Giter VIP home page Giter VIP logo

tokenplayer's Introduction

TokenPlayer

Manipulating and Abusing Windows Access Tokens.

TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows.

Features:

  • Stealing and Impersonating primary tokens.
  • Impersonating Protected Processes.
  • Bypassing UAC by using the Token-Duplication method.
  • Making new tokens for network authentication by providing credentials (similar to runas /netonly) without the need for special rights or elevated context.
  • Spoof the parent process ID and spawn a process with an alternative parent.
  • Execute any application with provided parameters under an impersonated context.
  • Can be used from non-interactive contexts (e.g. reverse shell) by using pipes for parent-child process communication.

Usage:

General options:
  --help                 Display help menu.

Impersonation Options:
  --impersonate          Impersonates the specified pid and spawns a new child
                         process under its context.
  --pid arg              Proccess ID to steal the token from.
  --spawn                Spawns a new command prompt under the context of the
                         stolen token.

Execution Options:
  --exec                 Execute an instance of a specified program under the
                         impersonated context.
  --pid arg              Proccess ID to steal the token from.
  --prog                 The full path to the program to be executed.
  --args                 Optional execution arguments for the specified
                         program.

Make Token Options:
  --maketoken            Create a new process under a set of creds for only
                         network authentication (Similar to runas /netonly).
  --username arg         Username
  --password arg         Password in plaintext format.
  --domain arg           The domain the user belongs, if domain isn't specified
                         the local machine will be used.

UAC Bypass Options:
  --pwnuac               Will try to bypass UAC using the token-duplication
                         method.
  --spawn                Spawns a new elevated prompt.
  --prog arg             The full path to the program to be executed.
  --args arg             Optional execution arguments for the specified
                         program.

Parent Process Spoofing Options:
  --spoofppid            Spawn a new instance of an application with spoofed
                         parent process.
  --ppid arg             The PID of the parent process.
  --prog arg             The full path to the program to be executed.
  --args arg             Optional execution arguments for the specified
                         program.

Usage 1: Token Impersonation

Using same console:

Token Impersonation

Spawning a new console:

Token Impersonation In New Window

Usage 2: Executing an application (e.g. rev shell)

Executing Reverse Shell

Usage 3: Make Token

Make Token

Usage 4: UAC Bypass

UAC Bypass

Usage 5: PPID Spoofing

PPID Spoofing

Compile Instructions

To compile it yourself you will need to install the boost library, because it uses it for parsing and handling the command line arguments. Also you'll need to specify the external library's folder on the project's settings.

References

tokenplayer's People

Contributors

s1ckb0y1337 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.