1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
|
#ifndef _NT_TOKEN_H_
#define _NT_TOKEN_H_
#include "nt_abi.h"
#include "nt_object.h"
typedef enum _nt_token_type {
NT_TOKEN_PRIMARY = 1,
NT_TOKEN_IMPERSONATION = 2,
} nt_token_type;
typedef enum _nt_token_info_class {
NT_TOKEN_USER = 1,
NT_TOKEN_GROUPS = 2,
NT_TOKEN_PRIVILEGES = 3,
NT_TOKEN_OWNER = 4,
NT_TOKEN_PRIMARY_GROUP = 5,
NT_TOKEN_DEFAULT_DACL = 6,
NT_TOKEN_SOURCE = 7,
NT_TOKEN_TYPE = 8,
NT_TOKEN_IMPERSONATION_LEVEL = 9,
NT_TOKEN_STATISTICS = 10,
NT_TOKEN_RESTRICTED_SIDS = 11,
NT_TOKEN_SESSION_ID = 12,
} nt_token_info_class;
/* token privilege constants */
#define NT_SE_CREATE_TOKEN_PRIVILEGE 2
#define NT_SE_ASSIGN_PRIMARY_TOKEN_PRIVILEGE 3
#define NT_SE_LOCK_MEMORY_PRIVILEGE 4
#define NT_SE_INCREASE_QUOTA_PRIVILEGE 5
#define NT_SE_MACHINE_ACCOUNT_PRIVILEGE 6
#define NT_SE_TCB_PRIVILEGE 7
#define NT_SE_SECURITY_PRIVILEGE 8
#define NT_SE_TAKE_OWNERSHIP_PRIVILEGE 9
#define NT_SE_LOAD_DRIVER_PRIVILEGE 10
#define NT_SE_SYSTEM_PROFILE_PRIVILEGE 11
#define NT_SE_SYSTEMTIME_PRIVILEGE 12
#define NT_SE_PROFILE_SINGLE_PROCESS_PRIVILEGE 13
#define NT_SE_INCREASE_BASE_PRIORITY_PRIVILEGE 14
#define NT_SE_CREATE_PAGEFILE_PRIVILEGE 15
#define NT_SE_CREATE_PERMANENT_PRIVILEGE 16
#define NT_SE_BACKUP_PRIVILEGE 17
#define NT_SE_RESTORE_PRIVILEGE 18
#define NT_SE_SHUTDOWN_PRIVILEGE 19
#define NT_SE_DEBUG_PRIVILEGE 20
#define NT_SE_AUDIT_PRIVILEGE 21
#define NT_SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22
#define NT_SE_CHANGE_NOTIFY_PRIVILEGE 23
#define NT_SE_REMOTE_SHUTDOWN_PRIVILEGE 24
#define NT_SE_UNDOCK_PRIVILEGE 25
#define NT_SE_SYNC_AGENT_PRIVILEGE 26
#define NT_SE_ENABLE_DELEGATION_PRIVILEGE 27
#define NT_SE_MANAGE_VOLUME_PRIVILEGE 28
#define NT_SE_IMPERSONATE_PRIVILEGE 29
#define NT_SE_CREATE_GLOBAL_PRIVILEGE 30
#define NT_SE_TRUSTED_CRED_MAN_ACCESS_PRIVILEGE 31
#define NT_SE_RELABEL_PRIVILEGE 32
#define NT_SE_INCREASE_WORKING_SET_PRIVILEGE 33
#define NT_SE_TIME_ZONE_PRIVILEGE 34
#define NT_SE_CREATE_SYMBOLIC_LINK_PRIVILEGE 35
/* token attribute bits */
#define NT_SE_DISABLE_PRIVILEGE (0x0001U)
#define NT_SE_ENABLE_PRIVILEGE (0x0002U)
/* token access bits */
#define NT_TOKEN_ASSIGN_PRIMARY 0x00000001U
#define NT_TOKEN_DUPLICATE 0x00000002U
#define NT_TOKEN_IMPERSONATE 0x00000004U
#define NT_TOKEN_QUERY 0x00000008U
#define NT_TOKEN_QUERY_SOURCE 0x00000010U
#define NT_TOKEN_ADJUST_PRIVILEGES 0x00000020U
#define NT_TOKEN_ADJUST_GROUPS 0x00000040U
#define NT_TOKEN_ADJUST_DEFAULT 0x00000080U
#define NT_TOKEN_ADJUST_SESSIONID 0x00000100U
#define NT_TOKEN_ALL_ACCESS NT_SEC_STANDARD_RIGHTS_REQUIRED \
| NT_TOKEN_ASSIGN_PRIMARY \
| NT_TOKEN_DUPLICATE \
| NT_TOKEN_IMPERSONATE \
| NT_TOKEN_QUERY \
| NT_TOKEN_QUERY_SOURCE \
| NT_TOKEN_ADJUST_PRIVILEGES \
| NT_TOKEN_ADJUST_GROUPS \
| NT_TOKEN_ADJUST_SESSIONID \
| NT_TOKEN_ADJUST_DEFAULT
#define NT_TOKEN_READ NT_SEC_STANDARD_RIGHTS_READ \
| NT_TOKEN_QUERY
#define NT_TOKEN_WRITE NT_SEC_STANDARD_RIGHTS_WRITE \
