<reponame>shownadda/Malware-Dev
## Check Process Token

# Global Imports
import ctypes
from ctypes.wintypes import DWORD

# Grab a handle on Advapi.dll, User32.dll and Kernel32.dll
a_handle = ctypes.WinDLL("Advapi32.dll")
u_handle = ctypes.WinDLL("User32.dll")
k_handle = ctypes.WinDLL("Kernel32.dll")

# Shortcut to give "All Access" rights to the current process. 
# The |'s are being used as "or" statements, as a shortcut instead of typing out every variable needed, and their values.
PROCESS_ALL_ACCESS = ( 0x000f0000 | 0x00100000 | 0xFFF)

# Also used in C# Libraries
# 2 is enabled, 0 is disabled
SE_PRIVILEGE_ENABLED = 0x00000002
SE_PRIVILEGE_DISABLED = 0x00000000

# Token Access Rights
STANDARD_RIGHTS_REQUIRED = 0x000F0000               #
STANDARD_RIGHTS_READ = 0x00020000                   #
TOKEN_ASSIGN_PRIMARY = 0x0001                       #
TOKEN_DUPLICATE = 0x0002                            #
TOKEN_IMPERSONATION = 0x0004                        #
TOKEN_QUERY = 0x0008                                #
TOKEN_QUERY_SOURCE = 0x0010                         #
TOKEN_ADJUST_PRIVILEGES = 0x0020                    #
TOKEN_ADJUST_GROUPS = 0x0040                        #
TOKEN_ADJUST_DEFAULT = 0x0080                       #
TOKEN_ADJUST_SESSIONID = 0x0100                     #
TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY)   #
TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | 
					TOKEN_ASSIGN_PRIMARY     |
					TOKEN_DUPLICATE          |
					TOKEN_IMPERSONATION      |
					TOKEN_QUERY              |
					TOKEN_QUERY_SOURCE       |
					TOKEN_ADJUST_PRIVILEGES  |
					TOKEN_ADJUST_GROUPS      |
					TOKEN_ADJUST_DEFAULT     |
					TOKEN_ADJUST_SESSIONID)

class LUID(ctypes.Structure):
    _fields_ = [
        ("LowPart", DWORD),
        ("HighPart", DWORD),
    ]

class LUID_AND_ATTRIBUTES(ctypes.Structure):
    _fields_ = [
        ("Luid", LUID),
        ("Attritbutes", DWORD),
    ]

class PRIVILEGE_SET(ctypes.Structure):
    _fields_ = [
        ("PrivilegeCount", DWORD),
        ("Control", DWORD),
        ("Privileges", LUID_AND_ATTRIBUTES),
    ]

# Grab the Window Name from User32.dll
lpWindowName = ctypes.c_char_p(input("Enter Window name to hook into: ").encode('utf-8'))
hWnd = u_handle.FindWindowA(None, lpWindowName)

if hWnd == 0:
    print("Error Code: {0} - Could not grab Process Handle! Error Code: {0}".format(k_handle.GetLastError()))
    exit(1)
else:
    print("Successfuly got Handle.")

lpdwProcessId = ctypes.c_ulong()

response = u_handle.GetWindowThreadProcessId(hWnd, ctypes.byref(lpdwProcessId))

if response == 0:
    print("Error Code: {0} - Could not grab PID from Handle! Error Code: {0}".format(k_handle.GetlastError))
    exit(1)
else:
    print("Successfuly got PID!")

dwDesiredAccess = PROCESS_ALL_ACCESS
bInheritHandle = False
dwProcessId = lpdwProcessId

hProcess = k_handle.OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId)

if hProcess <= 0:
    print("Error Code {0} - Could not grab Priv Handle".format(k_handle.GetLastError()))
else:
    print("Successfully grabbed higher privileges!")

