PrivFu

PrivFu

Kernel mode WinDbg extension and PoCs for testing how token privileges work.

There are notable repository and articles about token privilege abuse such Grzegorz Tworek's Priv2Admin. Codes in this repository are intended to help investigate how token privileges work.

Table Of Contents

• PrivFu
  • ArtsOfGetSystem
  • KernelWritePoCs
  • PrivEditor
    • getps Command
    • getpriv Command
    • addpriv Command
    • rmpriv Command
    • enablepriv Command
    • disablepriv Command
    • enableall Command
    • disableall Command
  • PrivilegedOperations
  • S4uDelegator
  • SwitchPriv
  • TokenDump
  • TokenAssignor
  • TrustExec
  • UserRightsUtil
  • Reference
  • Acknowledgments

ArtsOfGetSystem

Back to Top

Project

This project covers how to get system privileges from high integrity level shell. See README.md for details.

KernelWritePoCs

Back to Top

Project

The purpose of this project is to investigate how attackers abuse arbitrary kernel write vulnerability. All PoCs are written for HackSys Extreme Vulnerable Driver. Most of these PoCs perform to get SYSTEM integrity level by abusing arbitrary kernel write vulnerability and token privileges. Tested on Windows 10 version 1809/1903, but they should work most of Windows 10 theoretically:

PoC Name	Description
CreateAssignTokenVariant	This PoC performs EoP with SeCreateTokenPrivilege and SeAssignPrimaryTokenPrivilege.
CreateImpersonateTokenVariant	This PoC performs EoP with SeCreateTokenPrivilege and SeImpersonatePrivilege.
CreateTokenVariant	This PoC performs EoP with SeCreateTokenPrivilege.
DebugInjectionVariant	This PoC performs EoP with SeDebugPrivilege. Uses code injection to winlogon.exe at final stage.
DebugUpdateProcVariant	This PoC performs EoP with SeDebugPrivilege. Creates SYSTEM process from winlogon.exe with UpdateProcThreadAttribute API at final stage.
RestoreServiceModificationVariant	This PoC performs EoP with SeRestorePrivilege. Use HijackShellLib with this PoC.
SecondaryLogonVariant	This PoC performs EoP with SeCreateTokenPrivilege and SeImpersonatePrivilege. Uses secondary logon service at final stage.
TakeOwnershipServiceModificationVariant	This PoC performs EoP with SeTakeOwnershipPrivilege. Use HijackShellLib with this PoC.
TcbS4uAssignTokenVariant	This PoC performs EoP with SeTcbPrivilege. Get System mandatory level shell from medium mandatory level.
TcbS4uImpersonationVariant	This PoC performs EoP with SeTcbPrivilege. Performs thread impersonation with S4U logon. Not get high or system integrity level.

PrivEditor

Back to Top

Project

Warning

In some environment, Debug build does not work. Release build is preferred.

PrivEditor is kernel mode WinDbg extension to manipulate token privilege of specific process. This extension makes it easy to configure the token privilege you want to investigate:

…

getps Command

This command is to list processes in your target system:

0: kd> !getps /?

!getps - List processes in target system.

Usage : !getps [Process Name]

    Process Name : (OPTIONAL) Specifies filter string for process name.

If you execute this command without any arguments, this command list all processes in your target system as follows:

…

If you want to know specific processes, set string filter as follows. The filter works with forward matching and case insensitive:

0: kd> !getps micro

     PID        nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name
======== =================== ======================== ============
    4568 0xffffd60f`f14ed080      0xffffaf00`d3db60a0 MicrosoftEdge.exe
    4884 0xffffd60f`f1647080      0xffffaf00`d3fc17b0 MicrosoftEdgeCP.exe
    4892 0xffffd60f`f1685080      0xffffaf00`d3fc07b0 MicrosoftEdgeSH.exe

getpriv Command

This command is to list token privileges of a specific process:

0: kd> !getpriv /?

!getpriv - List privileges of a process.

Usage : !getpriv 

    PID : Specifies target process ID.

To use this command, you need to set a target process ID in decimal format as follows:

0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

addpriv Command

This command is to add token privilege(s) to a specific process:

…

For example, if you want to set SeDebugPrivilege to a specific process, set a target process ID for the first argument and shorten privilege name debug as listed in the help message for second argument as follows:

…

The privilege name argument is case insensitive.

If you want to add all token privileges at a time, set all as the privilege name argument:

0: kd> !addpriv 5704 all

[>] Trying to add all privileges.
[*] Done.

0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeCreateTokenPrivilege                     Disabled
SeAssignPrimaryTokenPrivilege              Disabled
SeLockMemoryPrivilege                      Disabled
SeIncreaseQuotaPrivilege                   Disabled
SeMachineAccountPrivilege                  Disabled
SeTcbPrivilege                             Disabled
SeSecurityPrivilege                        Disabled

--snip--

rmpriv Command

This command is to remove token privilege(s) from a specific process:

0: kd> !rmpriv /?

!rmpriv - Remove privilege(s) from a process.

Usage : !rmpriv  

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

If you want to remove SeChangeNotifyPrivilege, execute this command as follows:

…

As !addpriv command, you can remove all token privileges at a time by setting all as the privilege name argument:

0: kd> !rmpriv 352 all

[>] Trying to remove all privileges.
[*] Done.

0: kd> !getpriv 352

Privilege Name                             State
========================================== ========

[*] PID                      : 352
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d3468770

enablepriv Command

This command is to enable token privilege(s) of a specific process:

0: kd> !enablepriv /?

!enablepriv - Enable privilege(s) of a process.

Usage : !enablepriv  

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

The first argument is for process ID, and the second is for token privilege name:

…

If you tried to enable privilege(s), not added yet, this command adds it automatically:

…

disablepriv Command

This command is to disable token privilege(s) of a specific process:

0: kd> !disablepriv /?

!disablepriv - Disable privilege(s) of a process.

Usage : !disablepriv  

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

To use this command, set a target process ID for the first argument and token privilege name for the second argument:

…

enableall Command

This command is to enable all token privilege(s) available for a specific process:

0: kd> !enableall /?

!enableall - Enable all privileges available to a process.

Usage : !enableall 

    PID       : Specifies target process ID.

It works as follows:

…

disableall Command

This command is to disable all token privilege(s) for a specific process:

0: kd> !disableall /?

!disableall - Disable all privileges available to a process.

Usage : !disableall 

    PID : Specifies target process ID.

This command is equivalent to !disablepriv all. Works as follows:

…

PrivilegedOperations

Back to Top

Project

This project is PoCs for sensitive token privileges such SeDebugPrivilege. Currently, released PoCs for a part of them.

Program Name	Description
SeAuditPrivilegePoC	This PoC tries to create new security event(s) by SeAuditPrivilegePoC. SeAuditPrivilege does not require high integrity level, but this PoC requires administrative privileges at the first execution to install new event source. Additionally, to confirm the result, this PoC may require modification of local security policy setting.
SeBackupPrivilegePoC	This PoC tries to dump HKLM\SAM by SeBackupPrivilege.
SeCreatePagefilePrivilegePoC	This PoC tries to set pagefile option to specific values by SeCreatePagefilePrivilege.
SeCreateTokenPrivilegePoC	This PoC tries to create a elevated token by SeCreateTokenPrivilege.
SeDebugPrivilegePoC	This PoC tries to open a handle to winlogon.exe by SeDebugPrivilege.
SeLockMemoryPrivilegePoC	This PoC tries to allocate Large Page memory region by SeLockMemoryPrivilege.
[SeRestorePrivilegePoC](./PrivilegedOperations/Se