Token Theft

Algorithm

The steal_token() function performs the following steps:

1. OpenProcess with PROCESS_QUERY_LIMITED_INFORMATION
2. OpenProcessToken to obtain the target's primary token
3. DuplicateTokenEx(SecurityAnonymous, TokenPrimary) to create a usable copy
4. Enable SeAssignPrimaryTokenPrivilege via AdjustTokenPrivileges
5. ImpersonateLoggedOnUser to impersonate the token
6. CreateProcessAsUserW to spawn a new process under the stolen token
7. RevertToSelf to restore the original security context

Usage

1. Right-click on a process in the Process tab
2. Navigate to Miscellaneous → Steal Token
3. In the Token Thief window:
   • • Source process name and PID are displayed
   • • Select the executable to launch under the stolen token
   • • Optionally provide command line arguments
4. Click Steal Token
5. Success shows the new process PID/TID

Common Targets

Useful token sources for privilege escalation research:

• • SYSTEM processes — winlogon.exe, lsass.exe, services.exe
• • Service accounts — Processes running as LocalService or NetworkService
• • Elevated processes — Any process running with administrator privileges

Required Privileges

Token theft requires the following privileges (typically available to administrators):

• • SeDebugPrivilege — To open processes with limited access
• • SeAssignPrimaryTokenPrivilege — To assign tokens to new processes
• • SeImpersonatePrivilege — To impersonate tokens

Implementation