# Open a Handle to the Process's Token Directly
ProcessHandle = hProcess
DesiredAccess = TOKEN_ALL_ACCESS
TokenHandle = ctypes.c_void_p()

response = k_handle.OpenProcessToken(ProcessHandle, DesiredAccess, ctypes.byref(TokenHandle))

if response > 0:
    print("Handle to Process Token created! Token: {0}".format(TokenHandle))
else:
    print("Error: could not grab priviledged Token Handle! Error Code: {0}".format(k_handle.GetLastError()))

lpSystemName = None
lpName = "SEDebugPrivilege"
lpLuid = LUID()

response = a_handle.LookupPrivilegeValueW(lpSystemName, lpName, ctypes.byref(lpLuid))

if response > 0:
    print("Successfully found the LUID!")
else:
    print("Error: could not grab LUID! Error Code: {0}".format(k_handle.GetLastError()))

print("LUID VALUE HIGH: {0} \nLUID VALUE LOW: {1}".format(lpLuid.HighPart, lpLuid.LowPart))

requiredPrivileges = PRIVILEGE_SET()
requiredPrivileges.PrivilegeCount = 1
requiredPrivileges.Privileges = LUID_AND_ATTRIBUTES()
requiredPrivileges.Privileges.Luid = lpLuid
requiredPrivileges.Privileges.Attributes = SE_PRIVILEGE_ENABLED

pfResult = ctypes.c_long()

response = a_handle.PrivilegeCheck(TokenHandle, ctypes.byref(requiredPrivileges), ctypes.byref(pfResult))

if response > 0:
    print("Successfully ran Privilege check!")
else:
    print("Error: Was unable to check Privileges! Error Code: {0}".format(k_handle.GetLastError()))

if pfResult:
    print("Privilege Enabled: {0}".format(lpName))
else:
    print("Privileges Disabled: {0}".format(lpName))

## Check Process Token

# Global Imports
import ctypes
from ctypes.wintypes import DWORD

# Grab a handle on Advapi.dll, User32.dll and Kernel32.dll
a_handle = ctypes.WinDLL("Advapi32.dll")
u_handle = ctypes.WinDLL("User32.dll")
k_handle = ctypes.WinDLL("Kernel32.dll")

# Shortcut to give "All Access" rights to the current process. 
# The |'s are being used as "or" statements, as a shortcut instead of typing out every variable needed, and their values.
PROCESS_ALL_ACCESS = ( 0x000f0000 | 0x00100000 | 0xFFF)

# Also used in C# Libraries
# 2 is enabled, 0 is disabled
SE_PRIVILEGE_ENABLED = 0x00000002
SE_PRIVILEGE_DISABLED = 0x00000000

# Token Access Rights
STANDARD_RIGHTS_REQUIRED = 0x000F0000               #
STANDARD_RIGHTS_READ = 0x00020000                   #
TOKEN_ASSIGN_PRIMARY = 0x0001                       #
TOKEN_DUPLICATE = 0x0002                            #
TOKEN_IMPERSONATION = 0x0004                        #
TOKEN_QUERY = 0x0008                                #
TOKEN_QUERY_SOURCE = 0x0010                         #
TOKEN_ADJUST_PRIVILEGES = 0x0020                    #
TOKEN_ADJUST_GROUPS = 0x0040                        #
TOKEN_ADJUST_DEFAULT = 0x0080                       #
TOKEN_ADJUST_SESSIONID = 0x0100                     #
TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY)   #
TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | 
					TOKEN_ASSIGN_PRIMARY     |
					TOKEN_DUPLICATE          |
					TOKEN_IMPERSONATION      |
					TOKEN_QUERY              |
					TOKEN_QUERY_SOURCE       |
					TOKEN_ADJUST_PRIVILEGES  |
					TOKEN_ADJUST_GROUPS      |
					TOKEN_ADJUST_DEFAULT     |
					TOKEN_ADJUST_SESSIONID)

class LUID(ctypes.Structure):
    _fields_ = [
        ("LowPart", DWORD),
        ("HighPart", DWORD),
    ]

class LUID_AND_ATTRIBUTES(ctypes.Structure):
    _fields_ = [
        ("Luid", LUID),
        ("Attritbutes", DWORD),
    ]

class PRIVILEGE_SET(ctypes.Structure):
    _fields_ = [
        ("PrivilegeCount", DWORD),
        ("Control", DWORD),
        ("Privileges", LUID_AND_ATTRIBUTES),
    ]

