diff --git a/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/.suo b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/.suo new file mode 100644 index 0000000..fda69d2 Binary files /dev/null and b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/.suo differ diff --git a/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/Browse.VC.db b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/Browse.VC.db new file mode 100644 index 0000000..9db8885 Binary files /dev/null and b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/Browse.VC.db differ diff --git a/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/ipch/AutoPCH/22d3d5e1022bae77/SOURCE.ipch b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/ipch/AutoPCH/22d3d5e1022bae77/SOURCE.ipch new file mode 100644 index 0000000..f0b1196 Binary files /dev/null and b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/ipch/AutoPCH/22d3d5e1022bae77/SOURCE.ipch differ diff --git a/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/ipch/AutoPCH/2cfde4d56ae4fdd5/SOURCE.ipch b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/ipch/AutoPCH/2cfde4d56ae4fdd5/SOURCE.ipch new file mode 100644 index 0000000..27f0daf Binary files /dev/null and b/SetThreadToken/SetThreadToken/.vs/SetThreadToken/v17/ipch/AutoPCH/2cfde4d56ae4fdd5/SOURCE.ipch differ diff --git a/SetThreadToken/SetThreadToken/SetThreadToken.sln b/SetThreadToken/SetThreadToken/SetThreadToken.sln new file mode 100644 index 0000000..8a8afb9 --- /dev/null +++ b/SetThreadToken/SetThreadToken/SetThreadToken.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.3.32901.215 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SetThreadToken", "SetThreadToken.vcxproj", "{8D9F2905-0886-4981-955E-FB69DAC964F7}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Debug|x64.ActiveCfg = Debug|x64 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Debug|x64.Build.0 = Debug|x64 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Debug|x86.ActiveCfg = Debug|Win32 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Debug|x86.Build.0 = Debug|Win32 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Release|x64.ActiveCfg = Release|x64 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Release|x64.Build.0 = Release|x64 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Release|x86.ActiveCfg = Release|Win32 + {8D9F2905-0886-4981-955E-FB69DAC964F7}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {B03474CB-E36E-4A7C-BF80-0964B68AA46A} + EndGlobalSection +EndGlobal diff --git a/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj b/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj new file mode 100644 index 0000000..ef950f4 --- /dev/null +++ b/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj @@ -0,0 +1,135 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {8d9f2905-0886-4981-955e-fb69dac964f7} + SetThreadToken + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj.filters b/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj.filters new file mode 100644 index 0000000..3e7e62e --- /dev/null +++ b/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj.user b/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/SetThreadToken/SetThreadToken/SetThreadToken.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/SetThreadToken/SetThreadToken/Source.cpp b/SetThreadToken/SetThreadToken/Source.cpp new file mode 100644 index 0000000..c1ebcc8 --- /dev/null +++ b/SetThreadToken/SetThreadToken/Source.cpp @@ -0,0 +1,70 @@ +//Author: Jonathan Johnson + +#include +#include +#include +#include + +int main(int argc, char* argv[]) +{ + DWORD PID = atoi(argv[1]); + + HANDLE hToken, hDuplicate, hProcess = NULL; + + TCHAR username[UNLEN + 1]; + DWORD username_len = UNLEN + 1; + + + hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, true, PID); + if (!hProcess) + { + std::cout << "[-] OpenProcess Failed (" << GetLastError() << ").\n"; + } + else + { + std::cout << "[*] Handle to PID: " << PID << " aquired via OpenProcess!" << ".\n"; + if (!OpenProcessToken(hProcess, TOKEN_DUPLICATE, &hToken)) + { + std::cout << "[-] OpenProcessToken Failed (" << GetLastError() << ").\n"; + } + else + { + std::cout << "[*] OpenProcessToken passed!" << ".\n"; + + if (!DuplicateToken(hToken, SecurityImpersonation, &hDuplicate)) + { + std::cout << "[-] DuplicateToken Failed (" << GetLastError() << ").\n"; + } + else + { + if (!SetThreadToken(NULL, hDuplicate)) + { + std::cout << "[-] Impersonation Failed (" << GetLastError() << ").\n"; + } + else + { + printf("[*] Impersoantion Passed!\n"); + + if (!GetUserNameW(username, &username_len)) + { + std::cout << "[-] GetUserName Failed (" << GetLastError() << ").\n"; + } + else + { + std::wstring username_w(username); + std::string username_s(username_w.begin(), username_w.end()); + std::cout << "[*] Impersonated username is: " << username_s << "\n"; + + RevertToSelf(); + } + } + + } + CloseHandle(hDuplicate); + CloseHandle(hToken); + CloseHandle(hProcess); + + } + } + return 0; +} \ No newline at end of file