Process Token Dumper

1. Dump Token Information

1.1. GetTokenInformation()

1.1.1. TokenUser

1.1.1.1. SID_AND_ATTRIBUTES

1.1.1.1.1. Demo

1.1.2. TokenOwner

1.1.2.1. Demo

1.1.3. TokenPrimaryGroup

1.1.3.1. Demo

1.1.4. TokenGroups

1.1.4.1. Demo

1.1.5. TokenPrivileges

1.1.5.1. LUID_AND_ATTRIBUTES

1.1.5.1.1. Demo

1.1.6. TokenSource

1.1.6.1. Demo

1.1.7. TokenType

1.1.7.1. Demo

1.1.8. TokenElevation

1.1.8.1. Demo

1.1.9. ... many others

2. Windows API Exploitation Recipes for Red - Blue Teams http://www.pentesteracademy.com/course?id=31

3. Privilege Check

3.1. SeDebugPrivilege

3.1.1. GetCurrentProcess()

3.1.2. OpenProcessToken()

3.1.3. GetTokenInformation()

3.1.4. AdjustTokenPrivileges()

4. Get Process Handle

4.1. OpenProcess()

4.1.1. Choose Minimal Access

4.1.2. MAXIMUM_ALLOWED

4.1.3. PROCESS_QUERY_LIMITED_INFORMATION Protected Processes

4.1.3.1. Finding Protected Processes

5. Get Process Token Handle

5.1. OpenProcessToken()

5.1.1. MAXIMUM_ALLOWED