Modifying Process Access-Token Privileges with AdjustTokenPrivileges

Environment

Introduction

• During penetration testing, to perform an OpenProcess operation with specified write-related access rights on any process, the current process only needs to have the SeDebug privilege.

Reproduction Process

Workflow and functions used

• Open the process access token -> obtain the privilege's LUID value -> adjust the access token's privilege value
• The functions involved are:

OpenProcessToken();
LookupPrivilegeValue();
AdjustTokenPrivileges();

Code example

#include <stdio.h>
#include <windows.h>

int main(void)
{
     HANDLE token_handle;
     //打开访问令牌
     if (!OpenProcessToken(GetCurrentProcess(),       //要修改权限的进程句柄
          TOKEN_ALL_ACCESS,          //要对令牌进行何种操作
          &token_handle              //访问令牌
     ))
     {
          printf("openProcessToken error");
     }

     LUID luid;
     if (!LookupPrivilegeValue(NULL,                 //查看的系统，本地为NULL
          SE_DEBUG_NAME,        //要查看的特权名称
          &luid                 //用来接收标识符
     ))
     {
          printf("lookupPrivilegevalue error");
     }

     TOKEN_PRIVILEGES tkp;
     tkp.PrivilegeCount = 1;
     tkp.Privileges[0].Luid = luid;
     tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
     //调整访问令牌权限
     if (!AdjustTokenPrivileges(token_handle,    //令牌句柄
          FALSE,           //是否禁用权限
          &tkp,            //新的特权的权限信息
          sizeof(tkp),     //特权信息大小
          NULL,            //用来接收特权信息当前状态的buffer
          NULL             //缓冲区大小
     ))
     {
          printf("adjust error");
     }

     printf("sucessful");
     return 0;
}

• Compile and run it as shown in the figure: