This repo contains the toolings that was developped while writing the following blog post https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/. The blog post contains all necesary information to understand how the token manipulation internal mechanism works and how we can use it to our advantage.

This repo contains four tools:

• A standalone binary (Impersonate/) that you can use to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
• The CrackMapExec python module (impersonate.py) with the embedded Impersonate binary
• The embedded CrackMapExec binary (CME_module/) which is the same as the Impersonate.exe binary without printf's
• The list_tokens.c C++ code that is presented on the blog post

The Impersonate.exe tool contains three modules:

• Impersonate list: which will list available tokens
• Impersonate exec: which will allow you running commands impersonating a user
• Impersonate adduser: which will allow you elevating your privileges to domain admin

In order to compile the projects you will have to switch the Runtime library options to Multi-threaded Debug (/MtD) in the project properties.