DesertPenguin.org

I will be trying to write a series of blog posts about Windows privileges, in alphabetical order.

In Windows NT (and originally OpenVMS) privileges are attributes of a process that allow the process to perform privileged actions. Yes, it is very tautological*.

A process appears to get its privileges from a combination of the privileges held by the security principal (for example the user) that started it minus privileges dropped (for example by the service control manager) plus the privileges held by any pseudo-group it might belong to (for example SERVICE if it is a service) plus the privileges injected into its access token by software designed to modify access tokens.

Privileged actions include starting threads and processes using another identity (for example a different user), reading and overwriting files regardless of permissions (a backup program would need such a privilege), setting time and time zone and shutting down the system.

In alphabetical order the first privilege is Assign Primary Token.

It allows a process to start another process using a different identity. (This is distinct from creating a thread using a different identity.)

In the Win32 API Assign Primary Token is known as SE_ASSIGNPRIMARYTOKEN_NAME as a constant or "SeAssignPrimaryTokenPrivilege" as a string. See https://learn.microsoft.com/en-us/windows/win32/secauthz/privilege-constants for a full list.

HANDLE hUserToken = NULL;

ok = LogonUserW(sUserName, L".", sPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hUserToken);

Error(L"LogonUser");

ok = CreateProcessAsUserW(hUserToken, pathImage, sArguments, NULL, NULL, FALSE, dwCreationFlags, NULL, NULL, &si, &pi);

Error(L"CreateProcessAsUser");

The code above will work if the user sUserName exists, if his password sPassword is correct and if the calling process holds SeAssignPrimaryTokenPrivilege. The privilege also has to be enabled, which it will not be.

Enabling a privilege can be done with a function like this:

void EnablePrivilege(LPWSTR sPrivilegeName)

{
    HANDLE hCurrentProcessToken;

    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hCurrentProcessToken);

    TOKEN_PRIVILEGES privs;

    LUID luid;

    ok = LookupPrivilegeValue(NULL, sPrivilegeName, &luid);

    Error(L"LookupPrivilegeValue");

    privs.PrivilegeCount = 1;

    privs.Privileges[0].Luid = luid;

    privs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    ok = AdjustTokenPrivileges(hCurrentProcessToken, FALSE, &privs, sizeof(TOKEN_PRIVILEGES), NULL, NULL);

    Error(L"AdjustTokenPrivileges");
}

And I am using an Error() function to return error messages which is this:

BOOL debug = FALSE;
BOOL ok = TRUE;
DWORD error = 0;
LSTATUS status = 0;

void Error(LPCWSTR sz)

{
    if (!debug) { return; }

    if (!ok || status) { error = GetLastError(); }

    fwprintf(stderr, L"%sOK: [%d]STATUS: [%d], Error: [%d] ", sz, ok, status, error);

    error = 0;

    status = 0;

    ok = TRUE;
}

If debug is FALSE the Error() function returns immediately. Otherwise it will react to ok or status and if ok is FALSE or status is positive it will get the last error and display ok, status and the last error. (This is quite handy.) Then it will reset error, status, and ok for the next call.

If you run this with the wrong user name or password, you will get an error 1326 which means that "the user name or password is incorrect": (certutil.exe is a good way to find out the meaning of error codes.)

LookupPrivilegeValue    OK: [1] STATUS: [0], Error: [0]

AdjustTokenPrivileges   OK: [1] STATUS: [0], Error: [0]

LogonUser       OK: [0] STATUS: [0], Error: [1326]

CreateProcessAsUser     OK: [0] STATUS: [0], Error: [0]

C:\temp>certutil/error 1326

0x52e (WIN32: 1326 ERROR_LOGON_FAILURE) -- 1326 (1326)

Error message text: The user name or password is incorrect.

CertUtil: -error command completed successfully.

(Incidentally, since the user could not be logged on, hUserToken remained NULL and CreateProcessAsUser() with a NULL token still works, it just creates a process as the same user as the calling user., hence the error for CreateProcessAsUser() was 0.)

The result is much weirder if the user name and password are correct but SeAssignPrimaryTokenPrivilege is not held.

LookupPrivilegeValue    OK: [1] STATUS: [0], Error: [0]
AdjustTokenPrivileges   OK: [1] STATUS: [0], Error: [0]
LogonUser       OK: [1] STATUS: [0], Error: [0]
CreateProcessAsUser     OK: [0] STATUS: [0], Error: [1314]

C:temp>certutil/error 1314

0x522 (WIN32: 1314 ERROR_PRIVILEGE_NOT_HELD) -- 1314 (1314)
Error message text: A required privilege is not held by the client.

CertUtil: -error command completed successfully.

Here the user could be logged on (LogonUser() gives us ok=1, status=0 and error=0) but our process cannot start another process using that logged-on user. This is the error 1314 from CreateProcessAsUser() which translates to "A required privilege it not held by the client".

After granting the executing user the Assign Primary Token privilege, the impersonation works:

C:\temp>whoami/priv

PRIVILEGES INFORMATION
----------------------
Privilege Name                Description                          State
============================= ==================================== ========
SeAssignPrimaryTokenPrivilege Replace a process level token        Disabled
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

The resulting result is this:

LookupPrivilegeValue    OK: [1] STATUS: [0], Error: [0]
AdjustTokenPrivileges   OK: [1] STATUS: [0], Error: [0]
LogonUser       OK: [1] STATUS: [0], Error: [0]
CreateProcessAsUser     OK: [1] STATUS: [0], Error: [0]

 Every ok is 1, every status is 0 and there are no errors.

Do note that starting a process as another user this way leads to interesting display issues when used interactively. This is apparently really something services are supposed to do rather than interactive programs. This is probably also why the LocalService and NetworkService accounts hold this privilege by default.

*A tautology is something that is tautological.

Last week a colleague of mine tried to configure registry permissions using C#’s RegistryKey.SetAccessControl().

It turns out this fails when the user owns the registry key but does not have the “Set Value” permission set in the ACL.

I tried repeating the experiment with PowerShell with the same result:

(Benoit Brisefer is my non-admin test user. I have others.)

In RegEdit Benoit could modify permissions on his key:

And once “Full Control” (or simply “Set Value”) was set, the Set-Acl command would work.

This is a bit annoying since it is not clear how one should set “Set Value” if one doesn’t already have it, or why “Set Value” is required not to set a value but to modify the key’s security descriptor.

I tried it out using in C and got the same results with opening a registry key and trying to set its security descriptor. Again with “Set Value” set I could set permissions and without “Set Value” I could not. This was using the RegOpenKeyEx() and RegOpenRegSetSecurity() APIs.

But there is another C API SetNamedSecurityInfo() which does work!

I assume the first method does not work because it opens the registry key first and modifies its security descriptor via the open key (whatever that means) and then “Set Value” is required. Perhaps .NET does it the same way and this affects both C#’s RegistryKey class as well as PowerShell’s Set-Acl cmdlet.

The second method works.

Benoit can configure his own key’s permissions with RegEdit but also with SetNamedSecurityInfo(). Output is given in SDDL format.

First RegACL call is outputting the security descriptor with “Full Control”, second and third are showing the security descriptor with “Set Value” and “Write DAC” respectively not set. Benoit does not have special privileges.

And then Benoit can write the access control list giving him “Full Control” even when the key’s DACL is empty:

You can find my badly-tested and entirely non-error-checking code here:

https://github.com/ajbrehm/ABTokenTools/tree/master/RegACL

Use with care on a computer you don’t care about!

Update: This has since become part of AclEdit.exe in ABTokenTools.

But it remains an experimental tool.

As part of my never-ending quest to find a ebook reader for comic books, I stumbled upon the PocketBook Color, made by, I believe, a Russian-Swiss company and featuring a color e-ink display.

The colors are really crips and convincing, the home menu is nicely presented and easy to use. This is better than my Kindle. Just like all e-ink devices display refreshes are very slow, and I think they are even slower than on my Kindle. You don’t want to turn a page on this device.

I don’t know why the colours are completely different on the screenshots than seen on the device. I could try to change this in the settings, perhaps, but the pages in the settings are painfully slow as well.

The display is really too small for a comic page and while there is a theoretical landscape mode to present the upper and lower half of a page bigger, the e-ink display cannot scroll and always cuts through a row of pictures, as seen in this lower half of a page.

The settings menus remind me of a tablet computer rather than an ebook reader device but the actual hardware is not so impressive.

1 GB of RAM and (nominaly) 16 GB of internal storage are not very impressive. The storage is certainly not sufficient for a comic book collection (or any ebooks that contain lots of colored pictures). According to the manual the device supports SD cards only up to 32 GB. My SD card is full already.

The device has some built-in apps rather than booting directly into a reader app and even offers some games which are actually not bad. I think it is possible to add more games and I also found instructions somewhere for download of a Linux-based SDK that allows creation of custom apps.

The web browser app was a nice surprise and works really (if slowly).

But the device really shines if used for ebooks with color pictures. It comes with a built-in library of out-of-copyright books in multiple languages.

And that’s the thing, while the device’s screen is too small for pre-formatted comic book and PDF files, it is large enough for ebooks since it can format them itself and present them in a readable format.

It is a great device to read comic books if you can read small fonts.

All-in-all this is not a bad device and if you have money to waste on something, this could be an option.

Updated 4/12/2022

Some time ago already I had written a few utilities to manipulate Windows account security settings. I use them at work all the time because they are more flexible and easier to understand than the built-in GUI tools (and much much easier to use than the built-in CLI tools).

I have now updated the tools to use (mostly) WCHAR and standard I/O, so output is now redirectable. Everything is (should be) statically linked and does not require the Visual C runtime library installed. TokenTest requires the .NET Framework version 4. Some of the tools now display some help.

Source: https://github.com/ajbrehm/ABTokenTools

Download binaries (in ZIP archives) of the newest versions here:

• ABTokenTools x86 (for 32 bit PCs, will run on all current Windows 10)
  
• ABTokenTools x64 (for 64 bit PCs, will run on all current 64 bit Windows 10)
• ABTokenTools ARM (for 32 bit WOA devices, will run on 64 bit ARM Windows 10)
• ABTokenTools ARM64 (for 64 bit WOA devices, will run only on 64 bit ARM Windows 10)

 Do refer to the README.MD in the repository to find out what they do.