
/* _In_ HANDLE */ [In] SafeTokenHandle existingToken,
/* _In_ DWORD */ [In] TokenAccessRight desiredAccess,
/* _In_opt_ LPSECURITY_ATTRIBUTES */ [In][Out] ref SecurityAttributes threadAttributes,
/* _In_ SECURITY_IMPERSONATION_LEVEL */ [In] SecurityImpersonationLevel impersonationLevel,
/* _In_ TOKEN_TYPE */ [In] TokenType tokenType,
/* _Outptr_ PHANDLE */ [Out] out SafeTokenHandle newToken
);
public static extern bool DuplicateTokenEx(
SafeTokenHandle ExistingTokenHandle,
int DesiredAccess,
IntPtr lpTokenAttributes,
SecurityImpersonationLevel ImpersonationLevel,
TokenType TokenType,
out SafeTokenHandle DuplicateTokenHandle
);
public SecurityQualityOfService(SecurityImpersonationLevel imp_level,
SecurityContextTrackingMode tracking_mode,
bool effective_only) : this()
{
_imp_level = imp_level;
_tracking_mode = tracking_mode;
_effective_only = effective_only;
}
public SecurityQualityOfServiceStruct(SecurityImpersonationLevel impersonation_level,
SecurityContextTrackingMode context_tracking_mode, bool effective_only)
{
Length = Marshal.SizeOf(typeof(SecurityQualityOfServiceStruct));
ImpersonationLevel = impersonation_level;
ContextTrackingMode = context_tracking_mode;
EffectiveOnly = effective_only;
}
public TokenHandle DuplicateTokenEx(TokenAccessRights desiredAccess, SecurityImpersonationLevel impersonationLevel, TokenType tokenType)
{
TokenHandle newHandle;
if (!NativeMethods.DuplicateTokenEx(this, desiredAccess, null, impersonationLevel, tokenType, out newHandle))
{
ErrorHelper.ThrowCustomWin32Exception();
}
return newHandle;
}
/// <summary>
/// Causes the thread to impersonate a client thread.
/// </summary>
/// <param name="clientThreadHandle">A handle to a client thread.</param>
/// <param name="impersonationLevel">The impersonation level to request.</param>
public void Impersonate(ThreadHandle clientThreadHandle, SecurityImpersonationLevel impersonationLevel)
{
SecurityQualityOfService securityQos = new SecurityQualityOfService(impersonationLevel, false, false);
Win32.NtImpersonateThread(
this,
clientThreadHandle,
ref securityQos
).ThrowIf();
}
public SafeTokenHandle DuplicateImpersonation(SecurityImpersonationLevel imp_level)
{
SafeTokenHandle token;
if (!DuplicateTokenEx(this, 0x02000000, IntPtr.Zero, imp_level, TokenType.TokenImpersonation, out token))
{
throw new Win32Exception();
}
return(token);
}
public static TokenHandle OpenSystemToken(TokenAccess access, SecurityImpersonationLevel impersonationLevel, TokenType type)
{
using (var phandle = new ProcessHandle(4, OSVersion.MinProcessQueryInfoAccess))
{
using (var thandle = phandle.GetToken(TokenAccess.Duplicate | access))
{
return(thandle.Duplicate(access, impersonationLevel, type));
}
}
}
public TokenHandle DuplicateTokenEx(TokenAccessRights desiredAccess, SecurityImpersonationLevel impersonationLevel, TokenType tokenType)
{
TokenHandle newHandle;
if (!NativeMethods.DuplicateTokenEx(this, desiredAccess, null, impersonationLevel, tokenType, out newHandle))
{
ErrorHelper.ThrowCustomWin32Exception();
}
return(newHandle);
}
/// <summary>
/// Causes the thread to impersonate a client thread.
/// </summary>
/// <param name="clientThreadHandle">A handle to a client thread.</param>
/// <param name="impersonationLevel">The impersonation level to request.</param>
public void Impersonate(ThreadHandle clientThreadHandle, SecurityImpersonationLevel impersonationLevel)
{
NtStatus status;
SecurityQualityOfService securityQos =
new SecurityQualityOfService(impersonationLevel, false, false);
if ((status = Win32.NtImpersonateThread(this, clientThreadHandle, ref securityQos)) >= NtStatus.Error)
{
Win32.Throw(status);
}
}
public static SafeNativeHandle DuplicateToken(SafeNativeHandle hToken, TokenAccessLevels access,
SecurityImpersonationLevel impersonationLevel, TokenType tokenType)
{
SafeNativeHandle dupToken;
if (!NativeMethods.DuplicateTokenEx(hToken, access, IntPtr.Zero, impersonationLevel, tokenType, out dupToken))
{
throw new Win32Exception("Failed to duplicate token");
}
return(dupToken);
}
/// <summary>
/// Duplicates the token.
/// </summary>
/// <param name="access">The desired access to the new token.</param>
/// <param name="impersonationLevel">The new impersonation level.</param>
/// <param name="type">The new token type.</param>
/// <returns>A new token.</returns>
public TokenHandle Duplicate(TokenAccess access, SecurityImpersonationLevel impersonationLevel, TokenType type)
{
IntPtr token;
if (!Win32.DuplicateTokenEx(this, access, IntPtr.Zero, impersonationLevel, type, out token))
{
Win32.Throw();
}
return(new TokenHandle(token, true));
}
internal TokenStatistics(IntPtr ptr)
{
TOKEN_STATISTICS ts = (TOKEN_STATISTICS)Marshal.PtrToStructure(ptr, typeof(TOKEN_STATISTICS));
_tokenId = new Luid(ts.TokenId);
_authenticationId = new Luid(ts.AuthenticationId);
_expirationTime = new DateTime(ts.ExpirationTime);
_tokenType = ts.TokenType;
_impersonationLevel = ts.ImpersonationLevel;
_dynamicCharged = ts.DynamicCharged;
_dynamicAvailable = ts.DynamicAvailable;
_groupCount = ts.GroupCount;
_privilegeCount = ts.PrivilegeCount;
_modifiedId = new Luid(ts.ModifiedId);
}
internal TokenStatistics(IntPtr ptr)
{
TOKEN_STATISTICS ts = (TOKEN_STATISTICS)Marshal.PtrToStructure(ptr, typeof(TOKEN_STATISTICS));
_tokenId = new Luid(ts.TokenId);
_authenticationId = new Luid(ts.AuthenticationId);
_expirationTime = new DateTime(ts.ExpirationTime);
_tokenType = ts.TokenType;
_impersonationLevel = ts.ImpersonationLevel;
_dynamicCharged = ts.DynamicCharged;
_dynamicAvailable = ts.DynamicAvailable;
_groupCount = ts.GroupCount;
_privilegeCount = ts.PrivilegeCount;
_modifiedId = new Luid(ts.ModifiedId);
}
private void btnImpersonate_Click(object sender, EventArgs e)
{
SecurityImpersonationLevel implevel = SecurityImpersonationLevel.Impersonation;
try
{
if (_token.TokenType == TokenType.Impersonation)
{
implevel = _token.ImpersonationLevel;
}
using (NtToken token = _token.DuplicateToken(TokenType.Impersonation, implevel, TokenAccessRights.MaximumAllowed))
{
TokenIntegrityLevel il = GetILFromComboBox(comboBoxILForDup);
if (il != token.IntegrityLevel)
{
token.SetIntegrityLevel(il);
}
NtToken imptoken = null;
using (var imp = token.Impersonate())
{
imptoken = NtThread.Current.OpenToken();
}
if (imptoken != null)
{
OpenForm(imptoken, "Impersonation", false);
}
else
{
MessageBox.Show(this, "Couldn't open thread token", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
}
}
catch (Exception ex)
{
MessageBox.Show(this, ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
}
private void UpdateTokenData()
{
UserGroup user = _token.User;
txtUsername.Text = user.ToString();
txtUserSid.Text = user.Sid.ToString();
TokenType tokentype = _token.TokenType;
txtTokenType.Text = _token.TokenType.ToString();
if (_token.TokenType == TokenType.Impersonation)
{
SecurityImpersonationLevel implevel = _token.ImpersonationLevel;
txtImpLevel.Text = implevel.ToString();
}
else
{
txtImpLevel.Text = "N/A";
}
txtTokenId.Text = _token.Id.ToString();
txtModifiedId.Text = _token.ModifiedId.ToString();
txtAuthId.Text = _token.AuthenticationId.ToString();
if (Enum.IsDefined(typeof(TokenIntegrityLevel), _token.IntegrityLevel))
{
comboBoxIL.SelectedItem = _token.IntegrityLevel;
comboBoxILForDup.SelectedItem = _token.IntegrityLevel;
}
else
{
comboBoxIL.Text = _token.IntegrityLevel.ToString();
comboBoxILForDup.Text = _token.IntegrityLevel.ToString();
}
txtSessionId.Text = _token.SessionId.ToString();
if (_token.IsAccessGranted(TokenAccessRights.QuerySource))
{
txtSourceName.Text = _token.Source.SourceName;
txtSourceId.Text = _token.Source.SourceIdentifier.ToString();
}
else
{
txtSourceName.Text = "N/A";
txtSourceId.Text = "N/A";
}
TokenElevationType evtype = _token.ElevationType;
