public static void SetPrivilege(AccessTokenHandle handle, string privilege, bool enabled)
{
var newPrivs = new List <ATPrivilege>();
var attributes = (uint)(enabled ? Constants.SE_PRIVILEGE_ENABLED : Constants.SE_PRIVILEGE_DISABLED);
newPrivs.Add(ATPrivilege.FromValues(privilege, attributes));
AccessTokenPrivileges.AdjustTokenPrivileges(handle, newPrivs);
}
private void ShowPrivileges(AccessTokenHandle hToken)
{
var privileges = AccessTokenPrivileges.FromTokenHandle(hToken);
console.WriteLine("[PRIVILEGES]");
console.WriteLine("");
console.WriteLine(privileges.ToOutputString());
console.WriteLine("");
}
private void InnerEnablePrivileges()
{
foreach (var privName in Enum.GetNames(typeof(PrivilegeConstants)))
{
var privs = new List <ATPrivilege>();
privs.Add(ATPrivilege.CreateEnabled(privName));
try
{
AccessTokenPrivileges.AdjustTokenPrivileges(this.TokenHandle, privs);
}
catch
{
}
}
}
private void InnerElevateProcess(params PrivilegeConstants[] privs)
{
var hToken = AccessTokenHandle.GetCurrentProcessTokenHandle();
var privileges = AccessTokenPrivileges.FromTokenHandle(hToken);
foreach (var priv in privs)
{
if (!privileges.IsPrivilegeEnabled(priv))
{
//Due to current bug, i can only adjust one privilege at a time.
var newPriv = new List <ATPrivilege>();
newPriv.Add(ATPrivilege.CreateEnabled(priv));
AccessTokenPrivileges.AdjustTokenPrivileges(hToken, newPriv);
}
}
}
/// <summary>
/// Retrieves all current thread privileges, and enables the
/// ones that are possible.
/// </summary>
public static void SetAllPrivileges(AccessTokenHandle hToken, bool enabled)
{
foreach (var priv in Enum.GetNames(typeof(PrivilegeConstants)))
{
var attributes = enabled ? Constants.SE_PRIVILEGE_ENABLED : Constants.SE_PRIVILEGE_DISABLED;
var newPriv = new List <ATPrivilege>();
newPriv.Add(ATPrivilege.FromValues(priv, (uint)attributes));
try
{
AccessTokenPrivileges.AdjustTokenPrivileges(hToken, newPriv);
}
catch
{
continue;
}
}
}
public AccessTokenInformation(AccessTokenHandle handle)
{
try
{
this._groups = AccessTokenGroups.FromTokenHandle(handle);
}
catch { }
try
{
this._logonSid = AccessTokenLogonSid.FromTokenHandle(handle);
}
catch { }
try
{
this._owner = AccessTokenOwner.FromTokenHandle(handle);
}
catch { }
try
{
this._primaryGroup = AccessTokenPrimaryGroup.FromTokenHandle(handle);
}
catch { }
try
{
this._primaryGroup = AccessTokenPrimaryGroup.FromTokenHandle(handle);
}
catch { }
try
{
this._privileges = AccessTokenPrivileges.FromTokenHandle(handle);
}
catch { }
try
{
this._sessionId = AccessTokenSessionId.FromTokenHandle(handle);
}
catch { }
try
{
this._user = AccessTokenUser.FromTokenHandle(handle);
}
catch { }
}
private static string GetAccessTokenInfo(AccessTokenHandle hToken)
{
StringBuilder info = new StringBuilder();
var user = AccessTokenUser.FromTokenHandle(hToken);
var groups = AccessTokenGroups.FromTokenHandle(hToken);
var privileges = AccessTokenPrivileges.FromTokenHandle(hToken);
info.Append("[USERNAME]\n");
info.Append("\n");
info.Append($"{user.Domain}\\{user.Username}\n");
info.Append("\n");
info.Append("[GROUPS]");
info.Append("\n");
foreach (var group in groups.GetGroupEnumerator())
{
info.Append($"{group.Domain}\\{group.Name}\n");
}
info.Append("\n");
info.Append("[PRIVILEGES]");
info.Append("\n");
info.Append(privileges.ToOutputString());
info.Append("\n");
return(info.ToString());
}
public void Execute()
{
if (options.ListTokens)
{
var processes = TMProcess.GetAllProcesses();
this.InnerPrintProcesses(processes);
}
if (this.options.Privilege != null)
{
var processes = TMProcess.GetAllProcesses();
var found = new List <TMProcess>();
foreach (var proc in processes)
{
try
{
var hProc = TMProcessHandle.FromProcess(proc, ProcessAccessFlags.QueryInformation);
var hToken = AccessTokenHandle.FromProcessHandle(hProc, TokenAccess.TOKEN_QUERY);
var privileges = AccessTokenPrivileges.FromTokenHandle(hToken);
foreach (var priv in privileges.GetPrivileges())
{
if (priv.Name.ToLower().Contains(this.options.Privilege.ToLower()))
{
if (this.options.Disabled)
{
if (priv.IsDisabled())
{
found.Add(proc);
}
}
else
{
if (priv.IsEnabled())
{
found.Add(proc);
}
}
}
}
}
catch (Exception e)
{
console.Error("Failed to retrieve privilege information: " + e.Message);
}
}
this.InnerPrintProcesses(found);
}
if (this.options.Term != null && this.options.Term != "")
{
var processes = TMProcess.GetProcessByName(this.options.Term);
this.InnerPrintProcesses(processes);
}
if (this.options.User != null && this.options.User != "")
{
var processes = TMProcess.GetAllProcesses();
var found = new List <TMProcess>();
foreach (var proc in processes)
{
try
{
var hProc = TMProcessHandle.FromProcess(proc, ProcessAccessFlags.QueryInformation);
var hToken = AccessTokenHandle.FromProcessHandle(hProc, TokenAccess.TOKEN_QUERY);
var user = AccessTokenUser.FromTokenHandle(hToken);
if (user.Username.ToLower().Contains(this.options.User.ToLower()))
{
found.Add(proc);
}
}
catch
{
}
}
this.InnerPrintProcesses(found);
}
}