////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
public static void EnumerateTokenPrivileges(IntPtr hToken)
{
////////////////////////////////////////////////////////////////////////////////
UInt32 TokenInfLength = 0;
Console.WriteLine("[*] Enumerating Token Privileges");
Unmanaged.GetTokenInformation(
hToken,
Enums._TOKEN_INFORMATION_CLASS.TokenPrivileges,
IntPtr.Zero,
TokenInfLength,
out TokenInfLength
);
if (TokenInfLength < 0 || TokenInfLength > Int32.MaxValue)
{
GetError("GetTokenInformation - 1 " + TokenInfLength);
return;
}
Console.WriteLine(" [*] GetTokenInformation - Pass 1");
IntPtr lpTokenInformation = Marshal.AllocHGlobal((Int32)TokenInfLength);
////////////////////////////////////////////////////////////////////////////////
if (!Unmanaged.GetTokenInformation(
hToken,
Enums._TOKEN_INFORMATION_CLASS.TokenPrivileges,
lpTokenInformation,
TokenInfLength,
out TokenInfLength))
{
GetError("GetTokenInformation - 2" + TokenInfLength);
return;
}
Console.WriteLine(" [*] GetTokenInformation - Pass 2");
Structs._TOKEN_PRIVILEGES_ARRAY tokenPrivileges = (Structs._TOKEN_PRIVILEGES_ARRAY)Marshal.PtrToStructure(lpTokenInformation, typeof(Structs._TOKEN_PRIVILEGES_ARRAY));
Console.WriteLine(" [+] Enumerated " + tokenPrivileges.PrivilegeCount + " Privileges");
////////////////////////////////////////////////////////////////////////////////
for (Int32 i = 0; i < tokenPrivileges.PrivilegeCount; i++)
{
StringBuilder lpName = new StringBuilder();
Int32 cchName = 0;
IntPtr lpLuid = Marshal.AllocHGlobal(Marshal.SizeOf(tokenPrivileges.Privileges[i]));
Marshal.StructureToPtr(tokenPrivileges.Privileges[i].Luid, lpLuid, true);
Unmanaged.LookupPrivilegeName(null, lpLuid, null, ref cchName);
if (cchName < 0 || cchName > Int32.MaxValue)
{
GetError("LookupPrivilegeName " + cchName);
return;
}
lpName.EnsureCapacity(cchName + 1);
if (Unmanaged.LookupPrivilegeName(null, lpLuid, lpName, ref cchName))
{
Console.WriteLine(" [*] " + lpName.ToString());
}
Marshal.FreeHGlobal(lpLuid);
}
}