////////////////////////////////////////////////////////////////////////////////
// Enables, Disables, or Removes a privilege from a Token
////////////////////////////////////////////////////////////////////////////////
private static void _AlterPrivilege(CommandLineParsing cLP, IntPtr hToken, Winnt.TokenPrivileges attribute)
{
using (TokenManipulation t = new TokenManipulation(hToken))
{
if (cLP.Remote && !cLP.Impersonation && t.OpenProcessToken(cLP.ProcessID))
{
t.SetWorkingTokenToRemote();
}
else if (cLP.Remote && cLP.Impersonation)
{
t.ListThreads(cLP.ProcessID);
t.SetThreadTokenPrivilege(cLP.Privilege, attribute);
}
else if (!cLP.Remote && cLP.Impersonation)
{
t.ListThreads(Process.GetCurrentProcess().Id);
t.SetThreadTokenPrivilege(cLP.Privilege, attribute);
}
else
{
t.SetWorkingTokenToSelf();
}
t.SetTokenPrivilege(cLP.Privilege, attribute);
}
}
////////////////////////////////////////////////////////////////////////////////
//
////////////////////////////////////////////////////////////////////////////////
public void SetThreadTokenPrivilege(string privilege, Winnt.TokenPrivileges attribute)
{
foreach (uint t in threads)
{
Console.WriteLine("[*] Thread ID: " + t);
if (OpenThreadToken(t, Winnt.TOKEN_ALL_ACCESS))
{
SetWorkingTokenToThreadToken();
SetTokenPrivilege(privilege, attribute);
}
}
}
////////////////////////////////////////////////////////////////////////////////
// Sets a Token to have a specified privilege
// http://www.leeholmes.com/blog/2010/09/24/adjusting-token-privileges-in-powershell/
// https://support.microsoft.com/en-us/help/131065/how-to-obtain-a-handle-to-any-process-with-sedebugprivilege
////////////////////////////////////////////////////////////////////////////////
public static void SetTokenPrivilege(ref IntPtr hToken, String privilege, Winnt.TokenPrivileges attribute)
{
if (!validPrivileges.Contains(privilege))
{
Console.WriteLine("[-] Invalid Privilege Specified");
return;
}
Console.WriteLine("[*] Adjusting Token Privilege");
////////////////////////////////////////////////////////////////////////////////
Winnt._LUID luid = new Winnt._LUID();
if (!advapi32.LookupPrivilegeValue(null, privilege, ref luid))
{
GetWin32Error("LookupPrivilegeValue");
return;
}
Console.WriteLine(" [+] Recieved luid");
////////////////////////////////////////////////////////////////////////////////
Winnt._LUID_AND_ATTRIBUTES luidAndAttributes = new Winnt._LUID_AND_ATTRIBUTES
{
Luid = luid,
Attributes = (uint)attribute
};
Winnt._TOKEN_PRIVILEGES newState = new Winnt._TOKEN_PRIVILEGES
{
PrivilegeCount = 1,
Privileges = luidAndAttributes
};
Winnt._TOKEN_PRIVILEGES previousState = new Winnt._TOKEN_PRIVILEGES();
Console.WriteLine(" [*] AdjustTokenPrivilege");
UInt32 returnLength = 0;
if (!advapi32.AdjustTokenPrivileges(hToken, false, ref newState, (UInt32)Marshal.SizeOf(newState), ref previousState, out returnLength))
{
GetWin32Error("AdjustTokenPrivileges");
return;
}
Console.WriteLine(" [+] Adjusted Privilege: {0}", privilege);
Console.WriteLine(" [+] Privilege State: {0}", attribute);
return;
}
////////////////////////////////////////////////////////////////////////////////
// Sets a Token to have a specified privilege
// http://www.leeholmes.com/blog/2010/09/24/adjusting-token-privileges-in-powershell/
// https://support.microsoft.com/en-us/help/131065/how-to-obtain-a-handle-to-any-process-with-sedebugprivilege
////////////////////////////////////////////////////////////////////////////////
public bool SetTokenPrivilege(string privilege, Winnt.TokenPrivileges attribute)
{
Console.WriteLine("[*] Adjusting Token Privilege {0} => {1}", privilege, attribute);
////////////////////////////////////////////////////////////////////////////////
Winnt._LUID luid = new Winnt._LUID();
if (!advapi32.LookupPrivilegeValue(null, privilege, ref luid))
{
Misc.GetWin32Error("LookupPrivilegeValue");
return(false);
}
Console.WriteLine(" [+] Recieved luid");
////////////////////////////////////////////////////////////////////////////////
Winnt._LUID_AND_ATTRIBUTES luidAndAttributes = new Winnt._LUID_AND_ATTRIBUTES
{
Luid = luid,
Attributes = (uint)attribute
};
Winnt._TOKEN_PRIVILEGES newState = new Winnt._TOKEN_PRIVILEGES
{
PrivilegeCount = 1,
Privileges = luidAndAttributes
};
Winnt._TOKEN_PRIVILEGES previousState = new Winnt._TOKEN_PRIVILEGES();
Console.WriteLine(" [*] AdjustTokenPrivilege");
uint returnLength;
if (!advapi32.AdjustTokenPrivileges(hWorkingToken, false, ref newState, (uint)Marshal.SizeOf(newState), ref previousState, out returnLength))
{
Misc.GetWin32Error("AdjustTokenPrivileges");
return(false);
}
Console.WriteLine(" [+] Adjusted Privilege: {0}", privilege);
Console.WriteLine(" [+] Privilege State: {0}", attribute);
return(true);
}