Hey everybody.
Welcome to Part Six.
Going a little deeper into Windows OS.
So we're gonna be talking about windows tokens in this particular video.
So what does a token.
I know we've talked about it briefly and a few other videos we're going to do a little bit of a deeper
dive here.
So a token is an object that describes the security context of a process or a threat.
Now this means that it is taken to an account when any process needs to perform an API call that requires
some sort of permissions to be present or available or maybe there's some restriction checking involved
here.
Now as we talked about in the UAC video there it is created upon log in and provided from the domain
of the local system depending on how you have it set up.
So what's what's in a token.
So as we talked about before the users that's that's trying to log in.
There s i d this is where it is stored.
It is it sits inside of the token.
Now the next section of of it is s idea of any groups the user belongs to the user belongs to 10 groups
you're going to see 10 outside easier the log in s I.D. that identifies the log on session.
So when you log onto a machine you get a log in session I.D. I'm not going to go over that particular
idea in this video just know that it it is the I.D. around the log in session so anything that happens
in the session is Jenner is is going to fall under this section I.D. which also means this access token
falls under that log in session.
Then the list of privileges the user or its the groups have access to.
This can be very very large list the owner aside.
So this is the user who created this one.
So if you have a local admin b s idea of the user that created or that look at that local app and that
created a user that's a domain user.
There you go.
You have the domain users as do here.
Now the idea primary group normally it's the the first group they're part of.
So either if it's a domain user it would be a domain domain Users Group.
If it's a standard user which we've been working with before is the U is just a users group.
Now there's a default ACL which is an access control list similar to the privileges but slightly different.
We're gonna go over access control this later in a different module.
So this is only there when a user doesn't have an access control list set up ahead of time.
Again this is more of an internal system based thing.
We're not going to go into it in this particular video.
So the source of the access token.
So was it local system or was it a domain.
The type of access tokens.
So is it primary or is it an impersonation token.
Now we're gonna go over the types of tokens in the next slide but note that it does the type of token
it is in this particular spot.
So the optional list of restricted tokens This is normally done by a separate process but we have we
have a different slide around that types of tokens primary.
This is the standard access token that the user gets upon log in along with the session I log in.
Now the impersonation.
This is done when we want to run a process or threat as the security context as another user.
So if we want a if we're running as the user branded and we want to run as the user Bob we need to create
an impersonation token of Bob's of what Bob's token would be his access token would be and then we use
that we pass that instead of our own to impersonate Bob.
So one week we can launch of the command line with that impersonated token and it would show up as Bob's
command line instead of mine restricted tokens.
This is this is done when we use to create restricted token API call.
Again feel free to grab that and take a quick look in the windows docs about it.
When an application or a process needs to be ran in a restricted way let's say we don't need all of
the permissions or privileges of the current token but we need everything else but then trim that down
in that case we would create a restricted access token and then pass that instead.
So it's a restricted scope instead of it just being a wide scope token.
Now where are they used.
Again like we said before they're passed around to different types of API calls but they're normally
called when you look at the documentation you'll see references to access token but what you're going
to really see is references to the security descriptor which think of it more as a handle that points
to the access token.
So when we pass around security descriptor for that or the security context which is also a term that
can be used in their documentation when that's being passed around it's normally referring to an access
token of some kind.
Now why is this useful to an attacker is it useful.
Yes it is.
When an attacker gains admin rights they have the ability to create impersonation tokens they don't
need elevated privileges anymore they are already an administrator.
So if a standard user tries to create an impersonation token for the administrator it will fail.
If they try to create it for another user that they don't have permission for it will fail.
But from an admins perspective you can always get.
You can always access down but not up and in a standard permissions based system.
So it used so an admin you have admin rights on on a machine you just popped.
You can impersonate any user that's on that system.
Now if the network administrator is logged into that system and you have local admin you can grab there
you can grab their token use it to create an impersonation token and now you can log in to that machine
as them or open up a specific process as them.
Now this can be very useful because this allows you to get a command prompt as a image as a domain admin
which you now have the same rights as they do and that can be a complete compromise of the domain.
So it's very useful and there's a lot of times where I know I've mentioned before how you can go from
administrator to system.
This is one of the ways you can grab.
You can search the processes that are on the system that are running on your current system grab the
ones that are owned and have the context of the system user in windows and then you you just suck that
token out create an impersonation token and now you have system access on the command line just as simple
as that.
Now there are a lot of windows api docs that you can do and you can actually do this in dot net as well
you can actually do this on your own as well as and see Python's got a few modules that can do this.
That's not in the scope of this particular video we might view that in the python tutorial might do
a little bit of that type of stuff just to kind of get you a little bit in a different mindset for how
you how it can be used but understand that tokens are there why they're passed where they can be useful
and the differences between all of the different types of tokens.