# Grab the Window Name from User32.dll
lpWindowName = ctypes.c_char_p(input("Enter Window name to hook into: ").encode('utf-8'))
hWnd = u_handle.FindWindowA(None, lpWindowName)

if hWnd == 0:
    print("Error Code: {0} - Could not grab Process Handle! Error Code: {0}".format(k_handle.GetLastError()))
    exit(1)
else:
    print("Successfuly got Handle.")

lpdwProcessId = ctypes.c_ulong()

response = u_handle.GetWindowThreadProcessId(hWnd, ctypes.byref(lpdwProcessId))

if response == 0:
    print("Error Code: {0} - Could not grab PID from Handle! Error Code: {0}".format(k_handle.GetlastError))
    exit(1)
else:
    print("Successfuly got PID!")

dwDesiredAccess = PROCESS_ALL_ACCESS
bInheritHandle = False
dwProcessId = lpdwProcessId

hProcess = k_handle.OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId)

if hProcess <= 0:
    print("Error Code {0} - Could not grab Priv Handle".format(k_handle.GetLastError()))
else:
    print("Successfully grabbed higher privileges!")

# Open a Handle to the Process's Token Directly
ProcessHandle = hProcess
DesiredAccess = TOKEN_ALL_ACCESS
TokenHandle = ctypes.c_void_p()

response = k_handle.OpenProcessToken(ProcessHandle, DesiredAccess, ctypes.byref(TokenHandle))

if response > 0:
    print("Handle to Process Token created! Token: {0}".format(TokenHandle))
else:
    print("Error: could not grab priviledged Token Handle! Error Code: {0}".format(k_handle.GetLastError()))

lpSystemName = None
lpName = "SEDebugPrivilege"
lpLuid = LUID()

response = a_handle.LookupPrivilegeValueW(lpSystemName, lpName, ctypes.byref(lpLuid))

if response > 0:
    print("Successfully found the LUID!")
else:
    print("Error: could not grab LUID! Error Code: {0}".format(k_handle.GetLastError()))

print("LUID VALUE HIGH: {0} \nLUID VALUE LOW: {1}".format(lpLuid.HighPart, lpLuid.LowPart))

requiredPrivileges = PRIVILEGE_SET()
requiredPrivileges.PrivilegeCount = 1
requiredPrivileges.Privileges = LUID_AND_ATTRIBUTES()
requiredPrivileges.Privileges.Luid = lpLuid
requiredPrivileges.Privileges.Attributes = SE_PRIVILEGE_ENABLED

pfResult = ctypes.c_long()

response = a_handle.PrivilegeCheck(TokenHandle, ctypes.byref(requiredPrivileges), ctypes.byref(pfResult))

if response > 0:
    print("Successfully ran Privilege check!")
else:
    print("Error: Was unable to check Privileges! Error Code: {0}".format(k_handle.GetLastError()))

if pfResult:
    print("Privilege Enabled: {0}".format(lpName))
else:
    print("Privileges Disabled: {0}".format(lpName))
## Check Process Token # Global Imports # Grab a handle on Advapi.dll, User32.dll and Kernel32.dll # Shortcut to give "All Access" rights to the current process. # The |'s are being used as "or" statements, as a shortcut instead of typing out every variable needed, and their values. # Also used in C# Libraries # 2 is enabled, 0 is disabled # Token Access Rights # # # # # # # # # # # # # Grab the Window Name from User32.dll # Open a Handle to the Process's Token Directly