| TOKEN_ADJUST_PRIVILEGES \
| NT_OKEN_ADJUST_GROUPS \
| NT_TOKEN_ADJUST_DEFAULT
#define NT_TOKEN_EXECUTE NT_SEC_STANDARD_RIGHTS_EXECUTE
/* filtered token flags */
#define NT_DISABLE_MAX_PRIVILEGE 0x01
typedef struct _nt_token_statistics {
nt_luid token_id;
nt_luid authentication_id;
nt_large_integer expiration_time;
nt_token_type token_type;
nt_security_impersonation_level impersonation_level;
uint32_t dynamic_charged;
uint32_t dynamic_available;
uint32_t group_count;
uint32_t privilege_count;
nt_luid modified_id;
} nt_token_statistics;
typedef int32_t __stdcall ntapi_zw_create_token(
__out void ** htoken,
__in uint32_t desired_access,
__in nt_object_attributes * obj_attr,
__in nt_token_type type,
__in nt_luid * authentication_id,
__in nt_large_integer * expiration_time,
__in nt_token_user * user,
__in nt_token_groups * groups,
__in nt_token_privileges * privileges,
__in nt_token_owner * owner,
__in nt_token_primary_group * primary_group,
__in nt_token_default_dacl * default_dacl,
__in nt_token_source * source);
typedef int32_t __stdcall ntapi_zw_open_process_token(
__in void * hprocess,
__in uint32_t desired_access,
__out void ** htoken);
typedef int32_t __stdcall ntapi_zw_open_thread_token(
__in void * hthread,
__in uint32_t desired_access,
__in int32_t open_as_self,
__out void ** htoken);
typedef int32_t __stdcall ntapi_zw_duplicate_token(
__in void * htoken_existing,
__in uint32_t desired_access,
__in nt_object_attributes * obj_attr,
__in int32_t effective_only,
__in nt_token_type token_type,
__out void ** htoken_new);
typedef int32_t __stdcall ntapi_zw_filter_token(
__in void * htoken_existing,
__in uint32_t flags,
__in nt_token_groups * sids_to_disable,
__in nt_token_privileges * privileges_to_delete,
__in nt_token_groups * sids_to_restrict,
__out void ** htoken_new);
typedef int32_t __stdcall ntapi_zw_adjust_privileges_token(
__in void * htoken,
__in int32_t disable_all_privileges,
__in nt_token_privileges * new_state,
__in size_t buffer_length,
__in nt_token_privileges * prev_state __optional,
__out size_t * returned_length);
typedef int32_t __stdcall ntapi_zw_adjust_groups_token(
__in void * htoken,
__in int32_t reset_to_default,
__in nt_token_groups * new_state,
__in size_t buffer_length,
__in nt_token_groups * prev_state __optional,
__out size_t * returned_length);
typedef int32_t __stdcall ntapi_zw_query_information_token(
__in void * htoken,
__in nt_token_info_class token_info_class,
__out void * token_info,
__in size_t token_info_length,
__out size_t * returned_length);
typedef int32_t __stdcall ntapi_zw_set_information_token(
__in void * htoken,
__in nt_token_info_class token_info_class,
__in void * token_info,
__in size_t token_info_length);
/* extension functions */
typedef int32_t __stdcall ntapi_tt_enable_token_privilege(
__in void * htoken,
__in uint32_t privilege);
typedef int32_t __stdcall ntapi_tt_disable_token_privilege(
__in void * htoken,
__in uint32_t privilege);
#endif
|
