https://github.com/voidvxvt/enablealltokenprivs
Enable or Disable TokenPrivilege(s)
https://github.com/voidvxvt/enablealltokenprivs
Last synced: about 1 year ago
JSON representation
Enable or Disable TokenPrivilege(s)
- Host: GitHub
- URL: https://github.com/voidvxvt/enablealltokenprivs
- Owner: voidvxvt
- Created: 2024-02-17T15:39:25.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-05-17T12:43:43.000Z (about 2 years ago)
- Last Synced: 2025-03-29T19:04:05.791Z (about 1 year ago)
- Language: C#
- Homepage:
- Size: 19.5 KB
- Stars: 13
- Watchers: 1
- Forks: 5
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# EnableAllTokenPrivs
Enable or Disable TokenPrivilege(s)
This program is actually pretty useless as it is just a wrapper for the [`AdjustTokenPrivileges()`](https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges) WinAPI function and enables or disables privileges on processes.
Typically, when a program needs to perform a privileged task, it will simply call `AdjustTokenPrivileges` to enable the privileges it needs, or disable the privileges when it is done performing that privileged task.
## Usage
```cmd
C:\tools>.\EnableAllTokenPrivs.exe
EnableAllTokenPrivs.exe -> Enable/Disable TokenPrivilege(s)
-p --pid 6969 enable/disable privilege(s) of a process
-d --disable disable privilege(s)
-P --privilege SeDebugPrivilege enable/disable a single privilege
-l --list list privileges
-h --help print help (this output)
```
**Examples**
enable all disabled TokenPrivileges of the calling/parent process:
```cmd
EnableAllTokenPrivs.exe
```
list the TokenPrivileges of the calling/parent process (`whoami /priv`):
```cmd
EnableAllTokenPrivs.exe -l
```
enable the SeDebugPrivilege of the calling/parent process:
```cmd
EnableAllTokenPrivs.exe -P SeDebugPrivilege
```
disabled the SeDebugPrivilege of the process with PID 6969:
```cmd
EnableAllTokenPrivs.exe --pid 6969 --disable --privilege SeDebugPrivilege
```
list the TokenPrivileges of the process with PID 6969:
```cmd
EnableAllTokenPrivs.exe --pid 6969 --list
```
disable all enabled privileges of the process with PID 6969:
```cmd
EnableAllTokenPrivs.exe --pid 6969 --disable
```
disable the SeDebugPrivilege of the process with PID 6969:
```cmd
EnableAllTokenPrivs.exe --pid 6969 --disable --privilege SeDebugPrivilege
```
## Usage in sliver implant with `execute-assembly`
execute the assembly in a sacrifical process which enables all TokenPrivileges of the implant process (idk why you would do this but you can):
```sliver
execute-assembly -c EnableAllTokenPrivs.EnableAllTokenPrivs -m Main /tmp/EnableAllTokenPrivs.exe
```
___
if you just want to enable all privileges for your powershell process, you can use:
[EnableAllTokenPrivs.ps1](https://github.com/fashionproof/EnableAllTokenPrivs/blob/master/EnableAllTokenPrivs.ps1)
___
## Sources
[MSDN - OpenProcessToken](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken)
[MSDN - AdjustTokenPrivileges](https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges)
[antonioCoco/RunasCs](https://github.com/antonioCoco/RunasCs/blob/master/RunasCs.cs)