Invoke-TokenManipulation => Enum-AllTokens about powersploit HOT 7 CLOSED

The original doesn't work on Windows 10 because it is hard coded to use wininit.exe, which is a protected process in Windows 10. It's necessary to find another process to use. Better to check all available processes and find one that works than to use a hard coded process name.

I overlooked the fact that -IncludeUserName is PowerShell 4+ when I modified it. Obviously that breaks it on earlier versions. Will need to figure out another way to accomplish this.

from powersploit.

Understood!

from powersploit.

The below code should get the username for the processes on versions of PowerShell lower than 4:

[psobject]$AllProcessesFromWMI = Get-WmiObject -Class Win32_Process -ErrorAction 'SilentlyContinue'

[psobject[]]$AllProcessUserNames = @()
ForEach ($Process in $AllProcessesFromWMI) {
    Try { $ProcessOwnerInfo = $Process.GetOwner() } Catch { Continue }

    [psobject]$ProcessUserNameInfo = New-Object -TypeName 'PSObject' -Property @{
        PID = $Process.ProcessId
        NTAccount = If ($ProcessOwnerInfo.User) { "$($ProcessOwnerInfo.Domain)\$($ProcessOwnerInfo.User)" } Else { [string]::Empty }
    }
    [psobject[]]$AllProcessUserNames += $ProcessUserNameInfo
}
[string]$LocalSystemNTAccount = (New-Object -TypeName 'System.Security.Principal.SecurityIdentifier' -ArgumentList ([Security.Principal.WellKnownSidType]::'LocalSystemSid', $null)).Translate([Security.Principal.NTAccount]).Value
[int32[]]$AllSystemAccountProcessesIDs = $AllProcessUserNames | Where-Object { $_.NTAccount -eq $LocalSystemNTAccount} | Select-Object -ExpandProperty 'PID'

$SystemTokens = Get-Process | Where { $AllSystemAccountProcessesIDs -contains $_.Id }

I guess a nicer way would be to create a function that extends the results of the Get-Process function by adding a NoteProperty called NTAccount that contains the Domain\Username. But the above does the trick.

from powersploit.

Of course WMI is kind of slow. The Win32 method for getting a process username is much faster. Linking to an article about that here:
http://www.codeproject.com/Articles/14828/How-To-Get-Process-Owner-ID-and-Current-User-SID

from powersploit.

Sorry for the delay on this. Does anyone want to validate the fix?

from powersploit.

Thank you sir, fix verified!

from powersploit.

Thanks for bringing this to our attention!

from powersploit.