├── LICENCE ├── README.md ├── WhoWasI.sln ├── WhoWasI.v12.suo └── WhoWasI ├── ChangeLog.txt ├── Privilages.cs ├── Program.cs ├── Properties └── AssemblyInfo.cs ├── WhoWasI.cs ├── WhoWasI.csproj ├── WhoWasI.csproj.user ├── Win32API.cs ├── app.manifest ├── bin └── Debug │ ├── WhoWasI.exe │ ├── WhoWasI.pdb │ ├── WhoWasI.vshost.exe │ └── WhoWasI.vshost.exe.manifest └── obj └── Debug ├── DesignTimeResolveAssemblyReferences.cache ├── DesignTimeResolveAssemblyReferencesInput.cache ├── WhoWasI.csproj.FileListAbsolute.txt ├── WhoWasI.csprojResolveAssemblyReference.cache ├── WhoWasI.exe └── WhoWasI.pdb /LICENCE: -------------------------------------------------------------------------------- 1 | GNU AFFERO GENERAL PUBLIC LICENSE 2 | Version 3, 19 November 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU Affero General Public License is a free, copyleft license for 11 | software and other kinds of works, specifically designed to ensure 12 | cooperation with the community in the case of network server software. 13 | 14 | The licenses for most software and other practical works are designed 15 | to take away your freedom to share and change the works. By contrast, 16 | our General Public Licenses are intended to guarantee your freedom to 17 | share and change all versions of a program--to make sure it remains free 18 | software for all its users. 19 | 20 | When we speak of free software, we are referring to freedom, not 21 | price. Our General Public Licenses are designed to make sure that you 22 | have the freedom to distribute copies of free software (and charge for 23 | them if you wish), that you receive source code or can get it if you 24 | want it, that you can change the software or use pieces of it in new 25 | free programs, and that you know you can do these things. 26 | 27 | Developers that use our General Public Licenses protect your rights 28 | with two steps: (1) assert copyright on the software, and (2) offer 29 | you this License which gives you legal permission to copy, distribute 30 | and/or modify the software. 31 | 32 | A secondary benefit of defending all users' freedom is that 33 | improvements made in alternate versions of the program, if they 34 | receive widespread use, become available for other developers to 35 | incorporate. Many developers of free software are heartened and 36 | encouraged by the resulting cooperation. However, in the case of 37 | software used on network servers, this result may fail to come about. 38 | The GNU General Public License permits making a modified version and 39 | letting the public access it on a server without ever releasing its 40 | source code to the public. 41 | 42 | The GNU Affero General Public License is designed specifically to 43 | ensure that, in such cases, the modified source code becomes available 44 | to the community. It requires the operator of a network server to 45 | provide the source code of the modified version running there to the 46 | users of that server. Therefore, public use of a modified version, on 47 | a publicly accessible server, gives the public access to the source 48 | code of the modified version. 49 | 50 | An older license, called the Affero General Public License and 51 | published by Affero, was designed to accomplish similar goals. This is 52 | a different license, not a version of the Affero GPL, but Affero has 53 | released a new version of the Affero GPL which permits relicensing under 54 | this license. 55 | 56 | The precise terms and conditions for copying, distribution and 57 | modification follow. 58 | 59 | TERMS AND CONDITIONS 60 | 61 | 0. Definitions. 62 | 63 | "This License" refers to version 3 of the GNU Affero General Public License. 64 | 65 | "Copyright" also means copyright-like laws that apply to other kinds of 66 | works, such as semiconductor masks. 67 | 68 | "The Program" refers to any copyrightable work licensed under this 69 | License. Each licensee is addressed as "you". "Licensees" and 70 | "recipients" may be individuals or organizations. 71 | 72 | To "modify" a work means to copy from or adapt all or part of the work 73 | in a fashion requiring copyright permission, other than the making of an 74 | exact copy. The resulting work is called a "modified version" of the 75 | earlier work or a work "based on" the earlier work. 76 | 77 | A "covered work" means either the unmodified Program or a work based 78 | on the Program. 79 | 80 | To "propagate" a work means to do anything with it that, without 81 | permission, would make you directly or secondarily liable for 82 | infringement under applicable copyright law, except executing it on a 83 | computer or modifying a private copy. Propagation includes copying, 84 | distribution (with or without modification), making available to the 85 | public, and in some countries other activities as well. 86 | 87 | To "convey" a work means any kind of propagation that enables other 88 | parties to make or receive copies. Mere interaction with a user through 89 | a computer network, with no transfer of a copy, is not conveying. 90 | 91 | An interactive user interface displays "Appropriate Legal Notices" 92 | to the extent that it includes a convenient and prominently visible 93 | feature that (1) displays an appropriate copyright notice, and (2) 94 | tells the user that there is no warranty for the work (except to the 95 | extent that warranties are provided), that licensees may convey the 96 | work under this License, and how to view a copy of this License. If 97 | the interface presents a list of user commands or options, such as a 98 | menu, a prominent item in the list meets this criterion. 99 | 100 | 1. Source Code. 101 | 102 | The "source code" for a work means the preferred form of the work 103 | for making modifications to it. "Object code" means any non-source 104 | form of a work. 105 | 106 | A "Standard Interface" means an interface that either is an official 107 | standard defined by a recognized standards body, or, in the case of 108 | interfaces specified for a particular programming language, one that 109 | is widely used among developers working in that language. 110 | 111 | The "System Libraries" of an executable work include anything, other 112 | than the work as a whole, that (a) is included in the normal form of 113 | packaging a Major Component, but which is not part of that Major 114 | Component, and (b) serves only to enable use of the work with that 115 | Major Component, or to implement a Standard Interface for which an 116 | implementation is available to the public in source code form. A 117 | "Major Component", in this context, means a major essential component 118 | (kernel, window system, and so on) of the specific operating system 119 | (if any) on which the executable work runs, or a compiler used to 120 | produce the work, or an object code interpreter used to run it. 121 | 122 | The "Corresponding Source" for a work in object code form means all 123 | the source code needed to generate, install, and (for an executable 124 | work) run the object code and to modify the work, including scripts to 125 | control those activities. However, it does not include the work's 126 | System Libraries, or general-purpose tools or generally available free 127 | programs which are used unmodified in performing those activities but 128 | which are not part of the work. For example, Corresponding Source 129 | includes interface definition files associated with source files for 130 | the work, and the source code for shared libraries and dynamically 131 | linked subprograms that the work is specifically designed to require, 132 | such as by intimate data communication or control flow between those 133 | subprograms and other parts of the work. 134 | 135 | The Corresponding Source need not include anything that users 136 | can regenerate automatically from other parts of the Corresponding 137 | Source. 138 | 139 | The Corresponding Source for a work in source code form is that 140 | same work. 141 | 142 | 2. Basic Permissions. 143 | 144 | All rights granted under this License are granted for the term of 145 | copyright on the Program, and are irrevocable provided the stated 146 | conditions are met. This License explicitly affirms your unlimited 147 | permission to run the unmodified Program. The output from running a 148 | covered work is covered by this License only if the output, given its 149 | content, constitutes a covered work. This License acknowledges your 150 | rights of fair use or other equivalent, as provided by copyright law. 151 | 152 | You may make, run and propagate covered works that you do not 153 | convey, without conditions so long as your license otherwise remains 154 | in force. You may convey covered works to others for the sole purpose 155 | of having them make modifications exclusively for you, or provide you 156 | with facilities for running those works, provided that you comply with 157 | the terms of this License in conveying all material for which you do 158 | not control copyright. Those thus making or running the covered works 159 | for you must do so exclusively on your behalf, under your direction 160 | and control, on terms that prohibit them from making any copies of 161 | your copyrighted material outside their relationship with you. 162 | 163 | Conveying under any other circumstances is permitted solely under 164 | the conditions stated below. Sublicensing is not allowed; section 10 165 | makes it unnecessary. 166 | 167 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 168 | 169 | No covered work shall be deemed part of an effective technological 170 | measure under any applicable law fulfilling obligations under article 171 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 172 | similar laws prohibiting or restricting circumvention of such 173 | measures. 174 | 175 | When you convey a covered work, you waive any legal power to forbid 176 | circumvention of technological measures to the extent such circumvention 177 | is effected by exercising rights under this License with respect to 178 | the covered work, and you disclaim any intention to limit operation or 179 | modification of the work as a means of enforcing, against the work's 180 | users, your or third parties' legal rights to forbid circumvention of 181 | technological measures. 182 | 183 | 4. Conveying Verbatim Copies. 184 | 185 | You may convey verbatim copies of the Program's source code as you 186 | receive it, in any medium, provided that you conspicuously and 187 | appropriately publish on each copy an appropriate copyright notice; 188 | keep intact all notices stating that this License and any 189 | non-permissive terms added in accord with section 7 apply to the code; 190 | keep intact all notices of the absence of any warranty; and give all 191 | recipients a copy of this License along with the Program. 192 | 193 | You may charge any price or no price for each copy that you convey, 194 | and you may offer support or warranty protection for a fee. 195 | 196 | 5. Conveying Modified Source Versions. 197 | 198 | You may convey a work based on the Program, or the modifications to 199 | produce it from the Program, in the form of source code under the 200 | terms of section 4, provided that you also meet all of these conditions: 201 | 202 | a) The work must carry prominent notices stating that you modified 203 | it, and giving a relevant date. 204 | 205 | b) The work must carry prominent notices stating that it is 206 | released under this License and any conditions added under section 207 | 7. This requirement modifies the requirement in section 4 to 208 | "keep intact all notices". 209 | 210 | c) You must license the entire work, as a whole, under this 211 | License to anyone who comes into possession of a copy. This 212 | License will therefore apply, along with any applicable section 7 213 | additional terms, to the whole of the work, and all its parts, 214 | regardless of how they are packaged. This License gives no 215 | permission to license the work in any other way, but it does not 216 | invalidate such permission if you have separately received it. 217 | 218 | d) If the work has interactive user interfaces, each must display 219 | Appropriate Legal Notices; however, if the Program has interactive 220 | interfaces that do not display Appropriate Legal Notices, your 221 | work need not make them do so. 222 | 223 | A compilation of a covered work with other separate and independent 224 | works, which are not by their nature extensions of the covered work, 225 | and which are not combined with it such as to form a larger program, 226 | in or on a volume of a storage or distribution medium, is called an 227 | "aggregate" if the compilation and its resulting copyright are not 228 | used to limit the access or legal rights of the compilation's users 229 | beyond what the individual works permit. Inclusion of a covered work 230 | in an aggregate does not cause this License to apply to the other 231 | parts of the aggregate. 232 | 233 | 6. Conveying Non-Source Forms. 234 | 235 | You may convey a covered work in object code form under the terms 236 | of sections 4 and 5, provided that you also convey the 237 | machine-readable Corresponding Source under the terms of this License, 238 | in one of these ways: 239 | 240 | a) Convey the object code in, or embodied in, a physical product 241 | (including a physical distribution medium), accompanied by the 242 | Corresponding Source fixed on a durable physical medium 243 | customarily used for software interchange. 244 | 245 | b) Convey the object code in, or embodied in, a physical product 246 | (including a physical distribution medium), accompanied by a 247 | written offer, valid for at least three years and valid for as 248 | long as you offer spare parts or customer support for that product 249 | model, to give anyone who possesses the object code either (1) a 250 | copy of the Corresponding Source for all the software in the 251 | product that is covered by this License, on a durable physical 252 | medium customarily used for software interchange, for a price no 253 | more than your reasonable cost of physically performing this 254 | conveying of source, or (2) access to copy the 255 | Corresponding Source from a network server at no charge. 256 | 257 | c) Convey individual copies of the object code with a copy of the 258 | written offer to provide the Corresponding Source. This 259 | alternative is allowed only occasionally and noncommercially, and 260 | only if you received the object code with such an offer, in accord 261 | with subsection 6b. 262 | 263 | d) Convey the object code by offering access from a designated 264 | place (gratis or for a charge), and offer equivalent access to the 265 | Corresponding Source in the same way through the same place at no 266 | further charge. You need not require recipients to copy the 267 | Corresponding Source along with the object code. If the place to 268 | copy the object code is a network server, the Corresponding Source 269 | may be on a different server (operated by you or a third party) 270 | that supports equivalent copying facilities, provided you maintain 271 | clear directions next to the object code saying where to find the 272 | Corresponding Source. Regardless of what server hosts the 273 | Corresponding Source, you remain obligated to ensure that it is 274 | available for as long as needed to satisfy these requirements. 275 | 276 | e) Convey the object code using peer-to-peer transmission, provided 277 | you inform other peers where the object code and Corresponding 278 | Source of the work are being offered to the general public at no 279 | charge under subsection 6d. 280 | 281 | A separable portion of the object code, whose source code is excluded 282 | from the Corresponding Source as a System Library, need not be 283 | included in conveying the object code work. 284 | 285 | A "User Product" is either (1) a "consumer product", which means any 286 | tangible personal property which is normally used for personal, family, 287 | or household purposes, or (2) anything designed or sold for incorporation 288 | into a dwelling. In determining whether a product is a consumer product, 289 | doubtful cases shall be resolved in favor of coverage. For a particular 290 | product received by a particular user, "normally used" refers to a 291 | typical or common use of that class of product, regardless of the status 292 | of the particular user or of the way in which the particular user 293 | actually uses, or expects or is expected to use, the product. A product 294 | is a consumer product regardless of whether the product has substantial 295 | commercial, industrial or non-consumer uses, unless such uses represent 296 | the only significant mode of use of the product. 297 | 298 | "Installation Information" for a User Product means any methods, 299 | procedures, authorization keys, or other information required to install 300 | and execute modified versions of a covered work in that User Product from 301 | a modified version of its Corresponding Source. The information must 302 | suffice to ensure that the continued functioning of the modified object 303 | code is in no case prevented or interfered with solely because 304 | modification has been made. 305 | 306 | If you convey an object code work under this section in, or with, or 307 | specifically for use in, a User Product, and the conveying occurs as 308 | part of a transaction in which the right of possession and use of the 309 | User Product is transferred to the recipient in perpetuity or for a 310 | fixed term (regardless of how the transaction is characterized), the 311 | Corresponding Source conveyed under this section must be accompanied 312 | by the Installation Information. But this requirement does not apply 313 | if neither you nor any third party retains the ability to install 314 | modified object code on the User Product (for example, the work has 315 | been installed in ROM). 316 | 317 | The requirement to provide Installation Information does not include a 318 | requirement to continue to provide support service, warranty, or updates 319 | for a work that has been modified or installed by the recipient, or for 320 | the User Product in which it has been modified or installed. Access to a 321 | network may be denied when the modification itself materially and 322 | adversely affects the operation of the network or violates the rules and 323 | protocols for communication across the network. 324 | 325 | Corresponding Source conveyed, and Installation Information provided, 326 | in accord with this section must be in a format that is publicly 327 | documented (and with an implementation available to the public in 328 | source code form), and must require no special password or key for 329 | unpacking, reading or copying. 330 | 331 | 7. Additional Terms. 332 | 333 | "Additional permissions" are terms that supplement the terms of this 334 | License by making exceptions from one or more of its conditions. 335 | Additional permissions that are applicable to the entire Program shall 336 | be treated as though they were included in this License, to the extent 337 | that they are valid under applicable law. If additional permissions 338 | apply only to part of the Program, that part may be used separately 339 | under those permissions, but the entire Program remains governed by 340 | this License without regard to the additional permissions. 341 | 342 | When you convey a copy of a covered work, you may at your option 343 | remove any additional permissions from that copy, or from any part of 344 | it. (Additional permissions may be written to require their own 345 | removal in certain cases when you modify the work.) You may place 346 | additional permissions on material, added by you to a covered work, 347 | for which you have or can give appropriate copyright permission. 348 | 349 | Notwithstanding any other provision of this License, for material you 350 | add to a covered work, you may (if authorized by the copyright holders of 351 | that material) supplement the terms of this License with terms: 352 | 353 | a) Disclaiming warranty or limiting liability differently from the 354 | terms of sections 15 and 16 of this License; or 355 | 356 | b) Requiring preservation of specified reasonable legal notices or 357 | author attributions in that material or in the Appropriate Legal 358 | Notices displayed by works containing it; or 359 | 360 | c) Prohibiting misrepresentation of the origin of that material, or 361 | requiring that modified versions of such material be marked in 362 | reasonable ways as different from the original version; or 363 | 364 | d) Limiting the use for publicity purposes of names of licensors or 365 | authors of the material; or 366 | 367 | e) Declining to grant rights under trademark law for use of some 368 | trade names, trademarks, or service marks; or 369 | 370 | f) Requiring indemnification of licensors and authors of that 371 | material by anyone who conveys the material (or modified versions of 372 | it) with contractual assumptions of liability to the recipient, for 373 | any liability that these contractual assumptions directly impose on 374 | those licensors and authors. 375 | 376 | All other non-permissive additional terms are considered "further 377 | restrictions" within the meaning of section 10. If the Program as you 378 | received it, or any part of it, contains a notice stating that it is 379 | governed by this License along with a term that is a further 380 | restriction, you may remove that term. If a license document contains 381 | a further restriction but permits relicensing or conveying under this 382 | License, you may add to a covered work material governed by the terms 383 | of that license document, provided that the further restriction does 384 | not survive such relicensing or conveying. 385 | 386 | If you add terms to a covered work in accord with this section, you 387 | must place, in the relevant source files, a statement of the 388 | additional terms that apply to those files, or a notice indicating 389 | where to find the applicable terms. 390 | 391 | Additional terms, permissive or non-permissive, may be stated in the 392 | form of a separately written license, or stated as exceptions; 393 | the above requirements apply either way. 394 | 395 | 8. Termination. 396 | 397 | You may not propagate or modify a covered work except as expressly 398 | provided under this License. Any attempt otherwise to propagate or 399 | modify it is void, and will automatically terminate your rights under 400 | this License (including any patent licenses granted under the third 401 | paragraph of section 11). 402 | 403 | However, if you cease all violation of this License, then your 404 | license from a particular copyright holder is reinstated (a) 405 | provisionally, unless and until the copyright holder explicitly and 406 | finally terminates your license, and (b) permanently, if the copyright 407 | holder fails to notify you of the violation by some reasonable means 408 | prior to 60 days after the cessation. 409 | 410 | Moreover, your license from a particular copyright holder is 411 | reinstated permanently if the copyright holder notifies you of the 412 | violation by some reasonable means, this is the first time you have 413 | received notice of violation of this License (for any work) from that 414 | copyright holder, and you cure the violation prior to 30 days after 415 | your receipt of the notice. 416 | 417 | Termination of your rights under this section does not terminate the 418 | licenses of parties who have received copies or rights from you under 419 | this License. If your rights have been terminated and not permanently 420 | reinstated, you do not qualify to receive new licenses for the same 421 | material under section 10. 422 | 423 | 9. Acceptance Not Required for Having Copies. 424 | 425 | You are not required to accept this License in order to receive or 426 | run a copy of the Program. Ancillary propagation of a covered work 427 | occurring solely as a consequence of using peer-to-peer transmission 428 | to receive a copy likewise does not require acceptance. However, 429 | nothing other than this License grants you permission to propagate or 430 | modify any covered work. These actions infringe copyright if you do 431 | not accept this License. Therefore, by modifying or propagating a 432 | covered work, you indicate your acceptance of this License to do so. 433 | 434 | 10. Automatic Licensing of Downstream Recipients. 435 | 436 | Each time you convey a covered work, the recipient automatically 437 | receives a license from the original licensors, to run, modify and 438 | propagate that work, subject to this License. You are not responsible 439 | for enforcing compliance by third parties with this License. 440 | 441 | An "entity transaction" is a transaction transferring control of an 442 | organization, or substantially all assets of one, or subdividing an 443 | organization, or merging organizations. If propagation of a covered 444 | work results from an entity transaction, each party to that 445 | transaction who receives a copy of the work also receives whatever 446 | licenses to the work the party's predecessor in interest had or could 447 | give under the previous paragraph, plus a right to possession of the 448 | Corresponding Source of the work from the predecessor in interest, if 449 | the predecessor has it or can get it with reasonable efforts. 450 | 451 | You may not impose any further restrictions on the exercise of the 452 | rights granted or affirmed under this License. For example, you may 453 | not impose a license fee, royalty, or other charge for exercise of 454 | rights granted under this License, and you may not initiate litigation 455 | (including a cross-claim or counterclaim in a lawsuit) alleging that 456 | any patent claim is infringed by making, using, selling, offering for 457 | sale, or importing the Program or any portion of it. 458 | 459 | 11. Patents. 460 | 461 | A "contributor" is a copyright holder who authorizes use under this 462 | License of the Program or a work on which the Program is based. The 463 | work thus licensed is called the contributor's "contributor version". 464 | 465 | A contributor's "essential patent claims" are all patent claims 466 | owned or controlled by the contributor, whether already acquired or 467 | hereafter acquired, that would be infringed by some manner, permitted 468 | by this License, of making, using, or selling its contributor version, 469 | but do not include claims that would be infringed only as a 470 | consequence of further modification of the contributor version. For 471 | purposes of this definition, "control" includes the right to grant 472 | patent sublicenses in a manner consistent with the requirements of 473 | this License. 474 | 475 | Each contributor grants you a non-exclusive, worldwide, royalty-free 476 | patent license under the contributor's essential patent claims, to 477 | make, use, sell, offer for sale, import and otherwise run, modify and 478 | propagate the contents of its contributor version. 479 | 480 | In the following three paragraphs, a "patent license" is any express 481 | agreement or commitment, however denominated, not to enforce a patent 482 | (such as an express permission to practice a patent or covenant not to 483 | sue for patent infringement). To "grant" such a patent license to a 484 | party means to make such an agreement or commitment not to enforce a 485 | patent against the party. 486 | 487 | If you convey a covered work, knowingly relying on a patent license, 488 | and the Corresponding Source of the work is not available for anyone 489 | to copy, free of charge and under the terms of this License, through a 490 | publicly available network server or other readily accessible means, 491 | then you must either (1) cause the Corresponding Source to be so 492 | available, or (2) arrange to deprive yourself of the benefit of the 493 | patent license for this particular work, or (3) arrange, in a manner 494 | consistent with the requirements of this License, to extend the patent 495 | license to downstream recipients. "Knowingly relying" means you have 496 | actual knowledge that, but for the patent license, your conveying the 497 | covered work in a country, or your recipient's use of the covered work 498 | in a country, would infringe one or more identifiable patents in that 499 | country that you have reason to believe are valid. 500 | 501 | If, pursuant to or in connection with a single transaction or 502 | arrangement, you convey, or propagate by procuring conveyance of, a 503 | covered work, and grant a patent license to some of the parties 504 | receiving the covered work authorizing them to use, propagate, modify 505 | or convey a specific copy of the covered work, then the patent license 506 | you grant is automatically extended to all recipients of the covered 507 | work and works based on it. 508 | 509 | A patent license is "discriminatory" if it does not include within 510 | the scope of its coverage, prohibits the exercise of, or is 511 | conditioned on the non-exercise of one or more of the rights that are 512 | specifically granted under this License. You may not convey a covered 513 | work if you are a party to an arrangement with a third party that is 514 | in the business of distributing software, under which you make payment 515 | to the third party based on the extent of your activity of conveying 516 | the work, and under which the third party grants, to any of the 517 | parties who would receive the covered work from you, a discriminatory 518 | patent license (a) in connection with copies of the covered work 519 | conveyed by you (or copies made from those copies), or (b) primarily 520 | for and in connection with specific products or compilations that 521 | contain the covered work, unless you entered into that arrangement, 522 | or that patent license was granted, prior to 28 March 2007. 523 | 524 | Nothing in this License shall be construed as excluding or limiting 525 | any implied license or other defenses to infringement that may 526 | otherwise be available to you under applicable patent law. 527 | 528 | 12. No Surrender of Others' Freedom. 529 | 530 | If conditions are imposed on you (whether by court order, agreement or 531 | otherwise) that contradict the conditions of this License, they do not 532 | excuse you from the conditions of this License. If you cannot convey a 533 | covered work so as to satisfy simultaneously your obligations under this 534 | License and any other pertinent obligations, then as a consequence you may 535 | not convey it at all. For example, if you agree to terms that obligate you 536 | to collect a royalty for further conveying from those to whom you convey 537 | the Program, the only way you could satisfy both those terms and this 538 | License would be to refrain entirely from conveying the Program. 539 | 540 | 13. Remote Network Interaction; Use with the GNU General Public License. 541 | 542 | Notwithstanding any other provision of this License, if you modify the 543 | Program, your modified version must prominently offer all users 544 | interacting with it remotely through a computer network (if your version 545 | supports such interaction) an opportunity to receive the Corresponding 546 | Source of your version by providing access to the Corresponding Source 547 | from a network server at no charge, through some standard or customary 548 | means of facilitating copying of software. This Corresponding Source 549 | shall include the Corresponding Source for any work covered by version 3 550 | of the GNU General Public License that is incorporated pursuant to the 551 | following paragraph. 552 | 553 | Notwithstanding any other provision of this License, you have 554 | permission to link or combine any covered work with a work licensed 555 | under version 3 of the GNU General Public License into a single 556 | combined work, and to convey the resulting work. The terms of this 557 | License will continue to apply to the part which is the covered work, 558 | but the work with which it is combined will remain governed by version 559 | 3 of the GNU General Public License. 560 | 561 | 14. Revised Versions of this License. 562 | 563 | The Free Software Foundation may publish revised and/or new versions of 564 | the GNU Affero General Public License from time to time. Such new versions 565 | will be similar in spirit to the present version, but may differ in detail to 566 | address new problems or concerns. 567 | 568 | Each version is given a distinguishing version number. If the 569 | Program specifies that a certain numbered version of the GNU Affero General 570 | Public License "or any later version" applies to it, you have the 571 | option of following the terms and conditions either of that numbered 572 | version or of any later version published by the Free Software 573 | Foundation. If the Program does not specify a version number of the 574 | GNU Affero General Public License, you may choose any version ever published 575 | by the Free Software Foundation. 576 | 577 | If the Program specifies that a proxy can decide which future 578 | versions of the GNU Affero General Public License can be used, that proxy's 579 | public statement of acceptance of a version permanently authorizes you 580 | to choose that version for the Program. 581 | 582 | Later license versions may give you additional or different 583 | permissions. However, no additional obligations are imposed on any 584 | author or copyright holder as a result of your choosing to follow a 585 | later version. 586 | 587 | 15. Disclaimer of Warranty. 588 | 589 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 590 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 591 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 592 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 593 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 594 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 595 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 596 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 597 | 598 | 16. Limitation of Liability. 599 | 600 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 601 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 602 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 603 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 604 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 605 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 606 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 607 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 608 | SUCH DAMAGES. 609 | 610 | 17. Interpretation of Sections 15 and 16. 611 | 612 | If the disclaimer of warranty and limitation of liability provided 613 | above cannot be given local legal effect according to their terms, 614 | reviewing courts shall apply local law that most closely approximates 615 | an absolute waiver of all civil liability in connection with the 616 | Program, unless a warranty or assumption of liability accompanies a 617 | copy of the Program in return for a fee. 618 | 619 | END OF TERMS AND CONDITIONS 620 | 621 | How to Apply These Terms to Your New Programs 622 | 623 | If you develop a new program, and you want it to be of the greatest 624 | possible use to the public, the best way to achieve this is to make it 625 | free software which everyone can redistribute and change under these terms. 626 | 627 | To do so, attach the following notices to the program. It is safest 628 | to attach them to the start of each source file to most effectively 629 | state the exclusion of warranty; and each file should have at least 630 | the "copyright" line and a pointer to where the full notice is found. 631 | 632 | 633 | Copyright (C) 634 | 635 | This program is free software: you can redistribute it and/or modify 636 | it under the terms of the GNU Affero General Public License as published by 637 | the Free Software Foundation, either version 3 of the License, or 638 | (at your option) any later version. 639 | 640 | This program is distributed in the hope that it will be useful, 641 | but WITHOUT ANY WARRANTY; without even the implied warranty of 642 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 643 | GNU Affero General Public License for more details. 644 | 645 | You should have received a copy of the GNU Affero General Public License 646 | along with this program. If not, see . 647 | 648 | Also add information on how to contact you by electronic and paper mail. 649 | 650 | If your software can interact with users remotely through a computer 651 | network, you should also make sure that it provides a way for users to 652 | get its source. For example, if your program is a web application, its 653 | interface could display a "Source" link that leads users to an archive 654 | of the code. There are many ways you could offer source, and different 655 | solutions will be better for different programs; see section 13 for the 656 | specific requirements. 657 | 658 | You should also get your employer (if you work as a programmer) or school, 659 | if any, to sign a "copyright disclaimer" for the program, if necessary. 660 | For more information on this, and how to apply and follow the GNU AGPL, see 661 | . -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | WhoWasI 2 | ====================== 3 | This application is able to impersonate any logged in user and execute commands under the context of the impersonated user. 4 | 5 | Released as open source by NCC Group Plc - http://www.nccgroup.com/ 6 | 7 | Developed By: 8 | * Chris Thomas, chris [dot] Thomas [at] nccgroup [dot] com 9 | 10 | https://github.com/nccgroup/WhoWasI 11 | 12 | Released under AGPL see LICENSE for more information 13 | 14 | Usage 15 | ------------- 16 | [List Process Privileges] 17 | 18 | WhoWasI.exe -pp 19 | 20 | 21 | [List All Available Accounts] 22 | 23 | WhoWasI.exe -la 24 | 25 | 26 | [Impersonate & Execute Command as Another User] 27 | 28 | usage: WhoWasI.exe {account} {command} 29 | 30 | The following command will spawn a command shell as the SYSTEM user: 31 | 32 | WhoWasI.exe system cmd.exe 33 | 34 | 35 | Dependencies 36 | ------------- 37 | THE SOLUTION WILL COMPILE WITH ALL STOCK VERSIONS OF .NET, NO DEPENDANCIES ARE REQUIRED. 38 | 39 | Note: .NET Framework Binaries (.NET 2 is present on all Windows OS’s until Windows 8 / Server 2012 where .NET 4 is present by default) are required. 40 | 41 | Change Log 42 | ------------- 43 | Version 1.0 - 17th June 2014 44 | * Initial Release 45 | 46 | Version 1.1 - 1st Sept 2014 47 | * Added: Ability To Specify Process ID Instead of Account Name 48 | * Added: Able To List A Processes Privileges 49 | * Fixed: Wrong Application Name In Usage Menu 50 | * Fixed: The 'SeAssignPrimaryTokenPrivilege' Privilege Is Not Applied When Impersonating 51 | -------------------------------------------------------------------------------- /WhoWasI.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2013 4 | VisualStudioVersion = 12.0.30501.0 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WhoWasI", "WhoWasI\WhoWasI.csproj", "{E08F0042-63E4-4A1E-9786-B1E0D9E33695}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {E08F0042-63E4-4A1E-9786-B1E0D9E33695}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {E08F0042-63E4-4A1E-9786-B1E0D9E33695}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {E08F0042-63E4-4A1E-9786-B1E0D9E33695}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {E08F0042-63E4-4A1E-9786-B1E0D9E33695}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | EndGlobal 23 | -------------------------------------------------------------------------------- /WhoWasI.v12.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI.v12.suo -------------------------------------------------------------------------------- /WhoWasI/ChangeLog.txt: -------------------------------------------------------------------------------- 1 | Version 1.0 - 17th June 2014 2 | ==================================== 3 | Initial Release 4 | 5 | Version 1.1 - 1st September 2014 6 | ==================================== 7 | Added: Ability To Specify Process ID Instead of Account Name 8 | Added: Able To List A Processes Privileges 9 | Fixed: Wrong Application Name In Usage Menu 10 | Fixed: The 'SeAssignPrimaryTokenPrivilege' Privilege Was Not Applied When Impersonating 11 | 12 | Version 1.1.1 - 2nd September 2014 13 | ==================================== 14 | Fixed: If non-numerical proccess ID is specified the applicationc does not quit on error 15 | -------------------------------------------------------------------------------- /WhoWasI/Privilages.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | using System.Text; 4 | 5 | /* 6 | * 7 | * Released as open source by NCC Group Plc - http://www.nccgroup.com/ 8 | * 9 | * Developed by Chris Thomas, chris dot thomas at nccgroup dot com 10 | * 11 | * https://github.com/nccgroup/WhoWasI 12 | * 13 | * Released under AGPL see LICENSE for more information 14 | */ 15 | 16 | 17 | namespace WhoWasI 18 | { 19 | public static class Privilages 20 | { 21 | /// 22 | /// Resolves A Specified LUID Value Into The Apropriate Windows Privilege 23 | /// 24 | public static String GetPrivilegeName(Win32API.LUID luid) 25 | { 26 | try 27 | { 28 | StringBuilder _PrivilegeName = new StringBuilder(); 29 | 30 | //hold the length of the LuID Struct 31 | Int32 _NameLength = 0; 32 | 33 | //first method call is to get the _NameLength so we can allocate a buffer 34 | Win32API.LookupPrivilegeName(String.Empty, ref luid, _PrivilegeName, ref _NameLength); 35 | 36 | //make sure there is sufficient space in memory 37 | _PrivilegeName.EnsureCapacity(_NameLength); 38 | 39 | //look up the privilage name 40 | if (Win32API.LookupPrivilegeName(String.Empty, ref luid, _PrivilegeName, ref _NameLength)) 41 | { 42 | return _PrivilegeName.ToString(); 43 | }//if (Win32API.LookupPrivilegeName(String.Empty, ref luid, _PrivilegeName, ref _NameLength)) 44 | } 45 | catch (Exception) 46 | { 47 | Console.WriteLine("## ERROR ## - Problem Getting Privilege Name!\nWin32 Error: '{0}', LUID '{1}'", Marshal.GetLastWin32Error(), luid); 48 | }//end of try-catch 49 | 50 | //default catch all 51 | return String.Empty; 52 | }//end of public static String GetPrivilegeName(Win32API.LUID luid) 53 | 54 | 55 | /// 56 | /// Gets The System LUID Value for The Specified Privilege 57 | /// 58 | /// Specified Privilege 59 | /// Associated LUID Value 60 | public static Win32API.LUID GetLUIDFromPrivilageName(Win32API.Privilege privilege) 61 | { 62 | Win32API.LUID _LUID = new Win32API.LUID(); 63 | 64 | 65 | if (Win32API.LookupPrivilegeValue(String.Empty, privilege.ToString(), out _LUID) == false) 66 | { 67 | Console.WriteLine("## ERROR ## - Problem Resolving Privilage '{0}' To Its LUID!\nWin32 Error: '{1}'", privilege, Marshal.GetLastWin32Error()); 68 | 69 | return new Win32API.LUID(); 70 | } 71 | 72 | return _LUID; 73 | }//end of public static GetLUIDFromPrivilageName(Win32API.Privilege privilege) 74 | 75 | /// 76 | /// Checks Whether The Proccess Has A Specified Privilege 77 | /// 78 | /// Required Privilege 79 | /// Token Handle of Process 80 | public static Boolean HasPrivilege(Win32API.Privilege privilege, IntPtr processTokenHandle) 81 | { 82 | //Get the nessesary LUID for the required privilage 83 | Win32API.LUID _PrivLUID = GetLUIDFromPrivilageName(privilege); 84 | 85 | //did we get something valid? 86 | if (_PrivLUID.HighPart == 0) { return false; } 87 | 88 | //get a list of privs 89 | Win32API.LUID_AND_ATTRIBUTES[] _Privs = GetPrivileges(processTokenHandle); 90 | 91 | //cycle through each privilage and dump out to screen 92 | foreach (var luidAndAttributes in _Privs) 93 | { 94 | if (luidAndAttributes.Luid.Equals(_PrivLUID)) { return true; } 95 | }//end of foreach 96 | 97 | return false; 98 | } 99 | 100 | 101 | /// 102 | /// Get A List of Privilages Assigned To The Specified Process 103 | /// 104 | /// Process Handle 105 | /// List of Assigned Privileges 106 | public static Win32API.LUID_AND_ATTRIBUTES[] GetPrivileges(IntPtr processTokenHandle) 107 | { 108 | //generic try-catch to make sure we gracefully handle any errors! 109 | try 110 | { 111 | // hold the length of TOKEN_PRIVILEGES Struct that is returned on the first call 112 | Int32 _TokenInformationLength = 0; 113 | 114 | //_TokenInformationLength variable in the first instance is not required, its the "out" version of this variable we need 115 | Win32API.GetTokenInformation(processTokenHandle, Win32API.TOKEN_INFORMATION_CLASS.TokenPrivileges, IntPtr.Zero, _TokenInformationLength, out _TokenInformationLength); 116 | 117 | //Allocate a block of memory to hold the required info 118 | IntPtr _TokenInformation = Marshal.AllocHGlobal(_TokenInformationLength); 119 | 120 | //now we have an allocated block of memory to handle the privilage structre lets grab the list of privilages 121 | if (Win32API.GetTokenInformation(processTokenHandle, Win32API.TOKEN_INFORMATION_CLASS.TokenPrivileges, _TokenInformation, _TokenInformationLength, out _TokenInformationLength) == false) 122 | { 123 | Console.WriteLine("## ERROR ## - Problem Executing GetTokenInformation on ProcessHandle '{1}'!\nWin32 Error: '{0}'", Marshal.GetLastWin32Error(), processTokenHandle); 124 | }//end of if (Win32API.GetTokenInformation 125 | 126 | Int32 _PrivilegeCount = Marshal.ReadInt32(_TokenInformation); 127 | 128 | //do we have some privileges to cycle through? 129 | if (_PrivilegeCount <= 0) 130 | { 131 | Console.WriteLine("## ERROR ## - Privilege Count Aprears To Be Invalid on Process Handle '{0}', Count '{1}'", processTokenHandle, _PrivilegeCount); 132 | 133 | Marshal.FreeHGlobal(_TokenInformation); //clean up 134 | return new Win32API.LUID_AND_ATTRIBUTES[0]; 135 | }//end of if (_PrivilegeCount <= 0) 136 | 137 | Win32API.LUID_AND_ATTRIBUTES[] _TokenPrivileges = new Win32API.LUID_AND_ATTRIBUTES[_PrivilegeCount]; 138 | 139 | //pointer to hold the location within memory, take the last pointer plus the size of the last read structure 140 | IntPtr _ReadPointer = new IntPtr(_TokenInformation.ToInt32() + sizeof(int)); 141 | 142 | //cycle through the structure memory and fish out all of the pointer info 143 | for (Int32 i = 1; i < _PrivilegeCount; i++) 144 | { 145 | //Load the record 146 | Win32API.LUID_AND_ATTRIBUTES _TempTokenPrivs = (Win32API.LUID_AND_ATTRIBUTES)Marshal.PtrToStructure(_ReadPointer, typeof(Win32API.LUID_AND_ATTRIBUTES)); 147 | 148 | _ReadPointer = new IntPtr(_ReadPointer.ToInt32() + Marshal.SizeOf(_TempTokenPrivs)); 149 | _TokenPrivileges[i] = _TempTokenPrivs; 150 | }//end of for loop 151 | 152 | Marshal.FreeHGlobal(_TokenInformation); //clean up 153 | 154 | //return our list of privilages 155 | return _TokenPrivileges; 156 | } 157 | catch (Exception) 158 | { 159 | Console.WriteLine("## ERROR ## - Problem Listing System Privileges!\nWin32 Error: '{0}'", Marshal.GetLastWin32Error()); 160 | }//end of try-catch 161 | 162 | 163 | //default catch all, we should not get to this point if everything worked! 164 | return new Win32API.LUID_AND_ATTRIBUTES[0]; 165 | }//end of public static Boolean ListPrivilages(IntPtr processHandle) 166 | 167 | 168 | } 169 | } 170 | -------------------------------------------------------------------------------- /WhoWasI/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | /* 3 | * 4 | * Released as open source by NCC Group Plc - http://www.nccgroup.com/ 5 | * 6 | * Developed by Chris Thomas, chris dot thomas at nccgroup dot com 7 | * 8 | * https://github.com/nccgroup/WhoWasI 9 | * 10 | * Released under AGPL see LICENSE for more information 11 | */ 12 | 13 | namespace WhoWasI 14 | { 15 | class Program 16 | { 17 | private const String VERSION_NUMBER = "1.1.1"; 18 | 19 | static void Main(String[] args) 20 | { 21 | PrintBanner(); 22 | 23 | if (args.Length == 0) 24 | { 25 | PrintUseage(); 26 | return; 27 | } 28 | 29 | if (WhoWasI.IsAdmin == false) 30 | { 31 | Console.WriteLine("\n## ERROR ## - You Are Not An Admin.. You need Admin Privs!"); 32 | PrintUseage(); 33 | return; 34 | } 35 | 36 | 37 | 38 | //we already have the last two arguments 39 | for (Int32 i = 0; i < args.Length; i++) 40 | { 41 | switch (args[i].ToLower().Trim()) 42 | { 43 | case "-la": WhoWasI.PrintActiveAccountsToConsole(); 44 | return; 45 | case "-pp": 46 | Int32 _PID; 47 | 48 | //try and parse the next argument, this should be a process ID and so numerical 49 | if (!Int32.TryParse(args[i + 1], out _PID)) 50 | { 51 | Console.WriteLine("## ERROR ## - Invalid Process ID '{0}' Specified, Unable To Dump Process Privilages...\n"); 52 | PrintUseage(); 53 | Environment.Exit(0); 54 | }//end of if (!UInt32.TryParse(args[i + 1], out _PID)) 55 | 56 | WhoWasI.PrintProcessPrivsToConsole(_PID); 57 | Environment.Exit(0); 58 | 59 | return; 60 | }//end of switch 61 | }//end of for (Int32 i = 0; i < args.Length -2; i++) 62 | 63 | 64 | if (args.Length < 2) 65 | { 66 | Console.WriteLine("## ERROR ## - Not Enough Command Line Args, Aborting..n"); 67 | return; 68 | } 69 | 70 | //We want the penultimate paramiter as the account 71 | String _InputtedAccount = args[args.Length - 2]; 72 | 73 | 74 | Int32 _InputtedProcessID; 75 | Boolean _UseProcessIDAsAccountHandle = false; 76 | 77 | //the following checks are used to determine whether a string (account) or number (processID) has been specified 78 | if (Int32.TryParse(_InputtedAccount, out _InputtedProcessID)) { _UseProcessIDAsAccountHandle = true; } 79 | 80 | 81 | //Last paramiter is the command to run 82 | String _CommandToRun = args[args.Length - 1]; 83 | 84 | if (String.IsNullOrEmpty(_InputtedAccount)) 85 | { 86 | Console.WriteLine("## ERROR ## - Account Name Is NULL/Empty, Aborting..n"); 87 | PrintUseage(); 88 | return; 89 | }//end of if (String.IsNullOrEmpty(_InputtedAccount)) 90 | 91 | if (String.IsNullOrEmpty(_CommandToRun)) 92 | { 93 | Console.WriteLine("## ERROR ## - Command Is NULL/Empty, Aborting..\n"); 94 | PrintUseage(); 95 | return; 96 | }//end of if (String.IsNullOrEmpty(_CommandToRun)) 97 | 98 | ProcessEntry _ProcessIdToUse; 99 | 100 | 101 | if (_UseProcessIDAsAccountHandle) 102 | { 103 | _ProcessIdToUse = new ProcessEntry() 104 | { 105 | Name = "ASDF", 106 | PID = _InputtedProcessID 107 | }; 108 | } 109 | else 110 | { 111 | _ProcessIdToUse = WhoWasI.GetProcessIDForAccount(_InputtedAccount); 112 | } 113 | 114 | //do we have a valid process? 115 | if (_ProcessIdToUse.PID == -1) 116 | { 117 | Console.WriteLine("## ERROR ## - No Processes Found For Account '{0}', Aborting..