o j#@snddlZddlmZddlmZddlTGdddZGdddZed kr5eZ e Z e e e dSdS) N)logger)LocalWindowsAPI)*c@seZdZddZddZdS) TokenInfocCs"||_||_||_||_||_dSNpiddomainusernamesid token_type)selfrr r r r r/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/processmanipulator.py__init__ s  zTokenInfo.__init__cCsd|j|j|j|j|jfS)Nz%s:%s:%s:%s:%srr rrr__str__szTokenInfo.__str__N)__name__ __module__ __qualname__rrrrrrr s rc@seZdZdZdddZd ddZd dd Zd d Zd d d ZddZ ddZ de e e fddZ d!ddZd"ddZddZddZdS)#ProcessManipulatorz High level class to adjust privileges and manipulate tokens TODO: Currently only working with the current process, doesn't do remote processes! TODO: ther ways to get system, eg. creating a service that will launch the new app? like p s e x e c NcCs$||_|dur ||_dSt|_dSr)rrapi)r rrrrrrszProcessManipulator.__init__FcCs"td||jjj|d|dS)z Sets a given privilege z)[ProcessManipulator] Setting %s privilegeTenablethread_or_processrdebugrntdllRtlAdjustPrivileger privilige_idrrrr set_privilege!sz ProcessManipulator.set_privilegecCs&td||jjj|d|ddS)z Drops the given privilege z*[ProcessManipulator] Dropping %s privilegeFrNrrrrrdrop_privilege(sz!ProcessManipulator.drop_privilegecCsdS)z9 Lists all available privileges for the current user Nrrrrrlist_privileges/sz"ProcessManipulator.list_privilegesc Cstdz|t}Wnty*}z|durtd| WYd}~nd}~wwg}|jjD]}d}zz|jj t d|}t dd||fWn*tyw}zt dd|t |fWYd}~W|durr|jj |q3d}~wwd}zYz |jj|t}Wn6ty}z*t dd|t |fWYd}~W|dur|jj |W|dur|jj |q3d}~ww|||}||W|dur|jj |n |dur|jj |wwW|dur|jj |q3|dur|jj |ww|S) zo iterates trough all available processes, fetches all process tokens, gets user information for all tokens z*[ProcessManipulator] Listing all tokens...F$Failed to obtain SE_DEBUG privilege!N2[ProcessManipulator] Proc handle for PID %s is: %s=[ProcessManipulator] Failed to open process pid %s Reason: %sD[ProcessManipulator] Failed get token from process pid %s Reason: %s)rrr!SE_DEBUG Exceptionerrorrpsapi EnumProcesseskernel32 OpenProcessPROCESS_QUERY_INFORMATIONlogstr CloseHandleadvapi32OpenProcessTokenTOKEN_MANIP_ACCESSget_token_infoappend) r forcerese token_infosr proc_handle token_handletirrrlist_all_tokens6sh        z"ProcessManipulator.list_all_tokensc Csd}zez|jj}|jjtd|}Wnty"}z|d}~wwz7z(|jj|t}| ||WW|dur?|jj |W|durL|jj |SStyZ}z|d}~ww|durg|jj |ww|durt|jj |ww)NF) rr.GetCurrentProcessIdr/r0r*r4r5r6r7r3)r r=rr;r>rrrget_current_token_infocs6 z)ProcessManipulator.get_current_token_infocCsB|jj|}|jj|}|jjd|\}}}t|||||Sr)rr4GetTokenInformation_sidConvertSidToStringSidLookupAccountSidr)r r>rptr_sidsid_strnamer r rrrr7wsz!ProcessManipulator.get_token_infoS-1-5-18c csz|tWnty}ztd|d}~wwg}|jjD]}d}zz|jj t d|}t dd||fWn*tyh}zt dd|t |fWYd}~W|durc|jj |q$d}~wwd} zsz |jj|t} Wn6ty}z*t dd|t |fWYd}~W| dur|jj | W|dur|jj |q$d}~ww|jj| } |jj| } | |krtd|jjj| |||d } | VW| dur|jj | n | dur|jj | wwW|dur|jj |q$|dur|jj |ww|S) z iterates trough all available processes, fetches all process tokens, checks if sid matches for token, duplicates it and yields them also leaks a lot of handles, probably should be cleaned up TODO r$NFr%r&r'r(z1[ProcessManipulator] Found token with target sid!)dwDesiredAccessImpersonationLevel TokenType)r!r)r*rr+rr,r-r.r/r0r1r2r3r4r5r6rCrDrDuplicateTokenEx) r target_sidrJrKrLr;r<rr=r>rFrG cloned_tokenrrrget_token_for_sid}sx       z$ProcessManipulator.get_token_for_sidc Cs|j|ttBttdD]2}tdz |jj |Wnt y5}zt dd|WYd}~q d}~wwtddSdS)zt assigns the token to the thread specified by threadid, if threadid is none then it will use the current thread rNrJrKrLz7[ProcessManipulator] Setting token to current thread...r%z,Failed changing the thread token. Reason: %sNz>[ProcessManipulator] Sucsessfully set token to current thread!) rP TOKEN_QUERYTOKEN_IMPERSONATESecurityDelegationTokenImpersonationrrrr4SetThreadTokenr*r1)r rNtokenr;rrrassign_token_thread_sids   z*ProcessManipulator.assign_token_thread_sidC:\Windows\system32\cmd.exeTc Cst|j|tttdD].}z |jj||Wnty/}zt dd|WYd}~q d}~wwt ddSdS)zp Creates a new process with the token of the target SID TODO: implement non-interactive functionality :( rQr%z;Failed creating process with the token obtained. Reason: %sNz2[ProcessManipulator] Sucsessfully created process!) rPTOKEN_ALL_ACCESSSecurityImpersonationrUrr4CreateProcessWithToken_manipr*rr1r)r rNcmdline interactiverWr;rrrcreate_process_for_sids  z)ProcessManipulator.create_process_for_sidcCs|ddS)NrI)rXrrrr getsystemszProcessManipulator.getsystemcCs|jjdSr)rr4 RevertToSelfrrrr dropsystemszProcessManipulator.dropsystem)NN)F)rI)rIrYT)rrr__doc__rr!r"r#r@rBr7rZr[rPrXr_r`rbrrrrrs    - 4  r__main__)platformpypykatzr-pypykatz.commons.winapi.local.localwindowsapir!pypykatz.commons.winapi.constantsrrrpmrBr?printr2rrrrs   ?