txtElevationType.Text = evtype.ToString();
txtIsElevated.Text = _token.Elevated.ToString();
txtOriginLoginId.Text = _token.Origin.ToString();
btnLinkedToken.Enabled = evtype != TokenElevationType.Default;
UpdateGroupList();
txtPrimaryGroup.Text = _token.PrimaryGroup.Name;
txtOwner.Text = _token.Owner.Name;
Acl defdacl = _token.DefaultDacl;
if (!defdacl.NullAcl)
{
foreach (Ace ace in defdacl)
{
UserGroup group = new UserGroup(ace.Sid, GroupAttributes.None);
ListViewItem item = new ListViewItem(group.ToString());
AccessMask mask = GenericAccessRights.GenericAll | GenericAccessRights.GenericExecute | GenericAccessRights.GenericRead | GenericAccessRights.GenericWrite;
string maskstr;
if ((ace.Mask & ~mask).HasAccess)
{
maskstr = $"0x{ace.Mask:X08}";
}
else
{
maskstr = ace.Mask.ToGenericAccess().ToString();
}
item.SubItems.Add(maskstr);
item.SubItems.Add(ace.Flags.ToString());
item.SubItems.Add(ace.Type.ToString());
listViewDefDacl.Items.Add(item);
}
}
else
{
listViewDefDacl.Items.Add("No Default DACL");
}
listViewDefDacl.AutoResizeColumns(ColumnHeaderAutoResizeStyle.ColumnContent);
listViewDefDacl.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize);
if (_token.Restricted)
{
PopulateGroupList(listViewRestrictedSids, _token.RestrictedSids);
}
else
{
tabControlMain.TabPages.Remove(tabPageRestricted);
}
if (_token.AppContainer)
{
PopulateGroupList(listViewCapabilities, _token.Capabilities);
txtACNumber.Text = _token.AppContainerNumber.ToString();
txtPackageName.Text = _token.AppContainerSid.Name;
txtPackageSid.Text = _token.AppContainerSid.ToString();
}
else
{
tabControlMain.TabPages.Remove(tabPageAppContainer);
}
txtUIAccess.Text = _token.UIAccess.ToString();
txtSandboxInert.Text = _token.SandboxInert.ToString();
bool virtAllowed = _token.VirtualizationAllowed;
txtVirtualizationAllowed.Text = virtAllowed.ToString();
btnToggleVirtualizationEnabled.Enabled = virtAllowed;
if (virtAllowed)
{
txtVirtualizationEnabled.Text = _token.VirtualizationEnabled.ToString();
}
else
{
txtVirtualizationEnabled.Text = "N/A";
}
txtMandatoryILPolicy.Text = _token.MandatoryPolicy.ToString();
txtHandleAccess.Text = _token.GrantedAccess.ToString();
Sid trust_level = _token.TrustLevel;
txtTrustLevel.Text = trust_level != null ? trust_level.Name : "N/A";
UpdatePrivileges();
UpdateSecurityAttributes();
if (_token.IsAccessGranted(TokenAccessRights.ReadControl))
{
securityDescriptorViewerControl.SetSecurityDescriptor(_token.SecurityDescriptor, _token.NtType, _token.NtType.ValidAccess);
}
else
{
tabControlMain.TabPages.Remove(tabPageSecurity);
}
}
public IToken DuplicateTokenEx(TokenAccessRights desiredAccess, SecurityImpersonationLevel impersonationLevel, TokenType tokenType)
{
var handle = _handle.DuplicateTokenEx(desiredAccess, impersonationLevel, tokenType);
return new Token(handle);
}
private WindowsIdentity CreateWindowsIdentity(string username, string domain, string password, SecurityLogOnType logonType, LogOnProviderType logonProviderType, SecurityImpersonationLevel impersonationLevel)
{
// initialize tokens
var existingTokenHandle = IntPtr.Zero;
var duplicateTokenHandle = IntPtr.Zero;
if (!NativeMethods.LogonUser(
username,
domain,
password,
(int)logonType,
(int)logonProviderType,
out existingTokenHandle))
{
throw Marshal.GetExceptionForHR(Marshal.GetHRForLastWin32Error());
}
if (!NativeMethods.DuplicateToken(existingTokenHandle, (int)impersonationLevel, out duplicateTokenHandle))
{
NativeMethods.CloseHandle(existingTokenHandle);
throw Marshal.GetExceptionForHR(Marshal.GetHRForLastWin32Error());
}
// create new identity using new primary token
return(new WindowsIdentity(duplicateTokenHandle));
}
/// <summary>
/// Constructor.
/// </summary>
public TestNtTokenImpersonation()
{
ImpersonationLevel = SecurityImpersonationLevel.Impersonation;
}
/// <summary>
/// Impersonate another thread.
/// </summary>
/// <param name="thread">The thread to impersonate.</param>
/// <param name="impersonation_level">The impersonation level</param>
/// <returns>The imperonsation context. Dispose to revert to self.</returns>
public ThreadImpersonationContext ImpersonateThread(NtThread thread, SecurityImpersonationLevel impersonation_level)
{
NtSystemCalls.NtImpersonateThread(Handle, thread.Handle,
new SecurityQualityOfService(impersonation_level, SecurityContextTrackingMode.Static, false)).ToNtException();
return(new ThreadImpersonationContext(Duplicate()));
}
/// <summary>
/// Constructor.
/// </summary>
public GetNtTokenCmdlet()
{
Access = TokenAccessRights.MaximumAllowed;
TokenType = TokenType.Impersonation;
ImpersonationLevel = SecurityImpersonationLevel.Impersonation;
}
public extern static bool DuplicateToken( SafeTokenHandle existingTokenHandle, SecurityImpersonationLevel impersonationLevel, out SafeTokenHandle duplicateTokenHandle );
internal static extern Boolean DuplicateTokenEx(SafeTokenHandle ExistingToken,
TokenAccessLevels DesiredAccess, IntPtr TokenAttributes,
SecurityImpersonationLevel ImpersonationLevel, TokenType TokenType,
[In, Out] ref SafeTokenHandle NewToken);
public static extern bool DuplicateTokenEx(
IntPtr hExistingToken,
TokenAccess dwDesiredAccess,
SecurityAttributes lpThreadAttributes,
SecurityImpersonationLevel impersonationLevel,
TokenType dwTokenType,
out IntPtr phNewToken);
public extern static bool DuplicateToken(IntPtr existingTokenHandle, SecurityImpersonationLevel impersonationLevel, ref IntPtr duplicateTokenHandle);
public static extern int RtlImpersonateSelf([In] SecurityImpersonationLevel securityImpersonationLevel, [In] uint accessMask, [Out] out IntPtr threadToken);
private static extern int DuplicateTokenEx(IntPtr token, int desiredAccess, IntPtr tokenAttributes,
SecurityImpersonationLevel impersonationLevel, TokenType tokenType,
out IntPtr newToken);
public static extern bool DuplicateTokenEx(TokenHandle handle, TokenAccessRights desiredAccess, SecurityAttributes securityAttributes, SecurityImpersonationLevel impersonationLevel, TokenType tokenType, out TokenHandle newToken);
private WindowsIdentity CreateWindowsIdentity(string username, string domain, string password, SecurityLogOnType logonType, LogOnProviderType logonProviderType, SecurityImpersonationLevel impersonationLevel)
{
// initialize tokens
var existingTokenHandle = IntPtr.Zero;
var duplicateTokenHandle = IntPtr.Zero;
if (!NativeMethods.LogonUser(
username,
domain,
password,
(int)logonType,
(int)logonProviderType,
out existingTokenHandle))
{
throw Marshal.GetExceptionForHR(Marshal.GetHRForLastWin32Error());
}
if (!NativeMethods.DuplicateToken(existingTokenHandle, (int)impersonationLevel, out duplicateTokenHandle))
{
NativeMethods.CloseHandle(existingTokenHandle);
throw Marshal.GetExceptionForHR(Marshal.GetHRForLastWin32Error());
}
// create new identity using new primary token
return new WindowsIdentity(duplicateTokenHandle);
}
public extern static bool DuplicateToken(IntPtr existingTokenHandle, SecurityImpersonationLevel impersonationLevel, ref IntPtr duplicateTokenHandle);
internal static extern bool DuplicateToken(
IntPtr existingTokenHandle,
SecurityImpersonationLevel securityImpersonationLevel,
out IntPtr duplicateTokenHandle);
public static extern bool DuplicateToken(SafeTokenHandle ExistingTokenHandle, SecurityImpersonationLevel ImpersonationLevel,
out SafeTokenHandle DuplicateTokenHandle);
