mirror of
https://github.com/atomiczsec/Adrenaline
synced 2026-06-21 13:47:29 +00:00
Gavin K
e1e8b82368
- applications_enum.c: Remove RegCloseKey on uninitialized handle when RegOpenKeyExA fails (undefined behavior bug) - window_handles_enum.c: Report errors when GetClipboardData or GlobalLock fail in TestClipboardAccess instead of silently ignoring - powershell_history.c: Add error codes to file open/seek/read failures in read_snippet_ascii_at for diagnosability - notepad_grab.c: Report error when CreateToolhelp32Snapshot fails in FindNotepadProcesses - process_tokens_list.c: Report specific failure reason in EnableSeDebugPrivilege (OpenProcessToken vs LookupPrivilegeValue) - wevt_logon_enum.c: Report which wevtapi function failed to resolve instead of generic failure message Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Process Token Lister BOF
Summary
This Beacon Object File (BOF) enumerates accessible tokens from running processes, showing user context, token type (primary/impersonation), and impersonation level. Supports optional filtering by PID or process name. SeDebugPrivilege is disabled by default for OPSEC.
Example Output
[i] skipping seDebugPrivilege (OPSEC default).
[i] enumerating tokens for 195 processes
[+] PID: 1512 | Process: lsass.exe | User: NT AUTHORITY\SYSTEM | Type: Primary
[+] PID: 1234 | Process: explorer.exe | User: CORP\jdoe | Type: Primary
[+] PID: 4567 | Process: chrome.exe | User: CORP\jdoe | Type: Primary
[i] high-value processes (top 1)
[*] pid: 1512 | process: lsass.exe | domain: NT AUTHORITY\user: SYSTEM | type: SYSTEM
[i] opened: 45, skipped: 150, success: 23