MaorSabag-NaX/wiki/Token-Commands.md

Token Commands

NaX supports Windows access token manipulation for impersonation, privilege escalation, and lateral movement. Eight commands cover the full token lifecycle: query identity, steal tokens from processes, impersonate, create tokens from credentials, and manage the token store.

---

Architecture

Token Store

The beacon maintains an in-memory linked list of stolen/created tokens (NAX_TOKEN_NODE). Each entry holds the token handle, a numeric ID, and the resolved DOMAIN\user string. The store persists across heartbeats until explicitly cleared.

Impersonation Model

When a token is activated (via token steal with auto-impersonate, token use, or token make), the beacon calls ImpersonateLoggedOnUser on its main thread. All subsequent operations (file I/O, network access, process creation) run under the impersonated identity. The Adaptix console header updates to show the impersonated user with a * prefix.

Command IDs

Each token operation has its own command ID (Adaptix pattern), not a single command with sub-command dispatch:

Command	ID	Description
token getuid	0x50	Current identity (process or impersonated)
token steal	0x51	Duplicate token from a running process
token use	0x52	Impersonate a stored token by ID
token list	0x53	List all tokens in the store
token rm	0x54	Remove a token from the store
token revert	0x55	Drop impersonation, revert to process token
token make	0x56	Create token from credentials (LogonUserA)
token privs	0x57	List privileges on the current token

---

Commands

token getuid

Return the current effective identity. If impersonating, returns the impersonated user; otherwise returns the process token user.

token getuid

Result: DOMAIN\username with an elevated flag (Yes/No).

Implementation detail: Uses OpenThreadToken(..., OpenAsSelf=TRUE) to avoid ERROR_ACCESS_DENIED when impersonating a non-admin user. Falls back to OpenProcessToken if no thread token exists.

token steal

Duplicate a token from a target process and optionally impersonate it immediately.

token steal <pid> [impersonate]

Argument	Description
pid	Target process ID
impersonate	If present (any value), auto-impersonate the stolen token

token steal 4832
token steal 4832 true

Opens the process with PROCESS_QUERY_INFORMATION, duplicates the token with TOKEN_ALL_ACCESS, resolves the token's user/domain via GetTokenInformation, and stores it. If impersonate is set, calls ImpersonateLoggedOnUser and updates the console header.

token use

Impersonate a previously stored token by its numeric ID.

token use <token_id>

token use 1
token use 3

Looks up the token in the store, calls ImpersonateLoggedOnUser, and updates the console header with the token's DOMAIN\user.

token list

List all tokens currently in the store.

token list

Output is a table with columns: ID, Handle, User, Domain.

token rm

Remove a token from the store and close its handle.

token rm <token_id>

token rm 2

If the removed token was the currently impersonated one, impersonation is NOT automatically reverted -- use token revert separately.

token revert

Drop impersonation and revert to the process token.

token revert

Calls RevertToSelf() and clears the console header's impersonation indicator.

token make

Create a new token from plaintext credentials using LogonUserA. Supports multiple logon types for different use cases.

token make [-t <type>] <domain> <username> <password>

Argument	Description
-t <type>	Logon type (optional, default: new_credentials)
domain	Target domain (e.g., CORP, sevenkingdoms.local, . for local)
username	Account username
password	Account password

Logon Types

Type	Value	Behavior
interactive	2	Full logon. Token SID shows the actual user. Local and network access as the target user. Requires the password to be valid.
network	3	Network logon. Token valid for network resources only.
network_cleartext	8	Like network but credentials available for delegation. Useful for Kerberos double-hop.
new_credentials	9	(Default) Network-only credentials. Token SID remains the caller's identity locally, but network access uses the supplied credentials. Does NOT validate the password locally.

token make sevenkingdoms.local cersei.lannister il0vejaime
token make -t interactive CORP admin P@ssw0rd!
token make -t network_cleartext . svc_account SecretPass

Type 9 vs Type 2: With new_credentials (default), token getuid still shows the original user because the token SID isn't changed -- only outbound network authentication uses the new credentials. Use -t interactive when you need the token to fully reflect the target identity.

token privs

List all privileges on the current effective token (thread token if impersonating, process token otherwise).

token privs

Output is a table with columns: Privilege Name, Status (Enabled/Disabled).

Uses OpenThreadToken(..., OpenAsSelf=TRUE) like token getuid for the same access-check safety.

---

Console Header

When impersonation is active, the Adaptix console header shows the impersonated identity with a * prefix:

*SEVENKINGDOMS\cersei.lannister

This is updated via TsAgentUpdateDataPartial with the Impersonated field. Commands that set impersonation (token steal with impersonate flag, token use, token make) set the header. token revert clears it.

---

Wire Format

Task (server -> beacon)

All token commands use the standard task frame: cmdId(1) | taskId(4) | args(variable).

Command	Args format
token getuid	(none)
token steal	pid(4LE) | impersonate(1)
token use	tokenId(4LE)
token list	(none)
token rm	tokenId(4LE)
token revert	(none)
token make	logonType(4LE) | domainLen(4LE) | domain | userLen(4LE) | user | passLen(4LE) | pass
token privs	(none)

Result (beacon -> server)

Command	Success data
token getuid	userLen(4LE) | user | domainLen(4LE) | domain | elevated(1)
token steal	tokenId(4LE) | userLen(4LE) | user | domainLen(4LE) | domain | impersonate(1)
token use	userLen(4LE) | user | domainLen(4LE) | domain
token list	count(4LE) | [tokenId(4LE) | handle(8LE) | userLen(4LE) | user | domainLen(4LE) | domain] * count
token rm	(empty)
token revert	(empty)
token make	tokenId(4LE) | userLen(4LE) | user | domainLen(4LE) | domain
token privs	count(4LE) | [nameLen(4LE) | name | status(4LE)] * count

On error (status=0x01), all token commands return the Win32 error code as errorCode(4LE) in the result data.

---

Files

File	Role
src_beacon/include/Wire.h	NAX_CMD_TOKEN_GETUID through NAX_CMD_TOKEN_PRIVS (0x50-0x57)
src_beacon/include/Nax.h	Forward declarations for all 8 CmdToken* functions
src_beacon/src/Commands/Token.c	Beacon-side implementations
src_beacon/src/Commands/Dispatch.c	8 separate case entries routing to each handler
src_server/agent_nonameax/pl_main.go	CMD_TOKEN_* Go constants
src_server/agent_nonameax/pl_commands.go	Command packing (args -> wire format)
src_server/agent_nonameax/pl_format.go	Result decoders (decodeTokenGetUidResult, etc.)
src_server/agent_nonameax/pl_results.go	Result processing + console header updates
src_server/agent_nonameax/ax_config.axs	AxScript command registration + UI