slyd0g / primarytokentheft

Steal a primary token and spawn cmd.exe using the stolen token

PrimaryTokenTheft

Main code taken from @kondecuotas blog.

Steal a primary token and spawn cmd.exe using the stolen token.

• Added the ability to pass a PID by command-line argument.
• Automatically enable SeDebugPrivilege.
• Reduced privileges needed for OpenProcess(), OpenProcessToken() and DuplicateTokenEx() from TOKEN_ALL_ACCESS/PROCESS_ALL_ACCESS to the bare minimum needed for each API call.
• Will also use ImpersonatedLoggedOnUser() to impersonate the logged-on user in the current thread.

Blogpost

• https://posts.specterops.io/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe-80696c8a73b

Elevating to SYSTEM

Credit

Main blog and source code: https://ired.team/offensive-security/privilege-escalation/t1134-access-token-manipulation

Elevating to system with Winlogon: https://twitter.com/monoxgas/status/1109892490566336512?s=20

Figured out minimum privileges to call DuplicateTokenEx() with for CreateProcessWithTokenW to work here: https://stackoverflow.com/questions/5447418/why-is-createprocesswithtokenw-failing-with-error-access-denied (MSDN docs are wrong)

MSDN Enabling Privileges: https://docs.microsoft.com/en-us/windows/win32/secauthz/enabling-and-disabling-privileges-in-c--

primarytokentheft's Issues

warning: NULL used in arithmetic

Please change GetLastError() == NULL to GetLastError() == 0

main.cpp: In function 'int main(int, char**)':
main.cpp:92:24: warning: NULL used in arithmetic [-Wpointer-arith]
   92 |  if (GetLastError() == NULL)
      |                        ^~~~
main.cpp:102:24: warning: NULL used in arithmetic [-Wpointer-arith]
  102 |  if (GetLastError() == NULL)
      |                        ^~~~
main.cpp:112:24: warning: NULL used in arithmetic [-Wpointer-arith]
  112 |  if (GetLastError() == NULL)
      |                        ^~~~
main.cpp:127:24: warning: NULL used in arithmetic [-Wpointer-arith]
  127 |  if (GetLastError() == NULL)
      |                        ^~~~
main.cpp:137:24: warning: NULL used in arithmetic [-Wpointer-arith]
  137 |  if (GetLastError() == NULL)
      |                        ^~~~

Windows XP

Hello
this code don't work in Windows XP. Why? I cannot open process token or duplicate it.

compile issue

hello, I'm trying to compile the code you shared with VS2017 but keep asking me the path for pch.h how you did it ?