izogain / tokenvator

A tool to elevate privilege with Windows Tokens

Tokenvator

A tool to elevate privilege with Windows Tokens

This tool has two methods of operation - interactive and argument modes

Interactive Mode:
C:> tokenvator.exe
(Tokens) > steal_token 908 cmd.exe
(Tokens) >

Arguments Mode:
C:> tokenvator.exe steal_token 908 cmd.exe
C:>

Methods

• GetSystem

  • Optional Parameters: Process ID, Command
  • Examples:
    (Tokens) > GetSystem
    or
    (Tokens) > GetSystem 504
    or
    (Tokens) > GetSystem 504 regedit.exe
    

• GetTrustedInstaller

  • Optional Parameters: Command
  • Examples:
    (Tokens) > GetTrustedInstaller
    or
    (Tokens) > GetTrustedInstaller regedit.exe
    

• Steal_Token

  • Parameters: Process ID
  • Optional Parameters: Command
  • Examples:
    (Tokens) > StealToken 1008
    or
    (Tokens) > StealToken calc regedit.exe
    or
    (Tokens) > StealToken 1008 regedit.exe
    

• BypassUAC

  • Parameters: Process ID
  • Optional Parameters: Command
  • Examples:
    (Tokens) > BypassUAC 1008
    or
    (Tokens) > BypassUAC regedit.exe
    or
    (Tokens) > BypassUAC 1008 regedit.exe
    

• List_Privileges

  • Parameters: -
  • Optional Parameters: -
  • Examples:
    (Tokens) > List_Privileges
    

• Set_Privileges

  • Parameters: Privilege
  • Optional Parameters: -
  • Examples:
    (Tokens) > Set_Privileges SeSecurityPrivilege
    

• List_Processes

  • Parameters: -
  • Optional Parameters: -
  • Examples:
    (Tokens) > List_Processes
    

• List_Processes_WMI

  • Parameters: -
  • Optional Parameters: -
  • Examples:
    (Tokens) > List_Processes_WMI
    

• Find_User_Processes

  • Parameters: Username
  • Optional Parameters: -
  • Examples:
    (Tokens) > Find_User_Processes domain\user
    

• Find_User_Processes_WMI

  • Parameters: Username
  • Optional Parameters: -
  • Examples:
    (Tokens) > Find_User_Processes_WMI domain\user
    

• List_User_Sessions

  • Parameters: -
  • Optional Parameters: -
  • Examples:
    (Tokens) > List_User_Sessions
    

• WhoAmI

  • Parameters: -
  • Optional Parameters: -
  • Examples:
    (Tokens) > WhoAmI
    

• RevertToSelf

  • Parameters: -
  • Optional Parameters: -
  • Examples:
    (Tokens) > RevertToSelf
    

• Run

  • Parameters: Command
  • Optional Parameters: -
  • Examples:
    (Tokens) > Run cmd.exe
    

Author, Contributors, and License

Author: Alexander Leary (@0xbadjuju), NetSPI - 2018

License: BSD 3-Clause

Required Dependencies: None