Skip to content

Instantly share code, notes, and snippets.

@matterpreter
Created September 14, 2019 12:43
Show Gist options
  • Save matterpreter/8c87af2d45bb82905cf77f98e50ca67a to your computer and use it in GitHub Desktop.
Save matterpreter/8c87af2d45bb82905cf77f98e50ca67a to your computer and use it in GitHub Desktop.
Grant the current process token the specified privilege
using System;
using System.Runtime.InteropServices;
public static void SetTokenPrivilege(ref IntPtr hToken, string privName)
{
Console.WriteLine("[*] Adding {0} to token", privName);
LUID luid = new LUID();
if (!LookupPrivilegeValue(null, privName, ref luid))
{
Console.WriteLine("[-] LookupPrivilegeValue failed!");
return;
}
Console.WriteLine("[+] Received LUID");
LUID_AND_ATTRIBUTES luidAndAttributes = new LUID_AND_ATTRIBUTES();
luidAndAttributes.Luid = luid;
luidAndAttributes.Attributes = SE_PRIVILEGE_ENABLED;
TOKEN_PRIVILEGES newState = new TOKEN_PRIVILEGES();
newState.PrivilegeCount = 1;
newState.Privileges = luidAndAttributes;
TOKEN_PRIVILEGES previousState = new TOKEN_PRIVILEGES();
uint retLen = 0;
Console.WriteLine("[*] Adjusting token");
if (!AdjustTokenPrivileges(hToken, false, ref newState, (uint)Marshal.SizeOf(newState), ref previousState, out retLen))
{
Console.WriteLine("[-] AdjustTokenPrivileges failed!");
return;
}
Console.WriteLine("[+] {0} added!", privName);
return;
}
public static bool CheckTokenPrivs()
{
return false;
}
[DllImport("kernel32.dll")]
internal static extern Boolean OpenProcessToken(
IntPtr hProcess,
uint dwDesiredAccess,
out IntPtr hToken);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern Boolean AdjustTokenPrivileges(
IntPtr TokenHandle,
bool DisableAllPrivileges,
ref TOKEN_PRIVILEGES NewState,
uint BufferLengthInBytes,
ref TOKEN_PRIVILEGES PreviousState,
out uint ReturnLengthInBytes);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern Boolean LookupPrivilegeValue(
string lpSystemName,
string lpName,
ref LUID luid);
[StructLayout(LayoutKind.Sequential)]
public struct LUID_AND_ATTRIBUTES
{
public LUID Luid;
public uint Attributes;
}
[StructLayout(LayoutKind.Sequential)]
public struct LUID
{
public uint LowPart;
public uint HighPart;
}
public struct TOKEN_PRIVILEGES
{
public uint PrivilegeCount;
public LUID_AND_ATTRIBUTES Privileges;
}
public const uint STANDARD_RIGHTS_REQUIRED = 0x000F0000;
public const uint STANDARD_RIGHTS_READ = 0x00020000;
public const uint TOKEN_ASSIGN_PRIMARY = 0x0001;
public const uint TOKEN_DUPLICATE = 0x0002;
public const uint TOKEN_IMPERSONATE = 0x0004;
public const uint TOKEN_QUERY = 0x0008;
public const uint TOKEN_QUERY_SOURCE = 0x0010;
public const uint TOKEN_ADJUST_PRIVILEGES = 0x0020;
public const uint TOKEN_ADJUST_GROUPS = 0x0040;
public const uint TOKEN_ADJUST_DEFAULT = 0x0080;
public const uint TOKEN_ADJUST_SESSIONID = 0x0100;
public const uint TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY);
public const uint TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE |
TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT |
TOKEN_ADJUST_SESSIONID);
public const uint SE_PRIVILEGE_ENABLED = 0x2;
public const uint SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x1;
public const uint SE_PRIVILEGE_REMOVED = 0x4;
public const uint SE_PRIVILEGE_USED_FOR_ACCESS = 0x3;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment