Question

我的目标是在使用目标令牌启动用户模式进程之前，将privileges从一个主用户令牌复制到另一个用户令牌。我创建了一个示例伪代码来说明我需要完成的任务。

以下内容将从本地系统服务运行：

←[36mfilter received {:event=>{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]:(root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT"}, :level=>:debug, :file=>"(eval)", :line=>"69", :method=>"filter_func"}
 ←[0m
 ←[36mRunning grok filter {:event=>#<LogStash::Event:0x166d6250 @metadata_accessors=#<LogStash::Util::Accessors:0x14fe0ed7 @store={}, @lut={}>, @cancelled=false, @data={"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT"}, @metadata={}, @accessors=#<LogStash::Util::Accessors:0x6ee8ffaf @store={"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT"}, @lut={"host"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root)
CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT"}, "host"]}>>, :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-1.0.0/lib/logstash/filters/grok.rb", :line=>"283", :method=>"filter"}
←[0m
←[36mRegexp match object {:names=>["SYSLOGTIMESTAMP:message_timestamp", "SYSLOGHOST:message_hostname", "DATA:message_program", "POSINT:message_pid", "GREEDYDATA:user_message"], :captures=>["Jul 27 07:49:01", "Server1", "CRON", "21009", "(root) CMD LTest Message\r"], :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.2/lib/grok-pure.rb", :line=>"179", :method=>"match_and_capture"}
←[0m
←[36mfilters/LogStash::Filters::Grok: adding value to field {:field=>"received_at", :value=>["%{@timestamp}"], :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/util/decorators.rb", :line=>"28", :method=>"add_fields"}

←[0m
←[36mEvent now:  {:event=>#<LogStash::Event:0x166d6250 @metadata_accessors=#<LogStash::Util::Accessors:0x14fe0ed7 @store={}, @lut={}>, @cancelled=false, @data={"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, @metadata={}, @accessors=#<LogStash::Util::Accessors:0x6ee8ffaf @store={"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, @lut={"host"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "host"], "message"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009","user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message"], "message_timestamp"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_timestamp"], "message_hostname"=>[{"message"=>"Jul27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_hostname"], "message_program"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTestMessage\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_program"], "message_pid"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_pid"], "user_message"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "user_message"], "@timestamp"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "@timestamp"], "received_at"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01","message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "received_at"]}>>, :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-1.0.0/lib/logstash/filters/grok.rb", :line=>"303", :method=>"filter"}

←[0m
←[36mDate filter: received event {:type=>nil, :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/jruby/1.9/gems/logstash-filter
-date-1.0.0/lib/logstash/filters/date.rb", :line=>"206", :method=>"filter"}
←[0m←[36mDate filter looking for field {:type=>nil, :field=>"syslog_timestamp", :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/
jruby/1.9/gems/logstash-filter-date-1.0.0/lib/logstash/filters/date.rb", :line=>
"209", :method=>"filter"}
←[0m
←[36moutput received {:event=>{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]:(root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, :level=>:debug, :file=>"(eval)", :line=>"76", :method=>"output_func"}
←[0m
←[36mFlushing output {:outgoing_count=>1, :time_since_last_flush=>22.048, :outgoing_events=>{nil=>[["index", {:_id=>nil, :_index=>"%index-2015-08-14", :_type=>"logs", :_routing=>nil},
#<LogStash::Event:0x166d6250 
@metadata_accessors=#<LogStash::Util::Accessors:0x14fe0ed7 @store={"retry_count"=>0}, @lut={}>, @cancelled=false, @data={"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, @metadata={"retry_count"=>0}, 
@accessors=#<LogStash::Util::Accessors:0x6ee8ffaf @store={"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, @lut={"host"=>[{"message"=>sage\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, @lut={"host"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r","received_at"=>"2015-08-14T07:34:53.215Z"}, "host"], "message"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message"], "message_timestamp"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_timestamp"], "message_hostname"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_hostname"], "message_program"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_program"], "message_pid"=>[{"message"=>"Jul 27 07:49:01 Server1CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "message_pid"], "user_message"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "user_message"], "@timestamp"=>[{"message"=>"Jul 2707:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "@timestamp"], "received_at"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "received_at"], "type"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r","received_at"=>"2015-08-14T07:34:53.215Z"}, "type"], "syslog_timestamp"=>[{"message"=>"Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r", "@version"=>"1", "@timestamp"=>"2015-08-14T07:34:53.215Z", "host"=>"HOST-LT", "message_timestamp"=>"Jul 27 07:49:01", "message_hostname"=>"Server1", "message_program"=>"CRON", "message_pid"=>"21009", "user_message"=>"(root) CMD LTest Message\r", "received_at"=>"2015-08-14T07:34:53.215Z"}, "syslog_timestamp"]}>>]]}, :batch_timeout=>1, :force=>nil, :final=>nil, :level=>:debug, :file=>"/Folder/logstash-1.5.3/logstash-1.5.3/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb", :line=>"207", :method=>"buffer_flush"}