\n", _InputtedAccount); 118 | PrintUseage(); 119 | return; 120 | }//end of if (_ProcessIdToUse == -1) 121 | 122 | Console.WriteLine("[+] Using Process '[{0}] - {1}' With Owner '{2}'..", _ProcessIdToUse.Name, _ProcessIdToUse.PID, _InputtedAccount); 123 | 124 | WhoWasI.ImpersonateAndExecute(_ProcessIdToUse.PID, _CommandToRun); 125 | } 126 | 127 | 128 | 129 | private static void PrintBanner() 130 | { 131 | Console.WriteLine("WhoWasI v{0} - Written by Chris Thomas (chris.thomas@nccgroup.com)", VERSION_NUMBER); 132 | Console.WriteLine("=================================================================="); 133 | } 134 | 135 | 136 | private static void PrintUseage() 137 | { 138 | Console.WriteLine("Useage: WhoWasI.exe [Options] {Run As User/PID} {Command}"); 139 | Console.WriteLine("Options:"); 140 | Console.WriteLine("\t-la\t\t-\tList Available Users"); 141 | Console.WriteLine("\t-pp \t-\tList Process Privilages (By PID)"); 142 | Console.WriteLine("\nExample:"); 143 | Console.WriteLine("\tWhoWasI.exe system cmd.exe\t (Run With SYSTEM Permissions)"); 144 | Console.WriteLine("\tWhoWasI.exe 1234 cmd.exe\t (Run With PID 1234 Permissions)"); 145 | } 146 | } 147 | } 148 | -------------------------------------------------------------------------------- /WhoWasI/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("WhoWasI")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("WhoWasI")] 13 | [assembly: AssemblyCopyright("Copyright © 2014")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("2c89232b-8df4-4b23-9cdc-23e6853e8cc1")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /WhoWasI/WhoWasI.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.Runtime.InteropServices; 5 | using System.Security.Principal; 6 | 7 | /* 8 | * 9 | * Released as open source by NCC Group Plc - http://www.nccgroup.com/ 10 | * 11 | * Developed by Chris Thomas, chris dot thomas at nccgroup dot com 12 | * 13 | * https://github.com/nccgroup/WhoWasI 14 | * 15 | * Released under AGPL see LICENSE for more information 16 | */ 17 | 18 | namespace WhoWasI 19 | { 20 | public class WhoWasI 21 | { 22 | 23 | /// 24 | /// Impersonate Specified User & Execute A Command 25 | /// 26 | /// Process ID Which You Want To Impersonate 27 | /// Command You Want To Execute 28 | /// Was Execution Successful 29 | public static Boolean ImpersonateAndExecute(Int32 processID, String command) 30 | { 31 | Boolean _Errored = false; 32 | IntPtr _TokenHandle = IntPtr.Zero; 33 | IntPtr _DuplicateTokenHandle = IntPtr.Zero; 34 | 35 | //get the handle to the process 36 | IntPtr _ProcessIDHandle = Process.GetProcessById(processID).Handle; 37 | 38 | //have we obtained a valid handle? 39 | if (_ProcessIDHandle == IntPtr.Zero) 40 | { 41 | Console.WriteLine("## ERROR ## - Unable To Get Handle For Process ID '{0}', Aborting..", processID); 42 | return false; 43 | }//end of if 44 | 45 | 46 | //open the process and attempt to obtain the token. 47 | if (Win32API.OpenProcessToken(_ProcessIDHandle, Win32API.TOKEN_ASSIGN_PRIMARY | Win32API.TOKEN_DUPLICATE | Win32API.TOKEN_IMPERSONATE | Win32API.TOKEN_QUERY, out _TokenHandle) == false) 48 | { 49 | Console.WriteLine("## ERROR ## - Trying To Open Process ID '{0}' Handle..\nError '{1}'", processID, Marshal.GetLastWin32Error()); 50 | return false; 51 | }//end of if 52 | 53 | //do we have a valid token handle? 54 | if (_TokenHandle == IntPtr.Zero) 55 | { 56 | Console.WriteLine("## ERROR ## - Opened Token For Process ID '{0}' However Handle Is Invalid, Aborting..", processID); 57 | return false; 58 | } 59 | 60 | 61 | //Instantiate the process handle so we can resolve the account context 62 | WindowsIdentity _ProcessAccountID = new WindowsIdentity(_TokenHandle); 63 | Console.WriteLine("[+] Successfully Opened Process ID '{0}' Handle", processID); 64 | 65 | try 66 | { 67 | Win32API.SECURITY_ATTRIBUTES _SecuirtyAttributes = new Win32API.SECURITY_ATTRIBUTES(); 68 | _SecuirtyAttributes.nLength = Marshal.SizeOf(_SecuirtyAttributes); 69 | 70 | //we need to duplicate the primary token 71 | if (Win32API.DuplicateTokenEx(_TokenHandle, Win32API.TOKEN_ALL_ACCESS, ref _SecuirtyAttributes, Win32API.SECURITY_IMPERSONATION_LEVEL.SecurityIdentification, Win32API.TOKEN_TYPE.TokenPrimary, out _DuplicateTokenHandle) == false) 72 | { 73 | Console.WriteLine("## ERROR ## - Attempting To Duplicate Process Token..\nWin32 Error: {0}", Marshal.GetLastWin32Error()); 74 | return false; 75 | }//end of if 76 | 77 | 78 | //do we have a valid token 79 | if (_DuplicateTokenHandle == IntPtr.Zero) 80 | { 81 | Console.WriteLine("## ERROR ## - Token Duplication Failed!\nWin32 Error: {0}", Marshal.GetLastWin32Error()); 82 | return false; 83 | }//end of if 84 | 85 | //Who Was I Again? :D 86 | WindowsImpersonationContext _ImpersonationContext = _ProcessAccountID.Impersonate(); 87 | 88 | Console.WriteLine("[+] Impersonation Successful!\n[+] Account Token ID Is '{0}', Impersonated Account Is '{1}'", WindowsIdentity.GetCurrent().Token, WindowsIdentity.GetCurrent().Name); 89 | 90 | return ExecuteCommand(_DuplicateTokenHandle, command); 91 | } 92 | catch (Exception ex) 93 | { 94 | Console.WriteLine("## ERROR ## - Something Went Wrong Duplicating The Process Token!\nWin32 Error: '{0}'", ex.Message); 95 | _Errored = true; 96 | } 97 | finally 98 | { 99 | //clean up after ourselves 100 | if (_TokenHandle != IntPtr.Zero) { Win32API.CloseHandle(_TokenHandle); } 101 | }//end of try-catch-finally 102 | 103 | //catch it here because i always want the finally clase to execute 104 | //you cannot jump out of the finally block 105 | if (_Errored) { return false; } 106 | 107 | 108 | //default catchall 109 | return false; 110 | }//end of public Boolean ImpersonateAndExecute(Int32 processID, String command) 111 | 112 | 113 | private static Boolean ExecuteCommand(IntPtr userAccountHandle, String command) 114 | { 115 | //general structs we need, would prefer to use NULL but .NET doesnt like it. 116 | Win32API.PROCESS_INFORMATION _ProcessInfo = new Win32API.PROCESS_INFORMATION(); 117 | Win32API.SECURITY_ATTRIBUTES _ProcesSecurityAttributes = new Win32API.SECURITY_ATTRIBUTES(); 118 | Win32API.SECURITY_ATTRIBUTES _ThreadSecurityAttributes = new Win32API.SECURITY_ATTRIBUTES(); 119 | 120 | _ProcesSecurityAttributes.nLength = Marshal.SizeOf(_ProcesSecurityAttributes); 121 | _ThreadSecurityAttributes.nLength = Marshal.SizeOf(_ThreadSecurityAttributes); 122 | 123 | Win32API.STARTUP_INFO _AppStartupInfo = new Win32API.STARTUP_INFO(); 124 | _AppStartupInfo.cb = Marshal.SizeOf(_AppStartupInfo); 125 | 126 | //todo: is there a better method of selecting 127 | _AppStartupInfo.lpDesktop = @"WinSta0\Default"; //we want the defalt desktop 128 | _AppStartupInfo.dwFlags = Win32API.STARTF_USESHOWWINDOW | Win32API.STARTF_FORCEONFEEDBACK; 129 | _AppStartupInfo.wShowWindow = Win32API.SW_SHOW; 130 | 131 | 132 | //todo: load the user profile so i can access MyDocuments and other profile information 133 | 134 | //execute a new process with the token 135 | if (Win32API.CreateProcessWithTokenW(userAccountHandle, Win32API.LOGON_FLAGS.LOGON_NETCREDENTIALS_ONLY, null, command, Win32API.CREATION_FLAGS.CREATE_NEW_CONSOLE, IntPtr.Zero, null, ref _AppStartupInfo, out _ProcessInfo)) 136 | { 137 | Console.WriteLine("[+] Successfully Executed Command '{0}' With Process ID '{1}", command, _ProcessInfo.dwProcessId); 138 | return true; 139 | } 140 | 141 | Console.WriteLine("## ERROR ## - Problem Executing Command!\nWin32 Error: '{0}'", Marshal.GetLastWin32Error()); 142 | return false; 143 | } 144 | 145 | #region Process & Account Listing Methods 146 | 147 | /// 148 | /// Gets The First Process For The Listed Account 149 | /// 150 | /// Account Name To Search For 151 | /// Process Entry Containing The Process ID 152 | public static ProcessEntry GetProcessIDForAccount(String account) 153 | { 154 | //convert the account name to upper to remove variances 155 | account = account.ToUpper().Trim(); 156 | 157 | //convert the shorthand version to the proper account names. 158 | switch (account) 159 | { 160 | case "SYSTEM": account = @"NT AUTHORITY\SYSTEM"; break; 161 | case "NETWORK SERVICE": account = @"NT AUTHORITY\NETWORK SERVICE"; break; 162 | case "LOCAL SERVICE": account = @"NT AUTHORITY\LOCAL SERVICE"; break; 163 | }//end of switch (account) 164 | 165 | //cycle through a list of all users to see if the specified user is present 166 | foreach (KeyValuePair> _Account in ListProcessAccounts) 167 | { 168 | //have we found the correct user? 169 | if(_Account.Key.Equals(account)) 170 | { 171 | //return the first PID 172 | //there is a potential race condition, should 173 | //the process terminate before we grab the token the app will bork. 174 | return _Account.Value[0]; 175 | }// if(_Account.Key.Equals(account)) 176 | 177 | 178 | }//end of foreach (KeyValuePair> _Account in ListProcessAccounts) 179 | 180 | //return a default entry with an invalid PID so we know there is an error 181 | return new ProcessEntry 182 | { 183 | Name = String.Empty, 184 | PID = -1 185 | }; 186 | }//end of public ProcessEntry GetProcessIDForAccount(String account) 187 | 188 | 189 | /// 190 | /// List All Accounts Processes Are Running As. 191 | /// 192 | /// List of Account Names & Running Processes Under The Context of The Account. 193 | public static Dictionary> ListProcessAccounts 194 | { 195 | get 196 | { 197 | Dictionary> _ActiveAccounts = new Dictionary>(); 198 | 199 | //cycle through all processes to obtain a handle where we will attempt to 200 | //enumerate the account. 201 | foreach (var _Process in Process.GetProcesses()) 202 | { 203 | IntPtr _ProcessHandle = IntPtr.Zero; 204 | 205 | try 206 | { 207 | //obtain a handle to the process. 208 | if (Win32API.OpenProcessToken(_Process.Handle, Win32API.TOKEN_QUERY, out _ProcessHandle)) 209 | { 210 | //do we have a valid handle? 211 | if (_ProcessHandle != IntPtr.Zero) 212 | { 213 | //lets get the identity of the handle. 214 | WindowsIdentity _AccountIdentity = new WindowsIdentity(_ProcessHandle); 215 | 216 | //do we have th account stored already? 217 | List _ProcessIDs; 218 | if (_ActiveAccounts.TryGetValue(_AccountIdentity.Name, out _ProcessIDs)) 219 | { 220 | _ProcessIDs.Add( 221 | new ProcessEntry 222 | { 223 | Name = _Process.ProcessName, 224 | PID = _Process.Id 225 | } 226 | );//end of _ProcessIDs.Add( 227 | } 228 | else 229 | { 230 | _ActiveAccounts.Add(_AccountIdentity.Name, new List 231 | { 232 | new ProcessEntry 233 | { 234 | Name = _Process.ProcessName, 235 | PID = _Process.Id 236 | } 237 | });//end of _ActiveAccounts.Add( 238 | } //end of if-else 239 | 240 | } //end of if (_ProcessHandle != IntPtr.Zero) 241 | 242 | } //end of ifWin32API.OpenProcessToken 243 | } 244 | catch 245 | { 246 | //It Is not possible to open some processes and so there is always a few 247 | //access denied errors, as such i want to silently disguard them. 248 | } 249 | finally 250 | { 251 | //if the handle is not null/zero then we need to close it. 252 | if (_ProcessHandle != IntPtr.Zero) { Win32API.CloseHandle(_ProcessHandle); } 253 | }//end of try-finally 254 | 255 | }//end of foreach 256 | 257 | return _ActiveAccounts; 258 | 259 | }//end of get 260 | }//end of public static Dictionary> ListProcessAccounts 261 | 262 | /// 263 | /// Print A List of Logged In Accounts & Amount of Running Processes To Tthe Console 264 | /// 265 | public static void PrintActiveAccountsToConsole() 266 | { 267 | Console.WriteLine(" - Listing Accounts Of Active Processes..."); 268 | 269 | foreach (KeyValuePair> _RunningAccount in ListProcessAccounts) 270 | { 271 | Console.WriteLine("\t[+] {0} - {1} Running Processes", _RunningAccount.Key, _RunningAccount.Value.Count); 272 | }//end offoreach (KeyValuePair> _RunningAccount in ListProcessAccounts) 273 | 274 | }//end of public static void PrintActiveAccountsToConsole() 275 | 276 | public static void PrintProcessPrivsToConsole(Int32 processID) 277 | { 278 | //get the handle to the process 279 | IntPtr _ProcessIDHandle = Process.GetProcessById(processID).Handle; 280 | IntPtr _TokenHandle = IntPtr.Zero; 281 | 282 | //have we obtained a valid handle? 283 | if (_ProcessIDHandle == IntPtr.Zero) 284 | { 285 | Console.WriteLine("## ERROR ## - Unable To Get Handle For Process ID '{0}', Aborting..", processID); 286 | return; 287 | }//end of if 288 | 289 | 290 | //open the process and attempt to obtain the token. 291 | if (Win32API.OpenProcessToken(_ProcessIDHandle, Win32API.TOKEN_DUPLICATE | Win32API.TOKEN_IMPERSONATE | Win32API.TOKEN_QUERY, out _TokenHandle) == false) 292 | { 293 | Console.WriteLine("## ERROR ## - Trying To Open Process ID '{0}' Handle..\nError '{1}'", processID, Marshal.GetLastWin32Error()); 294 | 295 | Win32API.CloseHandle(_ProcessIDHandle); 296 | return; 297 | }//end of if 298 | 299 | //do we have a valid token handle? 300 | if (_TokenHandle == IntPtr.Zero) 301 | { 302 | Console.WriteLine("## ERROR ## - Opened Token For Process ID '{0}' However Handle Is Invalid, Aborting..", processID); 303 | 304 | Win32API.CloseHandle(_ProcessIDHandle); 305 | return; 306 | } 307 | 308 | //get a list of privs assigned to the process 309 | Win32API.LUID_AND_ATTRIBUTES[] _Privileges = Privilages.GetPrivileges(_TokenHandle); 310 | 311 | //did we get enough privilages 312 | if (_Privileges.Length == 0) { Console.WriteLine("## ERROR ## - Unable To Get Privilages For Process '{0}' [{1}]", Process.GetProcessById(processID).ProcessName, processID);} 313 | 314 | Console.WriteLine("[+] Obtained '{0}' Privilages For Process '{1}' [{2}]", _Privileges.Length, Process.GetProcessById(processID).ProcessName, processID); 315 | 316 | //cycle through each privilage and dump out to screen 317 | foreach (var luidAndAttributes in _Privileges) 318 | { 319 | String _EmptyStringTest = Privilages.GetPrivilegeName(luidAndAttributes.Luid); 320 | 321 | if (String.IsNullOrEmpty(_EmptyStringTest) == false) { Console.WriteLine("\t [-] {0}", _EmptyStringTest); } 322 | }//end of foreach 323 | } 324 | #endregion 325 | 326 | 327 | 328 | #region Utility Methods 329 | 330 | /// 331 | /// Is The Application Running With Admin Privileges 332 | /// 333 | public static Boolean IsAdmin 334 | { 335 | get 336 | { 337 | WindowsIdentity _Identity = WindowsIdentity.GetCurrent(); 338 | if (_Identity == null) { return false; } 339 | 340 | WindowsPrincipal _Principal = new WindowsPrincipal(_Identity); 341 | 342 | return _Principal.IsInRole(WindowsBuiltInRole.Administrator); 343 | } 344 | }//end of public static Boolean IsAdmin 345 | 346 | #endregion 347 | 348 | }//end of class WhoWasI 349 | 350 | //Used to store the process ID and acount name. 351 | public struct ProcessEntry 352 | { 353 | public String Name; 354 | public Int32 PID; 355 | }//end of Struct 356 | 357 | }//end of namespace 358 | -------------------------------------------------------------------------------- /WhoWasI/WhoWasI.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {E08F0042-63E4-4A1E-9786-B1E0D9E33695} 8 | Exe 9 | Properties 10 | WhoWasI 11 | WhoWasI 12 | v2.0 13 | 512 14 | 15 | 16 | AnyCPU 17 | true 18 | full 19 | false 20 | bin\Debug\ 21 | DEBUG;TRACE 22 | prompt 23 | 4 24 | 25 | 26 | AnyCPU 27 | pdbonly 28 | true 29 | bin\Release\ 30 | TRACE 31 | prompt 32 | 4 33 | 34 | 35 | app.manifest 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 67 | -------------------------------------------------------------------------------- /WhoWasI/WhoWasI.csproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -pp 8168 5 | 6 | -------------------------------------------------------------------------------- /WhoWasI/Win32API.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | /* 5 | * 6 | * Released as open source by NCC Group Plc - http://www.nccgroup.com/ 7 | * 8 | * Developed by Chris Thomas, chris dot thomas at nccgroup dot com 9 | * 10 | * https://github.com/nccgroup/WhoWasI 11 | * 12 | * Released under AGPL see LICENSE for more information 13 | */ 14 | 15 | namespace WhoWasI 16 | { 17 | public static class Win32API 18 | { 19 | //http://www.pinvoke.net/default.aspx/advapi32.openprocesstoken 20 | [DllImport("advapi32.dll", SetLastError = true)] 21 | [return: MarshalAs(UnmanagedType.Bool)] 22 | public static extern Boolean OpenProcessToken(IntPtr ProcessHandle, UInt32 DesiredAccess, out IntPtr TokenHandle); 23 | 24 | //http://www.pinvoke.net/default.aspx/kernel32.closehandle 25 | [DllImport("kernel32.dll", SetLastError=true)] 26 | [return: MarshalAs(UnmanagedType.Bool)] 27 | public static extern Boolean CloseHandle(IntPtr hObject); 28 | 29 | //http://www.pinvoke.net/default.aspx/advapi32.duplicatetokenex 30 | [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)] 31 | [return: MarshalAs(UnmanagedType.Bool)] 32 | public extern static Boolean DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess, ref SECURITY_ATTRIBUTES lpTokenAttributes, SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, TOKEN_TYPE TokenType, out IntPtr phNewToken); 33 | 34 | //http://www.pinvoke.net/default.aspx/Structures/CreateProcessWithTokenW.html 35 | [DllImport("advapi32", SetLastError = true, CharSet = CharSet.Unicode)] 36 | [return: MarshalAs(UnmanagedType.Bool)] 37 | public static extern Boolean CreateProcessWithTokenW(IntPtr hToken, LOGON_FLAGS dwLogonFlags, string lpApplicationName, string lpCommandLine, CREATION_FLAGS dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUP_INFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); 38 | 39 | //http://www.pinvoke.net/default.aspx/advapi32.gettokeninformation 40 | [DllImport("advapi32.dll", SetLastError = true)] 41 | [return: MarshalAs(UnmanagedType.Bool)] 42 | public static extern bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, int TokenInformationLength, out int ReturnLength); 43 | 44 | //http://www.pinvoke.net/default.aspx/advapi32.lookupprivilegename 45 | [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] 46 | [return: MarshalAs(UnmanagedType.Bool)] 47 | public static extern bool LookupPrivilegeName(string lpSystemName, ref LUID lpLuid, System.Text.StringBuilder lpName, ref int cchName); 48 | 49 | [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] 50 | [return: MarshalAs(UnmanagedType.Bool)] 51 | public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out LUID lpLuid); 52 | 53 | #region GetTokenInformation Constants/Structs 54 | //http://www.pinvoke.net/default.aspx/Enums/TOKEN_INFORMATION_CLASS.html 55 | public enum TOKEN_INFORMATION_CLASS 56 | { 57 | /// 58 | /// The buffer receives a TOKEN_USER structure that contains the user account of the token. 59 | /// 60 | TokenUser = 1, 61 | 62 | /// 63 | /// The buffer receives a TOKEN_GROUPS structure that contains the group accounts associated with the token. 64 | /// 65 | TokenGroups, 66 | 67 | /// 68 | /// The buffer receives a TOKEN_PRIVILEGES structure that contains the privileges of the token. 69 | /// 70 | TokenPrivileges, 71 | 72 | /// 73 | /// The buffer receives a TOKEN_OWNER structure that contains the default owner security identifier (SID) for newly created objects. 74 | /// 75 | TokenOwner, 76 | 77 | /// 78 | /// The buffer receives a TOKEN_PRIMARY_GROUP structure that contains the default primary group SID for newly created objects. 79 | /// 80 | TokenPrimaryGroup, 81 | 82 | /// 83 | /// The buffer receives a TOKEN_DEFAULT_DACL structure that contains the default DACL for newly created objects. 84 | /// 85 | TokenDefaultDacl, 86 | 87 | /// 88 | /// The buffer receives a TOKEN_SOURCE structure that contains the source of the token. TOKEN_QUERY_SOURCE access is needed to retrieve this information. 89 | /// 90 | TokenSource, 91 | 92 | /// 93 | /// The buffer receives a TOKEN_TYPE value that indicates whether the token is a primary or impersonation token. 94 | /// 95 | TokenType, 96 | 97 | /// 98 | /// The buffer receives a SECURITY_IMPERSONATION_LEVEL value that indicates the impersonation level of the token. If the access token is not an impersonation token, the function fails. 99 | /// 100 | TokenImpersonationLevel, 101 | 102 | /// 103 | /// The buffer receives a TOKEN_STATISTICS structure that contains various token statistics. 104 | /// 105 | TokenStatistics, 106 | 107 | /// 108 | /// The buffer receives a TOKEN_GROUPS structure that contains the list of restricting SIDs in a restricted token. 109 | /// 110 | TokenRestrictedSids, 111 | 112 | /// 113 | /// The buffer receives a DWORD value that indicates the Terminal Services session identifier that is associated with the token. 114 | /// 115 | TokenSessionId, 116 | 117 | /// 118 | /// The buffer receives a TOKEN_GROUPS_AND_PRIVILEGES structure that contains the user SID, the group accounts, the restricted SIDs, and the authentication ID associated with the token. 119 | /// 120 | TokenGroupsAndPrivileges, 121 | 122 | /// 123 | /// Reserved. 124 | /// 125 | TokenSessionReference, 126 | 127 | /// 128 | /// The buffer receives a DWORD value that is nonzero if the token includes the SANDBOX_INERT flag. 129 | /// 130 | TokenSandBoxInert, 131 | 132 | /// 133 | /// Reserved. 134 | /// 135 | TokenAuditPolicy, 136 | 137 | /// 138 | /// The buffer receives a TOKEN_ORIGIN value. 139 | /// 140 | TokenOrigin, 141 | 142 | /// 143 | /// The buffer receives a TOKEN_ELEVATION_TYPE value that specifies the elevation level of the token. 144 | /// 145 | TokenElevationType, 146 | 147 | /// 148 | /// The buffer receives a TOKEN_LINKED_TOKEN structure that contains a handle to another token that is linked to this token. 149 | /// 150 | TokenLinkedToken, 151 | 152 | /// 153 | /// The buffer receives a TOKEN_ELEVATION structure that specifies whether the token is elevated. 154 | /// 155 | TokenElevation, 156 | 157 | /// 158 | /// The buffer receives a DWORD value that is nonzero if the token has ever been filtered. 159 | /// 160 | TokenHasRestrictions, 161 | 162 | /// 163 | /// The buffer receives a TOKEN_ACCESS_INFORMATION structure that specifies security information contained in the token. 164 | /// 165 | TokenAccessInformation, 166 | 167 | /// 168 | /// The buffer receives a DWORD value that is nonzero if virtualization is allowed for the token. 169 | /// 170 | TokenVirtualizationAllowed, 171 | 172 | /// 173 | /// The buffer receives a DWORD value that is nonzero if virtualization is enabled for the token. 174 | /// 175 | TokenVirtualizationEnabled, 176 | 177 | /// 178 | /// The buffer receives a TOKEN_MANDATORY_LABEL structure that specifies the token's integrity level. 179 | /// 180 | TokenIntegrityLevel, 181 | 182 | /// 183 | /// The buffer receives a DWORD value that is nonzero if the token has the UIAccess flag set. 184 | /// 185 | TokenUIAccess, 186 | 187 | /// 188 | /// The buffer receives a TOKEN_MANDATORY_POLICY structure that specifies the token's mandatory integrity policy. 189 | /// 190 | TokenMandatoryPolicy, 191 | 192 | /// 193 | /// The buffer receives the token's logon security identifier (SID). 194 | /// 195 | TokenLogonSid, 196 | 197 | /// 198 | /// The maximum value for this enumeration 199 | /// 200 | MaxTokenInfoClass 201 | } 202 | #endregion 203 | 204 | #region LookupPrivilegeName/LookupPrivilegeValue Constants/Structs 205 | //http://www.pinvoke.net/default.aspx/Structures/TOKEN_PRIVILEGES.html 206 | public const UInt32 SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001; 207 | public const UInt32 SE_PRIVILEGE_ENABLED = 0x00000002; 208 | public const UInt32 SE_PRIVILEGE_REMOVED = 0x00000004; 209 | public const UInt32 SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000; 210 | 211 | //http://www.pinvoke.net/default.aspx/Structures/TOKEN_PRIVILEGES.html 212 | [StructLayout(LayoutKind.Sequential)] 213 | public struct TOKEN_PRIVILEGES 214 | { 215 | public UInt32 PrivilegeCount; 216 | public LUID Luid; 217 | public UInt32 Attributes; 218 | } 219 | 220 | //http://www.pinvoke.net/default.aspx/Structures/LUID_AND_ATTRIBUTES.html 221 | [StructLayout(LayoutKind.Sequential)] 222 | public struct LUID_AND_ATTRIBUTES 223 | { 224 | public LUID Luid; 225 | public UInt32 Attributes; 226 | } 227 | 228 | //http://www.pinvoke.net/default.aspx/Structures/LUID.html 229 | [StructLayout(LayoutKind.Sequential)] 230 | public struct LUID 231 | { 232 | public uint LowPart; 233 | public int HighPart; 234 | } 235 | 236 | //http://msdn.microsoft.com/en-gb/library/windows/desktop/bb530716(v=vs.85).aspx 237 | public enum Privilege 238 | { 239 | SeAssignPrimaryTokenPrivilege, 240 | SeAuditPrivilege, 241 | SeBackupPrivilege, 242 | SeChangeNotifyPrivilege, 243 | SeCreateGlobalPrivilege, 244 | SeCreatePagefilePrivilege, 245 | SeCreatePermanentPrivilege, 246 | SeCreateSymbolicLinkPrivilege, 247 | SeCreateTokenPrivilege, 248 | SeDebugPrivilege, 249 | SeEnableDelegationPrivilege, 250 | SeImpersonatePrivilege, 251 | SeIncreaseBasePriorityPrivilege, 252 | SeIncreaseQuotaPrivilege, 253 | SeIncreaseWorkingSetPrivilege, 254 | SeLoadDriverPrivilege, 255 | SeLockMemoryPrivilege, 256 | SeMachineAccountPrivilege, 257 | SeManageVolumePrivilege, 258 | SeProfileSingleProcessPrivilege, 259 | SeRelabelPrivilege, 260 | SeRemoteShutdownPrivilege, 261 | SeRestorePrivilege, 262 | SeSecurityPrivilege, 263 | SeShutdownPrivilege, 264 | SeSyncAgentPrivilege, 265 | SeSystemEnvironmentPrivilege, 266 | SeSystemProfilePrivilege, 267 | SeSystemtimePrivilege, 268 | SeTakeOwnershipPrivilege, 269 | SeTcbPrivilege, 270 | SeTimeZonePrivilege, 271 | SeTrustedCredManAccessPrivilege, 272 | SeUndockPrivilege, 273 | SeUnsolicitedInputPrivilege 274 | } 275 | 276 | #endregion 277 | 278 | #region DuplicateTokenEx Constants/Structs 279 | public enum SECURITY_IMPERSONATION_LEVEL 280 | { 281 | SecurityAnonymous, 282 | SecurityIdentification, 283 | SecurityImpersonation, 284 | SecurityDelegation 285 | } 286 | 287 | public enum TOKEN_TYPE 288 | { 289 | TokenPrimary = 1, 290 | TokenImpersonation 291 | } 292 | #endregion 293 | 294 | #region OpenProcessToken Constants/Structs 295 | public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000; 296 | public const UInt32 STANDARD_RIGHTS_READ = 0x00020000; 297 | public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001; 298 | public const UInt32 TOKEN_DUPLICATE = 0x0002; 299 | public const UInt32 TOKEN_IMPERSONATE = 0x0004; 300 | public const UInt32 TOKEN_QUERY = 0x0008; 301 | public const UInt32 TOKEN_QUERY_SOURCE = 0x0010; 302 | public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020; 303 | public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040; 304 | public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080; 305 | public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100; 306 | public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY); 307 | public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | 308 | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | 309 | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | 310 | TOKEN_ADJUST_SESSIONID); 311 | #endregion 312 | 313 | #region CreateProcessWithTokenW Constants/Structs 314 | [Flags] 315 | public enum CREATION_FLAGS 316 | { 317 | CREATE_SUSPENDED = 0x00000004, 318 | CREATE_NEW_CONSOLE = 0x00000010, 319 | CREATE_NEW_PROCESS_GROUP = 0x00000200, 320 | CREATE_UNICODE_ENVIRONMENT = 0x00000400, 321 | CREATE_SEPARATE_WOW_VDM = 0x00000800, 322 | CREATE_DEFAULT_ERROR_MODE = 0x04000000, 323 | } 324 | 325 | [Flags] 326 | public enum LOGON_FLAGS 327 | { 328 | LOGON_WITH_PROFILE = 0x00000001, 329 | LOGON_NETCREDENTIALS_ONLY = 0x00000002 330 | } 331 | 332 | #endregion 333 | 334 | #region Generic / All-Round Constants / Structs 335 | 336 | //todo: where are the references for this? 337 | public const short SW_SHOW = 5; 338 | public const int STARTF_USESHOWWINDOW = 0x00000001; 339 | public const int STARTF_FORCEONFEEDBACK = 0x00000040; 340 | 341 | //http://www.pinvoke.net/default.aspx/Structures/SECURITY_ATTRIBUTES.html 342 | [StructLayout(LayoutKind.Sequential)] 343 | public struct SECURITY_ATTRIBUTES 344 | { 345 | public int nLength; 346 | public IntPtr lpSecurityDescriptor; 347 | public int bInheritHandle; 348 | } 349 | 350 | //http://www.pinvoke.net/default.aspx/Structures/PROCESS_INFORMATION.html 351 | [StructLayout(LayoutKind.Sequential)] 352 | public struct PROCESS_INFORMATION 353 | { 354 | public IntPtr hProcess; 355 | public IntPtr hThread; 356 | public int dwProcessId; 357 | public int dwThreadId; 358 | } 359 | 360 | //http://www.pinvoke.net/default.aspx/Structures/STARTUPINFO.html 361 | [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] 362 | public struct STARTUP_INFO 363 | { 364 | public Int32 cb; 365 | public string lpReserved; 366 | public string lpDesktop; 367 | public string lpTitle; 368 | public Int32 dwX; 369 | public Int32 dwY; 370 | public Int32 dwXSize; 371 | public Int32 dwYSize; 372 | public Int32 dwXCountChars; 373 | public Int32 dwYCountChars; 374 | public Int32 dwFillAttribute; 375 | public Int32 dwFlags; 376 | public Int16 wShowWindow; 377 | public Int16 cbReserved2; 378 | public IntPtr lpReserved2; 379 | public IntPtr hStdInput; 380 | public IntPtr hStdOutput; 381 | public IntPtr hStdError; 382 | } 383 | #endregion 384 | 385 | } 386 | } 387 | -------------------------------------------------------------------------------- /WhoWasI/app.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 57 | 58 | 59 | -------------------------------------------------------------------------------- /WhoWasI/bin/Debug/WhoWasI.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/bin/Debug/WhoWasI.exe -------------------------------------------------------------------------------- /WhoWasI/bin/Debug/WhoWasI.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/bin/Debug/WhoWasI.pdb -------------------------------------------------------------------------------- /WhoWasI/bin/Debug/WhoWasI.vshost.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/bin/Debug/WhoWasI.vshost.exe -------------------------------------------------------------------------------- /WhoWasI/bin/Debug/WhoWasI.vshost.exe.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 57 | 58 | 59 | -------------------------------------------------------------------------------- /WhoWasI/obj/Debug/DesignTimeResolveAssemblyReferences.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/obj/Debug/DesignTimeResolveAssemblyReferences.cache -------------------------------------------------------------------------------- /WhoWasI/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /WhoWasI/obj/Debug/WhoWasI.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\chris\Dropbox\Dev\C#\WhoWasI\WhoWasI\bin\Debug\WhoWasI.exe 2 | C:\Users\chris\Dropbox\Dev\C#\WhoWasI\WhoWasI\bin\Debug\WhoWasI.pdb 3 | C:\Users\chris\Dropbox\Dev\C#\WhoWasI\WhoWasI\obj\Debug\WhoWasI.csprojResolveAssemblyReference.cache 4 | C:\Users\chris\Dropbox\Dev\C#\WhoWasI\WhoWasI\obj\Debug\WhoWasI.exe 5 | C:\Users\chris\Dropbox\Dev\C#\WhoWasI\WhoWasI\obj\Debug\WhoWasI.pdb 6 | -------------------------------------------------------------------------------- /WhoWasI/obj/Debug/WhoWasI.csprojResolveAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/obj/Debug/WhoWasI.csprojResolveAssemblyReference.cache -------------------------------------------------------------------------------- /WhoWasI/obj/Debug/WhoWasI.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/obj/Debug/WhoWasI.exe -------------------------------------------------------------------------------- /WhoWasI/obj/Debug/WhoWasI.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nccgroup/WhoWasI/f8d43ec4bb2ad6985b2ffa79dee3ce16b3ed7c56/WhoWasI/obj/Debug/WhoWasI.pdb --------------------------------------------------------------------------------