tokens

Documentation

Index

• Constants
• Variables
• func ApplyToken() error
• func CreateProcessWithToken(hToken windows.Token, application string, args []string) (stdout string, stderr string)
• func GetCurrentUserAndGroup() (username, group string, err error)
• func GetTokenIntegrityLevel(token windows.Token) (string, error)
• func GetTokenPrivileges(token windows.Token) (privs []windows.LUIDAndAttributes, err error)
• func GetTokenSessionId(token windows.Token) (sessionId uint32, err error)
• func GetTokenUsername(token windows.Token) (username string, err error)
• func ImpersonationToString(level uint32) string
• func LogonUser(user string, password string, domain string, logonType uint32, ...) (hToken windows.Token, err error)
• func PrivilegeAttributeToString(attribute uint32) string
• func PrivilegeToString(priv windows.LUID) string
• func TokenTypeToString(tokenType uint32) string
• type TOKEN_STATISTICS
  • func GetTokenStats(token windows.Token) (tokenStats TOKEN_STATISTICS, err error)

Constants

const (
	LOGON32_LOGON_INTERACTIVE       uint32 = 2
	LOGON32_LOGON_NETWORK           uint32 = 3
	LOGON32_LOGON_BATCH             uint32 = 4
	LOGON32_LOGON_SERVICE           uint32 = 5
	LOGON32_LOGON_UNLOCK            uint32 = 7
	LOGON32_LOGON_NETWORK_CLEARTEXT uint32 = 8
	LOGON32_LOGON_NEW_CREDENTIALS   uint32 = 9
)

LOGON32_LOGON_ constants from winbase.h The type of logon operation to perform

const (
	LOGON32_PROVIDER_DEFAULT uint32 = iota
	LOGON32_PROVIDER_WINNT35
	LOGON32_PROVIDER_WINNT40
	LOGON32_PROVIDER_WINNT50
	LOGON32_PROVIDER_VIRTUAL
)

LOGON32_PROVIDER_ constants The logon provider

const (
	LOGON_WITH_PROFILE        uint32 = 0x1
	LOGON_NETCREDENTIALS_ONLY uint32 = 0x2
)

LOGON_ The logon option

Variables

var Token windows.Token

Functions

func ApplyToken

func ApplyToken() error

ApplyToken applies any stolen or created Windows access token's to the current thread

func CreateProcessWithToken

func CreateProcessWithToken(hToken windows.Token, application string, args []string) (stdout string, stderr string)

CreateProcessWithToken creates a new process as the user associated with the passed in token STDOUT/STDERR is redirected to an anonymous pipe and collected after execution to be returned This requires administrative privileges or at least the SE_IMPERSONATE_NAME privilege

func GetCurrentUserAndGroup

func GetCurrentUserAndGroup() (username, group string, err error)

GetCurrentUserAndGroup retrieves the username and the user's primary group for the calling process primary token

func GetTokenIntegrityLevel

func GetTokenIntegrityLevel(token windows.Token) (string, error)

GetTokenIntegrityLevel enumerates the integrity level for the provided token and returns it as a string

func GetTokenPrivileges

func GetTokenPrivileges(token windows.Token) (privs []windows.LUIDAndAttributes, err error)

GetTokenPrivileges enumerates the token's privileges and attributes and returns them

func GetTokenSessionId

func GetTokenSessionId(token windows.Token) (sessionId uint32, err error)

GetTokenSessionId returns the session ID associated with the token

func GetTokenUsername

func GetTokenUsername(token windows.Token) (username string, err error)

GetTokenUsername returns the domain and username associated with the provided token as a string

func ImpersonationToString

func ImpersonationToString(level uint32) string

ImpersonationToString converts a SECURITY_IMPERSONATION_LEVEL uint32 value to it's associated string

func LogonUser

func LogonUser(user string, password string, domain string, logonType uint32, logonProvider uint32) (hToken windows.Token, err error)

LogonUser creates a new logon session for the user according to the provided logon type and returns a Windows access token for that logon session. This is a wrapper function that includes additional validation checks

func PrivilegeAttributeToString

func PrivilegeAttributeToString(attribute uint32) string

PrivilegeAttributeToString converts a privilege attribute integer to a string

func PrivilegeToString

func PrivilegeToString(priv windows.LUID) string

PrivilegeToString converts a LUID to it's string representation

func TokenTypeToString

func TokenTypeToString(tokenType uint32) string

TokenTypeToString converts a TOKEN_TYPE uint32 value to it's associated string

Types

type TOKEN_STATISTICS

type TOKEN_STATISTICS struct {
	TokenId            windows.LUID
	AuthenticationId   windows.LUID
	ExpirationTime     int64
	TokenType          uint32 // Enum of TokenPrimary 0 or TokenImpersonation 1
	ImpersonationLevel uint32 // Enum
	DynamicCharged     uint32
	DynamicAvailable   uint32
	GroupCount         uint32
	PrivilegeCount     uint32
	ModifiedId         windows.LUID
}

TOKEN_STATISTICS contains information about an access token https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-token_statistics

typedef struct _TOKEN_STATISTICS {
 LUID                         TokenId;
 LUID                         AuthenticationId;
 LARGE_INTEGER                ExpirationTime;
 TOKEN_TYPE                   TokenType;
 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 DWORD                        DynamicCharged;
 DWORD                        DynamicAvailable;
 DWORD                        GroupCount;
 DWORD                        PrivilegeCount;
 LUID                         ModifiedId;
} TOKEN_STATISTICS, *PTOKEN_STATISTICS;

func GetTokenStats

func GetTokenStats(token windows.Token) (tokenStats TOKEN_STATISTICS, err error)

GetTokenStats uses the GetTokenInformation Windows API call to gather information about the provided access token by retrieving the token's associated TOKEN_STATISTICS structure