←[0m{              "message" => "Jul 27 07:49:01 Server1 CRON[21009]: (root) CMD LTest Message\r",
             "@version" => "1",
           "@timestamp" => "2015-08-14T07:34:53.215Z",
                 "host" => "HOST-LT",
    "message_timestamp" => "Jul 27 07:49:01",
     "message_hostname" => "Server1",
      "message_program" => "CRON",
          "message_pid" => "21009",
         "user_message" => "(root) CMD LTest Message\r",
          "received_at" => "2015-08-14T07:34:53.215Z"
}

知道如何将权限从//dwSessionId = user session ID to run process in HANDLE hToken1 = NULL; //Source user token WTSQueryUserToken(dwSessionId, &hToken1); HANDLE hSelfToken = NULL; //User token for system service HANDLE hToken2 = NULL; //Adjusted self-token OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS, &hSelfToken); DuplicateTokenEx(hSelfToken, TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS, NULL, SecurityIdentification, TokenPrimary, &hToken2); //Specify user session to run in SetTokenInformation(hToken2, TokenSessionId, &dwSessionId, sizeof(dwSessionId)); //Now I need to set privileges in 'hToken2' as they are in 'hToken1' ... //Then use 'hToken2' in CreateProcessAsUser() to start a process复制到hToken1吗？

Answer 1

使用以下代码从hToken2获取hToken，然后在CreateProcessAsUser中使用它。实际上没有必要使用hSelfToken。

HANDLE GetAdjustedToken(HANDLE hSrcToken)
{
    TOKEN_LINKED_TOKEN admin = {};
    HANDLE hTarToken = 0;
    DWORD dw = 0;
    if (GetTokenInformation(hSrcToken, (TOKEN_INFORMATION_CLASS)TokenLinkedToken, &admin, sizeof(TOKEN_LINKED_TOKEN), &dw))
    {
        hTarToken = admin.LinkedToken;
    }
    else
    {
        DuplicateTokenEx(hSrcToken, MAXIMUM_ALLOWED, NULL, SecurityIdentification, TokenPrimary, &hTarToken);
    }
    return hTarToken;
}

如果您想以较低的强制性完整性级别创建新流程，请参阅this MSDN文章。

Answer 2

首先，您必须使用GetTokenInformation类为原始令牌调用TokenPrivileges以获取TOKEN_PRIVILEGES结构。然后用它调用AdjustTokenPrivileges来更新克隆的令牌。您必须两次调用GetTokenInformation - 第一个用于获取缓冲区长度，第二个用于获取实际数据。

HANDLE hSelfToken = NULL;   //User token for system service
HANDLE hToken2 = NULL;      //Adjusted self-token

OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS, &hSelfToken);
DuplicateTokenEx(hSelfToken, TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS,
    NULL, SecurityIdentification, TokenPrimary, &hToken2);

PTOKEN_PRIVILEGES pPriv = NULL;
DWORD dwLen = 0;
GetTokenInformation(hSelfToken, TokenPrivileges, (LPVOID)pPriv, 0, &dwLen);
if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
    return(0);

pPriv = (PTOKEN_PRIVILEGES)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwLen);
if (!GetTokenInformation(hSelfToken, TokenPrivileges, (LPVOID)pPriv, dwLen, &dwLen))
    return(0);

AdjustTokenPrivileges(hToken2, FALSE, pPriv, dwLen, NULL, NULL);

Answer 3

行。我可能已经接近了我需要的东西。它并不是真正复制权限，但为了“剥离”权限，我可以创建一个几乎删除了所有权限的受限令牌（SeChangeNotifyPrivilege和SeSystemtimePrivilege除外。）

//Call the following instead of DuplicateTokenEx() in my example above
CreateRestrictedToken(hSelfToken, DISABLE_MAX_PRIVILEGE,
            0, NULL, 0, NULL, 0, NULL,
            &hToken2);

仅供参考：这是一个奇怪的事实。出于某种原因，我无法从令牌中删除SeSystemtimePrivilege。不使用此方法，也不使用AdjustTokenPrivileges，其属性设置为SE_PRIVILEGE_REMOVED。除了这一个之外，所有其他权限都可以被删除。所以如果有人知道为什么，我会很高兴学到它吗？

如何将权限从一个主要用户令牌复制到另一个？

3 个答案: