diff options
| author | Jon Cave <jon.cave@mwrinfosecurity.com> | 2016-06-29 16:23:45 +0200 |
|---|---|---|
| committer | Jon Cave <jon.cave@mwrinfosecurity.com> | 2016-06-30 09:00:31 +0200 |
| commit | 9d2b9d763113d5241be2bb800f2aabd289e92222 (patch) | |
| tree | 07757076358d3893bef9de27f0bea1c1aaafee5c /Privesc | |
| parent | 81ac124f2211799207711fcd1b5fadb0091510f6 (diff) | |
| download | PowerSploit-9d2b9d763113d5241be2bb800f2aabd289e92222.tar.gz PowerSploit-9d2b9d763113d5241be2bb800f2aabd289e92222.zip | |
PowerUp: Allocate enough space for TOKEN_GROUPS
Make an initial call to GetTokenInformation() with a NULL buffer to get
the actual buffer size required. Prevents "The data area passed to a system
call is too small" error being thrown.
Diffstat (limited to 'Privesc')
| -rw-r--r-- | Privesc/PowerUp.ps1 | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/Privesc/PowerUp.ps1 b/Privesc/PowerUp.ps1 index 0b62245..7b6d3d2 100644 --- a/Privesc/PowerUp.ps1 +++ b/Privesc/PowerUp.ps1 @@ -974,17 +974,16 @@ function Get-CurrentUserTokenGroupSid { $Success = $Advapi32::OpenProcessToken($CurrentProcess, $TOKEN_QUERY, [ref]$hProcToken);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if($Success) { - - $TokenGroupsPtrSize = $TOKEN_GROUPS::GetSize() + $TokenGroupsPtrSize = 0 + # Initial query to determine the necessary buffer size + $Success = $Advapi32::GetTokenInformation($hProcToken, 2, 0, $TokenGroupsPtrSize, [ref]$TokenGroupsPtrSize) [IntPtr]$TokenGroupsPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenGroupsPtrSize) - [UInt32]$RealSize = 0 - # query the current process token with the 'TokenGroups=2' TOKEN_INFORMATION_CLASS enum to retrieve a TOKEN_GROUPS structure - $Success2 = $Advapi32::GetTokenInformation($hProcToken, 2, $TokenGroupsPtr, $TokenGroupsPtrSize, [ref]$TokenGroupsPtrSize);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() + $Success = $Advapi32::GetTokenInformation($hProcToken, 2, $TokenGroupsPtr, $TokenGroupsPtrSize, [ref]$TokenGroupsPtrSize);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() - if($Success2) { + if($Success) { $TokenGroups = $TokenGroupsPtr -as $TOKEN_GROUPS |