diff options
| author | HarmJ0y <will@harmj0y.net> | 2016-07-15 14:10:29 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-07-15 14:10:29 -0700 |
| commit | e6391254d137accbfe222cb3e4e9bdcc5571f129 (patch) | |
| tree | 9b9dc4ff0a6ce43f1c9412275c993176dfaab9d4 | |
| parent | 28d118f98765e19ed05abc358be5522898c4925a (diff) | |
| parent | 9d2b9d763113d5241be2bb800f2aabd289e92222 (diff) | |
| download | PowerSploit-e6391254d137accbfe222cb3e4e9bdcc5571f129.tar.gz PowerSploit-e6391254d137accbfe222cb3e4e9bdcc5571f129.zip | |
Merge pull request #160 from joncave/tokeninfo
PowerUp: Allocate enough space for TOKEN_GROUPS
| -rw-r--r-- | Privesc/PowerUp.ps1 | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/Privesc/PowerUp.ps1 b/Privesc/PowerUp.ps1 index 0b62245..7b6d3d2 100644 --- a/Privesc/PowerUp.ps1 +++ b/Privesc/PowerUp.ps1 @@ -974,17 +974,16 @@ function Get-CurrentUserTokenGroupSid { $Success = $Advapi32::OpenProcessToken($CurrentProcess, $TOKEN_QUERY, [ref]$hProcToken);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if($Success) { - - $TokenGroupsPtrSize = $TOKEN_GROUPS::GetSize() + $TokenGroupsPtrSize = 0 + # Initial query to determine the necessary buffer size + $Success = $Advapi32::GetTokenInformation($hProcToken, 2, 0, $TokenGroupsPtrSize, [ref]$TokenGroupsPtrSize) [IntPtr]$TokenGroupsPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenGroupsPtrSize) - [UInt32]$RealSize = 0 - # query the current process token with the 'TokenGroups=2' TOKEN_INFORMATION_CLASS enum to retrieve a TOKEN_GROUPS structure - $Success2 = $Advapi32::GetTokenInformation($hProcToken, 2, $TokenGroupsPtr, $TokenGroupsPtrSize, [ref]$TokenGroupsPtrSize);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() + $Success = $Advapi32::GetTokenInformation($hProcToken, 2, $TokenGroupsPtr, $TokenGroupsPtrSize, [ref]$TokenGroupsPtrSize);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() - if($Success2) { + if($Success) { $TokenGroups = $TokenGroupsPtr -as $TOKEN_GROUPS |