NtCreateToken example for creating elevated token without user password

Bala Smart 51

Hi,

I need elevated token for user, So i can achieve this by using NtCreateToken undocumented API. I'm not able to find any examples to call NtCreateToken.

If anybody knowing usage of [NtCreateToken][1], help me!!!!!!

RLWA32 45,236 Reputation points

2021-06-15T16:05:26.607+00:00

Have you considered doing what Task Scheduler does when it doesn't save a password for a scheduled task?
Bala Smart 51 Reputation points

2021-06-15T17:21:49.507+00:00

To create scheduler task with Run with highest privilege, We need users password.

My aim is to create elevated token without using users password
RLWA32 45,236 Reputation points

2021-06-15T17:26:16.847+00:00

The scheduler can create a process for a user without having the user's password.
Anyway, I'm not suggesting that you use the task scheduler. Only that you can do the same thing that it does to logon a user without a password.
Bala Smart 51 Reputation points

2021-06-17T11:00:34.987+00:00

To create scheduler task Run with highest privilege
we need user's password
RLWA32 45,236 Reputation points

2021-06-17T11:04:29.467+00:00

I suggest you re-read the comment to which you are responding. I didn't suggest that you create a scheduled task.

2 answers

Castorix31 84,471 Reputation points

2021-06-15T14:04:54.96+00:00

You can find samples from Google, like
SeCreateTokenPrivilege.cpp
But I get STATUS_PRIVILEGE_NOT_HELD as Admin on Windows 10
(cannot enable SE_CREATE_TOKEN_NAME privilege)
Please sign in to rate this answer.
Bala Smart 51 Reputation points

2021-06-15T15:51:45.203+00:00

I am also getting 1314 (A required privilege is not held by the client), Event i'm starting process as System account.

Bala Smart 51 Reputation points

2021-06-20T06:17:30.083+00:00

You have to enable SeCreateTokenPrivilege in your token in order to call NtCreateToken API @Castorix31
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
RLWA32 45,236 Reputation points

2021-06-17T22:29:36.047+00:00

Well, it can be done. Here's a standard user - Bozo with an elevated Administrator command prompt running.
Please sign in to rate this answer.
Bala Smart 51 Reputation points

2021-06-20T06:14:59.84+00:00

I am able to create token by using NtCreateToken, But when i run process by using CreateProcessAsUser API

Getting Access denied error

Following this project

Bala Smart 51 Reputation points

2021-06-27T17:16:35.673+00:00

Hi @RLWA32

Do you have source code of NtCreateToken API?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

NtCreateToken example for creating elevated token without user password

2 answers

Your answer