diff options
| author | Matt Graeber <mattifestation@users.noreply.github.com> | 2016-01-13 11:09:42 -0800 |
|---|---|---|
| committer | Matt Graeber <mattifestation@users.noreply.github.com> | 2016-01-13 11:09:42 -0800 |
| commit | e83e97d672632ca2253e06c9e00ef427c6f8353c (patch) | |
| tree | ca7bc4b991a98cf3af3d14ed4eb650d7b687f24d /Exfiltration | |
| parent | 872d4b0eb74072465980567d5cf2cb42fa0283d5 (diff) | |
| parent | 2a813faedb853d8043446c6d0cad2119ecd62d61 (diff) | |
| download | PowerSploit-e83e97d672632ca2253e06c9e00ef427c6f8353c.tar.gz PowerSploit-e83e97d672632ca2253e06c9e00ef427c6f8353c.zip | |
Merge pull request #110 from PowerShellMafia/master
Merging Invoke-TokenManipulation fix into dev
Diffstat (limited to 'Exfiltration')
| -rw-r--r-- | Exfiltration/Invoke-TokenManipulation.ps1 | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Exfiltration/Invoke-TokenManipulation.ps1 b/Exfiltration/Invoke-TokenManipulation.ps1 index 3a61da8..ea30952 100644 --- a/Exfiltration/Invoke-TokenManipulation.ps1 +++ b/Exfiltration/Invoke-TokenManipulation.ps1 @@ -1685,7 +1685,8 @@ Blog on this script: http://clymb3r.wordpress.com/2013/11/03/powershell-and-toke #First GetSystem. The script cannot enumerate all tokens unless it is system for some reason. Luckily it can impersonate a system token. #Even if already running as system, later parts on the script depend on having a SYSTEM token with most privileges. #We need to enumrate all processes running as SYSTEM and find one that we can use. - $SystemTokens = Get-Process -IncludeUserName | Where {$_.Username -eq "NT AUTHORITY\SYSTEM"} + [string]$LocalSystemNTAccount = (New-Object -TypeName 'System.Security.Principal.SecurityIdentifier' -ArgumentList ([Security.Principal.WellKnownSidType]::'LocalSystemSid', $null)).Translate([Security.Principal.NTAccount]).Value + $SystemTokens = Get-Process -IncludeUserName | Where {$_.Username -eq $LocalSystemNTAccount} ForEach ($SystemToken in $SystemTokens) { $SystemTokenInfo = Get-PrimaryToken -ProcessId $SystemToken.Id -WarningAction SilentlyContinue -ErrorAction SilentlyContinue |