Tokens activity implemented
This commit is contained in:
marcos.luna
@@ -28,6 +28,7 @@
|
||||
- [File Downloads Support](#file-downloads-support)
|
||||
- [File Uploads Support](#file-uploads-support)
|
||||
- [Keylogging Support](#%EF%B8%8F-keylogging-support)
|
||||
- [Token Support](#-token-support)
|
||||
- [Development](#development)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
- [Credits](#credits)
|
||||
@@ -203,6 +204,16 @@ For more information, see the [Mythic documentation on customizing public agents
|
||||
| `screenshot` | Capture full-screen screenshot (Mythic screenshot UI) | `screenshot` |
|
||||
| `keylog_start` | Start keystroke logging | `keylog_start` |
|
||||
| `keylog_stop` | Stop keystroke logging | `keylog_stop` |
|
||||
| `whoami` | Get current user context (thread token if impersonated, otherwise process token) | `whoami` |
|
||||
|
||||
### Token Operations
|
||||
|
||||
| Command | Description | Example |
|
||||
|---------|-------------|---------|
|
||||
| `list_tokens` | List all available tokens from running processes | `list_tokens` |
|
||||
| `steal_token` | Steal and impersonate token from a target process | `steal_token <pid>` |
|
||||
| `make_token` | Create a new token using credentials and impersonate it | `make_token domain username password [logon_type]` |
|
||||
| `rev2self` | Revert token impersonation back to original token | `rev2self` |
|
||||
|
||||
**Note**: The `ps` command integrates with Mythic's Process Browser, allowing unified process management across multiple callbacks. Process lists are automatically synchronized and viewable from the Process Browser UI.
|
||||
|
||||
@@ -1183,6 +1194,200 @@ For more information, see the [Mythic Keylog documentation](https://docs.mythic-
|
||||
|
||||
---
|
||||
|
||||
## 🔐 Token Support
|
||||
|
||||
Cazalla supports Windows token manipulation and impersonation, following [Mythic's Token specification](https://docs.mythic-c2.net/customizing/hooking-features/tokens).
|
||||
|
||||
### Features
|
||||
|
||||
- **Token Listing**: Enumerate all viewable tokens from running processes
|
||||
- **Token Theft**: Steal tokens from processes to impersonate different users
|
||||
- **Token Creation**: Create new tokens using credentials (domain, username, password)
|
||||
- **Token Impersonation**: Impersonate tokens for subsequent tasking
|
||||
- **Token Revert**: Revert to original token when done impersonating
|
||||
- **Token Tasking**: Use stolen/created tokens for executing commands with different privileges
|
||||
- **SeDebugPrivilege**: Automatically enables `SeDebugPrivilege` for accessing system processes
|
||||
- **Mythic Integration**: Tokens are tracked in Mythic's Token UI and can be selected for tasking
|
||||
|
||||
### How It Works
|
||||
|
||||
Cazalla implements token functionality following Mythic's token specification:
|
||||
|
||||
1. **Token Listing** (`list_tokens`):
|
||||
- Enumerates all running processes
|
||||
- Opens each process token with `OpenProcessToken`
|
||||
- Extracts user information, session ID, and process details
|
||||
- Reports tokens to Mythic using the `tokens` key in `post_response`
|
||||
- Tokens are viewable in Mythic's **Search → Tokens** page
|
||||
- Displays token information including: Token ID, PID, Process name, User, and Session
|
||||
|
||||
2. **Token Theft** (`steal_token <pid>`):
|
||||
- Opens the target process with appropriate access rights
|
||||
- Opens and duplicates the process token
|
||||
- Impersonates the token using `ImpersonateLoggedOnUser`
|
||||
- Registers the token as a `callback_token` for use in subsequent tasking
