From cfba2b8e2795e0d58d52fa8f8b88d94a7f50f424 Mon Sep 17 00:00:00 2001
From: lsecqt <lsecqt@gmail.com>
Date: Sat, 11 Jan 2025 15:39:50 +0200
Subject: [PATCH] Userspace enumeration

---
 .../{UserEnvironment.c => GetENV.c}           |  0
 Enumeration/User Environment/Get_CWD.c        | 17 ++++
 .../Get_Username_Domain_Privileges.c          | 91 +++++++++++++++++++
 3 files changed, 108 insertions(+)
 rename Enumeration/User Environment/{UserEnvironment.c => GetENV.c} (100%)
 create mode 100644 Enumeration/User Environment/Get_CWD.c
 create mode 100644 Enumeration/User Environment/Get_Username_Domain_Privileges.c

diff --git a/Enumeration/User Environment/UserEnvironment.c b/Enumeration/User Environment/GetENV.c
similarity index 100%
rename from Enumeration/User Environment/UserEnvironment.c
rename to Enumeration/User Environment/GetENV.c
diff --git a/Enumeration/User Environment/Get_CWD.c b/Enumeration/User Environment/Get_CWD.c
new file mode 100644
index 0000000..e33c483
--- /dev/null
+++ b/Enumeration/User Environment/Get_CWD.c	
@@ -0,0 +1,17 @@
+#include <tchar.h>
+#include <windows.h>
+
+void getCurrentWorkingDirectory() {
+    TCHAR cwd[MAX_PATH];
+    if (GetCurrentDirectory(MAX_PATH, cwd)) {
+        _tprintf(_T("Current Working Directory: %s\n"), cwd);
+    }
+    else {
+        _ftprintf(stderr, _T("Error retrieving current working directory.\n"));
+    }
+}
+
+int main() {
+    getCurrentWorkingDirectory();
+    return 0;
+}
diff --git a/Enumeration/User Environment/Get_Username_Domain_Privileges.c b/Enumeration/User Environment/Get_Username_Domain_Privileges.c
new file mode 100644
index 0000000..57fce6f
--- /dev/null
+++ b/Enumeration/User Environment/Get_Username_Domain_Privileges.c	
@@ -0,0 +1,91 @@
+#include <windows.h>
+#include <stdio.h>
+#include <tchar.h>
+
+void PrintPrivileges(HANDLE hToken) {
+    DWORD dwSize = 0;
+    // First call to GetTokenInformation to get the required buffer size
+    if (!GetTokenInformation(hToken, TokenPrivileges, NULL, 0, &dwSize) && GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
+        _tprintf(_T("Failed to get token information. Error: %lu\n"), GetLastError());
+        return;
+    }
+
+    PTOKEN_PRIVILEGES pPrivileges = (PTOKEN_PRIVILEGES)malloc(dwSize);
+    if (!pPrivileges) {
+        _tprintf(_T("Memory allocation failed.\n"));
+        return;
+    }
+
+    // Second call to actually get the token information
+    if (GetTokenInformation(hToken, TokenPrivileges, pPrivileges, dwSize, &dwSize)) {
+        _tprintf(_T("Privileges:\n"));
+        for (DWORD i = 0; i < pPrivileges->PrivilegeCount; i++) {
+            LUID_AND_ATTRIBUTES la = pPrivileges->Privileges[i];
+            TCHAR name[256];  // Buffer to store the privilege name
+            DWORD nameSize = sizeof(name) / sizeof(TCHAR);  // Initial buffer size
+
+            // We need to check if the buffer is large enough
+            if (!LookupPrivilegeName(NULL, &la.Luid, name, &nameSize)) {
+                // If the buffer is too small, reallocate and try again
+                if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+                    nameSize = nameSize * 2;  // Double the buffer size
+                    name[0] = '\0';  // Clear buffer
+                    if (!LookupPrivilegeName(NULL, &la.Luid, name, &nameSize)) {
+                        _tprintf(_T(" - Failed to retrieve full privilege name. Error: %lu\n"), GetLastError());
+                        continue;
+                    }
+                }
+                else {
+                    _tprintf(_T(" - Unknown Privilege (Error %lu)\n"), GetLastError());
+                    continue;
+                }
+            }
+
+            // Print the privilege name and its status
+            _tprintf(_T(" - %-35s : %s\n"), name, (la.Attributes & SE_PRIVILEGE_ENABLED) ? _T("Enabled") : _T("Disabled"));
+        }
+    }
+    else {
+        _tprintf(_T("Failed to retrieve token privileges. Error: %lu\n"), GetLastError());
+    }
+    free(pPrivileges);
+}
+
+int main() {
+    HANDLE hToken;
+    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
+        _tprintf(_T("Failed to open process token.\n"));
+        return 1;
+    }
+
+    // Get Username and Domain
+    DWORD size = 0;
+    GetTokenInformation(hToken, TokenUser, NULL, 0, &size);
+
+    PTOKEN_USER pTokenUser = (PTOKEN_USER)malloc(size);
+    if (GetTokenInformation(hToken, TokenUser, pTokenUser, size, &size)) {
+        SID_NAME_USE sidType;
+        TCHAR username[256];
+        TCHAR domain[256];
+        DWORD usernameLen = sizeof(username) / sizeof(TCHAR);
+        DWORD domainLen = sizeof(domain) / sizeof(TCHAR);
+
+        if (LookupAccountSid(NULL, pTokenUser->User.Sid, username, &usernameLen, domain, &domainLen, &sidType)) {
+            _tprintf(_T("Username: %-20s\n"), username);
+            _tprintf(_T("Domain:   %-20s\n"), domain);
+        }
+        else {
+            _tprintf(_T("Failed to retrieve account name. Error: %lu\n"), GetLastError());
+        }
+    }
+    else {
+        _tprintf(_T("Failed to retrieve token information. Error: %lu\n"), GetLastError());
+    }
+    free(pTokenUser);
+
+    // Get Token Privileges
+    PrintPrivileges(hToken);
+
+    CloseHandle(hToken);
+    return 0;
+}