|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/windows-access-tokens-for-red-teamers/
课程评论：没有评论
课程名称：Windows访问令牌为红队成员使用 课程概述： 在本课程中，我们将深入探讨Windows操作系统中的访问令牌。访问令牌是描述进程或线程安全上下文的一种工具，包含用户信息、用户组和权限等重要数据。课程首先介绍了什么是进程及线程，并阐述了Winlogon.exe在用户凭据输入过程中的角色。我们会详细剖析lsass进程如何加载认证包（如MSV1_0和Kerberos）以及用户凭据的验证流程。 进一步，我们将讨论访问令牌的使用，如何通过令牌检查用户对文件或其他对象的访问权限，以及特殊权限（如关闭权限和调试权限）的重要性。这些特权允许特定用户进行不受限制的操作，例如调试其他进程。 最后，课程将区分主要令牌和模拟令牌的类型，并鼓励对网络安全和红队技术感兴趣的人员参与课程学习。 如果你对此感兴趣，欢迎加入我们！
WHAT IS TOKEN?A process can be defined as instance of program running in memory.A thread is unit of execution of a process. a process can have any number of threads.An access token describes the security context of a process or thread.access token contains information about a user, user's groups, user's privileges, etc.LOGON PROCESSWinlogon.exe is responsible for providing interface for user to enter credentials.lsass process loads authentication packages like MSV1_0, Kerberos etc from security dllswhen user enters credentials, winlogon.exe sends to lsass process by calling lsaregisterlogonprocess, lsalookupauthenticationpackage, lsalogonuserlsass then pass on creds to authentication packages functions. these will check sam database or domain controller if credentials are correct.if credentials are correct, lsass creates a logonsession and creates a token and run explorer.exeUSAGE OF ACCESS TOKENSAccess tokens are checked aganist the object the process/thread trying to access.If user is trying to access a file, his token is being check aganist the file. if the ace of file allows the user to read the file then user is allowed access to the file.tokens also contains some special privileges like seshutdownprivilege, sedebugprivilege etc.these privileges allows user to perform certain actions without any restrictions.Eg: if we have sedebugprivilege, we can open handle to any process regardless of our permissions. "Programmers, testers" might have this privilege in an organisation.access tokens can be classified into PRIMARY TOKEN, IMPERSONATION TOKENIf this looks interesting to you then why not try it?