|
||||
- Reports a "Token Impersonation" artifact
|
||||
- The token becomes available in the Mythic UI for tasking
|
||||
|
||||
3. **Token Creation** (`make_token domain username password [logon_type]`):
|
||||
- Creates a new token using `LogonUserA` with provided credentials
|
||||
- Impersonates the newly created token
|
||||
- Registers the token as a `callback_token` for use in tasking
|
||||
- Reports a "Token Creation" artifact
|
||||
- Default `logon_type` is `9` (LOGON32_LOGON_NEW_CREDENTIALS) if not specified
|
||||
|
||||
4. **Token Revert** (`rev2self`):
|
||||
- Calls `RevertToSelf()` to revert to the original process token
|
||||
- Closes the impersonated token handle
|
||||
- Useful after completing operations with an impersonated token
|
||||
|
||||
5. **Token Tasking**:
|
||||
- When a token is registered as a `callback_token`, it appears in the Mythic UI
|
||||
- You can select a token from the dropdown when issuing tasks
|
||||
- The translator automatically includes the `token_id` in task messages
|
||||
- Commands executed with a selected token run under that token's security context
|
||||
|
||||
### Using Token Commands
|
||||
|
||||
#### List Available Tokens
|
||||
|
||||
```bash
|
||||
# List all viewable tokens from running processes
|
||||
list_tokens
|
||||
```
|
||||
|
||||
Output format:
|
||||
```
|
||||
Token ID: 1 | PID: 76 | Process: smss.exe | User: NT AUTHORITY\SYSTEM | Session: 0
|
||||
Token ID: 2 | PID: 116 | Process: csrss.exe | User: NT AUTHORITY\SYSTEM | Session: 0
|
||||
Token ID: 16 | PID: 1060 | Process: svchost.exe | User: NT AUTHORITY\SYSTEM | Session: 1
|
||||
...
|
||||
```
|
||||
|
||||
#### Steal Token from a Process
|
||||
|
||||
```bash
|
||||
# Steal token from PID 1060 (SYSTEM process)
|
||||
steal_token 1060
|
||||
```
|
||||
|
||||
After stealing a token:
|
||||
- The agent impersonates the token immediately
|
||||
- The token is registered in Mythic as a `callback_token`
|
||||
- You can verify impersonation with `whoami`
|
||||
- Subsequent commands will run with that token's privileges (if selected in Mythic UI)
|
||||
|
||||
#### Create Token with Credentials
|
||||
|
||||
```bash
|
||||
# Create token for domain user
|
||||
make_token DOMAIN username password
|
||||
|
||||
# Create token with specific logon type
|
||||
# Logon types: 2=Interactive, 3=Network, 9=NewCredentials (default)
|
||||
make_token DOMAIN username password 9
|
||||
```
|
||||
|
||||
#### Verify Token Impersonation
|
||||
|
||||
```bash
|
||||
# Check current user context (before stealing token)
|
||||
whoami
|
||||
# Output: CETP-WIN11-01\localuser
|
||||
|
||||
# Steal token from SYSTEM process
|
||||
steal_token 1060
|
||||
|
||||
# Check current user context (after stealing token)
|
||||
whoami
|
||||
# Output: NT AUTHORITY\SYSTEM
|
||||
|
||||
# Revert to original token
|
||||
rev2self
|
||||
|
||||
# Check current user context (after reverting)
|
||||
whoami
|
||||
# Output: CETP-WIN11-01\localuser
|
||||
```
|
||||
|
||||
#### Using Tokens for Tasking
|
||||
|
||||
1. Execute `list_tokens` to see available tokens
|
||||
2. Execute `steal_token <pid>` to steal a token (or use `make_token` to create one)
|
||||
3. In the Mythic UI, a dropdown appears next to the tasking bar
|
||||
4. Select a token from the dropdown before issuing commands
|
||||
5. Commands will execute with the selected token's security context
|
||||
|
||||
**Note**: Token selection in Mythic UI is handled automatically by the framework. The translator includes the `token_id` in the task message when a token is selected.
|
||||
|
||||
### Session Considerations
|
||||
|
||||
- **Session 0**: System services and processes run in Session 0
|
||||
- **Session 2+**: User sessions start from Session 2
|
||||
- Some processes may only be accessible if running with administrator privileges
|
||||
- The `EnableSeDebugPrivilege` function is called automatically to access protected processes
|
||||
|
||||
### Implementation Details
|
||||
|
||||
The token system uses:
|
||||
- **SeDebugPrivilege**: Automatically enabled for accessing system processes
|
||||
- **OpenProcessToken**: Opens process tokens with appropriate access rights
|
||||
- **DuplicateTokenEx**: Duplicates tokens for impersonation
|
||||
- **ImpersonateLoggedOnUser**: Impersonates tokens on the current thread
|
||||
- **RevertToSelf**: Reverts to the original process token
|
||||
- **Process Enumeration**: Uses `CreateToolhelp32Snapshot` to enumerate processes
|
||||
- **Token Information**: Uses `GetTokenInformation` and `LookupAccountSidA` to extract user info
|
||||
|
||||
### Error Handling
|
||||
|
||||
Token operations handle various scenarios:
|
||||
- **Access Denied**: Falls back to `PROCESS_QUERY_LIMITED_INFORMATION` if full access fails
|
||||
- **Protected Processes**: Some system processes may require elevated privileges
|
||||
- **Invalid PID**: Validates PID and rejects PIDs 0 and 2 (reserved)
|
||||
- **Token Opening**: Attempts multiple access rights combinations if initial attempt fails
|
||||
- **Privilege Escalation**: Automatically enables `SeDebugPrivilege` when needed
|
||||
|
||||
### Viewing Tokens
|
||||
|
||||
1. Execute `list_tokens` to enumerate tokens
|
||||
2. Navigate to **Search → Tokens** in the Mythic UI
|
||||
3. View all tokens with details:
|
||||
- Token ID (agent-generated unique identifier)
|
||||
- Host (computer name)
|
||||
- User (account name)
|
||||
- Process ID
|
||||
- Session ID
|
||||
- Process name (from `list_tokens` output)
|
||||
4. Tokens registered as `callback_tokens` (via `steal_token` or `make_token`) appear in the tasking dropdown
|
||||
|
||||
### Artifact Support
|
||||
|
||||
Token commands automatically report artifacts:
|
||||
|
||||
- **`steal_token`**: Reports "Token Impersonation" artifact with PID and user information
|
||||
- **`make_token`**: Reports "Token Creation" artifact with domain, username, and logon type
|
||||
|
||||
These artifacts appear in Mythic's Artifacts page when token operations are performed.
|
||||
|
||||
### Verification Tips
|
||||
|
||||
1. **Before and After**: Use `whoami` before and after `steal_token` to verify impersonation
|
||||
2. **Session 0 vs Session 2**: Tokens from Session 0 processes are accessible with administrator privileges
|
||||
3. **Process Names**: Use `list_tokens` to see process names alongside PIDs
|
||||
4. **Token ID**: The `token_id` in `list_tokens` output can be used to identify tokens, but for tasking, Mythic uses the token registered via `callback_tokens`
|
||||
|
||||
### Security Considerations
|
||||
|
||||
- **Token Impersonation**: Allows executing commands with different privileges
|
||||
- **SeDebugPrivilege**: Required for accessing system process tokens
|
||||
- **Token Theft**: Can be detected by security monitoring tools
|
||||
- **Session Isolation**: Tokens from different sessions may have different access rights
|
||||
- **Token Lifetime**: Impersonated tokens remain active until `rev2self` is called
|
||||
|
||||
For more information, see the [Mythic Tokens documentation](https://docs.mythic-c2.net/customizing/hooking-features/tokens).
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Development
|
||||
|
||||
### Project Structure
|
||||
|
||||
Reference in New Issue
Block a user