0

I'm attempting to grant a Windows interactive console process the SeTcbPrivilege privilege from a non-interactive SYSTEM process using OpenProcessToken(...) with TOKEN_ADJUST_PRIVILEGES.

Despite running as SYSTEM, the SeTcbPrivilege grant fails; as demonstrated by an audit failure in the Event Viewer when trying to perform an action with those rights and cross-checking with PrivilegeCheck(...). Granting the process SeDebugPrivilege and any other grants succeed.

My supposition is that this fails because of the 'Act as the part of the operating system' group policy, preventing even SYSTEM from granting this right to a non-SYSTEM process. Is this assumption valid, or is there some other hurdle that needs to be overcome? This is on an up-to-date, somewhat hardened, Windows 10 system.

1 Answer 1

5

For each of the possible privileges on a token, there are three possible states:

  1. Enabled: The privilege is present on the token and is active.
  2. Disabled: The privilege is present on the token, but not currently active.
  3. Not present: The privilege was either not included when the token was created, or has been removed.

There is no way to add a privilege that the token doesn't already have. It sounds like that's what you're trying to do, though; take a token belonging to a process without SeTcbPrivilege, and add SeTcbPrivilege to it. You can't do that (not from user-mode, at least; a kernel driver presumably could). If SeTcbPrivilege is in the third state - either it wasn't there originally (because the process didn't have "Act as art of the operating system" when it was created) or it was removed by a previous call to AdjustTokenPrivileges - then what you're trying to do is impossible.

Without knowing more of what your end-goal is, I can't provide an alternative approach to the problem.

2
  • The goal is to perform actions with SeTcbPrivilege privileges (specifically, LsaCallAuthenticationPackage()) from an interactive process running under an Administrator. I've tried also impersonation (the process can enable SeImpersonatePrivilege no issues, but can't impersonate a process token from a SYSTEM process) and neither worked. I feel like SYSTEM (in user space) should have some means to overcome this but it's not readily apparent to me what that would be. I know other applications (Mimikatz, Meterpreter, PsExec,etc) achieve this, and I'm just experimenting w/ the concepts to learn
    – Rushyo
    Nov 9, 2018 at 20:20
  • 1
    @Rushyo Impersonation is always done at the thread level, not the process level, and requires an "impersonation token". You may have opened the token HANDLE with the wrong permissions; see ImpersonateLoggedOnUser for the required privileges when opening the token (in particular, if it's not already an impersonation token, you need to open the token with TOKEN_DUPLICATE access so that ImpersonateLoggedOnUser can create an impersonation token as a duplicate).
    – CBHacking
    Nov 9, 2018 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .