DΛΣMӨП

// HackTricks · Windows

Access Tokens

Access Tokens

Access Tokens

Each user logged onto the system holds an access token with security information for that logon session. The system creates an access token when the user logs on. Every process executed on behalf of the user has a copy of the access token. The token identifies the user, the user’s groups, and the user’s privileges. A token also contains a logon SID (Security Identifier) that identifies the current logon session.

You can see this information executing whoami /all

whoami /all

USER INFORMATION
----------------

User Name             SID
===================== ============================================
desktop-rgfrdxl\cpolo S-1-5-21-3359511372-53430657-2078432294-1001


GROUP INFORMATION
-----------------

Group Name                                                    Type             SID                                                                                                           Attributes
============================================================= ================ ============================================================================================================= ==================================================
Mandatory Label\Medium Mandatory Level                        Label            S-1-16-8192
Everyone                                                      Well-known group S-1-1-0                                                                                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-114                                                                                                     Group used for deny only
BUILTIN\Administrators                                        Alias            S-1-5-32-544                                                                                                  Group used for deny only
BUILTIN\Users                                                 Alias            S-1-5-32-545                                                                                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Performance Log Users                                 Alias            S-1-5-32-559                                                                                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                                      Well-known group S-1-5-4                                                                                                       Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                                                 Well-known group S-1-2-1                                                                                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users                              Well-known group S-1-5-11                                                                                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization                                Well-known group S-1-5-15                                                                                                      Mandatory group, Enabled by default, Enabled group
MicrosoftAccount\cpolop@outlook.com                           User             S-1-11-96-3623454863-58364-18864-2661722203-1597581903-3158937479-2778085403-3651782251-2842230462-2314292098 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account                                    Well-known group S-1-5-113                                                                                                     Mandatory group, Enabled by default, Enabled group
LOCAL                                                         Well-known group S-1-2-0                                                                                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Cloud Account Authentication                     Well-known group S-1-5-64-36                                                                                                   Mandatory group, Enabled by default, Enabled group


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

or using Process Explorer from Sysinternals (select process and access”Security” tab):

Access Tokens - Access Tokens: or using Process Explorer from Sysinternals (select process and access"Security" tab)

Local administrator

When a local administrator logins, two access tokens are created: One with admin rights and other one with normal rights. By default, when this user executes a process the one with regular (non-administrator) rights is used. When this user tries to execute anything as administrator (“Run as Administrator” for example) the UAC will be used to ask for permission.
If you want to learn more about the UAC read this page.

In practice, this means a non-elevated admin shell usually runs with a filtered token. That is why whoami /groups often shows BUILTIN\Administrators as Deny only until the process is elevated. Internally, Windows keeps a linked elevated token (TokenLinkedToken) and tracks the state with fields such as TokenElevationType.

Credentials user impersonation

If you have valid credentials of any other user, you can create a new logon session with those credentials :

runas /user:domain\username cmd.exe

The access token has also a reference of the logon sessions inside the LSASS, this is useful if the process needs to access some objects of the network.
You can launch a process that uses different credentials for accessing network services using:

runas /user:domain\username /netonly cmd.exe

This is useful if you have useful credentials to access objects in the network but those credentials aren’t valid inside the current host as they are only going to be used in the network (in the current host your current user privileges will be used).

runas /netonly details

runas /netonly (and C2 helpers such as make_token) creates a LOGON32_LOGON_NEW_CREDENTIALS token. This is very useful to understand during lateral movement because:[3]

  • Locally, the new process keeps the same local identity, groups, integrity level, and most of the same access decisions as the current token.
  • Remotely, outbound authentication can use the supplied credentials for SMB / WinRM / LDAP / HTTP / Kerberos / NTLM.
  • Therefore whoami may still show the original local user while network access happens as the alternate account.

This is a great option when the credentials are valid in the domain or in another host, but the user cannot or should not log on locally to the current machine.

Types of tokens

There are two types of tokens available:

  • Primary Token: It serves as a representation of a process’s security credentials. The creation and association of primary tokens with processes are actions that require elevated privileges, emphasizing the principle of privilege separation. Typically, an authentication service is responsible for token creation, while a logon service handles its association with the user’s operating system shell. It is worth noting that processes inherit the primary token of their parent process at creation.
  • Impersonation Token: Empowers a server application to adopt the client’s identity temporarily for accessing secure objects. This mechanism is stratified into four levels of operation:
    • Anonymous: Grants server access akin to that of an unidentified user.
    • Identification: Allows the server to verify the client’s identity without utilizing it for object access.
    • Impersonation: Enables the server to operate under the client’s identity.
    • Delegation: Similar to Impersonation but includes the ability to extend this identity assumption to remote systems the server interacts with, ensuring credential preservation.

Impersonate Tokens

Using the incognito module of metasploit if you have enough privileges you can easily list and impersonate other tokens. This could be useful to perform actions as if you where the other user. You could also escalate privileges with this technique.

Some practical notes that are easy to forget while operating:[1]

  • CreateProcessWithTokenW requires SeImpersonatePrivilege in the caller and the new process will run in the caller’s session.
  • CreateProcessAsUserW is the usual fallback when CreateProcessWithTokenW fails with 1314, or when you need to launch in the session referenced by the token.
  • If a token comes from LogonUser(LOGON32_LOGON_NETWORK), it is usually an impersonation token, so you need DuplicateTokenEx(..., TokenPrimary, ...) before trying to spawn a process with it.
  • Not every impersonation token is equally useful: SecurityIdentification lets you inspect the user but not act as them. If a coercion primitive or pipe/RPC client gives you only an identification-level token, check TokenImpersonationLevel and switch to a primitive that yields SecurityImpersonation or better.

Token theft without touching LSASS

If you already have a service or SYSTEM context and a privileged user is logged on, stealing or duplicating that user’s token is often quieter than dumping LSASS. In many real intrusions this is enough to:[2]

  • run local actions as that user
  • access remote resources as that user
  • perform AD operations without extracting reusable credentials first

For examples of session/user token hijacking from a privileged context, check WTS Impersonator. Remember that APIs such as WTSQueryUserToken are meant for highly trusted services and normally require LocalSystem + SeTcbPrivilege, so they are primarily useful once you already control a service-level context. For privilege-specific ways to obtain SYSTEM first, check the pages below.

Token Privileges

Learn which token privileges can be abused to escalate privileges:

Privilege Escalation Abusing Tokens

Take a look to all the possible token privileges and some definitions on this external page.

References