Created
September 14, 2019 12:43
-
-
Save matterpreter/8c87af2d45bb82905cf77f98e50ca67a to your computer and use it in GitHub Desktop.
Grant the current process token the specified privilege
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Runtime.InteropServices; | |
public static void SetTokenPrivilege(ref IntPtr hToken, string privName) | |
{ | |
Console.WriteLine("[*] Adding {0} to token", privName); | |
LUID luid = new LUID(); | |
if (!LookupPrivilegeValue(null, privName, ref luid)) | |
{ | |
Console.WriteLine("[-] LookupPrivilegeValue failed!"); | |
return; | |
} | |
Console.WriteLine("[+] Received LUID"); | |
LUID_AND_ATTRIBUTES luidAndAttributes = new LUID_AND_ATTRIBUTES(); | |
luidAndAttributes.Luid = luid; | |
luidAndAttributes.Attributes = SE_PRIVILEGE_ENABLED; | |
TOKEN_PRIVILEGES newState = new TOKEN_PRIVILEGES(); | |
newState.PrivilegeCount = 1; | |
newState.Privileges = luidAndAttributes; | |
TOKEN_PRIVILEGES previousState = new TOKEN_PRIVILEGES(); | |
uint retLen = 0; | |
Console.WriteLine("[*] Adjusting token"); | |
if (!AdjustTokenPrivileges(hToken, false, ref newState, (uint)Marshal.SizeOf(newState), ref previousState, out retLen)) | |
{ | |
Console.WriteLine("[-] AdjustTokenPrivileges failed!"); | |
return; | |
} | |
Console.WriteLine("[+] {0} added!", privName); | |
return; | |
} | |
public static bool CheckTokenPrivs() | |
{ | |
return false; | |
} | |
[DllImport("kernel32.dll")] | |
internal static extern Boolean OpenProcessToken( | |
IntPtr hProcess, | |
uint dwDesiredAccess, | |
out IntPtr hToken); | |
[DllImport("advapi32.dll", SetLastError = true)] | |
public static extern Boolean AdjustTokenPrivileges( | |
IntPtr TokenHandle, | |
bool DisableAllPrivileges, | |
ref TOKEN_PRIVILEGES NewState, | |
uint BufferLengthInBytes, | |
ref TOKEN_PRIVILEGES PreviousState, | |
out uint ReturnLengthInBytes); | |
[DllImport("advapi32.dll", SetLastError = true)] | |
public static extern Boolean LookupPrivilegeValue( | |
string lpSystemName, | |
string lpName, | |
ref LUID luid); | |
[StructLayout(LayoutKind.Sequential)] | |
public struct LUID_AND_ATTRIBUTES | |
{ | |
public LUID Luid; | |
public uint Attributes; | |
} | |
[StructLayout(LayoutKind.Sequential)] | |
public struct LUID | |
{ | |
public uint LowPart; | |
public uint HighPart; | |
} | |
public struct TOKEN_PRIVILEGES | |
{ | |
public uint PrivilegeCount; | |
public LUID_AND_ATTRIBUTES Privileges; | |
} | |
public const uint STANDARD_RIGHTS_REQUIRED = 0x000F0000; | |
public const uint STANDARD_RIGHTS_READ = 0x00020000; | |
public const uint TOKEN_ASSIGN_PRIMARY = 0x0001; | |
public const uint TOKEN_DUPLICATE = 0x0002; | |
public const uint TOKEN_IMPERSONATE = 0x0004; | |
public const uint TOKEN_QUERY = 0x0008; | |
public const uint TOKEN_QUERY_SOURCE = 0x0010; | |
public const uint TOKEN_ADJUST_PRIVILEGES = 0x0020; | |
public const uint TOKEN_ADJUST_GROUPS = 0x0040; | |
public const uint TOKEN_ADJUST_DEFAULT = 0x0080; | |
public const uint TOKEN_ADJUST_SESSIONID = 0x0100; | |
public const uint TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY); | |
public const uint TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | | |
TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | | |
TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | | |
TOKEN_ADJUST_SESSIONID); | |
public const uint SE_PRIVILEGE_ENABLED = 0x2; | |
public const uint SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x1; | |
public const uint SE_PRIVILEGE_REMOVED = 0x4; | |
public const uint SE_PRIVILEGE_USED_FOR_ACCESS = 0x3; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment