Home page logo

metasploit logo Metasploit mailing list archives

Re: Using AdjustTokenPrivileges via Meterpreter Railgun
From: Rob Fuller <mubix () room362 com>
Date: Thu, 10 Jan 2013 15:34:44 -0500

The only way I know to make structs is to create them in ruby, byte for
bytes, get a size and write them to memory, then point what needs the
struct at that memory space (keeping in mind endianess)

Chao-mu was working on an automated way to do this but I don't think he
finished it. I do believe others have done this in other modules too. Look
for any write memory stuff in the post modules section.

Rob Fuller | Mubix
Certified Checkbox Unchecker
Room362.com | Hak5.org

On Mon, Jan 7, 2013 at 3:45 PM, Spencer, Shelby C
<Shelby_C_Spencer () rl gov>wrote:


** **

I’m trying to add a couple token privilege to the current process
Meterpreter is running under like so:****

** **

hcurrent = client.railgun.kernel32.GetCurrentProcess****

hcurrentToken =
client.railgun.advapi32.OpenProcessToken(hcurrent["return"], 40, 4) ****

SeIncreaseQuotaPrivilege =
"SeIncreaseQuotaPrivilege", 4)****

SeAssignPrimaryTokenPrivilege =
"SeAssignPrimaryTokenPrivilege", 4)****

false, <PTOKEN_PRIVILEGES Struct Here>, 0, nil, nil)****

** **

According to the MSDN documentation on AdjustTokenPrivileges (
the PTOKEN_PRIVILEGES struct should look something like this:****

privileges = {"PrivilegeCount" => 2, "Privileges" => [{"Luid" =>
SeIncreaseQuotaPrivilege["lpLuid"], "Attributes" => 2}, {"Luid" =>
SeIncreaseQuotaPrivilege["lpLuid"], "Attributes" => 2}]} #Ruby syntax****

** **

Obviously this complicated struct needs to be packed somehow using Ruby’s
“pack” command, but the problem is that I have no idea how to begin.  I
can’t find any documentation or any other modules which do anything
similarly complex.****

The closest code I found was in Metasm source:

I couldn’t seem to figure out how to translate this to my method using
Railgun, or call the Metasm module and methods in that file directly.****

** **

I’m sure this is probably pretty simple, I just need a little guidance.***

** **

Thanks in advance,****


** **



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]